source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "tdb_validate.h"
  29 #include "../libcli/auth/libcli_auth.h"
  30 #include "../librpc/gen_ndr/ndr_wbint.h"
  31 #include "ads.h"
  32 #include "nss_info.h"
  33 #include "../libcli/security/security.h"
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_WINBIND
  37
  38 #define WINBINDD_CACHE_VERSION 2
  39 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  40
  41 extern struct winbindd_methods reconnect_methods;
  42 #ifdef HAVE_ADS
  43 extern struct winbindd_methods ads_methods;
  44 #endif
  45 extern struct winbindd_methods builtin_passdb_methods;
  46 extern struct winbindd_methods sam_passdb_methods;
  47
  48 /*
  49  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  50  * Here are the list of entry types that are *not* stored
  51  * as form struct cache_entry in the cache.
  52  */
  53
  54 static const char *non_centry_keys[] = {
  55         "SEQNUM/",
  56         "DR/",
  57         "DE/",
  58         "WINBINDD_OFFLINE",
  59         WINBINDD_CACHE_VERSION_KEYSTR,
  60         NULL
  61 };
  62
  63 /************************************************************************
  64  Is this key a non-centry type ?
  65 ************************************************************************/
  66
  67 static bool is_non_centry_key(TDB_DATA kbuf)
  68 {
  69         int i;
  70
  71         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  72                 return false;
  73         }
  74         for (i = 0; non_centry_keys[i] != NULL; i++) {
  75                 size_t namelen = strlen(non_centry_keys[i]);
  76                 if (kbuf.dsize < namelen) {
  77                         continue;
  78                 }
  79                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  80                         return true;
  81                 }
  82         }
  83         return false;
  84 }
  85
  86 /* Global online/offline state - False when online. winbindd starts up online
  87    and sets this to true if the first query fails and there's an entry in
  88    the cache tdb telling us to stay offline. */
  89
  90 static bool global_winbindd_offline_state;
  91
  92 struct winbind_cache {
  93         TDB_CONTEXT *tdb;
  94 };
  95
  96 struct cache_entry {
  97         NTSTATUS status;
  98         uint32 sequence_number;
  99         uint64_t timeout;
 100         uint8 *data;
 101         uint32 len, ofs;
 102 };
 103
 104 void (*smb_panic_fn)(const char *const why) = smb_panic;
 105
 106 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
 107
 108 static struct winbind_cache *wcache;
 109
 110 /* get the winbind_cache structure */
 111 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 112 {
 113         struct winbind_cache *ret = wcache;
 114
 115         /* We have to know what type of domain we are dealing with first. */
 116
 117         if (domain->internal) {
 118                 domain->backend = &builtin_passdb_methods;
 119                 domain->initialized = True;
 120         }
 121
 122         if (strequal(domain->name, get_global_sam_name()) &&
 123             sid_check_is_domain(&domain->sid)) {
 124                 domain->backend = &sam_passdb_methods;
 125                 domain->initialized = True;
 126         }
 127
 128         if ( !domain->initialized ) {
 129                 init_dc_connection( domain );
 130         }
 131
 132         /*
 133            OK.  listen up becasue I'm only going to say this once.
 134            We have the following scenarios to consider
 135            (a) trusted AD domains on a Samba DC,
 136            (b) trusted AD domains and we are joined to a non-kerberos domain
 137            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 138
 139            For (a) we can always contact the trusted domain using krb5
 140            since we have the domain trust account password
 141
 142            For (b) we can only use RPC since we have no way of
 143            getting a krb5 ticket in our own domain
 144
 145            For (c) we can always use krb5 since we have a kerberos trust
 146
 147            --jerry
 148          */
 149
 150         if (!domain->backend) {
 151 #ifdef HAVE_ADS
 152                 struct winbindd_domain *our_domain = domain;
 153
 154                 /* find our domain first so we can figure out if we
 155                    are joined to a kerberized domain */
 156
 157                 if ( !domain->primary )
 158                         our_domain = find_our_domain();
 159
 160                 if ((our_domain->active_directory || IS_DC)
 161                     && domain->active_directory
 162                     && !lp_winbind_rpc_only()) {
 163                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 164                         domain->backend = &ads_methods;
 165                 } else {
 166 #endif  /* HAVE_ADS */
 167                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 168                         domain->backend = &reconnect_methods;
 169 #ifdef HAVE_ADS
 170                 }
 171 #endif  /* HAVE_ADS */
 172         }
 173
 174         if (ret)
 175                 return ret;
 176
 177         ret = SMB_XMALLOC_P(struct winbind_cache);
 178         ZERO_STRUCTP(ret);
 179
 180         wcache = ret;
 181         wcache_flush_cache();
 182
 183         return ret;
 184 }
 185
 186 /*
 187   free a centry structure
 188 */
 189 static void centry_free(struct cache_entry *centry)
 190 {
 191         if (!centry)
 192                 return;
 193         SAFE_FREE(centry->data);
 194         free(centry);
 195 }
 196
 197 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 198 {
 199         if (centry->len - centry->ofs < nbytes) {
 200                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 201                          (unsigned int)nbytes,
 202                          centry->len - centry->ofs));
 203                 return false;
 204         }
 205         return true;
 206 }
 207
 208 /*
 209   pull a uint64_t from a cache entry
 210 */
 211 static uint64_t centry_uint64_t(struct cache_entry *centry)
 212 {
 213         uint64_t ret;
 214
 215         if (!centry_check_bytes(centry, 8)) {
 216                 smb_panic_fn("centry_uint64_t");
 217         }
 218         ret = BVAL(centry->data, centry->ofs);
 219         centry->ofs += 8;
 220         return ret;
 221 }
 222
 223 /*
 224   pull a uint32 from a cache entry
 225 */
 226 static uint32 centry_uint32(struct cache_entry *centry)
 227 {
 228         uint32 ret;
 229
 230         if (!centry_check_bytes(centry, 4)) {
 231                 smb_panic_fn("centry_uint32");
 232         }
 233         ret = IVAL(centry->data, centry->ofs);
 234         centry->ofs += 4;
 235         return ret;
 236 }
 237
 238 /*
 239   pull a uint16 from a cache entry
 240 */
 241 static uint16 centry_uint16(struct cache_entry *centry)
 242 {
 243         uint16 ret;
 244         if (!centry_check_bytes(centry, 2)) {
 245                 smb_panic_fn("centry_uint16");
 246         }
 247         ret = CVAL(centry->data, centry->ofs);
 248         centry->ofs += 2;
 249         return ret;
 250 }
 251
 252 /*
 253   pull a uint8 from a cache entry
 254 */
 255 static uint8 centry_uint8(struct cache_entry *centry)
 256 {
 257         uint8 ret;
 258         if (!centry_check_bytes(centry, 1)) {
 259                 smb_panic_fn("centry_uint8");
 260         }
 261         ret = CVAL(centry->data, centry->ofs);
 262         centry->ofs += 1;
 263         return ret;
 264 }
 265
 266 /*
 267   pull a NTTIME from a cache entry
 268 */
 269 static NTTIME centry_nttime(struct cache_entry *centry)
 270 {
 271         NTTIME ret;
 272         if (!centry_check_bytes(centry, 8)) {
 273                 smb_panic_fn("centry_nttime");
 274         }
 275         ret = IVAL(centry->data, centry->ofs);
 276         centry->ofs += 4;
 277         ret += (uint64)IVAL(centry->data, centry->ofs) << 32;
 278         centry->ofs += 4;
 279         return ret;
 280 }
 281
 282 /*
 283   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 284 */
 285 static time_t centry_time(struct cache_entry *centry)
 286 {
 287         return (time_t)centry_nttime(centry);
 288 }
 289
 290 /* pull a string from a cache entry, using the supplied
 291    talloc context
 292 */
 293 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 294 {
 295         uint32 len;
 296         char *ret;
 297
 298         len = centry_uint8(centry);
 299
 300         if (len == 0xFF) {
 301                 /* a deliberate NULL string */
 302                 return NULL;
 303         }
 304
 305         if (!centry_check_bytes(centry, (size_t)len)) {
 306                 smb_panic_fn("centry_string");
 307         }
 308
 309         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 310         if (!ret) {
 311                 smb_panic_fn("centry_string out of memory\n");
 312         }
 313         memcpy(ret,centry->data + centry->ofs, len);
 314         ret[len] = 0;
 315         centry->ofs += len;
 316         return ret;
 317 }
 318
 319 /* pull a hash16 from a cache entry, using the supplied
 320    talloc context
 321 */
 322 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 323 {
 324         uint32 len;
 325         char *ret;
 326
 327         len = centry_uint8(centry);
 328
 329         if (len != 16) {
 330                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 331                         len ));
 332                 return NULL;
 333         }
 334
 335         if (!centry_check_bytes(centry, 16)) {
 336                 return NULL;
 337         }
 338
 339         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 340         if (!ret) {
 341                 smb_panic_fn("centry_hash out of memory\n");
 342         }
 343         memcpy(ret,centry->data + centry->ofs, 16);
 344         centry->ofs += 16;
 345         return ret;
 346 }
 347
 348 /* pull a sid from a cache entry, using the supplied
 349    talloc context
 350 */
 351 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
 352 {
 353         char *sid_string;
 354         bool ret;
 355
 356         sid_string = centry_string(centry, talloc_tos());
 357         if (sid_string == NULL) {
 358                 return false;
 359         }
 360         ret = string_to_sid(sid, sid_string);
 361         TALLOC_FREE(sid_string);
 362         return ret;
 363 }
 364
 365
 366 /*
 367   pull a NTSTATUS from a cache entry
 368 */
 369 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 370 {
 371         NTSTATUS status;
 372
 373         status = NT_STATUS(centry_uint32(centry));
 374         return status;
 375 }
 376
 377
 378 /* the server is considered down if it can't give us a sequence number */
 379 static bool wcache_server_down(struct winbindd_domain *domain)
 380 {
 381         bool ret;
 382
 383         if (!wcache->tdb)
 384                 return false;
 385
 386         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 387
 388         if (ret)
 389                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 390                         domain->name ));
 391         return ret;
 392 }
 393
 394 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
 395                                 uint32_t *last_seq_check)
 396 {
 397         char *key;
 398         TDB_DATA data;
 399
 400         if (wcache->tdb == NULL) {
 401                 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
 402                 return false;
 403         }
 404
 405         key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 406         if (key == NULL) {
 407                 DEBUG(10, ("talloc failed\n"));
 408                 return false;
 409         }
 410
 411         data = tdb_fetch_bystring(wcache->tdb, key);
 412         TALLOC_FREE(key);
 413
 414         if (data.dptr == NULL) {
 415                 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
 416                            domain_name));
 417                 return false;
 418         }
 419         if (data.dsize != 8) {
 420                 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
 421                            (int)data.dsize));
 422                 SAFE_FREE(data.dptr);
 423                 return false;
 424         }
 425
 426         *seqnum = IVAL(data.dptr, 0);
 427         *last_seq_check = IVAL(data.dptr, 4);
 428         SAFE_FREE(data.dptr);
 429
 430         return true;
 431 }
 432
 433 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 434 {
 435         uint32 last_check, time_diff;
 436
 437         if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
 438                                  &last_check)) {
 439                 return NT_STATUS_UNSUCCESSFUL;
 440         }
 441         domain->last_seq_check = last_check;
 442
 443         /* have we expired? */
 444
 445         time_diff = now - domain->last_seq_check;
 446         if ( time_diff > lp_winbind_cache_time() ) {
 447                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 448                         domain->name, domain->sequence_number,
 449                         (uint32)domain->last_seq_check));
 450                 return NT_STATUS_UNSUCCESSFUL;
 451         }
 452
 453         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 454                 domain->name, domain->sequence_number,
 455                 (uint32)domain->last_seq_check));
 456
 457         return NT_STATUS_OK;
 458 }
 459
 460 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
 461                          time_t last_seq_check)
 462 {
 463         char *key_str;
 464         uint8_t buf[8];
 465         int ret;
 466
 467         if (wcache->tdb == NULL) {
 468                 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
 469                 return false;
 470         }
 471
 472         key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 473         if (key_str == NULL) {
 474                 DEBUG(10, ("talloc_asprintf failed\n"));
 475                 return false;
 476         }
 477
 478         SIVAL(buf, 0, seqnum);
 479         SIVAL(buf, 4, last_seq_check);
 480
 481         ret = tdb_store_bystring(wcache->tdb, key_str,
 482                                  make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
 483         TALLOC_FREE(key_str);
 484         if (ret == -1) {
 485                 DEBUG(10, ("tdb_store_bystring failed: %s\n",
 486                            tdb_errorstr(wcache->tdb)));
 487                 TALLOC_FREE(key_str);
 488                 return false;
 489         }
 490
 491         DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
 492                    domain_name, seqnum, (unsigned)last_seq_check));
 493
 494         return true;
 495 }
 496
 497 static bool store_cache_seqnum( struct winbindd_domain *domain )
 498 {
 499         return wcache_store_seqnum(domain->name, domain->sequence_number,
 500                                    domain->last_seq_check);
 501 }
 502
 503 /*
 504   refresh the domain sequence number. If force is true
 505   then always refresh it, no matter how recently we fetched it
 506 */
 507
 508 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 509 {
 510         NTSTATUS status;
 511         unsigned time_diff;
 512         time_t t = time(NULL);
 513         unsigned cache_time = lp_winbind_cache_time();
 514
 515         if (is_domain_offline(domain)) {
 516                 return;
 517         }
 518
 519         get_cache( domain );
 520
 521 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 522         /* trying to reconnect is expensive, don't do it too often */
 523         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 524                 cache_time *= 8;
 525         }
 526 #endif
 527
 528         time_diff = t - domain->last_seq_check;
 529
 530         /* see if we have to refetch the domain sequence number */
 531         if (!force && (time_diff < cache_time) &&
 532                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 533                         NT_STATUS_IS_OK(domain->last_status)) {
 534                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 535                 goto done;
 536         }
 537
 538         /* try to get the sequence number from the tdb cache first */
 539         /* this will update the timestamp as well */
 540
 541         status = fetch_cache_seqnum( domain, t );
 542         if (NT_STATUS_IS_OK(status) &&
 543                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 544                         NT_STATUS_IS_OK(domain->last_status)) {
 545                 goto done;
 546         }
 547
 548         /* important! make sure that we know if this is a native
 549            mode domain or not.  And that we can contact it. */
 550
 551         if ( winbindd_can_contact_domain( domain ) ) {
 552                 status = domain->backend->sequence_number(domain,
 553                                                           &domain->sequence_number);
 554         } else {
 555                 /* just use the current time */
 556                 status = NT_STATUS_OK;
 557                 domain->sequence_number = time(NULL);
 558         }
 559
 560
 561         /* the above call could have set our domain->backend to NULL when
 562          * coming from offline to online mode, make sure to reinitialize the
 563          * backend - Guenther */
 564         get_cache( domain );
 565
 566         if (!NT_STATUS_IS_OK(status)) {
 567                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 568                 domain->sequence_number = DOM_SEQUENCE_NONE;
 569         }
 570
 571         domain->last_status = status;
 572         domain->last_seq_check = time(NULL);
 573
 574         /* save the new sequence number in the cache */
 575         store_cache_seqnum( domain );
 576
 577 done:
 578         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 579                    domain->name, domain->sequence_number));
 580
 581         return;
 582 }
 583
 584 /*
 585   decide if a cache entry has expired
 586 */
 587 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 588 {
 589         /* If we've been told to be offline - stay in that state... */
 590         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 591                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 592                         keystr, domain->name ));
 593                 return false;
 594         }
 595
 596         /* when the domain is offline return the cached entry.
