source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "tdb_validate.h"
  29 #include "../libcli/auth/libcli_auth.h"
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_WINBIND
  33
  34 #define WINBINDD_CACHE_VERSION 1
  35 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  36
  37 extern struct winbindd_methods reconnect_methods;
  38 #ifdef HAVE_ADS
  39 extern struct winbindd_methods ads_methods;
  40 #endif
  41 extern struct winbindd_methods builtin_passdb_methods;
  42
  43 /*
  44  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  45  * Here are the list of entry types that are *not* stored
  46  * as form struct cache_entry in the cache.
  47  */
  48
  49 static const char *non_centry_keys[] = {
  50         "SEQNUM/",
  51         "DR/",
  52         "DE/",
  53         "WINBINDD_OFFLINE",
  54         WINBINDD_CACHE_VERSION_KEYSTR,
  55         NULL
  56 };
  57
  58 /************************************************************************
  59  Is this key a non-centry type ?
  60 ************************************************************************/
  61
  62 static bool is_non_centry_key(TDB_DATA kbuf)
  63 {
  64         int i;
  65
  66         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  67                 return false;
  68         }
  69         for (i = 0; non_centry_keys[i] != NULL; i++) {
  70                 size_t namelen = strlen(non_centry_keys[i]);
  71                 if (kbuf.dsize < namelen) {
  72                         continue;
  73                 }
  74                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  75                         return true;
  76                 }
  77         }
  78         return false;
  79 }
  80
  81 /* Global online/offline state - False when online. winbindd starts up online
  82    and sets this to true if the first query fails and there's an entry in
  83    the cache tdb telling us to stay offline. */
  84
  85 static bool global_winbindd_offline_state;
  86
  87 struct winbind_cache {
  88         TDB_CONTEXT *tdb;
  89 };
  90
  91 struct cache_entry {
  92         NTSTATUS status;
  93         uint32 sequence_number;
  94         uint8 *data;
  95         uint32 len, ofs;
  96 };
  97
  98 void (*smb_panic_fn)(const char *const why) = smb_panic;
  99
 100 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
 101
 102 static struct winbind_cache *wcache;
 103
 104 void winbindd_check_cache_size(time_t t)
 105 {
 106         static time_t last_check_time;
 107         struct stat st;
 108
 109         if (last_check_time == (time_t)0)
 110                 last_check_time = t;
 111
 112         if (t - last_check_time < 60 && t - last_check_time > 0)
 113                 return;
 114
 115         if (wcache == NULL || wcache->tdb == NULL) {
 116                 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
 117                 return;
 118         }
 119
 120         if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
 121                 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
 122                 return;
 123         }
 124
 125         if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
 126                 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
 127                         (unsigned long)st.st_size,
 128                         (unsigned long)WINBINDD_MAX_CACHE_SIZE));
 129                 wcache_flush_cache();
 130         }
 131 }
 132
 133 /* get the winbind_cache structure */
 134 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 135 {
 136         struct winbind_cache *ret = wcache;
 137
 138         /* We have to know what type of domain we are dealing with first. */
 139
 140         if (domain->internal) {
 141                 domain->backend = &builtin_passdb_methods;
 142                 domain->initialized = True;
 143         }
 144         if ( !domain->initialized ) {
 145                 init_dc_connection( domain );
 146         }
 147
 148         /*
 149            OK.  listen up becasue I'm only going to say this once.
 150            We have the following scenarios to consider
 151            (a) trusted AD domains on a Samba DC,
 152            (b) trusted AD domains and we are joined to a non-kerberos domain
 153            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 154
 155            For (a) we can always contact the trusted domain using krb5
 156            since we have the domain trust account password
 157
 158            For (b) we can only use RPC since we have no way of
 159            getting a krb5 ticket in our own domain
 160
 161            For (c) we can always use krb5 since we have a kerberos trust
 162
 163            --jerry
 164          */
 165
 166         if (!domain->backend) {
 167 #ifdef HAVE_ADS
 168                 struct winbindd_domain *our_domain = domain;
 169
 170                 /* find our domain first so we can figure out if we
 171                    are joined to a kerberized domain */
 172
 173                 if ( !domain->primary )
 174                         our_domain = find_our_domain();
 175
 176                 if ((our_domain->active_directory || IS_DC)
 177                     && domain->active_directory
 178                     && !lp_winbind_rpc_only()) {
 179                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 180                         domain->backend = &ads_methods;
 181                 } else {
 182 #endif  /* HAVE_ADS */
 183                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 184                         domain->backend = &reconnect_methods;
 185 #ifdef HAVE_ADS
 186                 }
 187 #endif  /* HAVE_ADS */
 188         }
 189
 190         if (ret)
 191                 return ret;
 192
 193         ret = SMB_XMALLOC_P(struct winbind_cache);
