source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "tdb_validate.h"
  29 #include "../libcli/auth/libcli_auth.h"
  30 #include "../librpc/gen_ndr/ndr_wbint.h"
  31
  32 #undef DBGC_CLASS
  33 #define DBGC_CLASS DBGC_WINBIND
  34
  35 #define WINBINDD_CACHE_VERSION 1
  36 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  37
  38 extern struct winbindd_methods reconnect_methods;
  39 #ifdef HAVE_ADS
  40 extern struct winbindd_methods ads_methods;
  41 #endif
  42 extern struct winbindd_methods builtin_passdb_methods;
  43
  44 /*
  45  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  46  * Here are the list of entry types that are *not* stored
  47  * as form struct cache_entry in the cache.
  48  */
  49
  50 static const char *non_centry_keys[] = {
  51         "SEQNUM/",
  52         "DR/",
  53         "DE/",
  54         "WINBINDD_OFFLINE",
  55         WINBINDD_CACHE_VERSION_KEYSTR,
  56         NULL
  57 };
  58
  59 /************************************************************************
  60  Is this key a non-centry type ?
  61 ************************************************************************/
  62
  63 static bool is_non_centry_key(TDB_DATA kbuf)
  64 {
  65         int i;
  66
  67         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  68                 return false;
  69         }
  70         for (i = 0; non_centry_keys[i] != NULL; i++) {
  71                 size_t namelen = strlen(non_centry_keys[i]);
  72                 if (kbuf.dsize < namelen) {
  73                         continue;
  74                 }
  75                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  76                         return true;
  77                 }
  78         }
  79         return false;
  80 }
  81
  82 /* Global online/offline state - False when online. winbindd starts up online
  83    and sets this to true if the first query fails and there's an entry in
  84    the cache tdb telling us to stay offline. */
  85
  86 static bool global_winbindd_offline_state;
  87
  88 struct winbind_cache {
  89         TDB_CONTEXT *tdb;
  90 };
  91
  92 struct cache_entry {
  93         NTSTATUS status;
  94         uint32 sequence_number;
  95         uint8 *data;
  96         uint32 len, ofs;
  97 };
  98
  99 void (*smb_panic_fn)(const char *const why) = smb_panic;
 100
 101 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
 102
 103 static struct winbind_cache *wcache;
 104
 105 void winbindd_check_cache_size(time_t t)
 106 {
 107         static time_t last_check_time;
 108         struct stat st;
 109
 110         if (last_check_time == (time_t)0)
 111                 last_check_time = t;
 112
 113         if (t - last_check_time < 60 && t - last_check_time > 0)
 114                 return;
 115
 116         if (wcache == NULL || wcache->tdb == NULL) {
 117                 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
 118                 return;
 119         }
 120
 121         if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
 122                 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
 123                 return;
 124         }
 125
 126         if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
 127                 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
 128                         (unsigned long)st.st_size,
 129                         (unsigned long)WINBINDD_MAX_CACHE_SIZE));
 130                 wcache_flush_cache();
 131         }
 132 }
 133
 134 /* get the winbind_cache structure */
 135 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 136 {
 137         struct winbind_cache *ret = wcache;
 138
 139         /* We have to know what type of domain we are dealing with first. */
 140
 141         if (domain->internal) {
 142                 domain->backend = &builtin_passdb_methods;
 143                 domain->initialized = True;
 144         }
 145         if ( !domain->initialized ) {
 146                 init_dc_connection( domain );
 147         }
 148
 149         /*
 150            OK.  listen up becasue I'm only going to say this once.
 151            We have the following scenarios to consider
 152            (a) trusted AD domains on a Samba DC,
 153            (b) trusted AD domains and we are joined to a non-kerberos domain
 154            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 155
 156            For (a) we can always contact the trusted domain using krb5
 157            since we have the domain trust account password
 158
 159            For (b) we can only use RPC since we have no way of
 160            getting a krb5 ticket in our own domain
 161
 162            For (c) we can always use krb5 since we have a kerberos trust
 163
 164            --jerry
 165          */
 166
 167         if (!domain->backend) {
 168 #ifdef HAVE_ADS
 169                 struct winbindd_domain *our_domain = domain;
 170
 171                 /* find our domain first so we can figure out if we
 172                    are joined to a kerberized domain */
 173
 174                 if ( !domain->primary )
 175                         our_domain = find_our_domain();
 176
 177                 if ((our_domain->active_directory || IS_DC)
 178                     && domain->active_directory
 179                     && !lp_winbind_rpc_only()) {
 180                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 181                         domain->backend = &ads_methods;
 182                 } else {
 183 #endif  /* HAVE_ADS */
 184                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 185                         domain->backend = &reconnect_methods;
 186 #ifdef HAVE_ADS
 187                 }
 188 #endif  /* HAVE_ADS */
 189         }
 190
 191         if (ret)
 192                 return ret;
 193
 194         ret = SMB_XMALLOC_P(struct winbind_cache);
 195         ZERO_STRUCTP(ret);
 196
 197         wcache = ret;
 198         wcache_flush_cache();
 199
 200         return ret;
 201 }
 202
 203 /*
 204   free a centry structure
 205 */
 206 static void centry_free(struct cache_entry *centry)
 207 {
 208         if (!centry)
 209                 return;
 210         SAFE_FREE(centry->data);
 211         free(centry);
 212 }
 213
 214 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 215 {
 216         if (centry->len - centry->ofs < nbytes) {
 217                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 218                          (unsigned int)nbytes,
 219                          centry->len - centry->ofs));
 220                 return false;
 221         }
 222         return true;
 223 }
 224
 225 /*
 226   pull a uint32 from a cache entry
 227 */
 228 static uint32 centry_uint32(struct cache_entry *centry)
 229 {
 230         uint32 ret;
 231
 232         if (!centry_check_bytes(centry, 4)) {
 233                 smb_panic_fn("centry_uint32");
 234         }
 235         ret = IVAL(centry->data, centry->ofs);
 236         centry->ofs += 4;
 237         return ret;
 238 }
 239
 240 /*
 241   pull a uint16 from a cache entry
 242 */
 243 static uint16 centry_uint16(struct cache_entry *centry)
 244 {
 245         uint16 ret;
 246         if (!centry_check_bytes(centry, 2)) {
 247                 smb_panic_fn("centry_uint16");
 248         }
 249         ret = CVAL(centry->data, centry->ofs);
 250         centry->ofs += 2;
 251         return ret;
 252 }
 253
 254 /*
 255   pull a uint8 from a cache entry
 256 */
 257 static uint8 centry_uint8(struct cache_entry *centry)
 258 {
 259         uint8 ret;
 260         if (!centry_check_bytes(centry, 1)) {
 261                 smb_panic_fn("centry_uint8");
 262         }
 263         ret = CVAL(centry->data, centry->ofs);
 264         centry->ofs += 1;
 265         return ret;
 266 }
 267
 268 /*
 269   pull a NTTIME from a cache entry
 270 */
 271 static NTTIME centry_nttime(struct cache_entry *centry)
 272 {
 273         NTTIME ret;
 274         if (!centry_check_bytes(centry, 8)) {
 275                 smb_panic_fn("centry_nttime");
 276         }
 277         ret = IVAL(centry->data, centry->ofs);
 278         centry->ofs += 4;
 279         ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
 280         centry->ofs += 4;
 281         return ret;
 282 }
 283
 284 /*
 285   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 286 */
 287 static time_t centry_time(struct cache_entry *centry)
 288 {
 289         return (time_t)centry_nttime(centry);
 290 }
 291
 292 /* pull a string from a cache entry, using the supplied
 293    talloc context
 294 */
 295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 296 {
 297         uint32 len;
 298         char *ret;
 299
 300         len = centry_uint8(centry);
 301
 302         if (len == 0xFF) {
 303                 /* a deliberate NULL string */
 304                 return NULL;
 305         }
 306
 307         if (!centry_check_bytes(centry, (size_t)len)) {
 308                 smb_panic_fn("centry_string");
 309         }
 310
 311         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 312         if (!ret) {
 313                 smb_panic_fn("centry_string out of memory\n");
 314         }
 315         memcpy(ret,centry->data + centry->ofs, len);
 316         ret[len] = 0;
 317         centry->ofs += len;
 318         return ret;
 319 }
 320
 321 /* pull a hash16 from a cache entry, using the supplied
 322    talloc context
 323 */
 324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 325 {
 326         uint32 len;
 327         char *ret;
 328
 329         len = centry_uint8(centry);
 330
 331         if (len != 16) {
 332                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 333                         len ));
 334                 return NULL;
 335         }
 336
 337         if (!centry_check_bytes(centry, 16)) {
 338                 return NULL;
 339         }
 340
 341         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 342         if (!ret) {
 343                 smb_panic_fn("centry_hash out of memory\n");
 344         }
 345         memcpy(ret,centry->data + centry->ofs, 16);
 346         centry->ofs += 16;
 347         return ret;
 348 }
 349
 350 /* pull a sid from a cache entry, using the supplied
 351    talloc context
 352 */
 353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
 354 {
 355         char *sid_string;
 356         bool ret;
 357
 358         sid_string = centry_string(centry, talloc_tos());
 359         if (sid_string == NULL) {
 360                 return false;
 361         }
 362         ret = string_to_sid(sid, sid_string);
 363         TALLOC_FREE(sid_string);
 364         return ret;
 365 }
 366
 367
 368 /*
 369   pull a NTSTATUS from a cache entry
 370 */
 371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 372 {
 373         NTSTATUS status;
 374
 375         status = NT_STATUS(centry_uint32(centry));
 376         return status;
 377 }
 378
 379
 380 /* the server is considered down if it can't give us a sequence number */
 381 static bool wcache_server_down(struct winbindd_domain *domain)
 382 {
 383         bool ret;
 384
 385         if (!wcache->tdb)
 386                 return false;
 387
 388         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 389
 390         if (ret)
 391                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 392                         domain->name ));
 393         return ret;
 394 }
 395
 396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
 397                                 uint32_t *last_seq_check)
 398 {
 399         char *key;
 400         TDB_DATA data;
 401
 402         if (wcache->tdb == NULL) {
 403                 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
 404                 return false;
 405         }
 406
 407         key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 408         if (key == NULL) {
 409                 DEBUG(10, ("talloc failed\n"));
 410                 return false;
 411         }
 412
 413         data = tdb_fetch_bystring(wcache->tdb, key);
 414         TALLOC_FREE(key);
 415
 416         if (data.dptr == NULL) {
 417                 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
 418                            domain_name));
 419                 return false;
 420         }
 421         if (data.dsize != 8) {
 422                 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
 423                            (int)data.dsize));
 424                 SAFE_FREE(data.dptr);
 425                 return false;
 426         }
 427
 428         *seqnum = IVAL(data.dptr, 0);
 429         *last_seq_check = IVAL(data.dptr, 4);
 430         SAFE_FREE(data.dptr);
 431
 432         return true;
 433 }
 434
 435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 436 {
 437         uint32 last_check, time_diff;
 438
 439         if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
 440                                  &last_check)) {
 441                 return NT_STATUS_UNSUCCESSFUL;
 442         }
 443         domain->last_seq_check = last_check;
 444
 445         /* have we expired? */
 446
 447         time_diff = now - domain->last_seq_check;
 448         if ( time_diff > lp_winbind_cache_time() ) {
 449                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 450                         domain->name, domain->sequence_number,
 451                         (uint32)domain->last_seq_check));
 452                 return NT_STATUS_UNSUCCESSFUL;
 453         }
 454
 455         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 456                 domain->name, domain->sequence_number,
 457                 (uint32)domain->last_seq_check));
 458
 459         return NT_STATUS_OK;
 460 }
 461
 462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
 463                          time_t last_seq_check)
 464 {
 465         char *key_str;
 466         uint8_t buf[8];
 467         int ret;
 468
 469         if (wcache->tdb == NULL) {
 470                 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
 471                 return false;
 472         }
 473
 474         key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 475         if (key_str == NULL) {
 476                 DEBUG(10, ("talloc_asprintf failed\n"));
 477                 return false;
 478         }
 479
 480         SIVAL(buf, 0, seqnum);
 481         SIVAL(buf, 4, last_seq_check);
 482
 483         ret = tdb_store_bystring(wcache->tdb, key_str,
 484                                  make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
 485         TALLOC_FREE(key_str);
 486         if (ret == -1) {
 487                 DEBUG(10, ("tdb_store_bystring failed: %s\n",
 488                            tdb_errorstr(wcache->tdb)));
 489                 TALLOC_FREE(key_str);
 490                 return false;
 491         }
 492
 493         DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
 494                    domain_name, seqnum, (unsigned)last_seq_check));
 495
 496         return true;
 497 }
 498
 499 static bool store_cache_seqnum( struct winbindd_domain *domain )
 500 {
 501         return wcache_store_seqnum(domain->name, domain->sequence_number,
 502                                    domain->last_seq_check);
 503 }
 504
 505 /*
 506   refresh the domain sequence number. If force is true
 507   then always refresh it, no matter how recently we fetched it
 508 */
 509
 510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 511 {
 512         NTSTATUS status;
 513         unsigned time_diff;
 514         time_t t = time(NULL);
 515         unsigned cache_time = lp_winbind_cache_time();
 516
 517         if ( IS_DOMAIN_OFFLINE(domain) ) {
 518                 return;
 519         }
 520
 521         get_cache( domain );
 522
 523 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 524         /* trying to reconnect is expensive, don't do it too often */
 525         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 526                 cache_time *= 8;
 527         }
 528 #endif
 529
 530         time_diff = t - domain->last_seq_check;
 531
 532         /* see if we have to refetch the domain sequence number */
 533         if (!force && (time_diff < cache_time) &&
 534                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 535                         NT_STATUS_IS_OK(domain->last_status)) {
 536                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 537                 goto done;
 538         }
 539
 540         /* try to get the sequence number from the tdb cache first */
 541         /* this will update the timestamp as well */
 542
 543         status = fetch_cache_seqnum( domain, t );
 544         if (NT_STATUS_IS_OK(status) &&
 545                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 546                         NT_STATUS_IS_OK(domain->last_status)) {
 547                 goto done;
 548         }
 549
 550         /* important! make sure that we know if this is a native
 551            mode domain or not.  And that we can contact it. */
 552
 553         if ( winbindd_can_contact_domain( domain ) ) {
 554                 status = domain->backend->sequence_number(domain,
 555                                                           &domain->sequence_number);
 556         } else {
 557                 /* just use the current time */
 558                 status = NT_STATUS_OK;
 559                 domain->sequence_number = time(NULL);
 560         }
 561
 562
 563         /* the above call could have set our domain->backend to NULL when
 564          * coming from offline to online mode, make sure to reinitialize the
 565          * backend - Guenther */
 566         get_cache( domain );
 567
 568         if (!NT_STATUS_IS_OK(status)) {
 569                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 570                 domain->sequence_number = DOM_SEQUENCE_NONE;
 571         }
 572
 573         domain->last_status = status;
 574         domain->last_seq_check = time(NULL);
 575
 576         /* save the new sequence number in the cache */
 577         store_cache_seqnum( domain );
 578
 579 done:
 580         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 581                    domain->name, domain->sequence_number));
 582
 583         return;
 584 }
 585
 586 /*
 587   decide if a cache entry has expired
 588 */
 589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 590 {
 591         /* If we've been told to be offline - stay in that state... */
 592         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 593                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 594                         keystr, domain->name ));
 595                 return false;
 596         }
 597
 598         /* when the domain is offline return the cached entry.