 597          * This deals with transient offline states... */
 598
 599         if (!domain->online) {
 600                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 601                         keystr, domain->name ));
 602                 return false;
 603         }
 604
 605         /* if the server is OK and our cache entry came from when it was down then
 606            the entry is invalid */
 607         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 608             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 609                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 610                         keystr, domain->name ));
 611                 return true;
 612         }
 613
 614         /* if the server is down or the cache entry is not older than the
 615            current sequence number or it did not timeout then it is OK */
 616         if (wcache_server_down(domain)
 617             || ((centry->sequence_number == domain->sequence_number)
 618                 && (centry->timeout > time(NULL)))) {
 619                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 620                         keystr, domain->name ));
 621                 return false;
 622         }
 623
 624         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 625                 keystr, domain->name ));
 626
 627         /* it's expired */
 628         return true;
 629 }
 630
 631 static struct cache_entry *wcache_fetch_raw(char *kstr)
 632 {
 633         TDB_DATA data;
 634         struct cache_entry *centry;
 635         TDB_DATA key;
 636
 637         key = string_tdb_data(kstr);
 638         data = tdb_fetch(wcache->tdb, key);
 639         if (!data.dptr) {
 640                 /* a cache miss */
 641                 return NULL;
 642         }
 643
 644         centry = SMB_XMALLOC_P(struct cache_entry);
 645         centry->data = (unsigned char *)data.dptr;
 646         centry->len = data.dsize;
 647         centry->ofs = 0;
 648
 649         if (centry->len < 16) {
 650                 /* huh? corrupt cache? */
 651                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s "
 652                           "(len < 16)?\n", kstr));
 653                 centry_free(centry);
 654                 return NULL;
 655         }
 656
 657         centry->status = centry_ntstatus(centry);
 658         centry->sequence_number = centry_uint32(centry);
 659         centry->timeout = centry_uint64_t(centry);
 660
 661         return centry;
 662 }
 663
 664 static bool is_my_own_sam_domain(struct winbindd_domain *domain)
 665 {
 666         if (strequal(domain->name, get_global_sam_name()) &&
 667             sid_check_is_domain(&domain->sid)) {
 668                 return true;
 669         }
 670
 671         return false;
 672 }
 673
 674 static bool is_builtin_domain(struct winbindd_domain *domain)
 675 {
 676         if (strequal(domain->name, "BUILTIN") &&
 677             sid_check_is_builtin(&domain->sid)) {
 678                 return true;
 679         }
 680
 681         return false;
 682 }
 683
 684 /*
 685   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 686   number and return status
 687 */
 688 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 689                                         struct winbindd_domain *domain,
 690                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 691 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 692                                         struct winbindd_domain *domain,
 693                                         const char *format, ...)
 694 {
 695         va_list ap;
 696         char *kstr;
 697         struct cache_entry *centry;
 698
 699         if (!winbindd_use_cache() ||
 700             is_my_own_sam_domain(domain) ||
 701             is_builtin_domain(domain)) {
 702                 return NULL;
 703         }
 704
 705         refresh_sequence_number(domain, false);
 706
 707         va_start(ap, format);
 708         smb_xvasprintf(&kstr, format, ap);
 709         va_end(ap);
 710
 711         centry = wcache_fetch_raw(kstr);
 712         if (centry == NULL) {
 713                 free(kstr);
 714                 return NULL;
 715         }
 716
 717         if (centry_expired(domain, kstr, centry)) {
 718
 719                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 720                          kstr, domain->name ));
 721
 722                 centry_free(centry);
 723                 free(kstr);
 724                 return NULL;
 725         }
 726
 727         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 728                  kstr, domain->name ));
 729
 730         free(kstr);
 731         return centry;
 732 }
 733
 734 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 735 static void wcache_delete(const char *format, ...)
 736 {
 737         va_list ap;
 738         char *kstr;
 739         TDB_DATA key;
 740
 741         va_start(ap, format);
 742         smb_xvasprintf(&kstr, format, ap);
 743         va_end(ap);
 744
 745         key = string_tdb_data(kstr);
 746
 747         tdb_delete(wcache->tdb, key);
 748         free(kstr);
 749 }
 750
 751 /*
 752   make sure we have at least len bytes available in a centry
 753 */
 754 static void centry_expand(struct cache_entry *centry, uint32 len)
 755 {
 756         if (centry->len - centry->ofs >= len)
 757                 return;
 758         centry->len *= 2;
 759         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 760                                          centry->len);
 761         if (!centry->data) {
 762                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 763                 smb_panic_fn("out of memory in centry_expand");
 764         }
 765 }
 766
 767 /*
 768   push a uint64_t into a centry
 769 */
 770 static void centry_put_uint64_t(struct cache_entry *centry, uint64_t v)
 771 {
 772         centry_expand(centry, 8);
 773         SBVAL(centry->data, centry->ofs, v);
 774         centry->ofs += 8;
 775 }
 776
 777 /*
 778   push a uint32 into a centry
 779 */
 780 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 781 {
 782         centry_expand(centry, 4);
 783         SIVAL(centry->data, centry->ofs, v);
 784         centry->ofs += 4;
 785 }
 786
 787 /*
 788   push a uint16 into a centry
 789 */
 790 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 791 {
 792         centry_expand(centry, 2);
 793         SIVAL(centry->data, centry->ofs, v);
 794         centry->ofs += 2;
 795 }
 796
 797 /*
 798   push a uint8 into a centry
 799 */
 800 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 801 {
 802         centry_expand(centry, 1);
 803         SCVAL(centry->data, centry->ofs, v);
 804         centry->ofs += 1;
 805 }
 806
 807 /*
 808    push a string into a centry
 809  */
 810 static void centry_put_string(struct cache_entry *centry, const char *s)
 811 {
 812         int len;
 813
 814         if (!s) {
 815                 /* null strings are marked as len 0xFFFF */
 816                 centry_put_uint8(centry, 0xFF);
 817                 return;
 818         }
 819
 820         len = strlen(s);
 821         /* can't handle more than 254 char strings. Truncating is probably best */
 822         if (len > 254) {
 823                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 824                 len = 254;
 825         }
 826         centry_put_uint8(centry, len);
 827         centry_expand(centry, len);
 828         memcpy(centry->data + centry->ofs, s, len);
 829         centry->ofs += len;
 830 }
 831
 832 /*
 833    push a 16 byte hash into a centry - treat as 16 byte string.
 834  */
 835 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 836 {
 837         centry_put_uint8(centry, 16);
 838         centry_expand(centry, 16);
 839         memcpy(centry->data + centry->ofs, val, 16);
 840         centry->ofs += 16;
 841 }
 842
 843 static void centry_put_sid(struct cache_entry *centry, const struct dom_sid *sid)
 844 {
 845         fstring sid_string;
 846         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 847 }
 848
 849
 850 /*
 851   put NTSTATUS into a centry
 852 */
 853 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 854 {
 855         uint32 status_value = NT_STATUS_V(status);
 856         centry_put_uint32(centry, status_value);
 857 }
 858
 859
 860 /*
 861   push a NTTIME into a centry
 862 */
 863 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 864 {
 865         centry_expand(centry, 8);
 866         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 867         centry->ofs += 4;
 868         SIVAL(centry->data, centry->ofs, nt >> 32);
 869         centry->ofs += 4;
 870 }
 871
 872 /*
 873   push a time_t into a centry - use a 64 bit size.
 874   NTTIME here is being used as a convenient 64-bit size.
 875 */
 876 static void centry_put_time(struct cache_entry *centry, time_t t)
 877 {
 878         NTTIME nt = (NTTIME)t;
 879         centry_put_nttime(centry, nt);
 880 }
 881
 882 /*
 883   start a centry for output. When finished, call centry_end()
 884 */
 885 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 886 {
 887         struct cache_entry *centry;
 888
 889         if (!wcache->tdb)
 890                 return NULL;
 891
 892         centry = SMB_XMALLOC_P(struct cache_entry);
 893
 894         centry->len = 8192; /* reasonable default */
 895         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 896         centry->ofs = 0;
 897         centry->sequence_number = domain->sequence_number;
 898         centry->timeout = lp_winbind_cache_time() + time(NULL);
 899         centry_put_ntstatus(centry, status);
 900         centry_put_uint32(centry, centry->sequence_number);
 901         centry_put_uint64_t(centry, centry->timeout);
 902         return centry;
 903 }
 904
 905 /*
 906   finish a centry and write it to the tdb
 907 */
 908 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 909 static void centry_end(struct cache_entry *centry, const char *format, ...)
 910 {
 911         va_list ap;
 912         char *kstr;
 913         TDB_DATA key, data;
 914
 915         if (!winbindd_use_cache()) {
 916                 return;
 917         }
 918
 919         va_start(ap, format);
 920         smb_xvasprintf(&kstr, format, ap);
 921         va_end(ap);
 922
 923         key = string_tdb_data(kstr);
 924         data.dptr = centry->data;
 925         data.dsize = centry->ofs;
 926
 927         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 928         free(kstr);
 929 }
 930
 931 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 932                                     NTSTATUS status, const char *domain_name,
 933                                     const char *name, const struct dom_sid *sid,
 934                                     enum lsa_SidType type)
 935 {
 936         struct cache_entry *centry;
 937         fstring uname;
 938
 939         centry = centry_start(domain, status);
 940         if (!centry)
 941                 return;
 942         centry_put_uint32(centry, type);
 943         centry_put_sid(centry, sid);
 944         fstrcpy(uname, name);
 945         strupper_m(uname);
 946         centry_end(centry, "NS/%s/%s", domain_name, uname);
 947         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 948                   uname, sid_string_dbg(sid), nt_errstr(status)));
 949         centry_free(centry);
 950 }
 951
 952 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 953                                     const struct dom_sid *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 954 {
 955         struct cache_entry *centry;
 956         fstring sid_string;
 957
 958         centry = centry_start(domain, status);
 959         if (!centry)
 960                 return;
 961
 962         if (NT_STATUS_IS_OK(status)) {
 963                 centry_put_uint32(centry, type);
 964                 centry_put_string(centry, domain_name);
 965                 centry_put_string(centry, name);
 966         }
 967
 968         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 969         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 970                   name, nt_errstr(status)));
 971         centry_free(centry);
 972 }
 973
 974
 975 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
 976                              struct wbint_userinfo *info)
 977 {
 978         struct cache_entry *centry;
 979         fstring sid_string;
 980
 981         if (is_null_sid(&info->user_sid)) {
 982                 return;
 983         }
 984
 985         centry = centry_start(domain, status);
 986         if (!centry)
 987                 return;
 988         centry_put_string(centry, info->acct_name);
 989         centry_put_string(centry, info->full_name);
 990         centry_put_string(centry, info->homedir);
 991         centry_put_string(centry, info->shell);
 992         centry_put_uint32(centry, info->primary_gid);
 993         centry_put_sid(centry, &info->user_sid);
 994         centry_put_sid(centry, &info->group_sid);
 995         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 996                                                   &info->user_sid));
 997         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 998         centry_free(centry);
 999 }
1000
1001 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
1002                                        NTSTATUS status,
1003                                        struct samr_DomInfo12 *lockout_policy)
1004 {
1005         struct cache_entry *centry;
1006
1007         centry = centry_start(domain, status);
1008         if (!centry)
1009                 return;
1010
1011         centry_put_nttime(centry, lockout_policy->lockout_duration);
1012         centry_put_nttime(centry, lockout_policy->lockout_window);
1013         centry_put_uint16(centry, lockout_policy->lockout_threshold);
1014
1015         centry_end(centry, "LOC_POL/%s", domain->name);
1016
1017         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
1018
1019         centry_free(centry);
1020 }
1021
1022
1023
1024 static void wcache_save_password_policy(struct winbindd_domain *domain,
1025                                         NTSTATUS status,
1026                                         struct samr_DomInfo1 *policy)
1027 {
1028         struct cache_entry *centry;
1029
1030         centry = centry_start(domain, status);
1031         if (!centry)
1032                 return;
1033
1034         centry_put_uint16(centry, policy->min_password_length);
1035         centry_put_uint16(centry, policy->password_history_length);
1036         centry_put_uint32(centry, policy->password_properties);
1037         centry_put_nttime(centry, policy->max_password_age);
1038         centry_put_nttime(centry, policy->min_password_age);
1039
1040         centry_end(centry, "PWD_POL/%s", domain->name);
1041
1042         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1043
1044         centry_free(centry);
1045 }
1046
1047 /***************************************************************************
1048  ***************************************************************************/
1049
1050 static void wcache_save_username_alias(struct winbindd_domain *domain,
1051                                        NTSTATUS status,
1052                                        const char *name, const char *alias)
1053 {
1054         struct cache_entry *centry;
1055         fstring uname;
1056
1057         if ( (centry = centry_start(domain, status)) == NULL )
1058                 return;
1059
1060         centry_put_string( centry, alias );
1061
1062         fstrcpy(uname, name);
1063         strupper_m(uname);
1064         centry_end(centry, "NSS/NA/%s", uname);
1065
1066         DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1067
1068         centry_free(centry);
1069 }
1070
1071 static void wcache_save_alias_username(struct winbindd_domain *domain,
1072                                        NTSTATUS status,
1073                                        const char *alias, const char *name)
1074 {
1075         struct cache_entry *centry;
1076         fstring uname;
1077
1078         if ( (centry = centry_start(domain, status)) == NULL )
1079                 return;
1080
1081         centry_put_string( centry, name );
1082
1083         fstrcpy(uname, alias);
1084         strupper_m(uname);
1085         centry_end(centry, "NSS/AN/%s", uname);
1086
1087         DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1088
1089         centry_free(centry);
1090 }
1091
1092 /***************************************************************************
1093  ***************************************************************************/
1094
1095 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1096                                     struct winbindd_domain *domain,
1097                                     const char *name, char **alias )
1098 {
1099         struct winbind_cache *cache = get_cache(domain);
1100         struct cache_entry *centry = NULL;
1101         NTSTATUS status;
1102         char *upper_name;
1103
1104         if ( domain->internal )
1105                 return NT_STATUS_NOT_SUPPORTED;
1106
1107         if (!cache->tdb)
1108                 goto do_query;
1109
1110         if ( (upper_name = SMB_STRDUP(name)) == NULL )
1111                 return NT_STATUS_NO_MEMORY;
1112         strupper_m(upper_name);
1113
1114         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1115
1116         SAFE_FREE( upper_name );
1117
1118         if (!centry)
1119                 goto do_query;
1120
1121         status = centry->status;
1122
1123         if (!NT_STATUS_IS_OK(status)) {
1124                 centry_free(centry);
1125                 return status;
1126         }
1127
1128         *alias = centry_string( centry, mem_ctx );
1129
1130         centry_free(centry);
1131
1132         DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1133                   name, *alias ? *alias : "(none)"));
1134
1135         return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1136
1137 do_query:
1138
1139         /* If its not in cache and we are offline, then fail */
1140
1141         if ( get_global_winbindd_state_offline() || !domain->online ) {
1142                 DEBUG(8,("resolve_username_to_alias: rejecting query "
1143                          "in offline mode\n"));
1144                 return NT_STATUS_NOT_FOUND;
1145         }
1146
1147         status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1148
1149         if ( NT_STATUS_IS_OK( status ) ) {
1150                 wcache_save_username_alias(domain, status, name, *alias);
1151         }
1152
1153         if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1154                 wcache_save_username_alias(domain, status, name, "(NULL)");
1155         }
1156
1157         DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1158                  nt_errstr(status)));
1159
1160         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1161                 set_domain_offline( domain );
1162         }
1163
1164         return status;
1165 }
1166
1167 /***************************************************************************
1168  ***************************************************************************/
1169
1170 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1171                                     struct winbindd_domain *domain,
1172                                     const char *alias, char **name )
1173 {
1174         struct winbind_cache *cache = get_cache(domain);
1175         struct cache_entry *centry = NULL;
1176         NTSTATUS status;
1177         char *upper_name;
1178
1179         if ( domain->internal )
1180                 return  NT_STATUS_NOT_SUPPORTED;
1181
1182         if (!cache->tdb)
1183                 goto do_query;
1184
1185         if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1186                 return NT_STATUS_NO_MEMORY;
1187         strupper_m(upper_name);
1188
1189         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1190
1191         SAFE_FREE( upper_name );
1192
1193         if (!centry)
1194                 goto do_query;
1195
1196         status = centry->status;
1197
1198         if (!NT_STATUS_IS_OK(status)) {