 194         ZERO_STRUCTP(ret);
 195
 196         wcache = ret;
 197         wcache_flush_cache();
 198
 199         return ret;
 200 }
 201
 202 /*
 203   free a centry structure
 204 */
 205 static void centry_free(struct cache_entry *centry)
 206 {
 207         if (!centry)
 208                 return;
 209         SAFE_FREE(centry->data);
 210         free(centry);
 211 }
 212
 213 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 214 {
 215         if (centry->len - centry->ofs < nbytes) {
 216                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 217                          (unsigned int)nbytes,
 218                          centry->len - centry->ofs));
 219                 return false;
 220         }
 221         return true;
 222 }
 223
 224 /*
 225   pull a uint32 from a cache entry
 226 */
 227 static uint32 centry_uint32(struct cache_entry *centry)
 228 {
 229         uint32 ret;
 230
 231         if (!centry_check_bytes(centry, 4)) {
 232                 smb_panic_fn("centry_uint32");
 233         }
 234         ret = IVAL(centry->data, centry->ofs);
 235         centry->ofs += 4;
 236         return ret;
 237 }
 238
 239 /*
 240   pull a uint16 from a cache entry
 241 */
 242 static uint16 centry_uint16(struct cache_entry *centry)
 243 {
 244         uint16 ret;
 245         if (!centry_check_bytes(centry, 2)) {
 246                 smb_panic_fn("centry_uint16");
 247         }
 248         ret = CVAL(centry->data, centry->ofs);
 249         centry->ofs += 2;
 250         return ret;
 251 }
 252
 253 /*
 254   pull a uint8 from a cache entry
 255 */
 256 static uint8 centry_uint8(struct cache_entry *centry)
 257 {
 258         uint8 ret;
 259         if (!centry_check_bytes(centry, 1)) {
 260                 smb_panic_fn("centry_uint8");
 261         }
 262         ret = CVAL(centry->data, centry->ofs);
 263         centry->ofs += 1;
 264         return ret;
 265 }
 266
 267 /*
 268   pull a NTTIME from a cache entry
 269 */
 270 static NTTIME centry_nttime(struct cache_entry *centry)
 271 {
 272         NTTIME ret;
 273         if (!centry_check_bytes(centry, 8)) {
 274                 smb_panic_fn("centry_nttime");
 275         }
 276         ret = IVAL(centry->data, centry->ofs);
 277         centry->ofs += 4;
 278         ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
 279         centry->ofs += 4;
 280         return ret;
 281 }
 282
 283 /*
 284   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 285 */
 286 static time_t centry_time(struct cache_entry *centry)
 287 {
 288         return (time_t)centry_nttime(centry);
 289 }
 290
 291 /* pull a string from a cache entry, using the supplied
 292    talloc context
 293 */
 294 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 295 {
 296         uint32 len;
 297         char *ret;
 298
 299         len = centry_uint8(centry);
 300
 301         if (len == 0xFF) {
 302                 /* a deliberate NULL string */
 303                 return NULL;
 304         }
 305
 306         if (!centry_check_bytes(centry, (size_t)len)) {
 307                 smb_panic_fn("centry_string");
 308         }
 309
 310         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 311         if (!ret) {
 312                 smb_panic_fn("centry_string out of memory\n");
 313         }
 314         memcpy(ret,centry->data + centry->ofs, len);
 315         ret[len] = 0;
 316         centry->ofs += len;
 317         return ret;
 318 }
 319
 320 /* pull a hash16 from a cache entry, using the supplied
 321    talloc context
 322 */
 323 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 324 {
 325         uint32 len;
 326         char *ret;
 327
 328         len = centry_uint8(centry);
 329
 330         if (len != 16) {
 331                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 332                         len ));
 333                 return NULL;
 334         }
 335
 336         if (!centry_check_bytes(centry, 16)) {
 337                 return NULL;
 338         }
 339
 340         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 341         if (!ret) {
 342                 smb_panic_fn("centry_hash out of memory\n");
 343         }
 344         memcpy(ret,centry->data + centry->ofs, 16);
 345         centry->ofs += 16;
 346         return ret;
 347 }
 348
 349 /* pull a sid from a cache entry, using the supplied
 350    talloc context
 351 */
 352 static bool centry_sid(struct cache_entry *centry, TALLOC_CTX *mem_ctx, DOM_SID *sid)
 353 {
 354         char *sid_string;
 355         sid_string = centry_string(centry, mem_ctx);
 356         if ((sid_string == NULL) || (!string_to_sid(sid, sid_string))) {
 357                 return false;
 358         }
 359         return true;
 360 }
 361
 362
 363 /*
 364   pull a NTSTATUS from a cache entry
 365 */
 366 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 367 {
 368         NTSTATUS status;
 369
 370         status = NT_STATUS(centry_uint32(centry));
 371         return status;
 372 }
 373
 374
 375 /* the server is considered down if it can't give us a sequence number */
 376 static bool wcache_server_down(struct winbindd_domain *domain)
 377 {
 378         bool ret;
 379
 380         if (!wcache->tdb)
 381                 return false;
 382
 383         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 384
 385         if (ret)
 386                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 387                         domain->name ));
 388         return ret;
 389 }
 390
 391 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 392 {
 393         TDB_DATA data;
 394         fstring key;
 395         uint32 time_diff;
 396
 397         if (!wcache->tdb) {
 398                 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