 599          * This deals with transient offline states... */
 600
 601         if (!domain->online) {
 602                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 603                         keystr, domain->name ));
 604                 return false;
 605         }
 606
 607         /* if the server is OK and our cache entry came from when it was down then
 608            the entry is invalid */
 609         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 610             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 611                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 612                         keystr, domain->name ));
 613                 return true;
 614         }
 615
 616         /* if the server is down or the cache entry is not older than the
 617            current sequence number then it is OK */
 618         if (wcache_server_down(domain) ||
 619             centry->sequence_number == domain->sequence_number) {
 620                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 621                         keystr, domain->name ));
 622                 return false;
 623         }
 624
 625         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 626                 keystr, domain->name ));
 627
 628         /* it's expired */
 629         return true;
 630 }
 631
 632 static struct cache_entry *wcache_fetch_raw(char *kstr)
 633 {
 634         TDB_DATA data;
 635         struct cache_entry *centry;
 636         TDB_DATA key;
 637
 638         key = string_tdb_data(kstr);
 639         data = tdb_fetch(wcache->tdb, key);
 640         if (!data.dptr) {
 641                 /* a cache miss */
 642                 return NULL;
 643         }
 644
 645         centry = SMB_XMALLOC_P(struct cache_entry);
 646         centry->data = (unsigned char *)data.dptr;
 647         centry->len = data.dsize;
 648         centry->ofs = 0;
 649
 650         if (centry->len < 8) {
 651                 /* huh? corrupt cache? */
 652                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
 653                 centry_free(centry);
 654                 return NULL;
 655         }
 656
 657         centry->status = centry_ntstatus(centry);
 658         centry->sequence_number = centry_uint32(centry);
 659
 660         return centry;
 661 }
 662
 663 /*
 664   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 665   number and return status
 666 */
 667 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 668                                         struct winbindd_domain *domain,
 669                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 670 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 671                                         struct winbindd_domain *domain,
 672                                         const char *format, ...)
 673 {
 674         va_list ap;
 675         char *kstr;
 676         struct cache_entry *centry;
 677
 678         if (!winbindd_use_cache()) {
 679                 return NULL;
 680         }
 681
 682         refresh_sequence_number(domain, false);
 683
 684         va_start(ap, format);
 685         smb_xvasprintf(&kstr, format, ap);
 686         va_end(ap);
 687
 688         centry = wcache_fetch_raw(kstr);
 689         if (centry == NULL) {
 690                 free(kstr);
 691                 return NULL;
 692         }
 693
 694         if (centry_expired(domain, kstr, centry)) {
 695
 696                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 697                          kstr, domain->name ));
 698
 699                 centry_free(centry);
 700                 free(kstr);
 701                 return NULL;
 702         }
 703
 704         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 705                  kstr, domain->name ));
 706
 707         free(kstr);
 708         return centry;
 709 }
 710
 711 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 712 static void wcache_delete(const char *format, ...)
 713 {
 714         va_list ap;
 715         char *kstr;
 716         TDB_DATA key;
 717
 718         va_start(ap, format);
 719         smb_xvasprintf(&kstr, format, ap);
 720         va_end(ap);
 721
 722         key = string_tdb_data(kstr);
 723
 724         tdb_delete(wcache->tdb, key);
 725         free(kstr);
 726 }
 727
 728 /*
 729   make sure we have at least len bytes available in a centry
 730 */
 731 static void centry_expand(struct cache_entry *centry, uint32 len)
 732 {
 733         if (centry->len - centry->ofs >= len)
 734                 return;
 735         centry->len *= 2;
 736         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 737                                          centry->len);
 738         if (!centry->data) {
 739                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 740                 smb_panic_fn("out of memory in centry_expand");
 741         }
 742 }
 743
 744 /*
 745   push a uint32 into a centry
 746 */
 747 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 748 {
 749         centry_expand(centry, 4);
 750         SIVAL(centry->data, centry->ofs, v);
 751         centry->ofs += 4;
 752 }
 753
 754 /*
 755   push a uint16 into a centry
 756 */
 757 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 758 {
 759         centry_expand(centry, 2);
 760         SIVAL(centry->data, centry->ofs, v);
 761         centry->ofs += 2;
 762 }
 763
 764 /*
 765   push a uint8 into a centry
 766 */
 767 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 768 {
 769         centry_expand(centry, 1);
 770         SCVAL(centry->data, centry->ofs, v);
 771         centry->ofs += 1;
 772 }
 773
 774 /*
 775    push a string into a centry
 776  */
 777 static void centry_put_string(struct cache_entry *centry, const char *s)
 778 {
 779         int len;
 780
 781         if (!s) {
 782                 /* null strings are marked as len 0xFFFF */
 783                 centry_put_uint8(centry, 0xFF);
 784                 return;
 785         }
 786
 787         len = strlen(s);
 788         /* can't handle more than 254 char strings. Truncating is probably best */
 789         if (len > 254) {
 790                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 791                 len = 254;
 792         }
 793         centry_put_uint8(centry, len);
 794         centry_expand(centry, len);
 795         memcpy(centry->data + centry->ofs, s, len);
 796         centry->ofs += len;
 797 }
 798
 799 /*
 800    push a 16 byte hash into a centry - treat as 16 byte string.
 801  */
 802 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 803 {
 804         centry_put_uint8(centry, 16);
 805         centry_expand(centry, 16);
 806         memcpy(centry->data + centry->ofs, val, 16);
 807         centry->ofs += 16;
 808 }
 809
 810 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
 811 {
 812         fstring sid_string;
 813         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 814 }
 815
 816
 817 /*
 818   put NTSTATUS into a centry
 819 */
 820 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 821 {
 822         uint32 status_value = NT_STATUS_V(status);
 823         centry_put_uint32(centry, status_value);
 824 }
 825
 826
 827 /*
 828   push a NTTIME into a centry
 829 */
 830 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 831 {
 832         centry_expand(centry, 8);
 833         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 834         centry->ofs += 4;
 835         SIVAL(centry->data, centry->ofs, nt >> 32);
 836         centry->ofs += 4;
 837 }
 838
 839 /*
 840   push a time_t into a centry - use a 64 bit size.
 841   NTTIME here is being used as a convenient 64-bit size.
 842 */
 843 static void centry_put_time(struct cache_entry *centry, time_t t)
 844 {
 845         NTTIME nt = (NTTIME)t;
 846         centry_put_nttime(centry, nt);
 847 }
 848
 849 /*
 850   start a centry for output. When finished, call centry_end()
 851 */
 852 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 853 {
 854         struct cache_entry *centry;
 855
 856         if (!wcache->tdb)
 857                 return NULL;
 858
 859         centry = SMB_XMALLOC_P(struct cache_entry);
 860
 861         centry->len = 8192; /* reasonable default */
 862         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 863         centry->ofs = 0;
 864         centry->sequence_number = domain->sequence_number;
 865         centry_put_ntstatus(centry, status);
 866         centry_put_uint32(centry, centry->sequence_number);
 867         return centry;
 868 }
 869
 870 /*
 871   finish a centry and write it to the tdb
 872 */
 873 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 874 static void centry_end(struct cache_entry *centry, const char *format, ...)
 875 {
 876         va_list ap;
 877         char *kstr;
 878         TDB_DATA key, data;
 879
 880         if (!winbindd_use_cache()) {
 881                 return;
 882         }
 883
 884         va_start(ap, format);
 885         smb_xvasprintf(&kstr, format, ap);
 886         va_end(ap);
 887
 888         key = string_tdb_data(kstr);
 889         data.dptr = centry->data;
 890         data.dsize = centry->ofs;
 891
 892         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 893         free(kstr);
 894 }
 895
 896 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 897                                     NTSTATUS status, const char *domain_name,
 898                                     const char *name, const DOM_SID *sid,
 899                                     enum lsa_SidType type)
 900 {
 901         struct cache_entry *centry;
 902         fstring uname;
 903
 904         centry = centry_start(domain, status);
 905         if (!centry)
 906                 return;
 907         centry_put_uint32(centry, type);
 908         centry_put_sid(centry, sid);
 909         fstrcpy(uname, name);
 910         strupper_m(uname);
 911         centry_end(centry, "NS/%s/%s", domain_name, uname);
 912         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 913                   uname, sid_string_dbg(sid), nt_errstr(status)));
 914         centry_free(centry);
 915 }
 916
 917 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 918                                     const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 919 {
 920         struct cache_entry *centry;
 921         fstring sid_string;
 922
 923         centry = centry_start(domain, status);
 924         if (!centry)
 925                 return;
 926
 927         if (NT_STATUS_IS_OK(status)) {
 928                 centry_put_uint32(centry, type);
 929                 centry_put_string(centry, domain_name);
 930                 centry_put_string(centry, name);
 931         }
 932
 933         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 934         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 935                   name, nt_errstr(status)));
 936         centry_free(centry);
 937 }
 938
 939
 940 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
 941                              struct wbint_userinfo *info)
 942 {
 943         struct cache_entry *centry;
 944         fstring sid_string;
 945
 946         if (is_null_sid(&info->user_sid)) {
 947                 return;
 948         }
 949
 950         centry = centry_start(domain, status);
 951         if (!centry)
 952                 return;
 953         centry_put_string(centry, info->acct_name);
 954         centry_put_string(centry, info->full_name);
 955         centry_put_string(centry, info->homedir);
 956         centry_put_string(centry, info->shell);
 957         centry_put_uint32(centry, info->primary_gid);
 958         centry_put_sid(centry, &info->user_sid);
 959         centry_put_sid(centry, &info->group_sid);
 960         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 961                                                   &info->user_sid));
 962         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 963         centry_free(centry);
 964 }
 965
 966 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
 967                                        NTSTATUS status,
 968                                        struct samr_DomInfo12 *lockout_policy)
 969 {
 970         struct cache_entry *centry;
 971
 972         centry = centry_start(domain, status);
 973         if (!centry)
 974                 return;
 975
 976         centry_put_nttime(centry, lockout_policy->lockout_duration);
 977         centry_put_nttime(centry, lockout_policy->lockout_window);
 978         centry_put_uint16(centry, lockout_policy->lockout_threshold);
 979
 980         centry_end(centry, "LOC_POL/%s", domain->name);
 981
 982         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
 983
 984         centry_free(centry);
 985 }
 986
 987
 988
 989 static void wcache_save_password_policy(struct winbindd_domain *domain,
 990                                         NTSTATUS status,
 991                                         struct samr_DomInfo1 *policy)
 992 {
 993         struct cache_entry *centry;
 994
 995         centry = centry_start(domain, status);
 996         if (!centry)
 997                 return;
 998
 999         centry_put_uint16(centry, policy->min_password_length);
1000         centry_put_uint16(centry, policy->password_history_length);
1001         centry_put_uint32(centry, policy->password_properties);
1002         centry_put_nttime(centry, policy->max_password_age);
1003         centry_put_nttime(centry, policy->min_password_age);
1004
1005         centry_end(centry, "PWD_POL/%s", domain->name);
1006
1007         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1008
1009         centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013  ***************************************************************************/
1014
1015 static void wcache_save_username_alias(struct winbindd_domain *domain,
1016                                        NTSTATUS status,
1017                                        const char *name, const char *alias)
1018 {
1019         struct cache_entry *centry;
1020         fstring uname;
1021
1022         if ( (centry = centry_start(domain, status)) == NULL )
1023                 return;
1024
1025         centry_put_string( centry, alias );
1026
1027         fstrcpy(uname, name);
1028         strupper_m(uname);
1029         centry_end(centry, "NSS/NA/%s", uname);
1030
1031         DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1032
1033         centry_free(centry);
1034 }
1035
1036 static void wcache_save_alias_username(struct winbindd_domain *domain,
1037                                        NTSTATUS status,
1038                                        const char *alias, const char *name)
1039 {
1040         struct cache_entry *centry;
1041         fstring uname;
1042
1043         if ( (centry = centry_start(domain, status)) == NULL )
1044                 return;
1045
1046         centry_put_string( centry, name );
1047
1048         fstrcpy(uname, alias);
1049         strupper_m(uname);
1050         centry_end(centry, "NSS/AN/%s", uname);
1051
1052         DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1053
1054         centry_free(centry);
1055 }
1056
1057 /***************************************************************************
1058  ***************************************************************************/
1059
1060 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1061                                     struct winbindd_domain *domain,
1062                                     const char *name, char **alias )
1063 {
1064         struct winbind_cache *cache = get_cache(domain);
1065         struct cache_entry *centry = NULL;
1066         NTSTATUS status;
1067         char *upper_name;
1068
1069         if ( domain->internal )
1070                 return NT_STATUS_NOT_SUPPORTED;
1071
1072         if (!cache->tdb)
1073                 goto do_query;
1074
1075         if ( (upper_name = SMB_STRDUP(name)) == NULL )
1076                 return NT_STATUS_NO_MEMORY;
1077         strupper_m(upper_name);
1078
1079         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1080
1081         SAFE_FREE( upper_name );
1082
1083         if (!centry)
1084                 goto do_query;
1085
1086         status = centry->status;
1087
1088         if (!NT_STATUS_IS_OK(status)) {
1089                 centry_free(centry);
1090                 return status;
1091         }
1092
1093         *alias = centry_string( centry, mem_ctx );
1094
1095         centry_free(centry);
1096
1097         DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1098                   name, *alias ? *alias : "(none)"));
1099
1100         return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1101
1102 do_query:
1103
1104         /* If its not in cache and we are offline, then fail */
1105
1106         if ( get_global_winbindd_state_offline() || !domain->online ) {
1107                 DEBUG(8,("resolve_username_to_alias: rejecting query "
1108                          "in offline mode\n"));
1109                 return NT_STATUS_NOT_FOUND;
1110         }
1111
1112         status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1113
1114         if ( NT_STATUS_IS_OK( status ) ) {
1115                 wcache_save_username_alias(domain, status, name, *alias);
1116         }
1117
1118         if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1119                 wcache_save_username_alias(domain, status, name, "(NULL)");
1120         }
1121
1122         DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1123                  nt_errstr(status)));
1124
1125         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1126                 set_domain_offline( domain );
1127         }
1128
1129         return status;
1130 }
1131
1132 /***************************************************************************
1133  ***************************************************************************/
1134
1135 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1136                                     struct winbindd_domain *domain,
1137                                     const char *alias, char **name )
1138 {
1139         struct winbind_cache *cache = get_cache(domain);
1140         struct cache_entry *centry = NULL;
1141         NTSTATUS status;
1142         char *upper_name;
1143
1144         if ( domain->internal )
1145                 return  NT_STATUS_NOT_SUPPORTED;
1146
1147         if (!cache->tdb)
1148                 goto do_query;
1149
1150         if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1151                 return NT_STATUS_NO_MEMORY;
1152         strupper_m(upper_name);
1153
1154         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1155
1156         SAFE_FREE( upper_name );
1157
1158         if (!centry)
1159                 goto do_query;
1160
1161         status = centry->status;
1162
1163         if (!NT_STATUS_IS_OK(status)) {
1164                 centry_free(centry);
1165                 return status;
1166         }
1167
1168         *name = centry_string( centry, mem_ctx );
1169
1170         centry_free(centry);
1171
1172         DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1173                   alias, *name ? *name : "(none)"));
1174
1175         return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1176
1177 do_query:
1178