1199                 centry_free(centry);
1200                 return status;
1201         }
1202
1203         *name = centry_string( centry, mem_ctx );
1204
1205         centry_free(centry);
1206
1207         DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1208                   alias, *name ? *name : "(none)"));
1209
1210         return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1211
1212 do_query:
1213
1214         /* If its not in cache and we are offline, then fail */
1215
1216         if ( get_global_winbindd_state_offline() || !domain->online ) {
1217                 DEBUG(8,("resolve_alias_to_username: rejecting query "
1218                          "in offline mode\n"));
1219                 return NT_STATUS_NOT_FOUND;
1220         }
1221
1222         /* an alias cannot contain a domain prefix or '@' */
1223
1224         if (strchr(alias, '\\') || strchr(alias, '@')) {
1225                 DEBUG(10,("resolve_alias_to_username: skipping fully "
1226                           "qualified name %s\n", alias));
1227                 return NT_STATUS_OBJECT_NAME_INVALID;
1228         }
1229
1230         status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1231
1232         if ( NT_STATUS_IS_OK( status ) ) {
1233                 wcache_save_alias_username( domain, status, alias, *name );
1234         }
1235
1236         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1237                 wcache_save_alias_username(domain, status, alias, "(NULL)");
1238         }
1239
1240         DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1241                  nt_errstr(status)));
1242
1243         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1244                 set_domain_offline( domain );
1245         }
1246
1247         return status;
1248 }
1249
1250 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const struct dom_sid *sid)
1251 {
1252         struct winbind_cache *cache = get_cache(domain);
1253         TDB_DATA data;
1254         fstring key_str, tmp;
1255         uint32 rid;
1256
1257         if (!cache->tdb) {
1258                 return NT_STATUS_INTERNAL_DB_ERROR;
1259         }
1260
1261         if (is_null_sid(sid)) {
1262                 return NT_STATUS_INVALID_SID;
1263         }
1264
1265         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1266                 return NT_STATUS_INVALID_SID;
1267         }
1268
1269         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1270
1271         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1272         if (!data.dptr) {
1273                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1274         }
1275
1276         SAFE_FREE(data.dptr);
1277         return NT_STATUS_OK;
1278 }
1279
1280 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1281    as new salted ones. */
1282
1283 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1284                           TALLOC_CTX *mem_ctx,
1285                           const struct dom_sid *sid,
1286                           const uint8 **cached_nt_pass,
1287                           const uint8 **cached_salt)
1288 {
1289         struct winbind_cache *cache = get_cache(domain);
1290         struct cache_entry *centry = NULL;
1291         NTSTATUS status;
1292         time_t t;
1293         uint32 rid;
1294         fstring tmp;
1295
1296         if (!cache->tdb) {
1297                 return NT_STATUS_INTERNAL_DB_ERROR;
1298         }
1299
1300         if (is_null_sid(sid)) {
1301                 return NT_STATUS_INVALID_SID;
1302         }
1303
1304         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1305                 return NT_STATUS_INVALID_SID;
1306         }
1307
1308         /* Try and get a salted cred first. If we can't
1309            fall back to an unsalted cred. */
1310
1311         centry = wcache_fetch(cache, domain, "CRED/%s",
1312                               sid_to_fstring(tmp, sid));
1313         if (!centry) {
1314                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1315                           sid_string_dbg(sid)));
1316                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1317         }
1318
1319         t = centry_time(centry);
1320
1321         /* In the salted case this isn't actually the nt_hash itself,
1322            but the MD5 of the salt + nt_hash. Let the caller
1323            sort this out. It can tell as we only return the cached_salt
1324            if we are returning a salted cred. */
1325
1326         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1327         if (*cached_nt_pass == NULL) {
1328                 fstring sidstr;
1329
1330                 sid_to_fstring(sidstr, sid);
1331
1332                 /* Bad (old) cred cache. Delete and pretend we
1333                    don't have it. */
1334                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1335                                 sidstr));
1336                 wcache_delete("CRED/%s", sidstr);
1337                 centry_free(centry);
1338                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1339         }
1340
1341         /* We only have 17 bytes more data in the salted cred case. */
1342         if (centry->len - centry->ofs == 17) {
1343                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1344         } else {
1345                 *cached_salt = NULL;
1346         }
1347
1348         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1349         if (*cached_salt) {
1350                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1351         }
1352
1353         status = centry->status;
1354
1355         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1356                   sid_string_dbg(sid), nt_errstr(status) ));
1357
1358         centry_free(centry);
1359         return status;
1360 }
1361
1362 /* Store creds for a SID - only writes out new salted ones. */
1363
1364 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1365                            const struct dom_sid *sid,
1366                            const uint8 nt_pass[NT_HASH_LEN])
1367 {
1368         struct cache_entry *centry;
1369         fstring sid_string;
1370         uint32 rid;
1371         uint8 cred_salt[NT_HASH_LEN];
1372         uint8 salted_hash[NT_HASH_LEN];
1373
1374         if (is_null_sid(sid)) {
1375                 return NT_STATUS_INVALID_SID;
1376         }
1377
1378         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1379                 return NT_STATUS_INVALID_SID;
1380         }
1381
1382         centry = centry_start(domain, NT_STATUS_OK);
1383         if (!centry) {
1384                 return NT_STATUS_INTERNAL_DB_ERROR;
1385         }
1386
1387         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1388
1389         centry_put_time(centry, time(NULL));
1390
1391         /* Create a salt and then salt the hash. */
1392         generate_random_buffer(cred_salt, NT_HASH_LEN);
1393         E_md5hash(cred_salt, nt_pass, salted_hash);
1394
1395         centry_put_hash16(centry, salted_hash);
1396         centry_put_hash16(centry, cred_salt);
1397         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1398
1399         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1400
1401         centry_free(centry);
1402
1403         return NT_STATUS_OK;
1404 }
1405
1406
1407 /* Query display info. This is the basic user list fn */
1408 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1409                                 TALLOC_CTX *mem_ctx,
1410                                 uint32 *num_entries,
1411                                 struct wbint_userinfo **info)
1412 {
1413         struct winbind_cache *cache = get_cache(domain);
1414         struct cache_entry *centry = NULL;
1415         NTSTATUS status;
1416         unsigned int i, retry;
1417         bool old_status = domain->online;
1418
1419         if (!cache->tdb)
1420                 goto do_query;
1421
1422         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1423         if (!centry)
1424                 goto do_query;
1425
1426 do_fetch_cache:
1427         *num_entries = centry_uint32(centry);
1428
1429         if (*num_entries == 0)
1430                 goto do_cached;
1431
1432         (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1433         if (! (*info)) {
1434                 smb_panic_fn("query_user_list out of memory");
1435         }
1436         for (i=0; i<(*num_entries); i++) {
1437                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1438                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1439                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1440                 (*info)[i].shell = centry_string(centry, mem_ctx);
1441                 centry_sid(centry, &(*info)[i].user_sid);
1442                 centry_sid(centry, &(*info)[i].group_sid);
1443         }
1444
1445 do_cached:
1446         status = centry->status;
1447
1448         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1449                 domain->name, nt_errstr(status) ));
1450
1451         centry_free(centry);
1452         return status;
1453
1454 do_query:
1455         *num_entries = 0;
1456         *info = NULL;
1457
1458         /* Return status value returned by seq number check */
1459
1460         if (!NT_STATUS_IS_OK(domain->last_status))
1461                 return domain->last_status;
1462
1463         /* Put the query_user_list() in a retry loop.  There appears to be
1464          * some bug either with Windows 2000 or Samba's handling of large
1465          * rpc replies.  This manifests itself as sudden disconnection
1466          * at a random point in the enumeration of a large (60k) user list.
1467          * The retry loop simply tries the operation again. )-:  It's not
1468          * pretty but an acceptable workaround until we work out what the
1469          * real problem is. */
1470
1471         retry = 0;
1472         do {
1473
1474                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1475                         domain->name ));
1476
1477                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1478                 if (!NT_STATUS_IS_OK(status)) {
1479                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1480                                   "retrying\n", NT_STATUS_V(status)));
1481                 }
1482                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1483                         DEBUG(3, ("query_user_list: flushing "
1484                                   "connection cache\n"));
1485                         invalidate_cm_connection(&domain->conn);
1486                 }
1487                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1488                     NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1489                         if (!domain->internal && old_status) {
1490                                 set_domain_offline(domain);
1491                         }
1492                         /* store partial response. */
1493                         if (*num_entries > 0) {
1494                                 /*
1495                                  * humm, what about the status used for cache?
1496                                  * Should it be NT_STATUS_OK?
1497                                  */
1498                                 break;
1499                         }
1500                         /*
1501                          * domain is offline now, and there is no user entries,
1502                          * try to fetch from cache again.
1503                          */
1504                         if (cache->tdb && !domain->online && !domain->internal && old_status) {
1505                                 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1506                                 /* partial response... */
1507                                 if (!centry) {
1508                                         goto skip_save;
1509                                 } else {
1510                                         goto do_fetch_cache;
1511                                 }
1512                         } else {
1513                                 goto skip_save;
1514                         }
1515                 }
1516
1517         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1518                  (retry++ < 5));
1519
1520         /* and save it */
1521         refresh_sequence_number(domain, false);
1522         if (!NT_STATUS_IS_OK(status)) {
1523                 return status;
1524         }
1525         centry = centry_start(domain, status);
1526         if (!centry)
1527                 goto skip_save;
1528         centry_put_uint32(centry, *num_entries);
1529         for (i=0; i<(*num_entries); i++) {
1530                 centry_put_string(centry, (*info)[i].acct_name);
1531                 centry_put_string(centry, (*info)[i].full_name);
1532                 centry_put_string(centry, (*info)[i].homedir);
1533                 centry_put_string(centry, (*info)[i].shell);
1534                 centry_put_sid(centry, &(*info)[i].user_sid);
1535                 centry_put_sid(centry, &(*info)[i].group_sid);
1536                 if (domain->backend && domain->backend->consistent) {
1537                         /* when the backend is consistent we can pre-prime some mappings */
1538                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1539                                                 domain->name,
1540                                                 (*info)[i].acct_name,
1541                                                 &(*info)[i].user_sid,
1542                                                 SID_NAME_USER);
1543                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1544                                                 &(*info)[i].user_sid,
1545                                                 domain->name,
1546                                                 (*info)[i].acct_name,
1547                                                 SID_NAME_USER);
1548                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1549                 }
1550         }
1551         centry_end(centry, "UL/%s", domain->name);
1552         centry_free(centry);
1553
1554 skip_save:
1555         return status;
1556 }
1557
1558 /* list all domain groups */
1559 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1560                                 TALLOC_CTX *mem_ctx,
1561                                 uint32 *num_entries,
1562                                 struct acct_info **info)
1563 {
1564         struct winbind_cache *cache = get_cache(domain);
1565         struct cache_entry *centry = NULL;
1566         NTSTATUS status;
1567         unsigned int i;
1568         bool old_status;
1569
1570         old_status = domain->online;
1571         if (!cache->tdb)
1572                 goto do_query;
1573
1574         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1575         if (!centry)
1576                 goto do_query;
1577
1578 do_fetch_cache:
1579         *num_entries = centry_uint32(centry);
1580
1581         if (*num_entries == 0)
1582                 goto do_cached;
1583
1584         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1585         if (! (*info)) {
1586                 smb_panic_fn("enum_dom_groups out of memory");
1587         }
1588         for (i=0; i<(*num_entries); i++) {
1589                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1590                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1591                 (*info)[i].rid = centry_uint32(centry);
1592         }
1593
1594 do_cached:
1595         status = centry->status;
1596
1597         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1598                 domain->name, nt_errstr(status) ));
1599
1600         centry_free(centry);
1601         return status;
1602
1603 do_query:
1604         *num_entries = 0;
1605         *info = NULL;
1606
1607         /* Return status value returned by seq number check */
1608
1609         if (!NT_STATUS_IS_OK(domain->last_status))
1610                 return domain->last_status;
1611
1612         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1613                 domain->name ));
1614
1615         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1616
1617         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1618             NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1619                 if (!domain->internal && old_status) {
1620                         set_domain_offline(domain);
1621                 }
1622                 if (cache->tdb &&
1623                         !domain->online &&
1624                         !domain->internal &&
1625                         old_status) {
1626                         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1627                         if (centry) {
1628                                 goto do_fetch_cache;
1629                         }
1630                 }
1631         }
1632         /* and save it */
1633         refresh_sequence_number(domain, false);
1634         if (!NT_STATUS_IS_OK(status)) {
1635                 return status;
1636         }
1637         centry = centry_start(domain, status);
1638         if (!centry)
1639                 goto skip_save;
1640         centry_put_uint32(centry, *num_entries);
1641         for (i=0; i<(*num_entries); i++) {
1642                 centry_put_string(centry, (*info)[i].acct_name);
1643                 centry_put_string(centry, (*info)[i].acct_desc);
1644                 centry_put_uint32(centry, (*info)[i].rid);
1645         }
1646         centry_end(centry, "GL/%s/domain", domain->name);
1647         centry_free(centry);
1648
1649 skip_save:
1650         return status;
1651 }
1652
1653 /* list all domain groups */
1654 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1655                                 TALLOC_CTX *mem_ctx,
1656                                 uint32 *num_entries,
1657                                 struct acct_info **info)
1658 {
1659         struct winbind_cache *cache = get_cache(domain);
1660         struct cache_entry *centry = NULL;
1661         NTSTATUS status;
1662         unsigned int i;
1663         bool old_status;
1664
1665         old_status = domain->online;
1666         if (!cache->tdb)
1667                 goto do_query;
1668
1669         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1670         if (!centry)
1671                 goto do_query;
1672
1673 do_fetch_cache:
1674         *num_entries = centry_uint32(centry);
1675
1676         if (*num_entries == 0)
1677                 goto do_cached;
1678
1679         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1680         if (! (*info)) {
1681                 smb_panic_fn("enum_dom_groups out of memory");
1682         }
1683         for (i=0; i<(*num_entries); i++) {
1684                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1685                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1686                 (*info)[i].rid = centry_uint32(centry);
1687         }
1688
1689 do_cached:
1690
1691         /* If we are returning cached data and the domain controller
1692            is down then we don't know whether the data is up to date
1693            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1694            indicate this. */
1695
1696         if (wcache_server_down(domain)) {
1697                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1698                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1699         } else
1700                 status = centry->status;
1701
1702         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1703                 domain->name, nt_errstr(status) ));
1704
1705         centry_free(centry);
1706         return status;
1707
1708 do_query:
1709         *num_entries = 0;
1710         *info = NULL;
1711
1712         /* Return status value returned by seq number check */
1713
1714         if (!NT_STATUS_IS_OK(domain->last_status))
1715                 return domain->last_status;
1716
1717         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1718                 domain->name ));
1719
1720         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1721