 399                 return NT_STATUS_UNSUCCESSFUL;
 400         }
 401
 402         fstr_sprintf( key, "SEQNUM/%s", domain->name );
 403
 404         data = tdb_fetch_bystring( wcache->tdb, key );
 405         if ( !data.dptr || data.dsize!=8 ) {
 406                 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key ));
 407                 return NT_STATUS_UNSUCCESSFUL;
 408         }
 409
 410         domain->sequence_number = IVAL(data.dptr, 0);
 411         domain->last_seq_check  = IVAL(data.dptr, 4);
 412
 413         SAFE_FREE(data.dptr);
 414
 415         /* have we expired? */
 416
 417         time_diff = now - domain->last_seq_check;
 418         if ( time_diff > lp_winbind_cache_time() ) {
 419                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 420                         domain->name, domain->sequence_number,
 421                         (uint32)domain->last_seq_check));
 422                 return NT_STATUS_UNSUCCESSFUL;
 423         }
 424
 425         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 426                 domain->name, domain->sequence_number,
 427                 (uint32)domain->last_seq_check));
 428
 429         return NT_STATUS_OK;
 430 }
 431
 432 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
 433 {
 434         TDB_DATA data;
 435         fstring key_str;
 436         uint8 buf[8];
 437
 438         if (!wcache->tdb) {
 439                 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
 440                 return NT_STATUS_UNSUCCESSFUL;
 441         }
 442
 443         fstr_sprintf( key_str, "SEQNUM/%s", domain->name );
 444
 445         SIVAL(buf, 0, domain->sequence_number);
 446         SIVAL(buf, 4, domain->last_seq_check);
 447         data.dptr = buf;
 448         data.dsize = 8;
 449
 450         if ( tdb_store_bystring( wcache->tdb, key_str, data, TDB_REPLACE) == -1 ) {
 451                 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
 452                 return NT_STATUS_UNSUCCESSFUL;
 453         }
 454
 455         DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
 456                 domain->name, domain->sequence_number,
 457                 (uint32)domain->last_seq_check));
 458
 459         return NT_STATUS_OK;
 460 }
 461
 462 /*
 463   refresh the domain sequence number. If force is true
 464   then always refresh it, no matter how recently we fetched it
 465 */
 466
 467 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 468 {
 469         NTSTATUS status;
 470         unsigned time_diff;
 471         time_t t = time(NULL);
 472         unsigned cache_time = lp_winbind_cache_time();
 473
 474         if ( IS_DOMAIN_OFFLINE(domain) ) {
 475                 return;
 476         }
 477
 478         get_cache( domain );
 479
 480 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 481         /* trying to reconnect is expensive, don't do it too often */
 482         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 483                 cache_time *= 8;
 484         }
 485 #endif
 486
 487         time_diff = t - domain->last_seq_check;
 488
 489         /* see if we have to refetch the domain sequence number */
 490         if (!force && (time_diff < cache_time) &&
 491                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 492                         NT_STATUS_IS_OK(domain->last_status)) {
 493                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 494                 goto done;
 495         }
 496
 497         /* try to get the sequence number from the tdb cache first */
 498         /* this will update the timestamp as well */
 499
 500         status = fetch_cache_seqnum( domain, t );
 501         if (NT_STATUS_IS_OK(status) &&
 502                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 503                         NT_STATUS_IS_OK(domain->last_status)) {
 504                 goto done;
 505         }
 506
 507         /* important! make sure that we know if this is a native
 508            mode domain or not.  And that we can contact it. */
 509
 510         if ( winbindd_can_contact_domain( domain ) ) {
 511                 status = domain->backend->sequence_number(domain,
 512                                                           &domain->sequence_number);
 513         } else {
 514                 /* just use the current time */
 515                 status = NT_STATUS_OK;
 516                 domain->sequence_number = time(NULL);
 517         }
 518
 519
 520         /* the above call could have set our domain->backend to NULL when
 521          * coming from offline to online mode, make sure to reinitialize the
 522          * backend - Guenther */
 523         get_cache( domain );
 524
 525         if (!NT_STATUS_IS_OK(status)) {
 526                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 527                 domain->sequence_number = DOM_SEQUENCE_NONE;
 528         }
 529
 530         domain->last_status = status;
 531         domain->last_seq_check = time(NULL);
 532
 533         /* save the new sequence number in the cache */
 534         store_cache_seqnum( domain );
 535
 536 done:
 537         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 538                    domain->name, domain->sequence_number));
 539
 540         return;
 541 }
 542
 543 /*
 544   decide if a cache entry has expired
 545 */
 546 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 547 {
 548         /* If we've been told to be offline - stay in that state... */
 549         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 550                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 551                         keystr, domain->name ));
 552                 return false;
 553         }
 554
 555         /* when the domain is offline return the cached entry.