1179         /* If its not in cache and we are offline, then fail */
1180
1181         if ( get_global_winbindd_state_offline() || !domain->online ) {
1182                 DEBUG(8,("resolve_alias_to_username: rejecting query "
1183                          "in offline mode\n"));
1184                 return NT_STATUS_NOT_FOUND;
1185         }
1186
1187         /* an alias cannot contain a domain prefix or '@' */
1188
1189         if (strchr(alias, '\\') || strchr(alias, '@')) {
1190                 DEBUG(10,("resolve_alias_to_username: skipping fully "
1191                           "qualified name %s\n", alias));
1192                 return NT_STATUS_OBJECT_NAME_INVALID;
1193         }
1194
1195         status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1196
1197         if ( NT_STATUS_IS_OK( status ) ) {
1198                 wcache_save_alias_username( domain, status, alias, *name );
1199         }
1200
1201         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1202                 wcache_save_alias_username(domain, status, alias, "(NULL)");
1203         }
1204
1205         DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1206                  nt_errstr(status)));
1207
1208         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1209                 set_domain_offline( domain );
1210         }
1211
1212         return status;
1213 }
1214
1215 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1216 {
1217         struct winbind_cache *cache = get_cache(domain);
1218         TDB_DATA data;
1219         fstring key_str, tmp;
1220         uint32 rid;
1221
1222         if (!cache->tdb) {
1223                 return NT_STATUS_INTERNAL_DB_ERROR;
1224         }
1225
1226         if (is_null_sid(sid)) {
1227                 return NT_STATUS_INVALID_SID;
1228         }
1229
1230         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1231                 return NT_STATUS_INVALID_SID;
1232         }
1233
1234         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1235
1236         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1237         if (!data.dptr) {
1238                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1239         }
1240
1241         SAFE_FREE(data.dptr);
1242         return NT_STATUS_OK;
1243 }
1244
1245 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1246    as new salted ones. */
1247
1248 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1249                           TALLOC_CTX *mem_ctx,
1250                           const DOM_SID *sid,
1251                           const uint8 **cached_nt_pass,
1252                           const uint8 **cached_salt)
1253 {
1254         struct winbind_cache *cache = get_cache(domain);
1255         struct cache_entry *centry = NULL;
1256         NTSTATUS status;
1257         time_t t;
1258         uint32 rid;
1259         fstring tmp;
1260
1261         if (!cache->tdb) {
1262                 return NT_STATUS_INTERNAL_DB_ERROR;
1263         }
1264
1265         if (is_null_sid(sid)) {
1266                 return NT_STATUS_INVALID_SID;
1267         }
1268
1269         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1270                 return NT_STATUS_INVALID_SID;
1271         }
1272
1273         /* Try and get a salted cred first. If we can't
1274            fall back to an unsalted cred. */
1275
1276         centry = wcache_fetch(cache, domain, "CRED/%s",
1277                               sid_to_fstring(tmp, sid));
1278         if (!centry) {
1279                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1280                           sid_string_dbg(sid)));
1281                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1282         }
1283
1284         t = centry_time(centry);
1285
1286         /* In the salted case this isn't actually the nt_hash itself,
1287            but the MD5 of the salt + nt_hash. Let the caller
1288            sort this out. It can tell as we only return the cached_salt
1289            if we are returning a salted cred. */
1290
1291         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1292         if (*cached_nt_pass == NULL) {
1293                 fstring sidstr;
1294
1295                 sid_to_fstring(sidstr, sid);
1296
1297                 /* Bad (old) cred cache. Delete and pretend we
1298                    don't have it. */
1299                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1300                                 sidstr));
1301                 wcache_delete("CRED/%s", sidstr);
1302                 centry_free(centry);
1303                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1304         }
1305
1306         /* We only have 17 bytes more data in the salted cred case. */
1307         if (centry->len - centry->ofs == 17) {
1308                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1309         } else {
1310                 *cached_salt = NULL;
1311         }
1312
1313         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1314         if (*cached_salt) {
1315                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1316         }
1317
1318         status = centry->status;
1319
1320         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1321                   sid_string_dbg(sid), nt_errstr(status) ));
1322
1323         centry_free(centry);
1324         return status;
1325 }
1326
1327 /* Store creds for a SID - only writes out new salted ones. */
1328
1329 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1330                            TALLOC_CTX *mem_ctx,
1331                            const DOM_SID *sid,
1332                            const uint8 nt_pass[NT_HASH_LEN])
1333 {
1334         struct cache_entry *centry;
1335         fstring sid_string;
1336         uint32 rid;
1337         uint8 cred_salt[NT_HASH_LEN];
1338         uint8 salted_hash[NT_HASH_LEN];
1339
1340         if (is_null_sid(sid)) {
1341                 return NT_STATUS_INVALID_SID;
1342         }
1343
1344         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1345                 return NT_STATUS_INVALID_SID;
1346         }
1347
1348         centry = centry_start(domain, NT_STATUS_OK);
1349         if (!centry) {
1350                 return NT_STATUS_INTERNAL_DB_ERROR;
1351         }
1352
1353         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1354
1355         centry_put_time(centry, time(NULL));
1356
1357         /* Create a salt and then salt the hash. */
1358         generate_random_buffer(cred_salt, NT_HASH_LEN);
1359         E_md5hash(cred_salt, nt_pass, salted_hash);
1360
1361         centry_put_hash16(centry, salted_hash);
1362         centry_put_hash16(centry, cred_salt);
1363         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1364
1365         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1366
1367         centry_free(centry);
1368
1369         return NT_STATUS_OK;
1370 }
1371
1372
1373 /* Query display info. This is the basic user list fn */
1374 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1375                                 TALLOC_CTX *mem_ctx,
1376                                 uint32 *num_entries,
1377                                 struct wbint_userinfo **info)
1378 {
1379         struct winbind_cache *cache = get_cache(domain);
1380         struct cache_entry *centry = NULL;
1381         NTSTATUS status;
1382         unsigned int i, retry;
1383
1384         if (!cache->tdb)
1385                 goto do_query;
1386
1387         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1388         if (!centry)
1389                 goto do_query;
1390
1391         *num_entries = centry_uint32(centry);
1392
1393         if (*num_entries == 0)
1394                 goto do_cached;
1395
1396         (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1397         if (! (*info)) {
1398                 smb_panic_fn("query_user_list out of memory");
1399         }
1400         for (i=0; i<(*num_entries); i++) {
1401                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1402                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1403                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1404                 (*info)[i].shell = centry_string(centry, mem_ctx);
1405                 centry_sid(centry, &(*info)[i].user_sid);
1406                 centry_sid(centry, &(*info)[i].group_sid);
1407         }
1408
1409 do_cached:
1410         status = centry->status;
1411
1412         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1413                 domain->name, nt_errstr(status) ));
1414
1415         centry_free(centry);
1416         return status;
1417
1418 do_query:
1419         *num_entries = 0;
1420         *info = NULL;
1421
1422         /* Return status value returned by seq number check */
1423
1424         if (!NT_STATUS_IS_OK(domain->last_status))
1425                 return domain->last_status;
1426
1427         /* Put the query_user_list() in a retry loop.  There appears to be
1428          * some bug either with Windows 2000 or Samba's handling of large
1429          * rpc replies.  This manifests itself as sudden disconnection
1430          * at a random point in the enumeration of a large (60k) user list.
1431          * The retry loop simply tries the operation again. )-:  It's not
1432          * pretty but an acceptable workaround until we work out what the
1433          * real problem is. */
1434
1435         retry = 0;
1436         do {
1437
1438                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1439                         domain->name ));
1440
1441                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1442                 if (!NT_STATUS_IS_OK(status)) {
1443                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1444                                   "retrying\n", NT_STATUS_V(status)));
1445                 }
1446                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1447                         DEBUG(3, ("query_user_list: flushing "
1448                                   "connection cache\n"));
1449                         invalidate_cm_connection(&domain->conn);
1450                 }
1451
1452         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1453                  (retry++ < 5));
1454
1455         /* and save it */
1456         refresh_sequence_number(domain, false);
1457         centry = centry_start(domain, status);
1458         if (!centry)
1459                 goto skip_save;
1460         centry_put_uint32(centry, *num_entries);
1461         for (i=0; i<(*num_entries); i++) {
1462                 centry_put_string(centry, (*info)[i].acct_name);
1463                 centry_put_string(centry, (*info)[i].full_name);
1464                 centry_put_string(centry, (*info)[i].homedir);
1465                 centry_put_string(centry, (*info)[i].shell);
1466                 centry_put_sid(centry, &(*info)[i].user_sid);
1467                 centry_put_sid(centry, &(*info)[i].group_sid);
1468                 if (domain->backend && domain->backend->consistent) {
1469                         /* when the backend is consistent we can pre-prime some mappings */
1470                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1471                                                 domain->name,
1472                                                 (*info)[i].acct_name,
1473                                                 &(*info)[i].user_sid,
1474                                                 SID_NAME_USER);
1475                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1476                                                 &(*info)[i].user_sid,
1477                                                 domain->name,
1478                                                 (*info)[i].acct_name,
1479                                                 SID_NAME_USER);
1480                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1481                 }
1482         }
1483         centry_end(centry, "UL/%s", domain->name);
1484         centry_free(centry);
1485
1486 skip_save:
1487         return status;
1488 }
1489
1490 /* list all domain groups */
1491 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1492                                 TALLOC_CTX *mem_ctx,
1493                                 uint32 *num_entries,
1494                                 struct acct_info **info)
1495 {
1496         struct winbind_cache *cache = get_cache(domain);
1497         struct cache_entry *centry = NULL;
1498         NTSTATUS status;
1499         unsigned int i;
1500
1501         if (!cache->tdb)
1502                 goto do_query;
1503
1504         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1505         if (!centry)
1506                 goto do_query;
1507
1508         *num_entries = centry_uint32(centry);
1509
1510         if (*num_entries == 0)
1511                 goto do_cached;
1512
1513         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1514         if (! (*info)) {
1515                 smb_panic_fn("enum_dom_groups out of memory");
1516         }
1517         for (i=0; i<(*num_entries); i++) {
1518                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1519                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1520                 (*info)[i].rid = centry_uint32(centry);
1521         }
1522
1523 do_cached:
1524         status = centry->status;
1525
1526         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1527                 domain->name, nt_errstr(status) ));
1528
1529         centry_free(centry);
1530         return status;
1531
1532 do_query:
1533         *num_entries = 0;
1534         *info = NULL;
1535
1536         /* Return status value returned by seq number check */
1537
1538         if (!NT_STATUS_IS_OK(domain->last_status))
1539                 return domain->last_status;
1540
1541         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1542                 domain->name ));
1543
1544         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1545
1546         /* and save it */
1547         refresh_sequence_number(domain, false);
1548         centry = centry_start(domain, status);
1549         if (!centry)
1550                 goto skip_save;
1551         centry_put_uint32(centry, *num_entries);
1552         for (i=0; i<(*num_entries); i++) {
1553                 centry_put_string(centry, (*info)[i].acct_name);
1554                 centry_put_string(centry, (*info)[i].acct_desc);
1555                 centry_put_uint32(centry, (*info)[i].rid);
1556         }
1557         centry_end(centry, "GL/%s/domain", domain->name);
1558         centry_free(centry);
1559
1560 skip_save:
1561         return status;
1562 }
1563
1564 /* list all domain groups */
1565 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1566                                 TALLOC_CTX *mem_ctx,
1567                                 uint32 *num_entries,
1568                                 struct acct_info **info)
1569 {
1570         struct winbind_cache *cache = get_cache(domain);
1571         struct cache_entry *centry = NULL;
1572         NTSTATUS status;
1573         unsigned int i;
1574
1575         if (!cache->tdb)
1576                 goto do_query;
1577
1578         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1579         if (!centry)
1580                 goto do_query;
1581
1582         *num_entries = centry_uint32(centry);
1583
1584         if (*num_entries == 0)
1585                 goto do_cached;
1586
1587         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1588         if (! (*info)) {
1589                 smb_panic_fn("enum_dom_groups out of memory");
1590         }
1591         for (i=0; i<(*num_entries); i++) {
1592                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1593                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1594                 (*info)[i].rid = centry_uint32(centry);
1595         }
1596
1597 do_cached:
1598
1599         /* If we are returning cached data and the domain controller
1600            is down then we don't know whether the data is up to date
1601            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1602            indicate this. */
1603
1604         if (wcache_server_down(domain)) {
1605                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1606                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1607         } else
1608                 status = centry->status;
1609
1610         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1611                 domain->name, nt_errstr(status) ));
1612
1613         centry_free(centry);
1614         return status;
1615
1616 do_query:
1617         *num_entries = 0;
1618         *info = NULL;
1619
1620         /* Return status value returned by seq number check */
1621
1622         if (!NT_STATUS_IS_OK(domain->last_status))
1623                 return domain->last_status;
1624
1625         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1626                 domain->name ));
1627
1628         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1629
1630         /* and save it */
1631         refresh_sequence_number(domain, false);
1632         centry = centry_start(domain, status);
1633         if (!centry)
1634                 goto skip_save;
1635         centry_put_uint32(centry, *num_entries);
1636         for (i=0; i<(*num_entries); i++) {
1637                 centry_put_string(centry, (*info)[i].acct_name);
1638                 centry_put_string(centry, (*info)[i].acct_desc);
1639                 centry_put_uint32(centry, (*info)[i].rid);
1640         }
1641         centry_end(centry, "GL/%s/local", domain->name);
1642         centry_free(centry);
1643
1644 skip_save:
1645         return status;
1646 }
1647
1648 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1649                             const char *domain_name,
1650                             const char *name,
1651                             struct dom_sid *sid,
1652                             enum lsa_SidType *type)
1653 {
1654         struct winbind_cache *cache = get_cache(domain);
1655         struct cache_entry *centry;
1656         NTSTATUS status;
1657         char *uname;
1658
1659         if (cache->tdb == NULL) {
1660                 return NT_STATUS_NOT_FOUND;
1661         }
1662
1663         uname = talloc_strdup_upper(talloc_tos(), name);
1664         if (uname == NULL) {
1665                 return NT_STATUS_NO_MEMORY;
1666         }
1667
1668         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1669         TALLOC_FREE(uname);
1670         if (centry == NULL) {
1671                 return NT_STATUS_NOT_FOUND;
1672         }
1673
1674         status = centry->status;
1675         if (NT_STATUS_IS_OK(status)) {
1676                 *type = (enum lsa_SidType)centry_uint32(centry);
1677                 centry_sid(centry, sid);
1678         }
1679
1680         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1681                   "%s\n", domain->name, nt_errstr(status) ));
1682
1683         centry_free(centry);
1684         return status;
1685 }
1686
1687 /* convert a single name to a sid in a domain */
1688 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1689                             TALLOC_CTX *mem_ctx,
1690                             const char *domain_name,