1722         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1723                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1724                 if (!domain->internal && old_status) {
1725                         set_domain_offline(domain);
1726                 }
1727                 if (cache->tdb &&
1728                         !domain->internal &&
1729                         !domain->online &&
1730                         old_status) {
1731                         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1732                         if (centry) {
1733                                 goto do_fetch_cache;
1734                         }
1735                 }
1736         }
1737         /* and save it */
1738         refresh_sequence_number(domain, false);
1739         if (!NT_STATUS_IS_OK(status)) {
1740                 return status;
1741         }
1742         centry = centry_start(domain, status);
1743         if (!centry)
1744                 goto skip_save;
1745         centry_put_uint32(centry, *num_entries);
1746         for (i=0; i<(*num_entries); i++) {
1747                 centry_put_string(centry, (*info)[i].acct_name);
1748                 centry_put_string(centry, (*info)[i].acct_desc);
1749                 centry_put_uint32(centry, (*info)[i].rid);
1750         }
1751         centry_end(centry, "GL/%s/local", domain->name);
1752         centry_free(centry);
1753
1754 skip_save:
1755         return status;
1756 }
1757
1758 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1759                             const char *domain_name,
1760                             const char *name,
1761                             struct dom_sid *sid,
1762                             enum lsa_SidType *type)
1763 {
1764         struct winbind_cache *cache = get_cache(domain);
1765         struct cache_entry *centry;
1766         NTSTATUS status;
1767         char *uname;
1768
1769         if (cache->tdb == NULL) {
1770                 return NT_STATUS_NOT_FOUND;
1771         }
1772
1773         uname = talloc_strdup_upper(talloc_tos(), name);
1774         if (uname == NULL) {
1775                 return NT_STATUS_NO_MEMORY;
1776         }
1777
1778         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1779         TALLOC_FREE(uname);
1780         if (centry == NULL) {
1781                 return NT_STATUS_NOT_FOUND;
1782         }
1783
1784         status = centry->status;
1785         if (NT_STATUS_IS_OK(status)) {
1786                 *type = (enum lsa_SidType)centry_uint32(centry);
1787                 centry_sid(centry, sid);
1788         }
1789
1790         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1791                   "%s\n", domain->name, nt_errstr(status) ));
1792
1793         centry_free(centry);
1794         return status;
1795 }
1796
1797 /* convert a single name to a sid in a domain */
1798 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1799                             TALLOC_CTX *mem_ctx,
1800                             const char *domain_name,
1801                             const char *name,
1802                             uint32_t flags,
1803                             struct dom_sid *sid,
1804                             enum lsa_SidType *type)
1805 {
1806         NTSTATUS status;
1807         bool old_status;
1808
1809         old_status = domain->online;
1810
1811         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1812         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1813                 return status;
1814         }
1815
1816         ZERO_STRUCTP(sid);
1817
1818         /* If the seq number check indicated that there is a problem
1819          * with this DC, then return that status... except for
1820          * access_denied.  This is special because the dc may be in
1821          * "restrict anonymous = 1" mode, in which case it will deny
1822          * most unauthenticated operations, but *will* allow the LSA
1823          * name-to-sid that we try as a fallback. */
1824
1825         if (!(NT_STATUS_IS_OK(domain->last_status)
1826               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1827                 return domain->last_status;
1828
1829         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1830                 domain->name ));
1831
1832         status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1833                                               name, flags, sid, type);
1834
1835         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1836                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1837                 if (!domain->internal && old_status) {
1838                         set_domain_offline(domain);
1839                 }
1840                 if (!domain->internal &&
1841                         !domain->online &&
1842                         old_status) {
1843                         NTSTATUS cache_status;
1844                         cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1845                         return cache_status;
1846                 }
1847         }
1848         /* and save it */
1849         refresh_sequence_number(domain, false);
1850
1851         if (domain->online &&
1852             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1853                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1854
1855                 /* Only save the reverse mapping if this was not a UPN */
1856                 if (!strchr(name, '@')) {
1857                         strupper_m(CONST_DISCARD(char *,domain_name));
1858                         strlower_m(CONST_DISCARD(char *,name));
1859                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1860                 }
1861         }
1862
1863         return status;
1864 }
1865
1866 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1867                             const struct dom_sid *sid,
1868                             TALLOC_CTX *mem_ctx,
1869                             char **domain_name,
1870                             char **name,
1871                             enum lsa_SidType *type)
1872 {
1873         struct winbind_cache *cache = get_cache(domain);
1874         struct cache_entry *centry;
1875         char *sid_string;
1876         NTSTATUS status;
1877
1878         if (cache->tdb == NULL) {
1879                 return NT_STATUS_NOT_FOUND;
1880         }
1881
1882         sid_string = sid_string_tos(sid);
1883         if (sid_string == NULL) {
1884                 return NT_STATUS_NO_MEMORY;
1885         }
1886
1887         centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1888         TALLOC_FREE(sid_string);
1889         if (centry == NULL) {
1890                 return NT_STATUS_NOT_FOUND;
1891         }
1892
1893         if (NT_STATUS_IS_OK(centry->status)) {
1894                 *type = (enum lsa_SidType)centry_uint32(centry);
1895                 *domain_name = centry_string(centry, mem_ctx);
1896                 *name = centry_string(centry, mem_ctx);
1897         }
1898
1899         status = centry->status;
1900         centry_free(centry);
1901
1902         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1903                   "%s\n", domain->name, nt_errstr(status) ));
1904
1905         return status;
1906 }
1907
1908 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1909    given */
1910 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1911                             TALLOC_CTX *mem_ctx,
1912                             const struct dom_sid *sid,
1913                             char **domain_name,
1914                             char **name,
1915                             enum lsa_SidType *type)
1916 {
1917         NTSTATUS status;
1918         bool old_status;
1919
1920         old_status = domain->online;
1921         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1922                                     type);
1923         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1924                 return status;
1925         }
1926
1927         *name = NULL;
1928         *domain_name = NULL;
1929
1930         /* If the seq number check indicated that there is a problem
1931          * with this DC, then return that status... except for
1932          * access_denied.  This is special because the dc may be in
1933          * "restrict anonymous = 1" mode, in which case it will deny
1934          * most unauthenticated operations, but *will* allow the LSA
1935          * sid-to-name that we try as a fallback. */
1936
1937         if (!(NT_STATUS_IS_OK(domain->last_status)
1938               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1939                 return domain->last_status;
1940
1941         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1942                 domain->name ));
1943
1944         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1945
1946         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1947                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1948                 if (!domain->internal && old_status) {
1949                         set_domain_offline(domain);
1950                 }
1951                 if (!domain->internal &&
1952                         !domain->online &&
1953                         old_status) {
1954                         NTSTATUS cache_status;
1955                         cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1956                                                         domain_name, name, type);
1957                         return cache_status;
1958                 }
1959         }
1960         /* and save it */
1961         refresh_sequence_number(domain, false);
1962         if (!NT_STATUS_IS_OK(status)) {
1963                 return status;
1964         }
1965         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1966
1967         /* We can't save the name to sid mapping here, as with sid history a
1968          * later name2sid would give the wrong sid. */
1969
1970         return status;
1971 }
1972
1973 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1974                               TALLOC_CTX *mem_ctx,
1975                               const struct dom_sid *domain_sid,
1976                               uint32 *rids,
1977                               size_t num_rids,
1978                               char **domain_name,
1979                               char ***names,
1980                               enum lsa_SidType **types)
1981 {
1982         struct winbind_cache *cache = get_cache(domain);
1983         size_t i;
1984         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1985         bool have_mapped;
1986         bool have_unmapped;
1987         bool old_status;
1988
1989         old_status = domain->online;
1990         *domain_name = NULL;
1991         *names = NULL;
1992         *types = NULL;
1993
1994         if (!cache->tdb) {
1995                 goto do_query;
1996         }
1997
1998         if (num_rids == 0) {
1999                 return NT_STATUS_OK;
2000         }
2001
2002         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
2003         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
2004
2005         if ((*names == NULL) || (*types == NULL)) {
2006                 result = NT_STATUS_NO_MEMORY;
2007                 goto error;
2008         }
2009
2010         have_mapped = have_unmapped = false;
2011
2012         for (i=0; i<num_rids; i++) {
2013                 struct dom_sid sid;
2014                 struct cache_entry *centry;
2015                 fstring tmp;
2016
2017                 if (!sid_compose(&sid, domain_sid, rids[i])) {
2018                         result = NT_STATUS_INTERNAL_ERROR;
2019                         goto error;
2020                 }
2021
2022                 centry = wcache_fetch(cache, domain, "SN/%s",
2023                                       sid_to_fstring(tmp, &sid));
2024                 if (!centry) {
2025                         goto do_query;
2026                 }
2027
2028                 (*types)[i] = SID_NAME_UNKNOWN;
2029                 (*names)[i] = talloc_strdup(*names, "");
2030
2031                 if (NT_STATUS_IS_OK(centry->status)) {
2032                         char *dom;
2033                         have_mapped = true;
2034                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2035
2036                         dom = centry_string(centry, mem_ctx);
2037                         if (*domain_name == NULL) {
2038                                 *domain_name = dom;
2039                         } else {
2040                                 talloc_free(dom);
2041                         }
2042
2043                         (*names)[i] = centry_string(centry, *names);
2044
2045                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)
2046                            || NT_STATUS_EQUAL(centry->status, STATUS_SOME_UNMAPPED)) {
2047                         have_unmapped = true;
2048
2049                 } else {
2050                         /* something's definitely wrong */
2051                         result = centry->status;
2052                         goto error;
2053                 }
2054
2055                 centry_free(centry);
2056         }
2057
2058         if (!have_mapped) {
2059                 return NT_STATUS_NONE_MAPPED;
2060         }
2061         if (!have_unmapped) {
2062                 return NT_STATUS_OK;
2063         }
2064         return STATUS_SOME_UNMAPPED;
2065
2066  do_query:
2067
2068         TALLOC_FREE(*names);
2069         TALLOC_FREE(*types);
2070
2071         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2072                                                 rids, num_rids, domain_name,
2073                                                 names, types);
2074
2075         if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2076                 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2077                 if (!domain->internal && old_status) {
2078                         set_domain_offline(domain);
2079                 }
2080                 if (cache->tdb &&
2081                         !domain->internal &&
2082                         !domain->online &&
2083                         old_status) {
2084                         have_mapped = have_unmapped = false;
2085
2086                         for (i=0; i<num_rids; i++) {
2087                                 struct dom_sid sid;
2088                                 struct cache_entry *centry;
2089                                 fstring tmp;
2090
2091                                 if (!sid_compose(&sid, domain_sid, rids[i])) {
2092                                         result = NT_STATUS_INTERNAL_ERROR;
2093                                         goto error;
2094                                 }
2095
2096                                 centry = wcache_fetch(cache, domain, "SN/%s",
2097                                                       sid_to_fstring(tmp, &sid));
2098                                 if (!centry) {
2099                                         (*types)[i] = SID_NAME_UNKNOWN;
2100                                         (*names)[i] = talloc_strdup(*names, "");
2101                                         continue;
2102                                 }
2103
2104                                 (*types)[i] = SID_NAME_UNKNOWN;
2105                                 (*names)[i] = talloc_strdup(*names, "");
2106
2107                                 if (NT_STATUS_IS_OK(centry->status)) {
2108                                         char *dom;
2109                                         have_mapped = true;
2110                                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2111
2112                                         dom = centry_string(centry, mem_ctx);
2113                                         if (*domain_name == NULL) {
2114                                                 *domain_name = dom;
2115                                         } else {
2116                                                 talloc_free(dom);
2117                                         }
2118
2119                                         (*names)[i] = centry_string(centry, *names);
2120
2121                                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2122                                         have_unmapped = true;
2123
2124                                 } else {
2125                                         /* something's definitely wrong */
2126                                         result = centry->status;
2127                                         goto error;
2128                                 }
2129
2130                                 centry_free(centry);
2131                         }
2132
2133                         if (!have_mapped) {
2134                                 return NT_STATUS_NONE_MAPPED;
2135                         }
2136                         if (!have_unmapped) {
2137                                 return NT_STATUS_OK;
2138                         }
2139                         return STATUS_SOME_UNMAPPED;
2140                 }
2141         }
2142         /*
2143           None of the queried rids has been found so save all negative entries
2144         */
2145         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2146                 for (i = 0; i < num_rids; i++) {
2147                         struct dom_sid sid;
2148                         const char *name = "";
2149                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
2150                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
2151
2152                         if (!sid_compose(&sid, domain_sid, rids[i])) {
2153                                 return NT_STATUS_INTERNAL_ERROR;
2154                         }
2155
2156                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2157                                                 name, type);
2158                 }
2159
2160                 return result;
2161         }
2162
2163         /*
2164           Some or all of the queried rids have been found.
2165         */
2166         if (!NT_STATUS_IS_OK(result) &&
2167             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2168                 return result;
2169         }
2170
2171         refresh_sequence_number(domain, false);
2172
2173         for (i=0; i<num_rids; i++) {
2174                 struct dom_sid sid;
2175                 NTSTATUS status;
2176
2177                 if (!sid_compose(&sid, domain_sid, rids[i])) {
2178                         result = NT_STATUS_INTERNAL_ERROR;
2179                         goto error;
2180                 }
2181
2182                 status = (*types)[i] == SID_NAME_UNKNOWN ?
2183                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2184
2185                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2186                                         (*names)[i], (*types)[i]);
2187         }
2188
2189         return result;
2190
2191  error:
2192         TALLOC_FREE(*names);
2193         TALLOC_FREE(*types);
2194         return result;
2195 }
2196
2197 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2198                            TALLOC_CTX *mem_ctx,
2199                            const struct dom_sid *user_sid,
2200                            struct wbint_userinfo *info)
2201 {
2202         struct winbind_cache *cache = get_cache(domain);
2203         struct cache_entry *centry = NULL;
2204         NTSTATUS status;
2205         char *sid_string;
2206
2207         if (cache->tdb == NULL) {
2208                 return NT_STATUS_NOT_FOUND;
2209         }
2210
2211         sid_string = sid_string_tos(user_sid);
2212         if (sid_string == NULL) {
2213                 return NT_STATUS_NO_MEMORY;
2214         }
2215
2216         centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2217         TALLOC_FREE(sid_string);
2218         if (centry == NULL) {
2219                 return NT_STATUS_NOT_FOUND;
2220         }
2221
2222         /*
2223          * If we have an access denied cache entry and a cached info3
2224          * in the samlogon cache then do a query.  This will force the
2225          * rpc back end to return the info3 data.