 556          * This deals with transient offline states... */
 557
 558         if (!domain->online) {
 559                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 560                         keystr, domain->name ));
 561                 return false;
 562         }
 563
 564         /* if the server is OK and our cache entry came from when it was down then
 565            the entry is invalid */
 566         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 567             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 568                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 569                         keystr, domain->name ));
 570                 return true;
 571         }
 572
 573         /* if the server is down or the cache entry is not older than the
 574            current sequence number then it is OK */
 575         if (wcache_server_down(domain) ||
 576             centry->sequence_number == domain->sequence_number) {
 577                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 578                         keystr, domain->name ));
 579                 return false;
 580         }
 581
 582         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 583                 keystr, domain->name ));
 584
 585         /* it's expired */
 586         return true;
 587 }
 588
 589 static struct cache_entry *wcache_fetch_raw(char *kstr)
 590 {
 591         TDB_DATA data;
 592         struct cache_entry *centry;
 593         TDB_DATA key;
 594
 595         key = string_tdb_data(kstr);
 596         data = tdb_fetch(wcache->tdb, key);
 597         if (!data.dptr) {
 598                 /* a cache miss */
 599                 return NULL;
 600         }
 601
 602         centry = SMB_XMALLOC_P(struct cache_entry);
 603         centry->data = (unsigned char *)data.dptr;
 604         centry->len = data.dsize;
 605         centry->ofs = 0;
 606
 607         if (centry->len < 8) {
 608                 /* huh? corrupt cache? */
 609                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
 610                 centry_free(centry);
 611                 return NULL;
 612         }
 613
 614         centry->status = centry_ntstatus(centry);
 615         centry->sequence_number = centry_uint32(centry);
 616
 617         return centry;
 618 }
 619
 620 /*
 621   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 622   number and return status
 623 */
 624 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 625                                         struct winbindd_domain *domain,
 626                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 627 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 628                                         struct winbindd_domain *domain,
 629                                         const char *format, ...)
 630 {
 631         va_list ap;
 632         char *kstr;
 633         struct cache_entry *centry;
 634
 635         if (!winbindd_use_cache()) {
 636                 return NULL;
 637         }
 638
 639         refresh_sequence_number(domain, false);
 640
 641         va_start(ap, format);
 642         smb_xvasprintf(&kstr, format, ap);
 643         va_end(ap);
 644
 645         centry = wcache_fetch_raw(kstr);
 646         if (centry == NULL) {
 647                 free(kstr);
 648                 return NULL;
 649         }
 650
 651         if (centry_expired(domain, kstr, centry)) {
 652
 653                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 654                          kstr, domain->name ));
 655
 656                 centry_free(centry);
 657                 free(kstr);
 658                 return NULL;
 659         }
 660
 661         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 662                  kstr, domain->name ));
 663
 664         free(kstr);
 665         return centry;
 666 }
 667
 668 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 669 static void wcache_delete(const char *format, ...)
 670 {
 671         va_list ap;
 672         char *kstr;
 673         TDB_DATA key;
 674
 675         va_start(ap, format);
 676         smb_xvasprintf(&kstr, format, ap);
 677         va_end(ap);
 678
 679         key = string_tdb_data(kstr);
 680
 681         tdb_delete(wcache->tdb, key);
 682         free(kstr);
 683 }
 684
 685 /*
 686   make sure we have at least len bytes available in a centry
 687 */
 688 static void centry_expand(struct cache_entry *centry, uint32 len)
 689 {
 690         if (centry->len - centry->ofs >= len)
 691                 return;
 692         centry->len *= 2;
 693         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 694                                          centry->len);
 695         if (!centry->data) {
 696                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 697                 smb_panic_fn("out of memory in centry_expand");
 698         }
 699 }
 700
 701 /*
 702   push a uint32 into a centry
 703 */
 704 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 705 {
 706         centry_expand(centry, 4);
 707         SIVAL(centry->data, centry->ofs, v);
 708         centry->ofs += 4;
 709 }
 710
 711 /*
 712   push a uint16 into a centry
 713 */
 714 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 715 {
 716         centry_expand(centry, 2);
 717         SIVAL(centry->data, centry->ofs, v);
 718         centry->ofs += 2;
 719 }
 720
 721 /*
 722   push a uint8 into a centry
 723 */
 724 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 725 {
 726         centry_expand(centry, 1);
 727         SCVAL(centry->data, centry->ofs, v);
 728         centry->ofs += 1;
 729 }
 730
 731 /*
 732    push a string into a centry
 733  */
 734 static void centry_put_string(struct cache_entry *centry, const char *s)
 735 {
 736         int len;
 737
 738         if (!s) {
 739                 /* null strings are marked as len 0xFFFF */
 740                 centry_put_uint8(centry, 0xFF);
 741                 return;
 742         }
 743
 744         len = strlen(s);
 745         /* can't handle more than 254 char strings. Truncating is probably best */
 746         if (len > 254) {
 747                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 748                 len = 254;
 749         }
 750         centry_put_uint8(centry, len);
 751         centry_expand(centry, len);
 752         memcpy(centry->data + centry->ofs, s, len);
 753         centry->ofs += len;
 754 }
 755
 756 /*
 757    push a 16 byte hash into a centry - treat as 16 byte string.