1691                             const char *name,
1692                             uint32_t flags,
1693                             DOM_SID *sid,
1694                             enum lsa_SidType *type)
1695 {
1696         NTSTATUS status;
1697
1698         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1699         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1700                 return status;
1701         }
1702
1703         ZERO_STRUCTP(sid);
1704
1705         /* If the seq number check indicated that there is a problem
1706          * with this DC, then return that status... except for
1707          * access_denied.  This is special because the dc may be in
1708          * "restrict anonymous = 1" mode, in which case it will deny
1709          * most unauthenticated operations, but *will* allow the LSA
1710          * name-to-sid that we try as a fallback. */
1711
1712         if (!(NT_STATUS_IS_OK(domain->last_status)
1713               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1714                 return domain->last_status;
1715
1716         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1717                 domain->name ));
1718
1719         status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1720                                               name, flags, sid, type);
1721
1722         /* and save it */
1723         refresh_sequence_number(domain, false);
1724
1725         if (domain->online &&
1726             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1727                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1728
1729                 /* Only save the reverse mapping if this was not a UPN */
1730                 if (!strchr(name, '@')) {
1731                         strupper_m(CONST_DISCARD(char *,domain_name));
1732                         strlower_m(CONST_DISCARD(char *,name));
1733                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1734                 }
1735         }
1736
1737         return status;
1738 }
1739
1740 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1741                             const struct dom_sid *sid,
1742                             TALLOC_CTX *mem_ctx,
1743                             char **domain_name,
1744                             char **name,
1745                             enum lsa_SidType *type)
1746 {
1747         struct winbind_cache *cache = get_cache(domain);
1748         struct cache_entry *centry;
1749         char *sid_string;
1750         NTSTATUS status;
1751
1752         if (cache->tdb == NULL) {
1753                 return NT_STATUS_NOT_FOUND;
1754         }
1755
1756         sid_string = sid_string_tos(sid);
1757         if (sid_string == NULL) {
1758                 return NT_STATUS_NO_MEMORY;
1759         }
1760
1761         centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1762         TALLOC_FREE(sid_string);
1763         if (centry == NULL) {
1764                 return NT_STATUS_NOT_FOUND;
1765         }
1766
1767         if (NT_STATUS_IS_OK(centry->status)) {
1768                 *type = (enum lsa_SidType)centry_uint32(centry);
1769                 *domain_name = centry_string(centry, mem_ctx);
1770                 *name = centry_string(centry, mem_ctx);
1771         }
1772
1773         status = centry->status;
1774         centry_free(centry);
1775
1776         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1777                   "%s\n", domain->name, nt_errstr(status) ));
1778
1779         return status;
1780 }
1781
1782 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1783    given */
1784 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1785                             TALLOC_CTX *mem_ctx,
1786                             const DOM_SID *sid,
1787                             char **domain_name,
1788                             char **name,
1789                             enum lsa_SidType *type)
1790 {
1791         NTSTATUS status;
1792
1793         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1794                                     type);
1795         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1796                 return status;
1797         }
1798
1799         *name = NULL;
1800         *domain_name = NULL;
1801
1802         /* If the seq number check indicated that there is a problem
1803          * with this DC, then return that status... except for
1804          * access_denied.  This is special because the dc may be in
1805          * "restrict anonymous = 1" mode, in which case it will deny
1806          * most unauthenticated operations, but *will* allow the LSA
1807          * sid-to-name that we try as a fallback. */
1808
1809         if (!(NT_STATUS_IS_OK(domain->last_status)
1810               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1811                 return domain->last_status;
1812
1813         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1814                 domain->name ));
1815
1816         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1817
1818         /* and save it */
1819         refresh_sequence_number(domain, false);
1820         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1821
1822         /* We can't save the name to sid mapping here, as with sid history a
1823          * later name2sid would give the wrong sid. */
1824
1825         return status;
1826 }
1827
1828 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1829                               TALLOC_CTX *mem_ctx,
1830                               const DOM_SID *domain_sid,
1831                               uint32 *rids,
1832                               size_t num_rids,
1833                               char **domain_name,
1834                               char ***names,
1835                               enum lsa_SidType **types)
1836 {
1837         struct winbind_cache *cache = get_cache(domain);
1838         size_t i;
1839         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1840         bool have_mapped;
1841         bool have_unmapped;
1842
1843         *domain_name = NULL;
1844         *names = NULL;
1845         *types = NULL;
1846
1847         if (!cache->tdb) {
1848                 goto do_query;
1849         }
1850
1851         if (num_rids == 0) {
1852                 return NT_STATUS_OK;
1853         }
1854
1855         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1856         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1857
1858         if ((*names == NULL) || (*types == NULL)) {
1859                 result = NT_STATUS_NO_MEMORY;
1860                 goto error;
1861         }
1862
1863         have_mapped = have_unmapped = false;
1864
1865         for (i=0; i<num_rids; i++) {
1866                 DOM_SID sid;
1867                 struct cache_entry *centry;
1868                 fstring tmp;
1869
1870                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1871                         result = NT_STATUS_INTERNAL_ERROR;
1872                         goto error;
1873                 }
1874
1875                 centry = wcache_fetch(cache, domain, "SN/%s",
1876                                       sid_to_fstring(tmp, &sid));
1877                 if (!centry) {
1878                         goto do_query;
1879                 }
1880
1881                 (*types)[i] = SID_NAME_UNKNOWN;
1882                 (*names)[i] = talloc_strdup(*names, "");
1883
1884                 if (NT_STATUS_IS_OK(centry->status)) {
1885                         char *dom;
1886                         have_mapped = true;
1887                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1888
1889                         dom = centry_string(centry, mem_ctx);
1890                         if (*domain_name == NULL) {
1891                                 *domain_name = dom;
1892                         } else {
1893                                 talloc_free(dom);
1894                         }
1895
1896                         (*names)[i] = centry_string(centry, *names);
1897
1898                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1899                         have_unmapped = true;
1900
1901                 } else {
1902                         /* something's definitely wrong */
1903                         result = centry->status;
1904                         goto error;
1905                 }
1906
1907                 centry_free(centry);
1908         }
1909
1910         if (!have_mapped) {
1911                 return NT_STATUS_NONE_MAPPED;
1912         }
1913         if (!have_unmapped) {
1914                 return NT_STATUS_OK;
1915         }
1916         return STATUS_SOME_UNMAPPED;
1917
1918  do_query:
1919
1920         TALLOC_FREE(*names);
1921         TALLOC_FREE(*types);
1922
1923         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1924                                                 rids, num_rids, domain_name,
1925                                                 names, types);
1926
1927         /*
1928           None of the queried rids has been found so save all negative entries
1929         */
1930         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1931                 for (i = 0; i < num_rids; i++) {
1932                         DOM_SID sid;
1933                         const char *name = "";
1934                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
1935                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
1936
1937                         if (!sid_compose(&sid, domain_sid, rids[i])) {
1938                                 return NT_STATUS_INTERNAL_ERROR;
1939                         }
1940
1941                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1942                                                 name, type);
1943                 }
1944
1945                 return result;
1946         }
1947
1948         /*
1949           Some or all of the queried rids have been found.
1950         */
1951         if (!NT_STATUS_IS_OK(result) &&
1952             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1953                 return result;
1954         }
1955
1956         refresh_sequence_number(domain, false);
1957
1958         for (i=0; i<num_rids; i++) {
1959                 DOM_SID sid;
1960                 NTSTATUS status;
1961
1962                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1963                         result = NT_STATUS_INTERNAL_ERROR;
1964                         goto error;
1965                 }
1966
1967                 status = (*types)[i] == SID_NAME_UNKNOWN ?
1968                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1969
1970                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1971                                         (*names)[i], (*types)[i]);
1972         }
1973
1974         return result;
1975
1976  error:
1977         TALLOC_FREE(*names);
1978         TALLOC_FREE(*types);
1979         return result;
1980 }
1981
1982 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
1983                            TALLOC_CTX *mem_ctx,
1984                            const struct dom_sid *user_sid,
1985                            struct wbint_userinfo *info)
1986 {
1987         struct winbind_cache *cache = get_cache(domain);
1988         struct cache_entry *centry = NULL;
1989         NTSTATUS status;
1990         char *sid_string;
1991
1992         if (cache->tdb == NULL) {
1993                 return NT_STATUS_NOT_FOUND;
1994         }
1995
1996         sid_string = sid_string_tos(user_sid);
1997         if (sid_string == NULL) {
1998                 return NT_STATUS_NO_MEMORY;
1999         }
2000
2001         centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2002         TALLOC_FREE(sid_string);
2003         if (centry == NULL) {
2004                 return NT_STATUS_NOT_FOUND;
2005         }
2006
2007         /*
2008          * If we have an access denied cache entry and a cached info3
2009          * in the samlogon cache then do a query.  This will force the
2010          * rpc back end to return the info3 data.
2011          */
2012
2013         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2014             netsamlogon_cache_have(user_sid)) {
2015                 DEBUG(10, ("query_user: cached access denied and have cached "
2016                            "info3\n"));
2017                 domain->last_status = NT_STATUS_OK;
2018                 centry_free(centry);
2019                 return NT_STATUS_NOT_FOUND;
2020         }
2021
2022         /* if status is not ok then this is a negative hit
2023            and the rest of the data doesn't matter */
2024         status = centry->status;
2025         if (NT_STATUS_IS_OK(status)) {
2026                 info->acct_name = centry_string(centry, mem_ctx);
2027                 info->full_name = centry_string(centry, mem_ctx);
2028                 info->homedir = centry_string(centry, mem_ctx);
2029                 info->shell = centry_string(centry, mem_ctx);
2030                 info->primary_gid = centry_uint32(centry);
2031                 centry_sid(centry, &info->user_sid);
2032                 centry_sid(centry, &info->group_sid);
2033         }
2034
2035         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2036                   "%s\n", domain->name, nt_errstr(status) ));
2037
2038         centry_free(centry);
2039         return status;
2040 }
2041
2042 /* Lookup user information from a rid */
2043 static NTSTATUS query_user(struct winbindd_domain *domain,
2044                            TALLOC_CTX *mem_ctx,
2045                            const DOM_SID *user_sid,
2046                            struct wbint_userinfo *info)
2047 {
2048         NTSTATUS status;
2049
2050         status = wcache_query_user(domain, mem_ctx, user_sid, info);
2051         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2052                 return status;
2053         }
2054
2055         ZERO_STRUCTP(info);
2056
2057         /* Return status value returned by seq number check */
2058
2059         if (!NT_STATUS_IS_OK(domain->last_status))
2060                 return domain->last_status;
2061
2062         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2063                 domain->name ));
2064
2065         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2066
2067         /* and save it */
2068         refresh_sequence_number(domain, false);
2069         wcache_save_user(domain, status, info);
2070
2071         return status;
2072 }
2073
2074 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2075                                   TALLOC_CTX *mem_ctx,
2076                                   const struct dom_sid *user_sid,
2077                                   uint32_t *pnum_sids,
2078                                   struct dom_sid **psids)
2079 {
2080         struct winbind_cache *cache = get_cache(domain);
2081         struct cache_entry *centry = NULL;
2082         NTSTATUS status;
2083         uint32_t i, num_sids;
2084         struct dom_sid *sids;
2085         fstring sid_string;
2086
2087         if (cache->tdb == NULL) {
2088                 return NT_STATUS_NOT_FOUND;
2089         }
2090
2091         centry = wcache_fetch(cache, domain, "UG/%s",
2092                               sid_to_fstring(sid_string, user_sid));
2093         if (centry == NULL) {
2094                 return NT_STATUS_NOT_FOUND;
2095         }
2096
2097         /* If we have an access denied cache entry and a cached info3 in the
2098            samlogon cache then do a query.  This will force the rpc back end
2099            to return the info3 data. */
2100
2101         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2102             && netsamlogon_cache_have(user_sid)) {
2103                 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2104                            "cached info3\n"));
2105                 domain->last_status = NT_STATUS_OK;
2106                 centry_free(centry);
2107                 return NT_STATUS_NOT_FOUND;
2108         }
2109
2110         num_sids = centry_uint32(centry);
2111         sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2112         if (sids == NULL) {
2113                 return NT_STATUS_NO_MEMORY;
2114         }
2115
2116         for (i=0; i<num_sids; i++) {
2117                 centry_sid(centry, &sids[i]);
2118         }
2119
2120         status = centry->status;
2121
2122         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2123                   "status: %s\n", domain->name, nt_errstr(status)));
2124
2125         centry_free(centry);
2126
2127         *pnum_sids = num_sids;
2128         *psids = sids;
2129         return status;
2130 }
2131
2132 /* Lookup groups a user is a member of. */
2133 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2134                                   TALLOC_CTX *mem_ctx,
2135                                   const DOM_SID *user_sid,
2136                                   uint32 *num_groups, DOM_SID **user_gids)
2137 {
2138         struct cache_entry *centry = NULL;
2139         NTSTATUS status;
2140         unsigned int i;
2141         fstring sid_string;
2142
2143         status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2144                                           num_groups, user_gids);
2145         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2146                 return status;
2147         }
2148
2149         (*num_groups) = 0;
2150         (*user_gids) = NULL;
2151
2152         /* Return status value returned by seq number check */
2153
2154         if (!NT_STATUS_IS_OK(domain->last_status))
2155                 return domain->last_status;
2156
2157         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2158                 domain->name ));
2159
2160         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2161
2162         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2163                 goto skip_save;
2164
2165         /* and save it */
2166         refresh_sequence_number(domain, false);
2167         centry = centry_start(domain, status);
2168         if (!centry)
2169                 goto skip_save;
2170
2171         centry_put_uint32(centry, *num_groups);
2172         for (i=0; i<(*num_groups); i++) {
2173                 centry_put_sid(centry, &(*user_gids)[i]);
2174         }
2175
2176         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2177         centry_free(centry);
2178
2179 skip_save:
2180         return status;
2181 }
2182
2183 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2184                                  const struct dom_sid *sids)
2185 {
2186         uint32_t i;
2187         char *sidlist;
2188
2189         sidlist = talloc_strdup(mem_ctx, "");
2190         if (sidlist == NULL) {
2191                 return NULL;
2192         }
2193         for (i=0; i<num_sids; i++) {
2194                 fstring tmp;
2195                 sidlist = talloc_asprintf_append_buffer(
2196                         sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2197                 if (sidlist == NULL) {
2198                         return NULL;
2199                 }
2200         }
2201         return sidlist;
2202 }
2203
2204 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2205                                    TALLOC_CTX *mem_ctx, uint32_t num_sids,
2206                                    const struct dom_sid *sids,