2226          */
2227
2228         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2229             netsamlogon_cache_have(user_sid)) {
2230                 DEBUG(10, ("query_user: cached access denied and have cached "
2231                            "info3\n"));
2232                 domain->last_status = NT_STATUS_OK;
2233                 centry_free(centry);
2234                 return NT_STATUS_NOT_FOUND;
2235         }
2236
2237         /* if status is not ok then this is a negative hit
2238            and the rest of the data doesn't matter */
2239         status = centry->status;
2240         if (NT_STATUS_IS_OK(status)) {
2241                 info->acct_name = centry_string(centry, mem_ctx);
2242                 info->full_name = centry_string(centry, mem_ctx);
2243                 info->homedir = centry_string(centry, mem_ctx);
2244                 info->shell = centry_string(centry, mem_ctx);
2245                 info->primary_gid = centry_uint32(centry);
2246                 centry_sid(centry, &info->user_sid);
2247                 centry_sid(centry, &info->group_sid);
2248         }
2249
2250         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2251                   "%s\n", domain->name, nt_errstr(status) ));
2252
2253         centry_free(centry);
2254         return status;
2255 }
2256
2257 /* Lookup user information from a rid */
2258 static NTSTATUS query_user(struct winbindd_domain *domain,
2259                            TALLOC_CTX *mem_ctx,
2260                            const struct dom_sid *user_sid,
2261                            struct wbint_userinfo *info)
2262 {
2263         NTSTATUS status;
2264         bool old_status;
2265
2266         old_status = domain->online;
2267         status = wcache_query_user(domain, mem_ctx, user_sid, info);
2268         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2269                 return status;
2270         }
2271
2272         ZERO_STRUCTP(info);
2273
2274         /* Return status value returned by seq number check */
2275
2276         if (!NT_STATUS_IS_OK(domain->last_status))
2277                 return domain->last_status;
2278
2279         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2280                 domain->name ));
2281
2282         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2283
2284         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2285                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2286                 if (!domain->internal && old_status) {
2287                         set_domain_offline(domain);
2288                 }
2289                 if (!domain->internal &&
2290                         !domain->online &&
2291                         old_status) {
2292                         NTSTATUS cache_status;
2293                         cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2294                         return cache_status;
2295                 }
2296         }
2297         /* and save it */
2298         refresh_sequence_number(domain, false);
2299         if (!NT_STATUS_IS_OK(status)) {
2300                 return status;
2301         }
2302         wcache_save_user(domain, status, info);
2303
2304         return status;
2305 }
2306
2307 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2308                                   TALLOC_CTX *mem_ctx,
2309                                   const struct dom_sid *user_sid,
2310                                   uint32_t *pnum_sids,
2311                                   struct dom_sid **psids)
2312 {
2313         struct winbind_cache *cache = get_cache(domain);
2314         struct cache_entry *centry = NULL;
2315         NTSTATUS status;
2316         uint32_t i, num_sids;
2317         struct dom_sid *sids;
2318         fstring sid_string;
2319
2320         if (cache->tdb == NULL) {
2321                 return NT_STATUS_NOT_FOUND;
2322         }
2323
2324         centry = wcache_fetch(cache, domain, "UG/%s",
2325                               sid_to_fstring(sid_string, user_sid));
2326         if (centry == NULL) {
2327                 return NT_STATUS_NOT_FOUND;
2328         }
2329
2330         /* If we have an access denied cache entry and a cached info3 in the
2331            samlogon cache then do a query.  This will force the rpc back end
2332            to return the info3 data. */
2333
2334         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2335             && netsamlogon_cache_have(user_sid)) {
2336                 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2337                            "cached info3\n"));
2338                 domain->last_status = NT_STATUS_OK;
2339                 centry_free(centry);
2340                 return NT_STATUS_NOT_FOUND;
2341         }
2342
2343         num_sids = centry_uint32(centry);
2344         sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2345         if (sids == NULL) {
2346                 centry_free(centry);
2347                 return NT_STATUS_NO_MEMORY;
2348         }
2349
2350         for (i=0; i<num_sids; i++) {
2351                 centry_sid(centry, &sids[i]);
2352         }
2353
2354         status = centry->status;
2355
2356         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2357                   "status: %s\n", domain->name, nt_errstr(status)));
2358
2359         centry_free(centry);
2360
2361         *pnum_sids = num_sids;
2362         *psids = sids;
2363         return status;
2364 }
2365
2366 /* Lookup groups a user is a member of. */
2367 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2368                                   TALLOC_CTX *mem_ctx,
2369                                   const struct dom_sid *user_sid,
2370                                   uint32 *num_groups, struct dom_sid **user_gids)
2371 {
2372         struct cache_entry *centry = NULL;
2373         NTSTATUS status;
2374         unsigned int i;
2375         fstring sid_string;
2376         bool old_status;
2377
2378         old_status = domain->online;
2379         status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2380                                           num_groups, user_gids);
2381         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2382                 return status;
2383         }
2384
2385         (*num_groups) = 0;
2386         (*user_gids) = NULL;
2387
2388         /* Return status value returned by seq number check */
2389
2390         if (!NT_STATUS_IS_OK(domain->last_status))
2391                 return domain->last_status;
2392
2393         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2394                 domain->name ));
2395
2396         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2397
2398         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2399                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2400                 if (!domain->internal && old_status) {
2401                         set_domain_offline(domain);
2402                 }
2403                 if (!domain->internal &&
2404                         !domain->online &&
2405                         old_status) {
2406                         NTSTATUS cache_status;
2407                         cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2408                                                           num_groups, user_gids);
2409                         return cache_status;
2410                 }
2411         }
2412         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2413                 goto skip_save;
2414
2415         /* and save it */
2416         refresh_sequence_number(domain, false);
2417         if (!NT_STATUS_IS_OK(status)) {
2418                 return status;
2419         }
2420         centry = centry_start(domain, status);
2421         if (!centry)
2422                 goto skip_save;
2423
2424         centry_put_uint32(centry, *num_groups);
2425         for (i=0; i<(*num_groups); i++) {
2426                 centry_put_sid(centry, &(*user_gids)[i]);
2427         }
2428
2429         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2430         centry_free(centry);
2431
2432 skip_save:
2433         return status;
2434 }
2435
2436 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2437                                  const struct dom_sid *sids)
2438 {
2439         uint32_t i;
2440         char *sidlist;
2441
2442         sidlist = talloc_strdup(mem_ctx, "");
2443         if (sidlist == NULL) {
2444                 return NULL;
2445         }
2446         for (i=0; i<num_sids; i++) {
2447                 fstring tmp;
2448                 sidlist = talloc_asprintf_append_buffer(
2449                         sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2450                 if (sidlist == NULL) {
2451                         return NULL;
2452                 }
2453         }
2454         return sidlist;
2455 }
2456
2457 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2458                                    TALLOC_CTX *mem_ctx, uint32_t num_sids,
2459                                    const struct dom_sid *sids,
2460                                    uint32_t *pnum_aliases, uint32_t **paliases)
2461 {
2462         struct winbind_cache *cache = get_cache(domain);
2463         struct cache_entry *centry = NULL;
2464         uint32_t num_aliases;
2465         uint32_t *aliases;
2466         NTSTATUS status;
2467         char *sidlist;
2468         int i;
2469
2470         if (cache->tdb == NULL) {
2471                 return NT_STATUS_NOT_FOUND;
2472         }
2473
2474         if (num_sids == 0) {
2475                 *pnum_aliases = 0;
2476                 *paliases = NULL;
2477                 return NT_STATUS_OK;
2478         }
2479
2480         /* We need to cache indexed by the whole list of SIDs, the aliases
2481          * resulting might come from any of the SIDs. */
2482
2483         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2484         if (sidlist == NULL) {
2485                 return NT_STATUS_NO_MEMORY;
2486         }
2487
2488         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2489         TALLOC_FREE(sidlist);
2490         if (centry == NULL) {
2491                 return NT_STATUS_NOT_FOUND;
2492         }
2493
2494         num_aliases = centry_uint32(centry);
2495         aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2496         if (aliases == NULL) {
2497                 centry_free(centry);
2498                 return NT_STATUS_NO_MEMORY;
2499         }
2500
2501         for (i=0; i<num_aliases; i++) {
2502                 aliases[i] = centry_uint32(centry);
2503         }
2504
2505         status = centry->status;
2506
2507         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2508                   "status %s\n", domain->name, nt_errstr(status)));
2509
2510         centry_free(centry);
2511
2512         *pnum_aliases = num_aliases;
2513         *paliases = aliases;
2514
2515         return status;
2516 }
2517
2518 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2519                                    TALLOC_CTX *mem_ctx,
2520                                    uint32 num_sids, const struct dom_sid *sids,
2521                                    uint32 *num_aliases, uint32 **alias_rids)
2522 {
2523         struct cache_entry *centry = NULL;
2524         NTSTATUS status;
2525         char *sidlist;
2526         int i;
2527         bool old_status;
2528
2529         old_status = domain->online;
2530         status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2531                                            num_aliases, alias_rids);
2532         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2533                 return status;
2534         }
2535
2536         (*num_aliases) = 0;
2537         (*alias_rids) = NULL;
2538
2539         if (!NT_STATUS_IS_OK(domain->last_status))
2540                 return domain->last_status;
2541
2542         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2543                   "for domain %s\n", domain->name ));
2544
2545         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2546         if (sidlist == NULL) {
2547                 return NT_STATUS_NO_MEMORY;
2548         }
2549
2550         status = domain->backend->lookup_useraliases(domain, mem_ctx,
2551                                                      num_sids, sids,
2552                                                      num_aliases, alias_rids);
2553
2554         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2555                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2556                 if (!domain->internal && old_status) {
2557                         set_domain_offline(domain);
2558                 }
2559                 if (!domain->internal &&
2560                         !domain->online &&
2561                         old_status) {
2562                         NTSTATUS cache_status;
2563                         cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2564                                                                  sids, num_aliases, alias_rids);
2565                         return cache_status;
2566                 }
2567         }
2568         /* and save it */
2569         refresh_sequence_number(domain, false);
2570         if (!NT_STATUS_IS_OK(status)) {
2571                 return status;
2572         }
2573         centry = centry_start(domain, status);
2574         if (!centry)
2575                 goto skip_save;
2576         centry_put_uint32(centry, *num_aliases);
2577         for (i=0; i<(*num_aliases); i++)
2578                 centry_put_uint32(centry, (*alias_rids)[i]);
2579         centry_end(centry, "UA%s", sidlist);
2580         centry_free(centry);
2581
2582  skip_save:
2583         return status;
2584 }
2585
2586 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2587                                 TALLOC_CTX *mem_ctx,
2588                                 const struct dom_sid *group_sid,
2589                                 uint32_t *num_names,
2590                                 struct dom_sid **sid_mem, char ***names,
2591                                 uint32_t **name_types)
2592 {
2593         struct winbind_cache *cache = get_cache(domain);
2594         struct cache_entry *centry = NULL;
2595         NTSTATUS status;
2596         unsigned int i;
2597         char *sid_string;
2598
2599         if (cache->tdb == NULL) {
2600                 return NT_STATUS_NOT_FOUND;
2601         }
2602
2603         sid_string = sid_string_tos(group_sid);
2604         if (sid_string == NULL) {
2605                 return NT_STATUS_NO_MEMORY;
2606         }
2607
2608         centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2609         TALLOC_FREE(sid_string);
2610         if (centry == NULL) {
2611                 return NT_STATUS_NOT_FOUND;
2612         }
2613
2614         *sid_mem = NULL;
2615         *names = NULL;
2616         *name_types = NULL;
2617
2618         *num_names = centry_uint32(centry);
2619         if (*num_names == 0) {
2620                 centry_free(centry);
2621                 return NT_STATUS_OK;
2622         }
2623
2624         *sid_mem = talloc_array(mem_ctx, struct dom_sid, *num_names);
2625         *names = talloc_array(mem_ctx, char *, *num_names);
2626         *name_types = talloc_array(mem_ctx, uint32, *num_names);
2627
2628         if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2629                 TALLOC_FREE(*sid_mem);
2630                 TALLOC_FREE(*names);
2631                 TALLOC_FREE(*name_types);
2632                 centry_free(centry);
2633                 return NT_STATUS_NO_MEMORY;
2634         }
2635
2636         for (i=0; i<(*num_names); i++) {
2637                 centry_sid(centry, &(*sid_mem)[i]);
2638                 (*names)[i] = centry_string(centry, mem_ctx);
2639                 (*name_types)[i] = centry_uint32(centry);
2640         }
2641
2642         status = centry->status;
2643
2644         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2645                   "status: %s\n", domain->name, nt_errstr(status)));
2646
2647         centry_free(centry);
2648         return status;
2649 }
2650
2651 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2652                                 TALLOC_CTX *mem_ctx,
2653                                 const struct dom_sid *group_sid,
2654                                 enum lsa_SidType type,
2655                                 uint32 *num_names,
2656                                 struct dom_sid **sid_mem, char ***names,
2657                                 uint32 **name_types)
2658 {
2659         struct cache_entry *centry = NULL;
2660         NTSTATUS status;
2661         unsigned int i;
2662         fstring sid_string;
2663         bool old_status;
2664
2665         old_status = domain->online;
2666         status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2667                                         sid_mem, names, name_types);
2668         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2669                 return status;
2670         }
2671
2672         (*num_names) = 0;
2673         (*sid_mem) = NULL;
2674         (*names) = NULL;
2675         (*name_types) = NULL;
2676
2677         /* Return status value returned by seq number check */
2678
2679         if (!NT_STATUS_IS_OK(domain->last_status))
2680                 return domain->last_status;
2681
2682         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2683                 domain->name ));
2684
2685         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2686                                                   type, num_names,
2687                                                   sid_mem, names, name_types);
2688
2689         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2690                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2691                 if (!domain->internal && old_status) {
2692                         set_domain_offline(domain);
2693                 }
2694                 if (!domain->internal &&
2695                         !domain->online &&
2696                         old_status) {
2697                         NTSTATUS cache_status;
2698                         cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2699                                                               num_names, sid_mem, names,
2700                                                               name_types);
2701                         return cache_status;
2702                 }
2703         }
2704         /* and save it */
2705         refresh_sequence_number(domain, false);
2706         if (!NT_STATUS_IS_OK(status)) {
2707                 return status;
2708         }
2709         centry = centry_start(domain, status);
2710         if (!centry)
2711                 goto skip_save;
2712         centry_put_uint32(centry, *num_names);
2713         for (i=0; i<(*num_names); i++) {
2714                 centry_put_sid(centry, &(*sid_mem)[i]);
2715                 centry_put_string(centry, (*names)[i]);
2716                 centry_put_uint32(centry, (*name_types)[i]);
2717         }
2718         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2719         centry_free(centry);
2720
2721 skip_save:
2722         return status;
2723 }
2724
2725 /* find the sequence number for a domain */
2726 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2727 {
2728         refresh_sequence_number(domain, false);
2729
2730         *seq = domain->sequence_number;
2731
2732         return NT_STATUS_OK;
2733 }
2734
2735 /* enumerate trusted domains
2736  * (we need to have the list of trustdoms in the cache when we go offline) -
2737  * Guenther */
2738 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2739                                 TALLOC_CTX *mem_ctx,
2740                                 struct netr_DomainTrustList *trusts)
2741 {
2742         NTSTATUS status;
2743         struct winbind_cache *cache;
2744         struct winbindd_tdc_domain *dom_list = NULL;
2745         size_t num_domains = 0;
2746         bool retval = false;
2747         int i;
2748         bool old_status;
2749
2750         old_status = domain->online;
2751         trusts->count = 0;
2752         trusts->array = NULL;
2753
2754         cache = get_cache(domain);
2755         if (!cache || !cache->tdb) {
2756                 goto do_query;
2757         }
2758
2759         if (domain->online) {
2760                 goto do_query;
2761         }
2762
2763         retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2764         if (!retval || !num_domains || !dom_list) {
2765                 TALLOC_FREE(dom_list);
2766                 goto do_query;
2767         }
2768
2769 do_fetch_cache:
2770         trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
2771         if (!trusts->array) {
2772                 TALLOC_FREE(dom_list);
2773                 return NT_STATUS_NO_MEMORY;
2774         }
2775
2776         for (i = 0; i < num_domains; i++) {
2777                 struct netr_DomainTrust *trust;
2778                 struct dom_sid *sid;
2779                 struct winbindd_domain *dom;
2780
2781                 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2782                 if (dom && dom->internal) {
2783                         continue;
2784                 }
2785
2786                 trust = &trusts->array[trusts->count];
2787                 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2788                 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2789                 sid = talloc(trusts->array, struct dom_sid);
2790                 if (!trust->netbios_name || !trust->dns_name ||
2791                         !sid) {
2792                         TALLOC_FREE(dom_list);
2793                         TALLOC_FREE(trusts->array);
2794                         return NT_STATUS_NO_MEMORY;
2795                 }
2796
2797                 trust->trust_flags = dom_list[i].trust_flags;
2798                 trust->trust_attributes = dom_list[i].trust_attribs;
2799                 trust->trust_type = dom_list[i].trust_type;
2800                 sid_copy(sid, &dom_list[i].sid);
2801                 trust->sid = sid;
2802                 trusts->count++;
2803         }
2804
2805         TALLOC_FREE(dom_list);
2806         return NT_STATUS_OK;
2807
2808 do_query:
2809         /* Return status value returned by seq number check */
2810
2811         if (!NT_STATUS_IS_OK(domain->last_status))
2812                 return domain->last_status;
2813
2814         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2815                 domain->name ));
2816
2817         status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2818
2819         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2820                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2821                 if (!domain->internal && old_status) {
2822                         set_domain_offline(domain);
2823                 }
2824                 if (!domain->internal &&
2825                         !domain->online &&
2826                         old_status) {
2827                         retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2828                         if (retval && num_domains && dom_list) {
2829                                 TALLOC_FREE(trusts->array);
2830                                 trusts->count = 0;
2831                                 goto do_fetch_cache;
2832                         }
2833                 }
2834         }
2835         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2836          * so that the generic centry handling still applies correctly -
2837          * Guenther*/
2838
2839         if (!NT_STATUS_IS_ERR(status)) {
2840                 status = NT_STATUS_OK;
2841         }
2842         return status;
2843 }
2844
2845 /* get lockout policy */
2846 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2847                                TALLOC_CTX *mem_ctx,
2848                                struct samr_DomInfo12 *policy)
2849 {
2850         struct winbind_cache *cache = get_cache(domain);
2851         struct cache_entry *centry = NULL;
2852         NTSTATUS status;
2853         bool old_status;
2854
2855         old_status = domain->online;
2856         if (!cache->tdb)
2857                 goto do_query;
2858
2859         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2860
2861         if (!centry)
2862                 goto do_query;
2863
2864 do_fetch_cache:
2865         policy->lockout_duration = centry_nttime(centry);
2866         policy->lockout_window = centry_nttime(centry);
2867         policy->lockout_threshold = centry_uint16(centry);
2868
2869         status = centry->status;
2870
2871         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2872                 domain->name, nt_errstr(status) ));
2873
2874         centry_free(centry);
2875         return status;
2876
2877 do_query:
2878         ZERO_STRUCTP(policy);
2879
2880         /* Return status value returned by seq number check */
2881
2882         if (!NT_STATUS_IS_OK(domain->last_status))
2883                 return domain->last_status;
2884
2885         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2886                 domain->name ));
2887
2888         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2889
2890         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2891                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2892                 if (!domain->internal && old_status) {
2893                         set_domain_offline(domain);
2894                 }
2895                 if (cache->tdb &&
2896                         !domain->internal &&
2897                         !domain->online &&
2898                         old_status) {
2899                         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2900                         if (centry) {
2901                                 goto do_fetch_cache;
2902                         }
2903                 }
2904         }
2905         /* and save it */
2906         refresh_sequence_number(domain, false);
2907         if (!NT_STATUS_IS_OK(status)) {
2908                 return status;
2909         }
2910         wcache_save_lockout_policy(domain, status, policy);
2911
2912         return status;
2913 }
2914
2915 /* get password policy */
2916 static NTSTATUS password_policy(struct winbindd_domain *domain,
2917                                 TALLOC_CTX *mem_ctx,
2918                                 struct samr_DomInfo1 *policy)
2919 {
2920         struct winbind_cache *cache = get_cache(domain);
2921         struct cache_entry *centry = NULL;
2922         NTSTATUS status;
2923         bool old_status;
2924
2925         old_status = domain->online;
2926         if (!cache->tdb)
2927                 goto do_query;
2928
2929         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2930
2931         if (!centry)
2932                 goto do_query;
2933
2934 do_fetch_cache:
2935         policy->min_password_length = centry_uint16(centry);
2936         policy->password_history_length = centry_uint16(centry);
2937         policy->password_properties = centry_uint32(centry);
2938         policy->max_password_age = centry_nttime(centry);
2939         policy->min_password_age = centry_nttime(centry);
2940
2941         status = centry->status;
2942
2943         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2944                 domain->name, nt_errstr(status) ));
2945
2946         centry_free(centry);
2947         return status;
2948
2949 do_query:
2950         ZERO_STRUCTP(policy);
2951
2952         /* Return status value returned by seq number check */
2953
2954         if (!NT_STATUS_IS_OK(domain->last_status))
2955                 return domain->last_status;
2956
2957         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2958                 domain->name ));
2959
2960         status = domain->backend->password_policy(domain, mem_ctx, policy);
2961
2962         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2963                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2964                 if (!domain->internal && old_status) {
2965                         set_domain_offline(domain);
2966                 }
2967                 if (cache->tdb &&
2968                         !domain->internal &&
2969                         !domain->online &&
2970                         old_status) {
2971                         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2972                         if (centry) {
2973                                 goto do_fetch_cache;
2974                         }
2975                 }
2976         }
2977         /* and save it */
2978         refresh_sequence_number(domain, false);
2979         if (!NT_STATUS_IS_OK(status)) {
2980                 return status;
2981         }
2982         wcache_save_password_policy(domain, status, policy);
2983
2984         return status;
2985 }
2986
2987
2988 /* Invalidate cached user and group lists coherently */
2989
2990 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2991                        void *state)
2992 {
2993         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2994             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2995                 tdb_delete(the_tdb, kbuf);
2996
2997         return 0;
2998 }
2999
3000 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
3001
3002 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
3003                                 const struct dom_sid *sid)
3004 {
3005         fstring key_str, sid_string;
3006         struct winbind_cache *cache;
3007
3008         /* dont clear cached U/SID and UG/SID entries when we want to logon
3009          * offline - gd */
3010
3011         if (lp_winbind_offline_logon()) {
3012                 return;
3013         }
3014
3015         if (!domain)
3016                 return;
3017
3018         cache = get_cache(domain);
3019
3020         if (!cache->tdb) {
3021                 return;
3022         }
3023
3024         /* Clear U/SID cache entry */
3025         fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, sid));
3026         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3027         tdb_delete(cache->tdb, string_tdb_data(key_str));
3028
3029         /* Clear UG/SID cache entry */
3030         fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, sid));
3031         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3032         tdb_delete(cache->tdb, string_tdb_data(key_str));
3033
3034         /* Samba/winbindd never needs this. */
3035         netsamlogon_clear_cached_user(sid);
3036 }
3037
3038 bool wcache_invalidate_cache(void)
3039 {
3040         struct winbindd_domain *domain;
3041
3042         for (domain = domain_list(); domain; domain = domain->next) {
3043                 struct winbind_cache *cache = get_cache(domain);
3044
3045                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3046                            "entries for %s\n", domain->name));
3047                 if (cache) {
3048                         if (cache->tdb) {
3049                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
3050                         } else {
3051                                 return false;
3052                         }
3053                 }
3054         }
3055         return true;
3056 }
3057
3058 bool wcache_invalidate_cache_noinit(void)
3059 {
3060         struct winbindd_domain *domain;
3061
3062         for (domain = domain_list(); domain; domain = domain->next) {
3063                 struct winbind_cache *cache;
3064
3065                 /* Skip uninitialized domains. */
3066                 if (!domain->initialized && !domain->internal) {
3067                         continue;
3068                 }
3069
3070                 cache = get_cache(domain);
3071
3072                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3073                            "entries for %s\n", domain->name));
3074                 if (cache) {
3075                         if (cache->tdb) {
3076                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
3077                                 /*
3078                                  * Flushing cache has nothing to with domains.