 758  */
 759 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 760 {
 761         centry_put_uint8(centry, 16);
 762         centry_expand(centry, 16);
 763         memcpy(centry->data + centry->ofs, val, 16);
 764         centry->ofs += 16;
 765 }
 766
 767 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
 768 {
 769         fstring sid_string;
 770         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 771 }
 772
 773
 774 /*
 775   put NTSTATUS into a centry
 776 */
 777 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 778 {
 779         uint32 status_value = NT_STATUS_V(status);
 780         centry_put_uint32(centry, status_value);
 781 }
 782
 783
 784 /*
 785   push a NTTIME into a centry
 786 */
 787 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 788 {
 789         centry_expand(centry, 8);
 790         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 791         centry->ofs += 4;
 792         SIVAL(centry->data, centry->ofs, nt >> 32);
 793         centry->ofs += 4;
 794 }
 795
 796 /*
 797   push a time_t into a centry - use a 64 bit size.
 798   NTTIME here is being used as a convenient 64-bit size.
 799 */
 800 static void centry_put_time(struct cache_entry *centry, time_t t)
 801 {
 802         NTTIME nt = (NTTIME)t;
 803         centry_put_nttime(centry, nt);
 804 }
 805
 806 /*
 807   start a centry for output. When finished, call centry_end()
 808 */
 809 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 810 {
 811         struct cache_entry *centry;
 812
 813         if (!wcache->tdb)
 814                 return NULL;
 815
 816         centry = SMB_XMALLOC_P(struct cache_entry);
 817
 818         centry->len = 8192; /* reasonable default */
 819         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 820         centry->ofs = 0;
 821         centry->sequence_number = domain->sequence_number;
 822         centry_put_ntstatus(centry, status);
 823         centry_put_uint32(centry, centry->sequence_number);
 824         return centry;
 825 }
 826
 827 /*
 828   finish a centry and write it to the tdb
 829 */
 830 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 831 static void centry_end(struct cache_entry *centry, const char *format, ...)
 832 {
 833         va_list ap;
 834         char *kstr;
 835         TDB_DATA key, data;
 836
 837         if (!winbindd_use_cache()) {
 838                 return;
 839         }
 840
 841         va_start(ap, format);
 842         smb_xvasprintf(&kstr, format, ap);
 843         va_end(ap);
 844
 845         key = string_tdb_data(kstr);
 846         data.dptr = centry->data;
 847         data.dsize = centry->ofs;
 848
 849         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 850         free(kstr);
 851 }
 852
 853 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 854                                     NTSTATUS status, const char *domain_name,
 855                                     const char *name, const DOM_SID *sid,
 856                                     enum lsa_SidType type)
 857 {
 858         struct cache_entry *centry;
 859         fstring uname;
 860
 861         centry = centry_start(domain, status);
 862         if (!centry)
 863                 return;
 864         centry_put_uint32(centry, type);
 865         centry_put_sid(centry, sid);
 866         fstrcpy(uname, name);
 867         strupper_m(uname);
 868         centry_end(centry, "NS/%s/%s", domain_name, uname);
 869         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 870                   uname, sid_string_dbg(sid), nt_errstr(status)));
 871         centry_free(centry);
 872 }
 873
 874 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 875                                     const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 876 {
 877         struct cache_entry *centry;
 878         fstring sid_string;
 879
 880         centry = centry_start(domain, status);
 881         if (!centry)
 882                 return;
 883
 884         if (NT_STATUS_IS_OK(status)) {
 885                 centry_put_uint32(centry, type);
 886                 centry_put_string(centry, domain_name);
 887                 centry_put_string(centry, name);
 888         }
 889
 890         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 891         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 892                   name, nt_errstr(status)));
 893         centry_free(centry);
 894 }
 895
 896
 897 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WINBIND_USERINFO *info)
 898 {
 899         struct cache_entry *centry;
 900         fstring sid_string;
 901
 902         if (is_null_sid(&info->user_sid)) {
 903                 return;
 904         }
 905
 906         centry = centry_start(domain, status);
 907         if (!centry)
 908                 return;
 909         centry_put_string(centry, info->acct_name);
 910         centry_put_string(centry, info->full_name);
 911         centry_put_string(centry, info->homedir);
 912         centry_put_string(centry, info->shell);
 913         centry_put_uint32(centry, info->primary_gid);
 914         centry_put_sid(centry, &info->user_sid);
 915         centry_put_sid(centry, &info->group_sid);
 916         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 917                                                   &info->user_sid));
 918         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 919         centry_free(centry);
 920 }
 921
 922 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
 923                                        NTSTATUS status,
 924                                        struct samr_DomInfo12 *lockout_policy)
 925 {
 926         struct cache_entry *centry;
 927
 928         centry = centry_start(domain, status);
 929         if (!centry)
 930                 return;
 931
 932         centry_put_nttime(centry, lockout_policy->lockout_duration);
 933         centry_put_nttime(centry, lockout_policy->lockout_window);
 934         centry_put_uint16(centry, lockout_policy->lockout_threshold);