2207                                    uint32_t *pnum_aliases, uint32_t **paliases)
2208 {
2209         struct winbind_cache *cache = get_cache(domain);
2210         struct cache_entry *centry = NULL;
2211         uint32_t num_aliases;
2212         uint32_t *aliases;
2213         NTSTATUS status;
2214         char *sidlist;
2215         int i;
2216
2217         if (cache->tdb == NULL) {
2218                 return NT_STATUS_NOT_FOUND;
2219         }
2220
2221         if (num_sids == 0) {
2222                 *pnum_aliases = 0;
2223                 *paliases = NULL;
2224                 return NT_STATUS_OK;
2225         }
2226
2227         /* We need to cache indexed by the whole list of SIDs, the aliases
2228          * resulting might come from any of the SIDs. */
2229
2230         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2231         if (sidlist == NULL) {
2232                 return NT_STATUS_NO_MEMORY;
2233         }
2234
2235         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2236         TALLOC_FREE(sidlist);
2237         if (centry == NULL) {
2238                 return NT_STATUS_NOT_FOUND;
2239         }
2240
2241         num_aliases = centry_uint32(centry);
2242         aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2243         if (aliases == NULL) {
2244                 centry_free(centry);
2245                 return NT_STATUS_NO_MEMORY;
2246         }
2247
2248         for (i=0; i<num_aliases; i++) {
2249                 aliases[i] = centry_uint32(centry);
2250         }
2251
2252         status = centry->status;
2253
2254         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2255                   "status %s\n", domain->name, nt_errstr(status)));
2256
2257         centry_free(centry);
2258
2259         *pnum_aliases = num_aliases;
2260         *paliases = aliases;
2261
2262         return status;
2263 }
2264
2265 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2266                                    TALLOC_CTX *mem_ctx,
2267                                    uint32 num_sids, const DOM_SID *sids,
2268                                    uint32 *num_aliases, uint32 **alias_rids)
2269 {
2270         struct cache_entry *centry = NULL;
2271         NTSTATUS status;
2272         char *sidlist;
2273         int i;
2274
2275         status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2276                                            num_aliases, alias_rids);
2277         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2278                 return status;
2279         }
2280
2281         (*num_aliases) = 0;
2282         (*alias_rids) = NULL;
2283
2284         if (!NT_STATUS_IS_OK(domain->last_status))
2285                 return domain->last_status;
2286
2287         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2288                   "for domain %s\n", domain->name ));
2289
2290         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2291         if (sidlist == NULL) {
2292                 return NT_STATUS_NO_MEMORY;
2293         }
2294
2295         status = domain->backend->lookup_useraliases(domain, mem_ctx,
2296                                                      num_sids, sids,
2297                                                      num_aliases, alias_rids);
2298
2299         /* and save it */
2300         refresh_sequence_number(domain, false);
2301         centry = centry_start(domain, status);
2302         if (!centry)
2303                 goto skip_save;
2304         centry_put_uint32(centry, *num_aliases);
2305         for (i=0; i<(*num_aliases); i++)
2306                 centry_put_uint32(centry, (*alias_rids)[i]);
2307         centry_end(centry, "UA%s", sidlist);
2308         centry_free(centry);
2309
2310  skip_save:
2311         return status;
2312 }
2313
2314 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2315                                 TALLOC_CTX *mem_ctx,
2316                                 const struct dom_sid *group_sid,
2317                                 uint32_t *num_names,
2318                                 struct dom_sid **sid_mem, char ***names,
2319                                 uint32_t **name_types)
2320 {
2321         struct winbind_cache *cache = get_cache(domain);
2322         struct cache_entry *centry = NULL;
2323         NTSTATUS status;
2324         unsigned int i;
2325         char *sid_string;
2326
2327         if (cache->tdb == NULL) {
2328                 return NT_STATUS_NOT_FOUND;
2329         }
2330
2331         sid_string = sid_string_tos(group_sid);
2332         if (sid_string == NULL) {
2333                 return NT_STATUS_NO_MEMORY;
2334         }
2335
2336         centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2337         TALLOC_FREE(sid_string);
2338         if (centry == NULL) {
2339                 return NT_STATUS_NOT_FOUND;
2340         }
2341
2342         *sid_mem = NULL;
2343         *names = NULL;
2344         *name_types = NULL;
2345
2346         *num_names = centry_uint32(centry);
2347         if (*num_names == 0) {
2348                 centry_free(centry);
2349                 return NT_STATUS_OK;
2350         }
2351
2352         *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2353         *names = talloc_array(mem_ctx, char *, *num_names);
2354         *name_types = talloc_array(mem_ctx, uint32, *num_names);
2355
2356         if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2357                 TALLOC_FREE(*sid_mem);
2358                 TALLOC_FREE(*names);
2359                 TALLOC_FREE(*name_types);
2360                 centry_free(centry);
2361                 return NT_STATUS_NO_MEMORY;
2362         }
2363
2364         for (i=0; i<(*num_names); i++) {
2365                 centry_sid(centry, &(*sid_mem)[i]);
2366                 (*names)[i] = centry_string(centry, mem_ctx);
2367                 (*name_types)[i] = centry_uint32(centry);
2368         }
2369
2370         status = centry->status;
2371
2372         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2373                   "status: %s\n", domain->name, nt_errstr(status)));
2374
2375         centry_free(centry);
2376         return status;
2377 }
2378
2379 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2380                                 TALLOC_CTX *mem_ctx,
2381                                 const DOM_SID *group_sid, uint32 *num_names,
2382                                 DOM_SID **sid_mem, char ***names,
2383                                 uint32 **name_types)
2384 {
2385         struct cache_entry *centry = NULL;
2386         NTSTATUS status;
2387         unsigned int i;
2388         fstring sid_string;
2389
2390         status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2391                                         sid_mem, names, name_types);
2392         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2393                 return status;
2394         }
2395
2396         (*num_names) = 0;
2397         (*sid_mem) = NULL;
2398         (*names) = NULL;
2399         (*name_types) = NULL;
2400
2401         /* Return status value returned by seq number check */
2402
2403         if (!NT_STATUS_IS_OK(domain->last_status))
2404                 return domain->last_status;
2405
2406         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2407                 domain->name ));
2408
2409         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2410                                                   sid_mem, names, name_types);
2411
2412         /* and save it */
2413         refresh_sequence_number(domain, false);
2414         centry = centry_start(domain, status);
2415         if (!centry)
2416                 goto skip_save;
2417         centry_put_uint32(centry, *num_names);
2418         for (i=0; i<(*num_names); i++) {
2419                 centry_put_sid(centry, &(*sid_mem)[i]);
2420                 centry_put_string(centry, (*names)[i]);
2421                 centry_put_uint32(centry, (*name_types)[i]);
2422         }
2423         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2424         centry_free(centry);
2425
2426 skip_save:
2427         return status;
2428 }
2429
2430 /* find the sequence number for a domain */
2431 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2432 {
2433         refresh_sequence_number(domain, false);
2434
2435         *seq = domain->sequence_number;
2436
2437         return NT_STATUS_OK;
2438 }
2439
2440 /* enumerate trusted domains
2441  * (we need to have the list of trustdoms in the cache when we go offline) -
2442  * Guenther */
2443 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2444                                 TALLOC_CTX *mem_ctx,
2445                                 uint32 *num_domains,
2446                                 char ***names,
2447                                 char ***alt_names,
2448                                 DOM_SID **dom_sids)
2449 {
2450         struct winbind_cache *cache = get_cache(domain);
2451         struct cache_entry *centry = NULL;
2452         NTSTATUS status;
2453         int i;
2454
2455         if (!cache->tdb)
2456                 goto do_query;
2457
2458         centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2459
2460         if (!centry) {
2461                 goto do_query;
2462         }
2463
2464         *num_domains = centry_uint32(centry);
2465
2466         if (*num_domains) {
2467                 (*names)        = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2468                 (*alt_names)    = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2469                 (*dom_sids)     = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2470
2471                 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2472                         smb_panic_fn("trusted_domains out of memory");
2473                 }
2474         } else {
2475                 (*names) = NULL;
2476                 (*alt_names) = NULL;
2477                 (*dom_sids) = NULL;
2478         }
2479
2480         for (i=0; i<(*num_domains); i++) {
2481                 (*names)[i] = centry_string(centry, mem_ctx);
2482                 (*alt_names)[i] = centry_string(centry, mem_ctx);
2483                 if (!centry_sid(centry, &(*dom_sids)[i])) {
2484                         sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2485                 }
2486         }
2487
2488         status = centry->status;
2489
2490         DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2491                 domain->name, *num_domains, nt_errstr(status) ));
2492
2493         centry_free(centry);
2494         return status;
2495
2496 do_query:
2497         (*num_domains) = 0;
2498         (*dom_sids) = NULL;
2499         (*names) = NULL;
2500         (*alt_names) = NULL;
2501
2502         /* Return status value returned by seq number check */
2503
2504         if (!NT_STATUS_IS_OK(domain->last_status))
2505                 return domain->last_status;
2506
2507         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2508                 domain->name ));
2509
2510         status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2511                                                 names, alt_names, dom_sids);
2512
2513         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2514          * so that the generic centry handling still applies correctly -
2515          * Guenther*/
2516
2517         if (!NT_STATUS_IS_ERR(status)) {
2518                 status = NT_STATUS_OK;
2519         }
2520
2521
2522 #if 0    /* Disabled as we want the trust dom list to be managed by
2523             the main parent and always to make the query.  --jerry */
2524
2525         /* and save it */
2526         refresh_sequence_number(domain, false);
2527
2528         centry = centry_start(domain, status);
2529         if (!centry)
2530                 goto skip_save;
2531
2532         centry_put_uint32(centry, *num_domains);
2533
2534         for (i=0; i<(*num_domains); i++) {
2535                 centry_put_string(centry, (*names)[i]);
2536                 centry_put_string(centry, (*alt_names)[i]);
2537                 centry_put_sid(centry, &(*dom_sids)[i]);
2538         }
2539
2540         centry_end(centry, "TRUSTDOMS/%s", domain->name);
2541
2542         centry_free(centry);
2543
2544 skip_save:
2545 #endif
2546
2547         return status;
2548 }
2549
2550 /* get lockout policy */
2551 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2552                                TALLOC_CTX *mem_ctx,
2553                                struct samr_DomInfo12 *policy)
2554 {
2555         struct winbind_cache *cache = get_cache(domain);
2556         struct cache_entry *centry = NULL;
2557         NTSTATUS status;
2558
2559         if (!cache->tdb)
2560                 goto do_query;
2561
2562         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2563
2564         if (!centry)
2565                 goto do_query;
2566
2567         policy->lockout_duration = centry_nttime(centry);
2568         policy->lockout_window = centry_nttime(centry);
2569         policy->lockout_threshold = centry_uint16(centry);
2570
2571         status = centry->status;
2572
2573         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2574                 domain->name, nt_errstr(status) ));
2575
2576         centry_free(centry);
2577         return status;
2578
2579 do_query:
2580         ZERO_STRUCTP(policy);
2581
2582         /* Return status value returned by seq number check */
2583
2584         if (!NT_STATUS_IS_OK(domain->last_status))
2585                 return domain->last_status;
2586
2587         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2588                 domain->name ));
2589
2590         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2591
2592         /* and save it */
2593         refresh_sequence_number(domain, false);
2594         wcache_save_lockout_policy(domain, status, policy);
2595
2596         return status;
2597 }
2598
2599 /* get password policy */
2600 static NTSTATUS password_policy(struct winbindd_domain *domain,
2601                                 TALLOC_CTX *mem_ctx,
2602                                 struct samr_DomInfo1 *policy)
2603 {
2604         struct winbind_cache *cache = get_cache(domain);
2605         struct cache_entry *centry = NULL;
2606         NTSTATUS status;
2607
2608         if (!cache->tdb)
2609                 goto do_query;
2610
2611         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2612
2613         if (!centry)
2614                 goto do_query;
2615
2616         policy->min_password_length = centry_uint16(centry);
2617         policy->password_history_length = centry_uint16(centry);
2618         policy->password_properties = centry_uint32(centry);
2619         policy->max_password_age = centry_nttime(centry);
2620         policy->min_password_age = centry_nttime(centry);
2621
2622         status = centry->status;
2623
2624         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2625                 domain->name, nt_errstr(status) ));
2626
2627         centry_free(centry);
2628         return status;
2629
2630 do_query:
2631         ZERO_STRUCTP(policy);
2632
2633         /* Return status value returned by seq number check */
2634
2635         if (!NT_STATUS_IS_OK(domain->last_status))
2636                 return domain->last_status;
2637
2638         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2639                 domain->name ));
2640
2641         status = domain->backend->password_policy(domain, mem_ctx, policy);
2642
2643         /* and save it */
2644         refresh_sequence_number(domain, false);
2645         if (NT_STATUS_IS_OK(status)) {
2646                 wcache_save_password_policy(domain, status, policy);
2647         }
2648
2649         return status;
2650 }
2651
2652
2653 /* Invalidate cached user and group lists coherently */
2654
2655 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2656                        void *state)
2657 {
2658         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2659             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2660                 tdb_delete(the_tdb, kbuf);
2661
2662         return 0;
2663 }
2664
2665 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2666
2667 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2668                                 struct netr_SamInfo3 *info3)
2669 {
2670         DOM_SID sid;
2671         fstring key_str, sid_string;
2672         struct winbind_cache *cache;
2673
2674         /* dont clear cached U/SID and UG/SID entries when we want to logon
2675          * offline - gd */
2676
2677         if (lp_winbind_offline_logon()) {
2678                 return;
2679         }
2680
2681         if (!domain)
2682                 return;
2683
2684         cache = get_cache(domain);
2685
2686         if (!cache->tdb) {
2687                 return;
2688         }
2689
2690         sid_copy(&sid, info3->base.domain_sid);
2691         sid_append_rid(&sid, info3->base.rid);
2692
2693         /* Clear U/SID cache entry */
2694         fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2695         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2696         tdb_delete(cache->tdb, string_tdb_data(key_str));
2697
2698         /* Clear UG/SID cache entry */
2699         fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2700         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2701         tdb_delete(cache->tdb, string_tdb_data(key_str));
2702
2703         /* Samba/winbindd never needs this. */
2704         netsamlogon_clear_cached_user(info3);
2705 }
2706
2707 bool wcache_invalidate_cache(void)
2708 {
2709         struct winbindd_domain *domain;
2710
2711         for (domain = domain_list(); domain; domain = domain->next) {
2712                 struct winbind_cache *cache = get_cache(domain);
2713
2714                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2715                            "entries for %s\n", domain->name));
2716                 if (cache) {
2717                         if (cache->tdb) {
2718                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
2719                         } else {
2720                                 return false;
2721                         }
2722                 }
2723         }
2724         return true;
2725 }
2726
2727 bool init_wcache(void)
2728 {
2729         if (wcache == NULL) {
2730                 wcache = SMB_XMALLOC_P(struct winbind_cache);
2731                 ZERO_STRUCTP(wcache);
2732         }
2733
2734         if (wcache->tdb != NULL)
2735                 return true;
2736
2737         /* when working offline we must not clear the cache on restart */
2738         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2739                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2740                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2741                                 O_RDWR|O_CREAT, 0600);
2742
2743         if (wcache->tdb == NULL) {
2744                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2745                 return false;
2746         }
2747
2748         return true;
2749 }
2750
2751 /************************************************************************
2752  This is called by the parent to initialize the cache file.
2753  We don't need sophisticated locking here as we know we're the
2754  only opener.