3079                                  * return here if we successfully flushed once.
3080                                  * To avoid unnecessary traversing the cache.
3081                                  */
3082                                 return true;
3083                         } else {
3084                                 return false;
3085                         }
3086                 }
3087         }
3088         return true;
3089 }
3090
3091 bool init_wcache(void)
3092 {
3093         if (wcache == NULL) {
3094                 wcache = SMB_XMALLOC_P(struct winbind_cache);
3095                 ZERO_STRUCTP(wcache);
3096         }
3097
3098         if (wcache->tdb != NULL)
3099                 return true;
3100
3101         /* when working offline we must not clear the cache on restart */
3102         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3103                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3104                                 TDB_INCOMPATIBLE_HASH |
3105                                         (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3106                                 O_RDWR|O_CREAT, 0600);
3107
3108         if (wcache->tdb == NULL) {
3109                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3110                 return false;
3111         }
3112
3113         return true;
3114 }
3115
3116 /************************************************************************
3117  This is called by the parent to initialize the cache file.
3118  We don't need sophisticated locking here as we know we're the
3119  only opener.
3120 ************************************************************************/
3121
3122 bool initialize_winbindd_cache(void)
3123 {
3124         bool cache_bad = true;
3125         uint32 vers;
3126
3127         if (!init_wcache()) {
3128                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3129                 return false;
3130         }
3131
3132         /* Check version number. */
3133         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3134                         vers == WINBINDD_CACHE_VERSION) {
3135                 cache_bad = false;
3136         }
3137
3138         if (cache_bad) {
3139                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3140                         "and re-creating with version number %d\n",
3141                         WINBINDD_CACHE_VERSION ));
3142
3143                 tdb_close(wcache->tdb);
3144                 wcache->tdb = NULL;
3145
3146                 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
3147                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3148                                 cache_path("winbindd_cache.tdb"),
3149                                 strerror(errno) ));
3150                         return false;
3151                 }
3152                 if (!init_wcache()) {
3153                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
3154                                         "init_wcache failed.\n"));
3155                         return false;
3156                 }
3157
3158                 /* Write the version. */
3159                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3160                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3161                                 tdb_errorstr(wcache->tdb) ));
3162                         return false;
3163                 }
3164         }
3165
3166         tdb_close(wcache->tdb);
3167         wcache->tdb = NULL;
3168         return true;
3169 }
3170
3171 void close_winbindd_cache(void)
3172 {
3173         if (!wcache) {
3174                 return;
3175         }
3176         if (wcache->tdb) {
3177                 tdb_close(wcache->tdb);
3178                 wcache->tdb = NULL;
3179         }
3180 }
3181
3182 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
3183                        char **domain_name, char **name,
3184                        enum lsa_SidType *type)
3185 {
3186         struct winbindd_domain *domain;
3187         NTSTATUS status;
3188
3189         domain = find_lookup_domain_from_sid(sid);
3190         if (domain == NULL) {
3191                 return false;
3192         }
3193         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3194                                     type);
3195         return NT_STATUS_IS_OK(status);
3196 }
3197
3198 bool lookup_cached_name(const char *domain_name,
3199                         const char *name,
3200                         struct dom_sid *sid,
3201                         enum lsa_SidType *type)
3202 {
3203         struct winbindd_domain *domain;
3204         NTSTATUS status;
3205         bool original_online_state;
3206
3207         domain = find_lookup_domain_from_name(domain_name);
3208         if (domain == NULL) {
3209                 return false;
3210         }
3211
3212         /* If we are doing a cached logon, temporarily set the domain
3213            offline so the cache won't expire the entry */
3214
3215         original_online_state = domain->online;
3216         domain->online = false;
3217         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3218         domain->online = original_online_state;
3219
3220         return NT_STATUS_IS_OK(status);
3221 }
3222
3223 void cache_name2sid(struct winbindd_domain *domain,
3224                     const char *domain_name, const char *name,
3225                     enum lsa_SidType type, const struct dom_sid *sid)
3226 {
3227         refresh_sequence_number(domain, false);
3228         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3229                                 sid, type);
3230 }
3231
3232 /*
3233  * The original idea that this cache only contains centries has
3234  * been blurred - now other stuff gets put in here. Ensure we
3235  * ignore these things on cleanup.
3236  */
3237
3238 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3239                                TDB_DATA dbuf, void *state)
3240 {
3241         struct cache_entry *centry;
3242
3243         if (is_non_centry_key(kbuf)) {
3244                 return 0;
3245         }
3246
3247         centry = wcache_fetch_raw((char *)kbuf.dptr);
3248         if (!centry) {
3249                 return 0;
3250         }
3251
3252         if (!NT_STATUS_IS_OK(centry->status)) {
3253                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3254                 tdb_delete(the_tdb, kbuf);
3255         }
3256
3257         centry_free(centry);
3258         return 0;
3259 }
3260
3261 /* flush the cache */
3262 void wcache_flush_cache(void)
3263 {
3264         if (!wcache)
3265                 return;
3266         if (wcache->tdb) {
3267                 tdb_close(wcache->tdb);
3268                 wcache->tdb = NULL;
3269         }
3270         if (!winbindd_use_cache()) {
3271                 return;
3272         }
3273
3274         /* when working offline we must not clear the cache on restart */
3275         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3276                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3277                                 TDB_INCOMPATIBLE_HASH |
3278                                 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3279                                 O_RDWR|O_CREAT, 0600);
3280
3281         if (!wcache->tdb) {
3282                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3283                 return;
3284         }
3285
3286         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3287
3288         DEBUG(10,("wcache_flush_cache success\n"));
3289 }
3290
3291 /* Count cached creds */
3292
3293 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3294                                     void *state)
3295 {
3296         int *cred_count = (int*)state;
3297
3298         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3299                 (*cred_count)++;
3300         }
3301         return 0;
3302 }
3303
3304 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3305 {
3306         struct winbind_cache *cache = get_cache(domain);
3307
3308         *count = 0;
3309
3310         if (!cache->tdb) {
3311                 return NT_STATUS_INTERNAL_DB_ERROR;
3312         }
3313
3314         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3315
3316         return NT_STATUS_OK;
3317 }
3318
3319 struct cred_list {
3320         struct cred_list *prev, *next;
3321         TDB_DATA key;
3322         fstring name;
3323         time_t created;
3324 };
3325 static struct cred_list *wcache_cred_list;
3326
3327 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3328                                     void *state)
3329 {
3330         struct cred_list *cred;
3331
3332         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3333
3334                 cred = SMB_MALLOC_P(struct cred_list);
3335                 if (cred == NULL) {
3336                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3337                         return -1;
3338                 }
3339
3340                 ZERO_STRUCTP(cred);
3341
3342                 /* save a copy of the key */
3343
3344                 fstrcpy(cred->name, (const char *)kbuf.dptr);
3345                 DLIST_ADD(wcache_cred_list, cred);
3346         }
3347
3348         return 0;
3349 }
3350
3351 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const struct dom_sid *sid)
3352 {
3353         struct winbind_cache *cache = get_cache(domain);
3354         NTSTATUS status;
3355         int ret;
3356         struct cred_list *cred, *oldest = NULL;
3357
3358         if (!cache->tdb) {
3359                 return NT_STATUS_INTERNAL_DB_ERROR;
3360         }
3361
3362         /* we possibly already have an entry */
3363         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3364
3365                 fstring key_str, tmp;
3366
3367                 DEBUG(11,("we already have an entry, deleting that\n"));
3368
3369                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3370
3371                 tdb_delete(cache->tdb, string_tdb_data(key_str));
3372
3373                 return NT_STATUS_OK;
3374         }
3375
3376         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3377         if (ret == 0) {
3378                 return NT_STATUS_OK;
3379         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3380                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3381         }
3382
3383         ZERO_STRUCTP(oldest);
3384
3385         for (cred = wcache_cred_list; cred; cred = cred->next) {
3386
3387                 TDB_DATA data;
3388                 time_t t;
3389
3390                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3391                 if (!data.dptr) {
3392                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3393                                 cred->name));
3394                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3395                         goto done;
3396                 }
3397
3398                 t = IVAL(data.dptr, 0);
3399                 SAFE_FREE(data.dptr);
3400
3401                 if (!oldest) {
3402                         oldest = SMB_MALLOC_P(struct cred_list);
3403                         if (oldest == NULL) {
3404                                 status = NT_STATUS_NO_MEMORY;
3405                                 goto done;
3406                         }
3407
3408                         fstrcpy(oldest->name, cred->name);
3409                         oldest->created = t;
3410                         continue;
3411                 }
3412
3413                 if (t < oldest->created) {
3414                         fstrcpy(oldest->name, cred->name);
3415                         oldest->created = t;
3416                 }
3417         }
3418
3419         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3420                 status = NT_STATUS_OK;
3421         } else {
3422                 status = NT_STATUS_UNSUCCESSFUL;
3423         }
3424 done:
3425         SAFE_FREE(wcache_cred_list);
3426         SAFE_FREE(oldest);
3427
3428         return status;
3429 }
3430
3431 /* Change the global online/offline state. */
3432 bool set_global_winbindd_state_offline(void)
3433 {
3434         TDB_DATA data;
3435
3436         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3437
3438         /* Only go offline if someone has created
3439            the key "WINBINDD_OFFLINE" in the cache tdb. */
3440
3441         if (wcache == NULL || wcache->tdb == NULL) {
3442                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3443                 return false;
3444         }
3445
3446         if (!lp_winbind_offline_logon()) {
3447                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3448                 return false;
3449         }
3450
3451         if (global_winbindd_offline_state) {
3452                 /* Already offline. */
3453                 return true;
3454         }
3455
3456         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3457
3458         if (!data.dptr || data.dsize != 4) {
3459                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3460                 SAFE_FREE(data.dptr);
3461                 return false;
3462         } else {
3463                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3464                 global_winbindd_offline_state = true;
3465                 SAFE_FREE(data.dptr);
3466                 return true;
3467         }
3468 }
3469
3470 void set_global_winbindd_state_online(void)
3471 {
3472         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3473
3474         if (!lp_winbind_offline_logon()) {
3475                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3476                 return;
3477         }
3478
3479         if (!global_winbindd_offline_state) {
3480                 /* Already online. */
3481                 return;
3482         }
3483         global_winbindd_offline_state = false;
3484
3485         if (!wcache->tdb) {
3486                 return;
3487         }
3488
3489         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3490         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3491 }
3492
3493 bool get_global_winbindd_state_offline(void)
3494 {
3495         return global_winbindd_offline_state;