 935
 936         centry_end(centry, "LOC_POL/%s", domain->name);
 937
 938         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
 939
 940         centry_free(centry);
 941 }
 942
 943
 944
 945 static void wcache_save_password_policy(struct winbindd_domain *domain,
 946                                         NTSTATUS status,
 947                                         struct samr_DomInfo1 *policy)
 948 {
 949         struct cache_entry *centry;
 950
 951         centry = centry_start(domain, status);
 952         if (!centry)
 953                 return;
 954
 955         centry_put_uint16(centry, policy->min_password_length);
 956         centry_put_uint16(centry, policy->password_history_length);
 957         centry_put_uint32(centry, policy->password_properties);
 958         centry_put_nttime(centry, policy->max_password_age);
 959         centry_put_nttime(centry, policy->min_password_age);
 960
 961         centry_end(centry, "PWD_POL/%s", domain->name);
 962
 963         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
 964
 965         centry_free(centry);
 966 }
 967
 968 /***************************************************************************
 969  ***************************************************************************/
 970
 971 static void wcache_save_username_alias(struct winbindd_domain *domain,
 972                                        NTSTATUS status,
 973                                        const char *name, const char *alias)
 974 {
 975         struct cache_entry *centry;
 976         fstring uname;
 977
 978         if ( (centry = centry_start(domain, status)) == NULL )
 979                 return;
 980
 981         centry_put_string( centry, alias );
 982
 983         fstrcpy(uname, name);
 984         strupper_m(uname);
 985         centry_end(centry, "NSS/NA/%s", uname);
 986
 987         DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
 988
 989         centry_free(centry);
 990 }
 991
 992 static void wcache_save_alias_username(struct winbindd_domain *domain,
 993                                        NTSTATUS status,
 994                                        const char *alias, const char *name)
 995 {
 996         struct cache_entry *centry;
 997         fstring uname;
 998
 999         if ( (centry = centry_start(domain, status)) == NULL )
1000                 return;
1001
1002         centry_put_string( centry, name );
1003
1004         fstrcpy(uname, alias);
1005         strupper_m(uname);
1006         centry_end(centry, "NSS/AN/%s", uname);
1007
1008         DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1009
1010         centry_free(centry);
1011 }
1012
1013 /***************************************************************************
1014  ***************************************************************************/
1015
1016 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1017                                     struct winbindd_domain *domain,
1018                                     const char *name, char **alias )
1019 {
1020         struct winbind_cache *cache = get_cache(domain);
1021         struct cache_entry *centry = NULL;
1022         NTSTATUS status;
1023         char *upper_name;
1024
1025         if ( domain->internal )
1026                 return NT_STATUS_NOT_SUPPORTED;
1027
1028         if (!cache->tdb)
1029                 goto do_query;
1030
1031         if ( (upper_name = SMB_STRDUP(name)) == NULL )
1032                 return NT_STATUS_NO_MEMORY;
1033         strupper_m(upper_name);
1034
1035         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1036
1037         SAFE_FREE( upper_name );
1038
1039         if (!centry)
1040                 goto do_query;
1041
1042         status = centry->status;
1043
1044         if (!NT_STATUS_IS_OK(status)) {
1045                 centry_free(centry);
1046                 return status;
1047         }
1048
1049         *alias = centry_string( centry, mem_ctx );
1050
1051         centry_free(centry);
1052
1053         DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1054                   name, *alias ? *alias : "(none)"));
1055
1056         return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1057
1058 do_query:
1059
1060         /* If its not in cache and we are offline, then fail */
1061
1062         if ( get_global_winbindd_state_offline() || !domain->online ) {
1063                 DEBUG(8,("resolve_username_to_alias: rejecting query "
1064                          "in offline mode\n"));
1065                 return NT_STATUS_NOT_FOUND;
1066         }
1067
1068         status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1069
1070         if ( NT_STATUS_IS_OK( status ) ) {
1071                 wcache_save_username_alias(domain, status, name, *alias);
1072         }
1073
1074         if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1075                 wcache_save_username_alias(domain, status, name, "(NULL)");
1076         }
1077
1078         DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1079                  nt_errstr(status)));
1080
1081         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1082                 set_domain_offline( domain );
1083         }
1084
1085         return status;
1086 }
1087
1088 /***************************************************************************
1089  ***************************************************************************/
1090
1091 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1092                                     struct winbindd_domain *domain,
1093                                     const char *alias, char **name )
1094 {
1095         struct winbind_cache *cache = get_cache(domain);
1096         struct cache_entry *centry = NULL;
1097         NTSTATUS status;
1098         char *upper_name;
1099
1100         if ( domain->internal )
1101                 return  NT_STATUS_NOT_SUPPORTED;
1102
1103         if (!cache->tdb)
1104                 goto do_query;
1105