2755 ************************************************************************/
2756
2757 bool initialize_winbindd_cache(void)
2758 {
2759         bool cache_bad = true;
2760         uint32 vers;
2761
2762         if (!init_wcache()) {
2763                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2764                 return false;
2765         }
2766
2767         /* Check version number. */
2768         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2769                         vers == WINBINDD_CACHE_VERSION) {
2770                 cache_bad = false;
2771         }
2772
2773         if (cache_bad) {
2774                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2775                         "and re-creating with version number %d\n",
2776                         WINBINDD_CACHE_VERSION ));
2777
2778                 tdb_close(wcache->tdb);
2779                 wcache->tdb = NULL;
2780
2781                 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2782                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2783                                 cache_path("winbindd_cache.tdb"),
2784                                 strerror(errno) ));
2785                         return false;
2786                 }
2787                 if (!init_wcache()) {
2788                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
2789                                         "init_wcache failed.\n"));
2790                         return false;
2791                 }
2792
2793                 /* Write the version. */
2794                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2795                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2796                                 tdb_errorstr(wcache->tdb) ));
2797                         return false;
2798                 }
2799         }
2800
2801         tdb_close(wcache->tdb);
2802         wcache->tdb = NULL;
2803         return true;
2804 }
2805
2806 void close_winbindd_cache(void)
2807 {
2808         if (!wcache) {
2809                 return;
2810         }
2811         if (wcache->tdb) {
2812                 tdb_close(wcache->tdb);
2813                 wcache->tdb = NULL;
2814         }
2815 }
2816
2817 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2818                        char **domain_name, char **name,
2819                        enum lsa_SidType *type)
2820 {
2821         struct winbindd_domain *domain;
2822         NTSTATUS status;
2823
2824         domain = find_lookup_domain_from_sid(sid);
2825         if (domain == NULL) {
2826                 return false;
2827         }
2828         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
2829                                     type);
2830         return NT_STATUS_IS_OK(status);
2831 }
2832
2833 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2834                         const char *domain_name,
2835                         const char *name,
2836                         DOM_SID *sid,
2837                         enum lsa_SidType *type)
2838 {
2839         struct winbindd_domain *domain;
2840         NTSTATUS status;
2841         bool original_online_state;
2842
2843         domain = find_lookup_domain_from_name(domain_name);
2844         if (domain == NULL) {
2845                 return false;
2846         }
2847
2848         /* If we are doing a cached logon, temporarily set the domain
2849            offline so the cache won't expire the entry */
2850
2851         original_online_state = domain->online;
2852         domain->online = false;
2853         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
2854         domain->online = original_online_state;
2855
2856         return NT_STATUS_IS_OK(status);
2857 }
2858
2859 void cache_name2sid(struct winbindd_domain *domain,
2860                     const char *domain_name, const char *name,
2861                     enum lsa_SidType type, const DOM_SID *sid)
2862 {
2863         refresh_sequence_number(domain, false);
2864         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2865                                 sid, type);
2866 }
2867
2868 /*
2869  * The original idea that this cache only contains centries has
2870  * been blurred - now other stuff gets put in here. Ensure we
2871  * ignore these things on cleanup.
2872  */
2873
2874 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2875                                TDB_DATA dbuf, void *state)
2876 {
2877         struct cache_entry *centry;
2878
2879         if (is_non_centry_key(kbuf)) {
2880                 return 0;
2881         }
2882
2883         centry = wcache_fetch_raw((char *)kbuf.dptr);
2884         if (!centry) {
2885                 return 0;
2886         }
2887
2888         if (!NT_STATUS_IS_OK(centry->status)) {
2889                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2890                 tdb_delete(the_tdb, kbuf);
2891         }
2892
2893         centry_free(centry);
2894         return 0;
2895 }
2896
2897 /* flush the cache */
2898 void wcache_flush_cache(void)
2899 {
2900         if (!wcache)
2901                 return;
2902         if (wcache->tdb) {
2903                 tdb_close(wcache->tdb);
2904                 wcache->tdb = NULL;
2905         }
2906         if (!winbindd_use_cache()) {
2907                 return;
2908         }
2909
2910         /* when working offline we must not clear the cache on restart */
2911         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2912                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2913                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2914                                 O_RDWR|O_CREAT, 0600);
2915
2916         if (!wcache->tdb) {
2917                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2918                 return;
2919         }
2920
2921         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2922
2923         DEBUG(10,("wcache_flush_cache success\n"));
2924 }
2925
2926 /* Count cached creds */
2927
2928 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2929                                     void *state)
2930 {
2931         int *cred_count = (int*)state;
2932
2933         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2934                 (*cred_count)++;
2935         }
2936         return 0;
2937 }
2938
2939 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2940 {
2941         struct winbind_cache *cache = get_cache(domain);
2942
2943         *count = 0;
2944
2945         if (!cache->tdb) {
2946                 return NT_STATUS_INTERNAL_DB_ERROR;
2947         }
2948
2949         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2950
2951         return NT_STATUS_OK;
2952 }
2953
2954 struct cred_list {
2955         struct cred_list *prev, *next;
2956         TDB_DATA key;
2957         fstring name;
2958         time_t created;
2959 };
2960 static struct cred_list *wcache_cred_list;
2961
2962 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2963                                     void *state)
2964 {
2965         struct cred_list *cred;
2966
2967         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2968
2969                 cred = SMB_MALLOC_P(struct cred_list);
2970                 if (cred == NULL) {
2971                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2972                         return -1;
2973                 }
2974
2975                 ZERO_STRUCTP(cred);
2976
2977                 /* save a copy of the key */
2978
2979                 fstrcpy(cred->name, (const char *)kbuf.dptr);
2980                 DLIST_ADD(wcache_cred_list, cred);
2981         }
2982
2983         return 0;
2984 }
2985
2986 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2987 {
2988         struct winbind_cache *cache = get_cache(domain);
2989         NTSTATUS status;
2990         int ret;
2991         struct cred_list *cred, *oldest = NULL;
2992
2993         if (!cache->tdb) {
2994                 return NT_STATUS_INTERNAL_DB_ERROR;
2995         }
2996
2997         /* we possibly already have an entry */
2998         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2999
3000                 fstring key_str, tmp;
3001
3002                 DEBUG(11,("we already have an entry, deleting that\n"));
3003
3004                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3005
3006                 tdb_delete(cache->tdb, string_tdb_data(key_str));
3007
3008                 return NT_STATUS_OK;
3009         }
3010
3011         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3012         if (ret == 0) {
3013                 return NT_STATUS_OK;
3014         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3015                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3016         }
3017
3018         ZERO_STRUCTP(oldest);
3019
3020         for (cred = wcache_cred_list; cred; cred = cred->next) {
3021
3022                 TDB_DATA data;
3023                 time_t t;
3024
3025                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3026                 if (!data.dptr) {
3027                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3028                                 cred->name));
3029                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3030                         goto done;
3031                 }
3032
3033                 t = IVAL(data.dptr, 0);
3034                 SAFE_FREE(data.dptr);
3035
3036                 if (!oldest) {
3037                         oldest = SMB_MALLOC_P(struct cred_list);
3038                         if (oldest == NULL) {
3039                                 status = NT_STATUS_NO_MEMORY;
3040                                 goto done;
3041                         }
3042
3043                         fstrcpy(oldest->name, cred->name);
3044                         oldest->created = t;
3045                         continue;
3046                 }
3047
3048                 if (t < oldest->created) {
3049                         fstrcpy(oldest->name, cred->name);
3050                         oldest->created = t;
3051                 }
3052         }
3053
3054         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3055                 status = NT_STATUS_OK;
3056         } else {
3057                 status = NT_STATUS_UNSUCCESSFUL;
3058         }
3059 done:
3060         SAFE_FREE(wcache_cred_list);
3061         SAFE_FREE(oldest);
3062
3063         return status;
3064 }
3065
3066 /* Change the global online/offline state. */
3067 bool set_global_winbindd_state_offline(void)
3068 {
3069         TDB_DATA data;
3070
3071         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3072
3073         /* Only go offline if someone has created
3074            the key "WINBINDD_OFFLINE" in the cache tdb. */
3075
3076         if (wcache == NULL || wcache->tdb == NULL) {
3077                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3078                 return false;
3079         }
3080
3081         if (!lp_winbind_offline_logon()) {
3082                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3083                 return false;
3084         }
3085
3086         if (global_winbindd_offline_state) {
3087                 /* Already offline. */
3088                 return true;
3089         }
3090
3091         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3092
3093         if (!data.dptr || data.dsize != 4) {
3094                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3095                 SAFE_FREE(data.dptr);
3096                 return false;
3097         } else {
3098                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3099                 global_winbindd_offline_state = true;
3100                 SAFE_FREE(data.dptr);
3101                 return true;
3102         }
3103 }
3104
3105 void set_global_winbindd_state_online(void)
3106 {
3107         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3108
3109         if (!lp_winbind_offline_logon()) {
3110                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3111                 return;
3112         }
3113
3114         if (!global_winbindd_offline_state) {
3115                 /* Already online. */
3116                 return;
3117         }
3118         global_winbindd_offline_state = false;
3119
3120         if (!wcache->tdb) {
3121                 return;
3122         }
3123
3124         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3125         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3126 }
3127
3128 bool get_global_winbindd_state_offline(void)
3129 {
3130         return global_winbindd_offline_state;