3496 }
3497
3498 /***********************************************************************
3499  Validate functions for all possible cache tdb keys.
3500 ***********************************************************************/
3501
3502 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3503                                                   struct tdb_validation_status *state)
3504 {
3505         struct cache_entry *centry;
3506
3507         centry = SMB_XMALLOC_P(struct cache_entry);
3508         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3509         if (!centry->data) {
3510                 SAFE_FREE(centry);
3511                 return NULL;
3512         }
3513         centry->len = data.dsize;
3514         centry->ofs = 0;
3515
3516         if (centry->len < 16) {
3517                 /* huh? corrupt cache? */
3518                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s "
3519                          "(len < 16) ?\n", kstr));
3520                 centry_free(centry);
3521                 state->bad_entry = true;
3522                 state->success = false;
3523                 return NULL;
3524         }
3525
3526         centry->status = NT_STATUS(centry_uint32(centry));
3527         centry->sequence_number = centry_uint32(centry);
3528         centry->timeout = centry_uint64_t(centry);
3529         return centry;
3530 }
3531
3532 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3533                            struct tdb_validation_status *state)
3534 {
3535         if (dbuf.dsize != 8) {
3536                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3537                                 keystr, (unsigned int)dbuf.dsize ));
3538                 state->bad_entry = true;
3539                 return 1;
3540         }
3541         return 0;
3542 }
3543
3544 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3545                        struct tdb_validation_status *state)
3546 {
3547         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3548         if (!centry) {
3549                 return 1;
3550         }
3551
3552         (void)centry_uint32(centry);
3553         if (NT_STATUS_IS_OK(centry->status)) {
3554                 struct dom_sid sid;
3555                 (void)centry_sid(centry, &sid);
3556         }
3557
3558         centry_free(centry);
3559
3560         if (!(state->success)) {
3561                 return 1;
3562         }
3563         DEBUG(10,("validate_ns: %s ok\n", keystr));
3564         return 0;
3565 }
3566
3567 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3568                        struct tdb_validation_status *state)
3569 {
3570         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3571         if (!centry) {
3572                 return 1;
3573         }
3574
3575         if (NT_STATUS_IS_OK(centry->status)) {
3576                 (void)centry_uint32(centry);
3577                 (void)centry_string(centry, mem_ctx);
3578                 (void)centry_string(centry, mem_ctx);
3579         }
3580
3581         centry_free(centry);
3582
3583         if (!(state->success)) {
3584                 return 1;
3585         }
3586         DEBUG(10,("validate_sn: %s ok\n", keystr));
3587         return 0;
3588 }
3589
3590 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3591                       struct tdb_validation_status *state)
3592 {
3593         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3594         struct dom_sid sid;
3595
3596         if (!centry) {
3597                 return 1;
3598         }
3599
3600         (void)centry_string(centry, mem_ctx);
3601         (void)centry_string(centry, mem_ctx);
3602         (void)centry_string(centry, mem_ctx);
3603         (void)centry_string(centry, mem_ctx);
3604         (void)centry_uint32(centry);
3605         (void)centry_sid(centry, &sid);
3606         (void)centry_sid(centry, &sid);
3607
3608         centry_free(centry);
3609
3610         if (!(state->success)) {
3611                 return 1;
3612         }
3613         DEBUG(10,("validate_u: %s ok\n", keystr));
3614         return 0;
3615 }
3616
3617 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3618                             struct tdb_validation_status *state)
3619 {
3620         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3621
3622         if (!centry) {
3623                 return 1;
3624         }
3625
3626         (void)centry_nttime(centry);
3627         (void)centry_nttime(centry);
3628         (void)centry_uint16(centry);
3629
3630         centry_free(centry);
3631
3632         if (!(state->success)) {
3633                 return 1;
3634         }
3635         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3636         return 0;
3637 }
3638
3639 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3640                             struct tdb_validation_status *state)
3641 {
3642         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3643
3644         if (!centry) {
3645                 return 1;
3646         }
3647
3648         (void)centry_uint16(centry);
3649         (void)centry_uint16(centry);
3650         (void)centry_uint32(centry);
3651         (void)centry_nttime(centry);
3652         (void)centry_nttime(centry);
3653
3654         centry_free(centry);
3655
3656         if (!(state->success)) {
3657                 return 1;
3658         }
3659         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3660         return 0;
3661 }
3662
3663 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3664                          struct tdb_validation_status *state)
3665 {
3666         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3667
3668         if (!centry) {
3669                 return 1;
3670         }
3671
3672         (void)centry_time(centry);
3673         (void)centry_hash16(centry, mem_ctx);
3674
3675         /* We only have 17 bytes more data in the salted cred case. */
3676         if (centry->len - centry->ofs == 17) {
3677                 (void)centry_hash16(centry, mem_ctx);
3678         }
3679
3680         centry_free(centry);
3681
3682         if (!(state->success)) {
3683                 return 1;
3684         }
3685         DEBUG(10,("validate_cred: %s ok\n", keystr));
3686         return 0;
3687 }
3688
3689 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3690                        struct tdb_validation_status *state)
3691 {
3692         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3693         int32 num_entries, i;
3694
3695         if (!centry) {
3696                 return 1;
3697         }
3698
3699         num_entries = (int32)centry_uint32(centry);
3700
3701         for (i=0; i< num_entries; i++) {
3702                 struct dom_sid sid;
3703                 (void)centry_string(centry, mem_ctx);
3704                 (void)centry_string(centry, mem_ctx);
3705                 (void)centry_string(centry, mem_ctx);
3706                 (void)centry_string(centry, mem_ctx);
3707                 (void)centry_sid(centry, &sid);
3708                 (void)centry_sid(centry, &sid);
3709         }
3710
3711         centry_free(centry);
3712
3713         if (!(state->success)) {
3714                 return 1;
3715         }
3716         DEBUG(10,("validate_ul: %s ok\n", keystr));
3717         return 0;
3718 }
3719
3720 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3721                        struct tdb_validation_status *state)
3722 {
3723         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3724         int32 num_entries, i;
3725
3726         if (!centry) {
3727                 return 1;
3728         }
3729
3730         num_entries = centry_uint32(centry);
3731
3732         for (i=0; i< num_entries; i++) {
3733                 (void)centry_string(centry, mem_ctx);
3734                 (void)centry_string(centry, mem_ctx);
3735                 (void)centry_uint32(centry);
3736         }
3737
3738         centry_free(centry);
3739
3740         if (!(state->success)) {
3741                 return 1;
3742         }
3743         DEBUG(10,("validate_gl: %s ok\n", keystr));
3744         return 0;
3745 }
3746
3747 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3748                        struct tdb_validation_status *state)
3749 {
3750         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3751         int32 num_groups, i;
3752
3753         if (!centry) {
3754                 return 1;
3755         }
3756
3757         num_groups = centry_uint32(centry);
3758
3759         for (i=0; i< num_groups; i++) {
3760                 struct dom_sid sid;
3761                 centry_sid(centry, &sid);
3762         }
3763
3764         centry_free(centry);
3765
3766         if (!(state->success)) {
3767                 return 1;
3768         }
3769         DEBUG(10,("validate_ug: %s ok\n", keystr));
3770         return 0;
3771 }
3772
3773 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3774                        struct tdb_validation_status *state)
3775 {
3776         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3777         int32 num_aliases, i;
3778
3779         if (!centry) {
3780                 return 1;
3781         }
3782
3783         num_aliases = centry_uint32(centry);
3784
3785         for (i=0; i < num_aliases; i++) {
3786                 (void)centry_uint32(centry);
3787         }
3788
3789         centry_free(centry);
3790
3791         if (!(state->success)) {
3792                 return 1;
3793         }
3794         DEBUG(10,("validate_ua: %s ok\n", keystr));
3795         return 0;
3796 }
3797
3798 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3799                        struct tdb_validation_status *state)
3800 {
3801         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3802         int32 num_names, i;
3803
3804         if (!centry) {
3805                 return 1;
3806         }
3807
3808         num_names = centry_uint32(centry);
3809
3810         for (i=0; i< num_names; i++) {
3811                 struct dom_sid sid;
3812                 centry_sid(centry, &sid);
3813                 (void)centry_string(centry, mem_ctx);
3814                 (void)centry_uint32(centry);
3815         }
3816
3817         centry_free(centry);
3818
3819         if (!(state->success)) {
3820                 return 1;
3821         }
3822         DEBUG(10,("validate_gm: %s ok\n", keystr));
3823         return 0;
3824 }
3825
3826 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3827                        struct tdb_validation_status *state)
3828 {
3829         /* Can't say anything about this other than must be nonzero. */
3830         if (dbuf.dsize == 0) {
3831                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3832                                 keystr));
3833                 state->bad_entry = true;
3834                 state->success = false;
3835                 return 1;
3836         }
3837
3838         DEBUG(10,("validate_dr: %s ok\n", keystr));
3839         return 0;
3840 }
3841
3842 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3843                        struct tdb_validation_status *state)
3844 {
3845         /* Can't say anything about this other than must be nonzero. */
3846         if (dbuf.dsize == 0) {
3847                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3848                                 keystr));
3849                 state->bad_entry = true;
3850                 state->success = false;
3851                 return 1;
3852         }
3853
3854         DEBUG(10,("validate_de: %s ok\n", keystr));
3855         return 0;
3856 }
3857
3858 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3859                            TDB_DATA dbuf, struct tdb_validation_status *state)
3860 {
3861         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3862
3863         if (!centry) {
3864                 return 1;
3865         }
3866
3867         (void)centry_string(centry, mem_ctx);
3868         (void)centry_string(centry, mem_ctx);
3869         (void)centry_string(centry, mem_ctx);
3870         (void)centry_uint32(centry);
3871
3872         centry_free(centry);
3873
3874         if (!(state->success)) {
3875                 return 1;
3876         }
3877         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3878         return 0;
3879 }
3880
3881 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3882                            TDB_DATA dbuf,
3883                            struct tdb_validation_status *state)
3884 {
3885         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3886
3887         if (!centry) {
3888                 return 1;
3889         }
3890
3891         (void)centry_string( centry, mem_ctx );
3892
3893         centry_free(centry);
3894
3895         if (!(state->success)) {
3896                 return 1;
3897         }
3898         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3899         return 0;
3900 }
3901
3902 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3903                            TDB_DATA dbuf,
3904                            struct tdb_validation_status *state)
3905 {
3906         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3907
3908         if (!centry) {
3909                 return 1;
3910         }
3911
3912         (void)centry_string( centry, mem_ctx );
3913
3914         centry_free(centry);
3915
3916         if (!(state->success)) {
3917                 return 1;
3918         }
3919         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3920         return 0;
3921 }
3922
3923 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3924                                   TDB_DATA dbuf,
3925                                   struct tdb_validation_status *state)
3926 {
3927         if (dbuf.dsize == 0) {
3928                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3929                           "key %s (len ==0) ?\n", keystr));
3930                 state->bad_entry = true;
3931                 state->success = false;
3932                 return 1;
3933         }
3934
3935         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3936         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3937         return 0;
3938 }
3939
3940 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3941                             struct tdb_validation_status *state)
3942 {
3943         if (dbuf.dsize != 4) {
3944                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3945                                 keystr, (unsigned int)dbuf.dsize ));
3946                 state->bad_entry = true;
3947                 state->success = false;
3948                 return 1;
3949         }
3950         DEBUG(10,("validate_offline: %s ok\n", keystr));
3951         return 0;
3952 }
3953
3954 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3955                         struct tdb_validation_status *state)
3956 {
3957         /*
3958          * Ignore validation for now. The proper way to do this is with a
3959          * checksum. Just pure parsing does not really catch much.
3960          */
3961         return 0;
3962 }
3963
3964 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3965                                   struct tdb_validation_status *state)
3966 {
3967         if (dbuf.dsize != 4) {
3968                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3969                           "key %s (len %u != 4) ?\n",
3970                           keystr, (unsigned int)dbuf.dsize));
3971                 state->bad_entry = true;
3972                 state->success = false;
3973                 return 1;
3974         }
3975
3976         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3977         return 0;
3978 }
3979
3980 /***********************************************************************
3981  A list of all possible cache tdb keys with associated validation
3982  functions.
3983 ***********************************************************************/
3984
3985 struct key_val_struct {
3986         const char *keyname;
3987         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3988 } key_val[] = {
3989         {"SEQNUM/", validate_seqnum},
3990         {"NS/", validate_ns},
3991         {"SN/", validate_sn},
3992         {"U/", validate_u},
3993         {"LOC_POL/", validate_loc_pol},
3994         {"PWD_POL/", validate_pwd_pol},
3995         {"CRED/", validate_cred},
3996         {"UL/", validate_ul},
3997         {"GL/", validate_gl},
3998         {"UG/", validate_ug},
3999         {"UA", validate_ua},
4000         {"GM/", validate_gm},
4001         {"DR/", validate_dr},
4002         {"DE/", validate_de},
4003         {"NSS/PWINFO/", validate_pwinfo},
4004         {"TRUSTDOMCACHE/", validate_trustdomcache},
4005         {"NSS/NA/", validate_nss_na},
4006         {"NSS/AN/", validate_nss_an},
4007         {"WINBINDD_OFFLINE", validate_offline},
4008         {"NDR/", validate_ndr},
4009         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
4010         {NULL, NULL}
4011 };
4012
4013 /***********************************************************************
4014  Function to look at every entry in the tdb and validate it as far as
4015  possible.
4016 ***********************************************************************/
4017
4018 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
4019 {
4020         int i;
4021         unsigned int max_key_len = 1024;
4022         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
4023
4024         /* Paranoia check. */
4025         if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
4026                 max_key_len = 1024 * 1024;
4027         }
4028         if (kbuf.dsize > max_key_len) {
4029                 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
4030                           "(%u) > (%u)\n\n",
4031                           (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
4032                 return 1;
4033         }
4034
4035         for (i = 0; key_val[i].keyname; i++) {
4036                 size_t namelen = strlen(key_val[i].keyname);
4037                 if (kbuf.dsize >= namelen && (
4038                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
4039                         TALLOC_CTX *mem_ctx;
4040                         char *keystr;
4041                         int ret;
4042
4043                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
4044                         if (!keystr) {
4045                                 return 1;
4046                         }
4047                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
4048                         keystr[kbuf.dsize] = '\0';
4049
4050                         mem_ctx = talloc_init("validate_ctx");
4051                         if (!mem_ctx) {
4052                                 SAFE_FREE(keystr);
4053                                 return 1;
4054                         }
4055
4056                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
4057                                                           v_state);
4058
4059                         SAFE_FREE(keystr);
4060                         talloc_destroy(mem_ctx);
4061                         return ret;
4062                 }
4063         }
4064
4065         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
4066         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
4067         DEBUG(0,("data :\n"));
4068         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4069         v_state->unknown_key = true;
4070         v_state->success = false;
4071         return 1; /* terminate. */
4072 }
4073
4074 static void validate_panic(const char *const why)
4075 {
4076         DEBUG(0,("validating cache: would panic %s\n", why ));
4077         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4078         exit(47);
4079 }
4080
4081 /***********************************************************************
4082  Try and validate every entry in the winbindd cache. If we fail here,
4083  delete the cache tdb and return non-zero.
4084 ***********************************************************************/
4085
4086 int winbindd_validate_cache(void)
4087 {
4088         int ret = -1;
4089         const char *tdb_path = cache_path("winbindd_cache.tdb");
4090         TDB_CONTEXT *tdb = NULL;
4091
4092         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4093         smb_panic_fn = validate_panic;
4094
4095
4096         tdb = tdb_open_log(tdb_path,
4097                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4098                            TDB_INCOMPATIBLE_HASH |
4099                            ( lp_winbind_offline_logon()
4100                              ? TDB_DEFAULT
4101                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4102                            O_RDWR|O_CREAT,
4103                            0600);
4104         if (!tdb) {
4105                 DEBUG(0, ("winbindd_validate_cache: "
4106                           "error opening/initializing tdb\n"));
4107                 goto done;
4108         }
4109         tdb_close(tdb);
4110
4111         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4112
4113         if (ret != 0) {
4114                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4115                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4116                 unlink(tdb_path);
4117         }
4118
4119 done:
4120         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4121         smb_panic_fn = smb_panic;
4122         return ret;