1106         if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1107                 return NT_STATUS_NO_MEMORY;
1108         strupper_m(upper_name);
1109
1110         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1111
1112         SAFE_FREE( upper_name );
1113
1114         if (!centry)
1115                 goto do_query;
1116
1117         status = centry->status;
1118
1119         if (!NT_STATUS_IS_OK(status)) {
1120                 centry_free(centry);
1121                 return status;
1122         }
1123
1124         *name = centry_string( centry, mem_ctx );
1125
1126         centry_free(centry);
1127
1128         DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1129                   alias, *name ? *name : "(none)"));
1130
1131         return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1132
1133 do_query:
1134
1135         /* If its not in cache and we are offline, then fail */
1136
1137         if ( get_global_winbindd_state_offline() || !domain->online ) {
1138                 DEBUG(8,("resolve_alias_to_username: rejecting query "
1139                          "in offline mode\n"));
1140                 return NT_STATUS_NOT_FOUND;
1141         }
1142
1143         /* an alias cannot contain a domain prefix or '@' */
1144
1145         if (strchr(alias, '\\') || strchr(alias, '@')) {
1146                 DEBUG(10,("resolve_alias_to_username: skipping fully "
1147                           "qualified name %s\n", alias));
1148                 return NT_STATUS_OBJECT_NAME_INVALID;
1149         }
1150
1151         status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1152
1153         if ( NT_STATUS_IS_OK( status ) ) {
1154                 wcache_save_alias_username( domain, status, alias, *name );
1155         }
1156
1157         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1158                 wcache_save_alias_username(domain, status, alias, "(NULL)");
1159         }
1160
1161         DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1162                  nt_errstr(status)));
1163
1164         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1165                 set_domain_offline( domain );
1166         }
1167
1168         return status;
1169 }
1170
1171 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1172 {
1173         struct winbind_cache *cache = get_cache(domain);
1174         TDB_DATA data;
1175         fstring key_str, tmp;
1176         uint32 rid;
1177
1178         if (!cache->tdb) {
1179                 return NT_STATUS_INTERNAL_DB_ERROR;
1180         }
1181
1182         if (is_null_sid(sid)) {
1183                 return NT_STATUS_INVALID_SID;
1184         }
1185
1186         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1187                 return NT_STATUS_INVALID_SID;
1188         }
1189
1190         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1191
1192         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1193         if (!data.dptr) {
1194                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1195         }
1196
1197         SAFE_FREE(data.dptr);
1198         return NT_STATUS_OK;
1199 }
1200
1201 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1202    as new salted ones. */
1203
1204 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1205                           TALLOC_CTX *mem_ctx,
1206                           const DOM_SID *sid,
1207                           const uint8 **cached_nt_pass,
1208                           const uint8 **cached_salt)
1209 {
1210         struct winbind_cache *cache = get_cache(domain);
1211         struct cache_entry *centry = NULL;
1212         NTSTATUS status;
1213         time_t t;
1214         uint32 rid;
1215         fstring tmp;
1216
1217         if (!cache->tdb) {
1218                 return NT_STATUS_INTERNAL_DB_ERROR;
1219         }
1220
1221         if (is_null_sid(sid)) {
1222                 return NT_STATUS_INVALID_SID;
1223         }
1224
1225         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1226                 return NT_STATUS_INVALID_SID;
1227         }
1228
1229         /* Try and get a salted cred first. If we can't
1230            fall back to an unsalted cred. */
1231
1232         centry = wcache_fetch(cache, domain, "CRED/%s",
1233                               sid_to_fstring(tmp, sid));
1234         if (!centry) {
1235                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1236                           sid_string_dbg(sid)));
1237                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1238         }
1239
1240         t = centry_time(centry);
1241
1242         /* In the salted case this isn't actually the nt_hash itself,
1243            but the MD5 of the salt + nt_hash. Let the caller
1244            sort this out. It can tell as we only return the cached_salt
1245            if we are returning a salted cred. */
1246
1247         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1248         if (*cached_nt_pass == NULL) {
1249                 fstring sidstr;
1250
1251                 sid_to_fstring(sidstr, sid);
1252
1253                 /* Bad (old) cred cache. Delete and pretend we
1254                    don't have it. */
1255                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1256                                 sidstr));
1257                 wcache_delete("CRED/%s", sidstr);
1258                 centry_free(centry);
1259                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1260         }
1261
1262         /* We only have 17 bytes more data in the salted cred case. */
1263         if (centry->len - centry->ofs == 17) {
1264                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1265         } else {
1266                 *cached_salt = NULL;
1267         }
1268
1269         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1270         if (*cached_salt) {
1271                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1272         }
1273
1274         status = centry->status;
1275