3131 }
3132
3133 /***********************************************************************
3134  Validate functions for all possible cache tdb keys.
3135 ***********************************************************************/
3136
3137 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3138                                                   struct tdb_validation_status *state)
3139 {
3140         struct cache_entry *centry;
3141
3142         centry = SMB_XMALLOC_P(struct cache_entry);
3143         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3144         if (!centry->data) {
3145                 SAFE_FREE(centry);
3146                 return NULL;
3147         }
3148         centry->len = data.dsize;
3149         centry->ofs = 0;
3150
3151         if (centry->len < 8) {
3152                 /* huh? corrupt cache? */
3153                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3154                 centry_free(centry);
3155                 state->bad_entry = true;
3156                 state->success = false;
3157                 return NULL;
3158         }
3159
3160         centry->status = NT_STATUS(centry_uint32(centry));
3161         centry->sequence_number = centry_uint32(centry);
3162         return centry;
3163 }
3164
3165 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3166                            struct tdb_validation_status *state)
3167 {
3168         if (dbuf.dsize != 8) {
3169                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3170                                 keystr, (unsigned int)dbuf.dsize ));
3171                 state->bad_entry = true;
3172                 return 1;
3173         }
3174         return 0;
3175 }
3176
3177 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3178                        struct tdb_validation_status *state)
3179 {
3180         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3181         if (!centry) {
3182                 return 1;
3183         }
3184
3185         (void)centry_uint32(centry);
3186         if (NT_STATUS_IS_OK(centry->status)) {
3187                 DOM_SID sid;
3188                 (void)centry_sid(centry, &sid);
3189         }
3190
3191         centry_free(centry);
3192
3193         if (!(state->success)) {
3194                 return 1;
3195         }
3196         DEBUG(10,("validate_ns: %s ok\n", keystr));
3197         return 0;
3198 }
3199
3200 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3201                        struct tdb_validation_status *state)
3202 {
3203         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3204         if (!centry) {
3205                 return 1;
3206         }
3207
3208         if (NT_STATUS_IS_OK(centry->status)) {
3209                 (void)centry_uint32(centry);
3210                 (void)centry_string(centry, mem_ctx);
3211                 (void)centry_string(centry, mem_ctx);
3212         }
3213
3214         centry_free(centry);
3215
3216         if (!(state->success)) {
3217                 return 1;
3218         }
3219         DEBUG(10,("validate_sn: %s ok\n", keystr));
3220         return 0;
3221 }
3222
3223 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3224                       struct tdb_validation_status *state)
3225 {
3226         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3227         DOM_SID sid;
3228
3229         if (!centry) {
3230                 return 1;
3231         }
3232
3233         (void)centry_string(centry, mem_ctx);
3234         (void)centry_string(centry, mem_ctx);
3235         (void)centry_string(centry, mem_ctx);
3236         (void)centry_string(centry, mem_ctx);
3237         (void)centry_uint32(centry);
3238         (void)centry_sid(centry, &sid);
3239         (void)centry_sid(centry, &sid);
3240
3241         centry_free(centry);
3242
3243         if (!(state->success)) {
3244                 return 1;
3245         }
3246         DEBUG(10,("validate_u: %s ok\n", keystr));
3247         return 0;
3248 }
3249
3250 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3251                             struct tdb_validation_status *state)
3252 {
3253         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3254
3255         if (!centry) {
3256                 return 1;
3257         }
3258
3259         (void)centry_nttime(centry);
3260         (void)centry_nttime(centry);
3261         (void)centry_uint16(centry);
3262
3263         centry_free(centry);
3264
3265         if (!(state->success)) {
3266                 return 1;
3267         }
3268         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3269         return 0;
3270 }
3271
3272 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3273                             struct tdb_validation_status *state)
3274 {
3275         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3276
3277         if (!centry) {
3278                 return 1;
3279         }
3280
3281         (void)centry_uint16(centry);
3282         (void)centry_uint16(centry);
3283         (void)centry_uint32(centry);
3284         (void)centry_nttime(centry);
3285         (void)centry_nttime(centry);
3286
3287         centry_free(centry);
3288
3289         if (!(state->success)) {
3290                 return 1;
3291         }
3292         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3293         return 0;
3294 }
3295
3296 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3297                          struct tdb_validation_status *state)
3298 {
3299         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3300
3301         if (!centry) {
3302                 return 1;
3303         }
3304
3305         (void)centry_time(centry);
3306         (void)centry_hash16(centry, mem_ctx);
3307
3308         /* We only have 17 bytes more data in the salted cred case. */
3309         if (centry->len - centry->ofs == 17) {
3310                 (void)centry_hash16(centry, mem_ctx);
3311         }
3312
3313         centry_free(centry);
3314
3315         if (!(state->success)) {
3316                 return 1;
3317         }
3318         DEBUG(10,("validate_cred: %s ok\n", keystr));
3319         return 0;
3320 }
3321
3322 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3323                        struct tdb_validation_status *state)
3324 {
3325         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3326         int32 num_entries, i;
3327
3328         if (!centry) {
3329                 return 1;
3330         }
3331
3332         num_entries = (int32)centry_uint32(centry);
3333
3334         for (i=0; i< num_entries; i++) {
3335                 DOM_SID sid;
3336                 (void)centry_string(centry, mem_ctx);
3337                 (void)centry_string(centry, mem_ctx);
3338                 (void)centry_string(centry, mem_ctx);
3339                 (void)centry_string(centry, mem_ctx);
3340                 (void)centry_sid(centry, &sid);
3341                 (void)centry_sid(centry, &sid);
3342         }
3343
3344         centry_free(centry);
3345
3346         if (!(state->success)) {
3347                 return 1;
3348         }
3349         DEBUG(10,("validate_ul: %s ok\n", keystr));
3350         return 0;
3351 }
3352
3353 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3354                        struct tdb_validation_status *state)
3355 {
3356         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3357         int32 num_entries, i;
3358
3359         if (!centry) {
3360                 return 1;
3361         }
3362
3363         num_entries = centry_uint32(centry);
3364
3365         for (i=0; i< num_entries; i++) {
3366                 (void)centry_string(centry, mem_ctx);
3367                 (void)centry_string(centry, mem_ctx);
3368                 (void)centry_uint32(centry);
3369         }
3370
3371         centry_free(centry);
3372
3373         if (!(state->success)) {
3374                 return 1;
3375         }
3376         DEBUG(10,("validate_gl: %s ok\n", keystr));
3377         return 0;
3378 }
3379
3380 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3381                        struct tdb_validation_status *state)
3382 {
3383         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3384         int32 num_groups, i;
3385
3386         if (!centry) {
3387                 return 1;
3388         }
3389
3390         num_groups = centry_uint32(centry);
3391
3392         for (i=0; i< num_groups; i++) {
3393                 DOM_SID sid;
3394                 centry_sid(centry, &sid);
3395         }
3396
3397         centry_free(centry);
3398
3399         if (!(state->success)) {
3400                 return 1;
3401         }
3402         DEBUG(10,("validate_ug: %s ok\n", keystr));
3403         return 0;
3404 }
3405
3406 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3407                        struct tdb_validation_status *state)
3408 {
3409         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3410         int32 num_aliases, i;
3411
3412         if (!centry) {
3413                 return 1;
3414         }
3415
3416         num_aliases = centry_uint32(centry);
3417
3418         for (i=0; i < num_aliases; i++) {
3419                 (void)centry_uint32(centry);
3420         }
3421
3422         centry_free(centry);
3423
3424         if (!(state->success)) {
3425                 return 1;
3426         }
3427         DEBUG(10,("validate_ua: %s ok\n", keystr));
3428         return 0;
3429 }
3430
3431 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3432                        struct tdb_validation_status *state)
3433 {
3434         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3435         int32 num_names, i;
3436
3437         if (!centry) {
3438                 return 1;
3439         }
3440
3441         num_names = centry_uint32(centry);
3442
3443         for (i=0; i< num_names; i++) {
3444                 DOM_SID sid;
3445                 centry_sid(centry, &sid);
3446                 (void)centry_string(centry, mem_ctx);
3447                 (void)centry_uint32(centry);
3448         }
3449
3450         centry_free(centry);
3451
3452         if (!(state->success)) {
3453                 return 1;
3454         }
3455         DEBUG(10,("validate_gm: %s ok\n", keystr));
3456         return 0;
3457 }
3458
3459 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3460                        struct tdb_validation_status *state)
3461 {
3462         /* Can't say anything about this other than must be nonzero. */
3463         if (dbuf.dsize == 0) {
3464                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3465                                 keystr));
3466                 state->bad_entry = true;
3467                 state->success = false;
3468                 return 1;
3469         }
3470
3471         DEBUG(10,("validate_dr: %s ok\n", keystr));
3472         return 0;
3473 }
3474
3475 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3476                        struct tdb_validation_status *state)
3477 {
3478         /* Can't say anything about this other than must be nonzero. */
3479         if (dbuf.dsize == 0) {
3480                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3481                                 keystr));
3482                 state->bad_entry = true;
3483                 state->success = false;
3484                 return 1;
3485         }
3486
3487         DEBUG(10,("validate_de: %s ok\n", keystr));
3488         return 0;
3489 }
3490
3491 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3492                            TDB_DATA dbuf, struct tdb_validation_status *state)
3493 {
3494         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3495
3496         if (!centry) {
3497                 return 1;
3498         }
3499
3500         (void)centry_string(centry, mem_ctx);
3501         (void)centry_string(centry, mem_ctx);
3502         (void)centry_string(centry, mem_ctx);
3503         (void)centry_uint32(centry);
3504
3505         centry_free(centry);
3506
3507         if (!(state->success)) {
3508                 return 1;
3509         }
3510         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3511         return 0;
3512 }
3513
3514 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3515                            TDB_DATA dbuf,
3516                            struct tdb_validation_status *state)
3517 {
3518         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3519
3520         if (!centry) {
3521                 return 1;
3522         }
3523
3524         (void)centry_string( centry, mem_ctx );
3525
3526         centry_free(centry);
3527
3528         if (!(state->success)) {
3529                 return 1;
3530         }
3531         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3532         return 0;
3533 }
3534
3535 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3536                            TDB_DATA dbuf,
3537                            struct tdb_validation_status *state)
3538 {
3539         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3540
3541         if (!centry) {
3542                 return 1;
3543         }
3544
3545         (void)centry_string( centry, mem_ctx );
3546
3547         centry_free(centry);
3548
3549         if (!(state->success)) {
3550                 return 1;
3551         }
3552         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3553         return 0;
3554 }
3555
3556 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3557                               struct tdb_validation_status *state)
3558 {
3559         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3560         int32 num_domains, i;
3561
3562         if (!centry) {
3563                 return 1;
3564         }
3565
3566         num_domains = centry_uint32(centry);
3567
3568         for (i=0; i< num_domains; i++) {
3569                 DOM_SID sid;
3570                 (void)centry_string(centry, mem_ctx);
3571                 (void)centry_string(centry, mem_ctx);
3572                 (void)centry_sid(centry, &sid);
3573         }
3574
3575         centry_free(centry);
3576
3577         if (!(state->success)) {
3578                 return 1;
3579         }
3580         DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3581         return 0;
3582 }
3583
3584 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3585                                   TDB_DATA dbuf,
3586                                   struct tdb_validation_status *state)
3587 {
3588         if (dbuf.dsize == 0) {
3589                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3590                           "key %s (len ==0) ?\n", keystr));
3591                 state->bad_entry = true;
3592                 state->success = false;
3593                 return 1;
3594         }
3595
3596         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3597         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3598         return 0;
3599 }
3600
3601 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3602                             struct tdb_validation_status *state)
3603 {
3604         if (dbuf.dsize != 4) {
3605                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3606                                 keystr, (unsigned int)dbuf.dsize ));
3607                 state->bad_entry = true;
3608                 state->success = false;
3609                 return 1;
3610         }
3611         DEBUG(10,("validate_offline: %s ok\n", keystr));
3612         return 0;
3613 }
3614
3615 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3616                                   struct tdb_validation_status *state)
3617 {
3618         if (dbuf.dsize != 4) {
3619                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3620                           "key %s (len %u != 4) ?\n",
3621                           keystr, (unsigned int)dbuf.dsize));
3622                 state->bad_entry = true;
3623                 state->success = false;
3624                 return 1;
3625         }
3626
3627         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3628         return 0;
3629 }
3630
3631 /***********************************************************************
3632  A list of all possible cache tdb keys with associated validation
3633  functions.
3634 ***********************************************************************/
3635
3636 struct key_val_struct {
3637         const char *keyname;
3638         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3639 } key_val[] = {
3640         {"SEQNUM/", validate_seqnum},
3641         {"NS/", validate_ns},
3642         {"SN/", validate_sn},
3643         {"U/", validate_u},
3644         {"LOC_POL/", validate_loc_pol},
3645         {"PWD_POL/", validate_pwd_pol},
3646         {"CRED/", validate_cred},
3647         {"UL/", validate_ul},
3648         {"GL/", validate_gl},
3649         {"UG/", validate_ug},
3650         {"UA", validate_ua},
3651         {"GM/", validate_gm},
3652         {"DR/", validate_dr},
3653         {"DE/", validate_de},
3654         {"NSS/PWINFO/", validate_pwinfo},
3655         {"TRUSTDOMS/", validate_trustdoms},
3656         {"TRUSTDOMCACHE/", validate_trustdomcache},
3657         {"NSS/NA/", validate_nss_na},
3658         {"NSS/AN/", validate_nss_an},
3659         {"WINBINDD_OFFLINE", validate_offline},
3660         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3661         {NULL, NULL}
3662 };
3663
3664 /***********************************************************************
3665  Function to look at every entry in the tdb and validate it as far as
3666  possible.
3667 ***********************************************************************/
3668
3669 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3670 {
3671         int i;
3672         unsigned int max_key_len = 1024;
3673         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3674
3675         /* Paranoia check. */
3676         if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3677                 max_key_len = 1024 * 1024;
3678         }
3679         if (kbuf.dsize > max_key_len) {
3680                 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3681                           "(%u) > (%u)\n\n",
3682                           (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3683                 return 1;
3684         }
3685
3686         for (i = 0; key_val[i].keyname; i++) {
3687                 size_t namelen = strlen(key_val[i].keyname);
3688                 if (kbuf.dsize >= namelen && (
3689                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3690                         TALLOC_CTX *mem_ctx;
3691                         char *keystr;
3692                         int ret;
3693
3694                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3695                         if (!keystr) {
3696                                 return 1;
3697                         }
3698                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
3699                         keystr[kbuf.dsize] = '\0';
3700
3701                         mem_ctx = talloc_init("validate_ctx");
3702                         if (!mem_ctx) {
3703                                 SAFE_FREE(keystr);
3704                                 return 1;
3705                         }
3706
3707                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3708                                                           v_state);
3709
3710                         SAFE_FREE(keystr);
3711                         talloc_destroy(mem_ctx);
3712                         return ret;
3713                 }
3714         }
3715
3716         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3717         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3718         DEBUG(0,("data :\n"));
3719         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3720         v_state->unknown_key = true;
3721         v_state->success = false;
3722         return 1; /* terminate. */
3723 }
3724
3725 static void validate_panic(const char *const why)
3726 {
3727         DEBUG(0,("validating cache: would panic %s\n", why ));
3728         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3729         exit(47);
3730 }
3731
3732 /***********************************************************************
3733  Try and validate every entry in the winbindd cache. If we fail here,
3734  delete the cache tdb and return non-zero.
3735 ***********************************************************************/
3736
3737 int winbindd_validate_cache(void)
3738 {
3739         int ret = -1;
3740         const char *tdb_path = cache_path("winbindd_cache.tdb");
3741         TDB_CONTEXT *tdb = NULL;
3742
3743         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3744         smb_panic_fn = validate_panic;
3745
3746
3747         tdb = tdb_open_log(tdb_path,
3748                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3749                            ( lp_winbind_offline_logon()
3750                              ? TDB_DEFAULT
3751                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3752                            O_RDWR|O_CREAT,
3753                            0600);
3754         if (!tdb) {
3755                 DEBUG(0, ("winbindd_validate_cache: "
3756                           "error opening/initializing tdb\n"));
3757                 goto done;
3758         }
3759         tdb_close(tdb);
3760
3761         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3762
3763         if (ret != 0) {
3764                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3765                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3766                 unlink(tdb_path);
3767         }
3768
3769 done:
3770         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3771         smb_panic_fn = smb_panic;
3772         return ret;