4123 }
4124
4125 /***********************************************************************
4126  Try and validate every entry in the winbindd cache.
4127 ***********************************************************************/
4128
4129 int winbindd_validate_cache_nobackup(void)
4130 {
4131         int ret = -1;
4132         const char *tdb_path = cache_path("winbindd_cache.tdb");
4133
4134         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4135         smb_panic_fn = validate_panic;
4136
4137
4138         if (wcache == NULL || wcache->tdb == NULL) {
4139                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4140         } else {
4141                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4142         }
4143
4144         if (ret != 0) {
4145                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4146                            "successful.\n"));
4147         }
4148
4149         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4150                    "function\n"));
4151         smb_panic_fn = smb_panic;
4152         return ret;
4153 }
4154
4155 bool winbindd_cache_validate_and_initialize(void)
4156 {
4157         close_winbindd_cache();
4158
4159         if (lp_winbind_offline_logon()) {
4160                 if (winbindd_validate_cache() < 0) {
4161                         DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4162                                   "could be restored.\n"));
4163                 }
4164         }
4165
4166         return initialize_winbindd_cache();
4167 }
4168
4169 /*********************************************************************
4170  ********************************************************************/
4171
4172 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4173                                        struct winbindd_tdc_domain **domains,
4174                                        size_t *num_domains )
4175 {
4176         struct winbindd_tdc_domain *list = NULL;
4177         size_t idx;
4178         int i;
4179         bool set_only = false;
4180
4181         /* don't allow duplicates */
4182
4183         idx = *num_domains;
4184         list = *domains;
4185
4186         for ( i=0; i< (*num_domains); i++ ) {
4187                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4188                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4189                                   new_dom->name));
4190                         idx = i;
4191                         set_only = true;
4192
4193                         break;
4194                 }
4195         }
4196
4197         if ( !set_only ) {
4198                 if ( !*domains ) {
4199                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
4200                         idx = 0;
4201                 } else {
4202                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
4203                                                      struct winbindd_tdc_domain,
4204                                                      (*num_domains)+1);
4205                         idx = *num_domains;
4206                 }
4207
4208                 ZERO_STRUCT( list[idx] );
4209         }
4210
4211         if ( !list )
4212                 return false;
4213
4214         list[idx].domain_name = talloc_strdup( list, new_dom->name );
4215         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4216
4217         if ( !is_null_sid( &new_dom->sid ) ) {
4218                 sid_copy( &list[idx].sid, &new_dom->sid );
4219         } else {
4220                 sid_copy(&list[idx].sid, &global_sid_NULL);
4221         }
4222
4223         if ( new_dom->domain_flags != 0x0 )
4224                 list[idx].trust_flags = new_dom->domain_flags;
4225
4226         if ( new_dom->domain_type != 0x0 )
4227                 list[idx].trust_type = new_dom->domain_type;
4228
4229         if ( new_dom->domain_trust_attribs != 0x0 )
4230                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4231
4232         if ( !set_only ) {
4233                 *domains = list;
4234                 *num_domains = idx + 1;
4235         }
4236
4237         return true;
4238 }
4239
4240 /*********************************************************************
4241  ********************************************************************/
4242
4243 static TDB_DATA make_tdc_key( const char *domain_name )
4244 {
4245         char *keystr = NULL;
4246         TDB_DATA key = { NULL, 0 };
4247
4248         if ( !domain_name ) {
4249                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4250                 return key;
4251         }
4252
4253         if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4254                 return key;
4255         }
4256         key = string_term_tdb_data(keystr);
4257
4258         return key;
4259 }
4260
4261 /*********************************************************************
4262  ********************************************************************/
4263
4264 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4265                              size_t num_domains,
4266                              unsigned char **buf )
4267 {
4268         unsigned char *buffer = NULL;
4269         int len = 0;
4270         int buflen = 0;
4271         int i = 0;
4272
4273         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4274                   (int)num_domains));
4275
4276         buflen = 0;
4277
4278  again:
4279         len = 0;
4280
4281         /* Store the number of array items first */
4282         len += tdb_pack( buffer+len, buflen-len, "d",
4283                          num_domains );
4284
4285         /* now pack each domain trust record */
4286         for ( i=0; i<num_domains; i++ ) {
4287
4288                 fstring tmp;
4289
4290                 if ( buflen > 0 ) {
4291                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4292                                   domains[i].domain_name,
4293                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4294                 }
4295
4296                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4297                                  domains[i].domain_name,
4298                                  domains[i].dns_name,
4299                                  sid_to_fstring(tmp, &domains[i].sid),
4300                                  domains[i].trust_flags,
4301                                  domains[i].trust_attribs,
4302                                  domains[i].trust_type );
4303         }
4304
4305         if ( buflen < len ) {
4306                 SAFE_FREE(buffer);
4307                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4308                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4309                         buflen = -1;
4310                         goto done;
4311                 }
4312                 buflen = len;
4313                 goto again;
4314         }
4315
4316         *buf = buffer;
4317
4318  done:
4319         return buflen;
4320 }
4321
4322 /*********************************************************************
4323  ********************************************************************/
4324
4325 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4326                                   struct winbindd_tdc_domain **domains )
4327 {
4328         fstring domain_name, dns_name, sid_string;
4329         uint32 type, attribs, flags;
4330         int num_domains;
4331         int len = 0;
4332         int i;
4333         struct winbindd_tdc_domain *list = NULL;
4334
4335         /* get the number of domains */
4336         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4337         if ( len == -1 ) {
4338                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4339                 return 0;
4340         }
4341
4342         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4343         if ( !list ) {
4344                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4345                 return 0;
4346         }
4347
4348         for ( i=0; i<num_domains; i++ ) {
4349                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4350                                    domain_name,
4351                                    dns_name,
4352                                    sid_string,
4353                                    &flags,
4354                                    &attribs,
4355                                    &type );
4356
4357                 if ( len == -1 ) {
4358                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4359                         TALLOC_FREE( list );
4360                         return 0;
4361                 }
4362
4363                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4364                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4365                           domain_name, dns_name, sid_string,
4366                           flags, attribs, type));
4367
4368                 list[i].domain_name = talloc_strdup( list, domain_name );
4369                 list[i].dns_name = talloc_strdup( list, dns_name );
4370                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4371                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4372                                   domain_name));
4373                 }
4374                 list[i].trust_flags = flags;
4375                 list[i].trust_attribs = attribs;
4376                 list[i].trust_type = type;
4377         }
4378
4379         *domains = list;
4380
4381         return num_domains;
4382 }
4383
4384 /*********************************************************************
4385  ********************************************************************/
4386
4387 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4388 {
4389         TDB_DATA key = make_tdc_key( lp_workgroup() );
4390         TDB_DATA data = { NULL, 0 };
4391         int ret;
4392
4393         if ( !key.dptr )
4394                 return false;
4395
4396         /* See if we were asked to delete the cache entry */
4397
4398         if ( !domains ) {
4399                 ret = tdb_delete( wcache->tdb, key );
4400                 goto done;
4401         }
4402
4403         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4404
4405         if ( !data.dptr ) {
4406                 ret = -1;
4407                 goto done;
4408         }
4409
4410         ret = tdb_store( wcache->tdb, key, data, 0 );
4411
4412  done:
4413         SAFE_FREE( data.dptr );
4414         SAFE_FREE( key.dptr );
4415
4416         return ( ret != -1 );
4417 }
4418
4419 /*********************************************************************
4420  ********************************************************************/
4421
4422 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4423 {
4424         TDB_DATA key = make_tdc_key( lp_workgroup() );
4425         TDB_DATA data = { NULL, 0 };
4426
4427         *domains = NULL;
4428         *num_domains = 0;
4429
4430         if ( !key.dptr )
4431                 return false;
4432
4433         data = tdb_fetch( wcache->tdb, key );
4434
4435         SAFE_FREE( key.dptr );
4436
4437         if ( !data.dptr )
4438                 return false;
4439
4440         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4441
4442         SAFE_FREE( data.dptr );
4443
4444         if ( !*domains )
4445                 return false;
4446
4447         return true;
4448 }
4449
4450 /*********************************************************************
4451  ********************************************************************/
4452
4453 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4454 {
4455         struct winbindd_tdc_domain *dom_list = NULL;
4456         size_t num_domains = 0;
4457         bool ret = false;
4458
4459         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4460                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4461                   domain->name, domain->alt_name,
4462                   sid_string_dbg(&domain->sid),
4463                   domain->domain_flags,
4464                   domain->domain_trust_attribs,
4465                   domain->domain_type));
4466
4467         if ( !init_wcache() ) {
4468                 return false;
4469         }
4470
4471         /* fetch the list */
4472
4473         wcache_tdc_fetch_list( &dom_list, &num_domains );
4474
4475         /* add the new domain */
4476
4477         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4478                 goto done;
4479         }
4480
4481         /* pack the domain */
4482
4483         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4484                 goto done;
4485         }
4486
4487         /* Success */
4488
4489         ret = true;
4490  done:
4491         TALLOC_FREE( dom_list );
4492
4493         return ret;
4494 }
4495
4496 /*********************************************************************
4497  ********************************************************************/
4498
4499 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4500 {
4501         struct winbindd_tdc_domain *dom_list = NULL;
4502         size_t num_domains = 0;
4503         int i;
4504         struct winbindd_tdc_domain *d = NULL;
4505
4506         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4507
4508         if ( !init_wcache() ) {
4509                 return false;
4510         }
4511
4512         /* fetch the list */
4513
4514         wcache_tdc_fetch_list( &dom_list, &num_domains );
4515
4516         for ( i=0; i<num_domains; i++ ) {
4517                 if ( strequal(name, dom_list[i].domain_name) ||
4518                      strequal(name, dom_list[i].dns_name) )
4519                 {
4520                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4521                                   name));
4522
4523                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4524                         if ( !d )
4525                                 break;
4526
4527                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4528                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4529                         sid_copy( &d->sid, &dom_list[i].sid );
4530                         d->trust_flags   = dom_list[i].trust_flags;
4531                         d->trust_type    = dom_list[i].trust_type;
4532                         d->trust_attribs = dom_list[i].trust_attribs;
4533
4534                         break;
4535                 }
4536         }
4537
4538         TALLOC_FREE( dom_list );
4539
4540         return d;
4541 }
4542
4543 /*********************************************************************
4544  ********************************************************************/
4545
4546 struct winbindd_tdc_domain*
4547         wcache_tdc_fetch_domainbysid(TALLOC_CTX *ctx,
4548                                      const struct dom_sid *sid)
4549 {
4550         struct winbindd_tdc_domain *dom_list = NULL;
4551         size_t num_domains = 0;
4552         int i;
4553         struct winbindd_tdc_domain *d = NULL;
4554
4555         DEBUG(10,("wcache_tdc_fetch_domainbysid: Searching for domain %s\n",
4556                   sid_string_dbg(sid)));
4557
4558         if (!init_wcache()) {
4559                 return false;
4560         }
4561
4562         /* fetch the list */
4563
4564         wcache_tdc_fetch_list(&dom_list, &num_domains);
4565
4566         for (i = 0; i<num_domains; i++) {
4567                 if (sid_equal(sid, &(dom_list[i].sid))) {
4568                         DEBUG(10, ("wcache_tdc_fetch_domainbysid: "
4569                                    "Found domain %s for SID %s\n",
4570                                    dom_list[i].domain_name,
4571                                    sid_string_dbg(sid)));
4572
4573                         d = TALLOC_P(ctx, struct winbindd_tdc_domain);
4574                         if (!d)
4575                                 break;
4576
4577                         d->domain_name = talloc_strdup(d,
4578                                                        dom_list[i].domain_name);
4579
4580                         d->dns_name = talloc_strdup(d, dom_list[i].dns_name);
4581                         sid_copy(&d->sid, &dom_list[i].sid);
4582                         d->trust_flags = dom_list[i].trust_flags;
4583                         d->trust_type = dom_list[i].trust_type;
4584                         d->trust_attribs = dom_list[i].trust_attribs;
4585
4586                         break;
4587                 }
4588         }
4589
4590         TALLOC_FREE(dom_list);
4591
4592         return d;
4593 }
4594
4595
4596 /*********************************************************************
4597  ********************************************************************/
4598
4599 void wcache_tdc_clear( void )
4600 {
4601         if ( !init_wcache() )
4602                 return;
4603
4604         wcache_tdc_store_list( NULL, 0 );
4605
4606         return;
4607 }
4608
4609
4610 /*********************************************************************
4611  ********************************************************************/
4612
4613 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4614                                     NTSTATUS status,
4615                                     const struct dom_sid *user_sid,
4616                                     const char *homedir,
4617                                     const char *shell,
4618                                     const char *gecos,
4619                                     uint32 gid)
4620 {
4621         struct cache_entry *centry;
4622         fstring tmp;
4623
4624         if ( (centry = centry_start(domain, status)) == NULL )
4625                 return;
4626
4627         centry_put_string( centry, homedir );
4628         centry_put_string( centry, shell );
4629         centry_put_string( centry, gecos );
4630         centry_put_uint32( centry, gid );
4631
4632         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4633
4634         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4635
4636         centry_free(centry);
4637 }
4638
4639 #ifdef HAVE_ADS
4640
4641 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4642                               const struct dom_sid *user_sid,
4643                               TALLOC_CTX *ctx,
4644                               ADS_STRUCT *ads, LDAPMessage *msg,
4645                               const char **homedir, const char **shell,
4646                               const char **gecos, gid_t *p_gid)
4647 {
4648         struct winbind_cache *cache = get_cache(domain);
4649         struct cache_entry *centry = NULL;
4650         NTSTATUS nt_status;
4651         fstring tmp;
4652
4653         if (!cache->tdb)
4654                 goto do_query;
4655
4656         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4657                               sid_to_fstring(tmp, user_sid));
4658
4659         if (!centry)
4660                 goto do_query;
4661
4662         *homedir = centry_string( centry, ctx );
4663         *shell   = centry_string( centry, ctx );
4664         *gecos   = centry_string( centry, ctx );
4665         *p_gid   = centry_uint32( centry );
4666
4667         centry_free(centry);
4668
4669         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4670                   sid_string_dbg(user_sid)));
4671
4672         return NT_STATUS_OK;
4673
4674 do_query:
4675
4676         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4677                                   homedir, shell, gecos, p_gid );
4678
4679         DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4680
4681         if ( NT_STATUS_IS_OK(nt_status) ) {
4682                 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4683                 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4684                 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4685                 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4686
4687                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4688                                          *homedir, *shell, *gecos, *p_gid );
4689         }
4690
4691         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4692                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4693                          domain->name ));
4694                 set_domain_offline( domain );
4695         }
4696
4697         return nt_status;
4698 }
4699
4700 #endif
4701
4702 /* the cache backend methods are exposed via this structure */
4703 struct winbindd_methods cache_methods = {
4704         true,
4705         query_user_list,
4706         enum_dom_groups,
4707         enum_local_groups,
4708         name_to_sid,
4709         sid_to_name,
4710         rids_to_names,
4711         query_user,
4712         lookup_usergroups,
4713         lookup_useraliases,
4714         lookup_groupmem,
4715         sequence_number,
4716         lockout_policy,
4717         password_policy,
4718         trusted_domains
4719 };
4720
4721 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4722                            uint32_t opnum, const DATA_BLOB *req,
4723                            TDB_DATA *pkey)
4724 {
4725         char *key;
4726         size_t keylen;
4727
4728         key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4729         if (key == NULL) {
4730                 return false;
4731         }
4732         keylen = talloc_get_size(key) - 1;
4733
4734         key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4735         if (key == NULL) {
4736                 return false;
4737         }
4738         memcpy(key + keylen, req->data, req->length);
4739
4740         pkey->dptr = (uint8_t *)key;
4741         pkey->dsize = talloc_get_size(key);
4742         return true;
4743 }
4744
4745 static bool wcache_opnum_cacheable(uint32_t opnum)
4746 {
4747         switch (opnum) {
4748         case NDR_WBINT_PING:
4749         case NDR_WBINT_QUERYSEQUENCENUMBER:
4750         case NDR_WBINT_ALLOCATEUID:
4751         case NDR_WBINT_ALLOCATEGID:
4752         case NDR_WBINT_CHECKMACHINEACCOUNT:
4753         case NDR_WBINT_CHANGEMACHINEACCOUNT:
4754         case NDR_WBINT_PINGDC:
4755                 return false;
4756         }
4757         return true;
4758 }
4759
4760 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4761                       uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4762 {
4763         TDB_DATA key, data;
4764         bool ret = false;
4765
4766         if (!wcache_opnum_cacheable(opnum) ||
4767             is_my_own_sam_domain(domain) ||
4768             is_builtin_domain(domain)) {
4769                 return false;
4770         }
4771
4772         if (wcache->tdb == NULL) {
4773                 return false;
4774         }
4775
4776         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4777                 return false;
4778         }
4779         data = tdb_fetch(wcache->tdb, key);
4780         TALLOC_FREE(key.dptr);
4781
4782         if (data.dptr == NULL) {
4783                 return false;
4784         }
4785         if (data.dsize < 12) {
4786                 goto fail;
4787         }
4788
4789         if (!is_domain_offline(domain)) {
4790                 uint32_t entry_seqnum, dom_seqnum, last_check;
4791                 uint64_t entry_timeout;
4792
4793                 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4794                                          &last_check)) {
4795                         goto fail;
4796                 }
4797                 entry_seqnum = IVAL(data.dptr, 0);
4798                 if (entry_seqnum != dom_seqnum) {
4799                         DEBUG(10, ("Entry has wrong sequence number: %d\n",
4800                                    (int)entry_seqnum));
4801                         goto fail;
4802                 }
4803                 entry_timeout = BVAL(data.dptr, 4);
4804                 if (entry_timeout > time(NULL)) {
4805                         DEBUG(10, ("Entry has timed out\n"));
4806                         goto fail;
4807                 }
4808         }
4809
4810         resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 12,
4811                                               data.dsize - 12);
4812         if (resp->data == NULL) {
4813                 DEBUG(10, ("talloc failed\n"));
4814                 goto fail;
4815         }
4816         resp->length = data.dsize - 12;
4817
4818         ret = true;
4819 fail:
4820         SAFE_FREE(data.dptr);
4821         return ret;
4822 }
4823
4824 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4825                       const DATA_BLOB *req, const DATA_BLOB *resp)
4826 {
4827         TDB_DATA key, data;
4828         uint32_t dom_seqnum, last_check;
4829         uint64_t timeout;
4830
4831         if (!wcache_opnum_cacheable(opnum) ||
4832             is_my_own_sam_domain(domain) ||
4833             is_builtin_domain(domain)) {
4834                 return;
4835         }
4836
4837         if (wcache->tdb == NULL) {
4838                 return;
4839         }
4840
4841         if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4842                 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4843                            domain->name));
4844                 return;
4845         }
4846
4847         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4848                 return;
4849         }
4850
4851         timeout = time(NULL) + lp_winbind_cache_time();
4852
4853         data.dsize = resp->length + 12;
4854         data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4855         if (data.dptr == NULL) {
4856                 goto done;
4857         }
4858
4859         SIVAL(data.dptr, 0, dom_seqnum);
4860         SBVAL(data.dptr, 4, timeout);
4861         memcpy(data.dptr + 12, resp->data, resp->length);
4862
4863         tdb_store(wcache->tdb, key, data, 0);
4864
4865 done:
4866         TALLOC_FREE(key.dptr);
4867         return;
4868 }