3773 }
3774
3775 /***********************************************************************
3776  Try and validate every entry in the winbindd cache.
3777 ***********************************************************************/
3778
3779 int winbindd_validate_cache_nobackup(void)
3780 {
3781         int ret = -1;
3782         const char *tdb_path = cache_path("winbindd_cache.tdb");
3783
3784         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3785         smb_panic_fn = validate_panic;
3786
3787
3788         if (wcache == NULL || wcache->tdb == NULL) {
3789                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3790         } else {
3791                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3792         }
3793
3794         if (ret != 0) {
3795                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3796                            "successful.\n"));
3797         }
3798
3799         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3800                    "function\n"));
3801         smb_panic_fn = smb_panic;
3802         return ret;
3803 }
3804
3805 bool winbindd_cache_validate_and_initialize(void)
3806 {
3807         close_winbindd_cache();
3808
3809         if (lp_winbind_offline_logon()) {
3810                 if (winbindd_validate_cache() < 0) {
3811                         DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3812                                   "could be restored.\n"));
3813                 }
3814         }
3815
3816         return initialize_winbindd_cache();
3817 }
3818
3819 /*********************************************************************
3820  ********************************************************************/
3821
3822 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3823                                        struct winbindd_tdc_domain **domains,
3824                                        size_t *num_domains )
3825 {
3826         struct winbindd_tdc_domain *list = NULL;
3827         size_t idx;
3828         int i;
3829         bool set_only = false;
3830
3831         /* don't allow duplicates */
3832
3833         idx = *num_domains;
3834         list = *domains;
3835
3836         for ( i=0; i< (*num_domains); i++ ) {
3837                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3838                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3839                                   new_dom->name));
3840                         idx = i;
3841                         set_only = true;
3842
3843                         break;
3844                 }
3845         }
3846
3847         if ( !set_only ) {
3848                 if ( !*domains ) {
3849                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3850                         idx = 0;
3851                 } else {
3852                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3853                                                      struct winbindd_tdc_domain,
3854                                                      (*num_domains)+1);
3855                         idx = *num_domains;
3856                 }
3857
3858                 ZERO_STRUCT( list[idx] );
3859         }
3860
3861         if ( !list )
3862                 return false;
3863
3864         list[idx].domain_name = talloc_strdup( list, new_dom->name );
3865         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3866
3867         if ( !is_null_sid( &new_dom->sid ) ) {
3868                 sid_copy( &list[idx].sid, &new_dom->sid );
3869         } else {
3870                 sid_copy(&list[idx].sid, &global_sid_NULL);
3871         }
3872
3873         if ( new_dom->domain_flags != 0x0 )
3874                 list[idx].trust_flags = new_dom->domain_flags;
3875
3876         if ( new_dom->domain_type != 0x0 )
3877                 list[idx].trust_type = new_dom->domain_type;
3878
3879         if ( new_dom->domain_trust_attribs != 0x0 )
3880                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3881
3882         if ( !set_only ) {
3883                 *domains = list;
3884                 *num_domains = idx + 1;
3885         }
3886
3887         return true;
3888 }
3889
3890 /*********************************************************************
3891  ********************************************************************/
3892
3893 static TDB_DATA make_tdc_key( const char *domain_name )
3894 {
3895         char *keystr = NULL;
3896         TDB_DATA key = { NULL, 0 };
3897
3898         if ( !domain_name ) {
3899                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3900                 return key;
3901         }
3902
3903         if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3904                 return key;
3905         }
3906         key = string_term_tdb_data(keystr);
3907
3908         return key;
3909 }
3910
3911 /*********************************************************************
3912  ********************************************************************/
3913
3914 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3915                              size_t num_domains,
3916                              unsigned char **buf )
3917 {
3918         unsigned char *buffer = NULL;
3919         int len = 0;
3920         int buflen = 0;
3921         int i = 0;
3922
3923         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3924                   (int)num_domains));
3925
3926         buflen = 0;
3927
3928  again:
3929         len = 0;
3930
3931         /* Store the number of array items first */
3932         len += tdb_pack( buffer+len, buflen-len, "d",
3933                          num_domains );
3934
3935         /* now pack each domain trust record */
3936         for ( i=0; i<num_domains; i++ ) {
3937
3938                 fstring tmp;
3939
3940                 if ( buflen > 0 ) {
3941                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3942                                   domains[i].domain_name,
3943                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3944                 }
3945
3946                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3947                                  domains[i].domain_name,
3948                                  domains[i].dns_name,
3949                                  sid_to_fstring(tmp, &domains[i].sid),
3950                                  domains[i].trust_flags,
3951                                  domains[i].trust_attribs,
3952                                  domains[i].trust_type );
3953         }
3954
3955         if ( buflen < len ) {
3956                 SAFE_FREE(buffer);
3957                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3958                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3959                         buflen = -1;
3960                         goto done;
3961                 }
3962                 buflen = len;
3963                 goto again;
3964         }
3965
3966         *buf = buffer;
3967
3968  done:
3969         return buflen;
3970 }
3971
3972 /*********************************************************************
3973  ********************************************************************/
3974
3975 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3976                                   struct winbindd_tdc_domain **domains )
3977 {
3978         fstring domain_name, dns_name, sid_string;
3979         uint32 type, attribs, flags;
3980         int num_domains;
3981         int len = 0;
3982         int i;
3983         struct winbindd_tdc_domain *list = NULL;
3984
3985         /* get the number of domains */
3986         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3987         if ( len == -1 ) {
3988                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3989                 return 0;
3990         }
3991
3992         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3993         if ( !list ) {
3994                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3995                 return 0;
3996         }
3997
3998         for ( i=0; i<num_domains; i++ ) {
3999                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4000                                    domain_name,
4001                                    dns_name,
4002                                    sid_string,
4003                                    &flags,
4004                                    &attribs,
4005                                    &type );
4006
4007                 if ( len == -1 ) {
4008                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4009                         TALLOC_FREE( list );
4010                         return 0;
4011                 }
4012
4013                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4014                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4015                           domain_name, dns_name, sid_string,
4016                           flags, attribs, type));
4017
4018                 list[i].domain_name = talloc_strdup( list, domain_name );
4019                 list[i].dns_name = talloc_strdup( list, dns_name );
4020                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4021                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4022                                   domain_name));
4023                 }
4024                 list[i].trust_flags = flags;
4025                 list[i].trust_attribs = attribs;
4026                 list[i].trust_type = type;
4027         }
4028
4029         *domains = list;
4030
4031         return num_domains;
4032 }
4033
4034 /*********************************************************************
4035  ********************************************************************/
4036
4037 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4038 {
4039         TDB_DATA key = make_tdc_key( lp_workgroup() );
4040         TDB_DATA data = { NULL, 0 };
4041         int ret;
4042
4043         if ( !key.dptr )
4044                 return false;
4045
4046         /* See if we were asked to delete the cache entry */
4047
4048         if ( !domains ) {
4049                 ret = tdb_delete( wcache->tdb, key );
4050                 goto done;
4051         }
4052
4053         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4054
4055         if ( !data.dptr ) {
4056                 ret = -1;
4057                 goto done;
4058         }
4059
4060         ret = tdb_store( wcache->tdb, key, data, 0 );
4061
4062  done:
4063         SAFE_FREE( data.dptr );
4064         SAFE_FREE( key.dptr );
4065
4066         return ( ret != -1 );
4067 }
4068
4069 /*********************************************************************
4070  ********************************************************************/
4071
4072 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4073 {
4074         TDB_DATA key = make_tdc_key( lp_workgroup() );
4075         TDB_DATA data = { NULL, 0 };
4076
4077         *domains = NULL;
4078         *num_domains = 0;
4079
4080         if ( !key.dptr )
4081                 return false;
4082
4083         data = tdb_fetch( wcache->tdb, key );
4084
4085         SAFE_FREE( key.dptr );
4086
4087         if ( !data.dptr )
4088                 return false;
4089
4090         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4091
4092         SAFE_FREE( data.dptr );
4093
4094         if ( !*domains )
4095                 return false;
4096
4097         return true;
4098 }
4099
4100 /*********************************************************************
4101  ********************************************************************/
4102
4103 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4104 {
4105         struct winbindd_tdc_domain *dom_list = NULL;
4106         size_t num_domains = 0;
4107         bool ret = false;
4108
4109         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4110                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4111                   domain->name, domain->alt_name,
4112                   sid_string_dbg(&domain->sid),
4113                   domain->domain_flags,
4114                   domain->domain_trust_attribs,
4115                   domain->domain_type));
4116
4117         if ( !init_wcache() ) {
4118                 return false;
4119         }
4120
4121         /* fetch the list */
4122
4123         wcache_tdc_fetch_list( &dom_list, &num_domains );
4124
4125         /* add the new domain */
4126
4127         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4128                 goto done;
4129         }
4130
4131         /* pack the domain */
4132
4133         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4134                 goto done;
4135         }
4136
4137         /* Success */
4138
4139         ret = true;
4140  done:
4141         TALLOC_FREE( dom_list );
4142
4143         return ret;
4144 }
4145
4146 /*********************************************************************
4147  ********************************************************************/
4148
4149 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4150 {
4151         struct winbindd_tdc_domain *dom_list = NULL;
4152         size_t num_domains = 0;
4153         int i;
4154         struct winbindd_tdc_domain *d = NULL;
4155
4156         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4157
4158         if ( !init_wcache() ) {
4159                 return false;
4160         }
4161
4162         /* fetch the list */
4163
4164         wcache_tdc_fetch_list( &dom_list, &num_domains );
4165
4166         for ( i=0; i<num_domains; i++ ) {
4167                 if ( strequal(name, dom_list[i].domain_name) ||
4168                      strequal(name, dom_list[i].dns_name) )
4169                 {
4170                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4171                                   name));
4172
4173                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4174                         if ( !d )
4175                                 break;
4176
4177                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4178                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4179                         sid_copy( &d->sid, &dom_list[i].sid );
4180                         d->trust_flags   = dom_list[i].trust_flags;
4181                         d->trust_type    = dom_list[i].trust_type;
4182                         d->trust_attribs = dom_list[i].trust_attribs;
4183
4184                         break;
4185                 }
4186         }
4187
4188         TALLOC_FREE( dom_list );
4189
4190         return d;
4191 }
4192
4193
4194 /*********************************************************************
4195  ********************************************************************/
4196
4197 void wcache_tdc_clear( void )
4198 {
4199         if ( !init_wcache() )
4200                 return;
4201
4202         wcache_tdc_store_list( NULL, 0 );
4203
4204         return;
4205 }
4206
4207
4208 /*********************************************************************
4209  ********************************************************************/
4210
4211 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4212                                     NTSTATUS status,
4213                                     const DOM_SID *user_sid,
4214                                     const char *homedir,
4215                                     const char *shell,
4216                                     const char *gecos,
4217                                     uint32 gid)
4218 {
4219         struct cache_entry *centry;
4220         fstring tmp;
4221
4222         if ( (centry = centry_start(domain, status)) == NULL )
4223                 return;
4224
4225         centry_put_string( centry, homedir );
4226         centry_put_string( centry, shell );
4227         centry_put_string( centry, gecos );
4228         centry_put_uint32( centry, gid );
4229
4230         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4231
4232         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4233
4234         centry_free(centry);
4235 }
4236
4237 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4238                               const DOM_SID *user_sid,
4239                               TALLOC_CTX *ctx,
4240                               ADS_STRUCT *ads, LDAPMessage *msg,
4241                               const char **homedir, const char **shell,
4242                               const char **gecos, gid_t *p_gid)
4243 {
4244         struct winbind_cache *cache = get_cache(domain);
4245         struct cache_entry *centry = NULL;
4246         NTSTATUS nt_status;
4247         fstring tmp;
4248
4249         if (!cache->tdb)
4250                 goto do_query;
4251
4252         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4253                               sid_to_fstring(tmp, user_sid));
4254
4255         if (!centry)
4256                 goto do_query;
4257
4258         *homedir = centry_string( centry, ctx );
4259         *shell   = centry_string( centry, ctx );
4260         *gecos   = centry_string( centry, ctx );
4261         *p_gid   = centry_uint32( centry );
4262
4263         centry_free(centry);
4264
4265         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4266                   sid_string_dbg(user_sid)));
4267
4268         return NT_STATUS_OK;
4269
4270 do_query:
4271
4272         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4273                                   homedir, shell, gecos, p_gid );
4274
4275         DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4276
4277         if ( NT_STATUS_IS_OK(nt_status) ) {
4278                 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4279                 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4280                 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4281                 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4282
4283                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4284                                          *homedir, *shell, *gecos, *p_gid );
4285         }
4286
4287         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4288                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4289                          domain->name ));
4290                 set_domain_offline( domain );
4291         }
4292
4293         return nt_status;
4294 }
4295
4296
4297 /* the cache backend methods are exposed via this structure */
4298 struct winbindd_methods cache_methods = {
4299         true,
4300         query_user_list,
4301         enum_dom_groups,
4302         enum_local_groups,
4303         name_to_sid,
4304         sid_to_name,
4305         rids_to_names,
4306         query_user,
4307         lookup_usergroups,
4308         lookup_useraliases,
4309         lookup_groupmem,
4310         sequence_number,
4311         lockout_policy,
4312         password_policy,
4313         trusted_domains
4314 };
4315
4316 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4317                            uint32_t opnum, const DATA_BLOB *req,
4318                            TDB_DATA *pkey)
4319 {
4320         char *key;
4321         size_t keylen;
4322
4323         key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4324         if (key == NULL) {
4325                 return false;
4326         }
4327         keylen = talloc_get_size(key) - 1;
4328
4329         key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4330         if (key == NULL) {
4331                 return false;
4332         }
4333         memcpy(key + keylen, req->data, req->length);
4334
4335         pkey->dptr = (uint8_t *)key;
4336         pkey->dsize = talloc_get_size(key);
4337         return true;
4338 }
4339
4340 static bool wcache_opnum_cacheable(uint32_t opnum)
4341 {
4342         switch (opnum) {
4343         case NDR_WBINT_PING:
4344         case NDR_WBINT_QUERYSEQUENCENUMBER:
4345                 return false;
4346         }
4347         return true;
4348 }
4349
4350 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4351                       uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4352 {
4353         TDB_DATA key, data;
4354         bool ret = false;
4355
4356         if (!wcache_opnum_cacheable(opnum)) {
4357                 return false;
4358         }
4359
4360         if (wcache->tdb == NULL) {
4361                 return false;
4362         }
4363
4364         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4365                 return false;
4366         }
4367         data = tdb_fetch(wcache->tdb, key);
4368         TALLOC_FREE(key.dptr);
4369
4370         if (data.dptr == NULL) {
4371                 return false;
4372         }
4373         if (data.dsize < 4) {
4374                 goto fail;
4375         }
4376
4377         if (IS_DOMAIN_ONLINE(domain)) {
4378                 uint32_t entry_seqnum, dom_seqnum, last_check;
4379
4380                 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4381                                          &last_check)) {
4382                         goto fail;
4383                 }
4384                 entry_seqnum = IVAL(data.dptr, 0);
4385                 if (entry_seqnum != dom_seqnum) {
4386                         DEBUG(10, ("Entry has wrong sequence number: %d\n",
4387                                    (int)entry_seqnum));
4388                         goto fail;
4389                 }
4390         }
4391
4392         resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4393                                               data.dsize - 4);
4394         if (resp->data == NULL) {
4395                 DEBUG(10, ("talloc failed\n"));
4396                 goto fail;
4397         }
4398         resp->length = data.dsize - 4;
4399
4400         ret = true;
4401 fail:
4402         SAFE_FREE(data.dptr);
4403         return ret;
4404 }
4405
4406 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4407                       const DATA_BLOB *req, const DATA_BLOB *resp)
4408 {
4409         TDB_DATA key, data;
4410         uint32_t dom_seqnum, last_check;
4411
4412         if (!wcache_opnum_cacheable(opnum)) {
4413                 return;
4414         }
4415
4416         if (wcache->tdb == NULL) {
4417                 return;
4418         }
4419
4420         if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4421                 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4422                            domain->name));
4423                 return;
4424         }
4425
4426         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4427                 return;
4428         }
4429
4430         data.dsize = resp->length + 4;
4431         data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4432         if (data.dptr == NULL) {
4433                 goto done;
4434         }
4435
4436         SIVAL(data.dptr, 0, dom_seqnum);
4437         memcpy(data.dptr+4, resp->data, resp->length);
4438
4439         tdb_store(wcache->tdb, key, data, 0);
4440
4441 done:
4442         TALLOC_FREE(key.dptr);
4443         return;
4444 }