1276         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1277                   sid_string_dbg(sid), nt_errstr(status) ));
1278
1279         centry_free(centry);
1280         return status;
1281 }
1282
1283 /* Store creds for a SID - only writes out new salted ones. */
1284
1285 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1286                            TALLOC_CTX *mem_ctx,
1287                            const DOM_SID *sid,
1288                            const uint8 nt_pass[NT_HASH_LEN])
1289 {
1290         struct cache_entry *centry;
1291         fstring sid_string;
1292         uint32 rid;
1293         uint8 cred_salt[NT_HASH_LEN];
1294         uint8 salted_hash[NT_HASH_LEN];
1295
1296         if (is_null_sid(sid)) {
1297                 return NT_STATUS_INVALID_SID;
1298         }
1299
1300         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1301                 return NT_STATUS_INVALID_SID;
1302         }
1303
1304         centry = centry_start(domain, NT_STATUS_OK);
1305         if (!centry) {
1306                 return NT_STATUS_INTERNAL_DB_ERROR;
1307         }
1308
1309         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1310
1311         centry_put_time(centry, time(NULL));
1312
1313         /* Create a salt and then salt the hash. */
1314         generate_random_buffer(cred_salt, NT_HASH_LEN);
1315         E_md5hash(cred_salt, nt_pass, salted_hash);
1316
1317         centry_put_hash16(centry, salted_hash);
1318         centry_put_hash16(centry, cred_salt);
1319         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1320
1321         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1322
1323         centry_free(centry);
1324
1325         return NT_STATUS_OK;
1326 }
1327
1328
1329 /* Query display info. This is the basic user list fn */
1330 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1331                                 TALLOC_CTX *mem_ctx,
1332                                 uint32 *num_entries,
1333                                 WINBIND_USERINFO **info)
1334 {
1335         struct winbind_cache *cache = get_cache(domain);
1336         struct cache_entry *centry = NULL;
1337         NTSTATUS status;
1338         unsigned int i, retry;
1339
1340         if (!cache->tdb)
1341                 goto do_query;
1342
1343         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1344         if (!centry)
1345                 goto do_query;
1346
1347         *num_entries = centry_uint32(centry);
1348
1349         if (*num_entries == 0)
1350                 goto do_cached;
1351
1352         (*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
1353         if (! (*info)) {
1354                 smb_panic_fn("query_user_list out of memory");
1355         }
1356         for (i=0; i<(*num_entries); i++) {
1357                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1358                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1359                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1360                 (*info)[i].shell = centry_string(centry, mem_ctx);
1361                 centry_sid(centry, mem_ctx, &(*info)[i].user_sid);
1362                 centry_sid(centry, mem_ctx, &(*info)[i].group_sid);
1363         }
1364
1365 do_cached:
1366         status = centry->status;
1367
1368         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1369                 domain->name, nt_errstr(status) ));
1370
1371         centry_free(centry);
1372         return status;
1373
1374 do_query:
1375         *num_entries = 0;
1376         *info = NULL;
1377
1378         /* Return status value returned by seq number check */
1379
1380         if (!NT_STATUS_IS_OK(domain->last_status))
1381                 return domain->last_status;
1382
1383         /* Put the query_user_list() in a retry loop.  There appears to be
1384          * some bug either with Windows 2000 or Samba's handling of large
1385          * rpc replies.  This manifests itself as sudden disconnection
1386          * at a random point in the enumeration of a large (60k) user list.
1387          * The retry loop simply tries the operation again. )-:  It's not
1388          * pretty but an acceptable workaround until we work out what the
1389          * real problem is. */
1390
1391         retry = 0;
1392         do {
1393
1394                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1395                         domain->name ));
1396
1397                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1398                 if (!NT_STATUS_IS_OK(status)) {
1399                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1400                                   "retrying\n", NT_STATUS_V(status)));
1401                 }
1402                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1403                         DEBUG(3, ("query_user_list: flushing "
1404                                   "connection cache\n"));
1405                         invalidate_cm_connection(&domain->conn);
1406                 }
1407
1408         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1409                  (retry++ < 5));
1410
1411         /* and save it */
1412         refresh_sequence_number(domain, false);
1413         centry = centry_start(domain, status);
1414         if (!centry)
1415                 goto skip_save;
1416         centry_put_uint32(centry, *num_entries);
1417         for (i=0; i<(*num_entries); i++) {
1418                 centry_put_string(centry, (*info)[i].acct_name);
1419                 centry_put_string(centry, (*info)[i].full_name);
1420                 centry_put_string(centry, (*info)[i].homedir);
1421                 centry_put_string(centry, (*info)[i].shell);
1422                 centry_put_sid(centry, &(*info)[i].user_sid);
1423                 centry_put_sid(centry, &(*info)[i].group_sid);
1424                 if (domain->backend && domain->backend->consistent) {
1425                         /* when the backend is consistent we can pre-prime some mappings */
1426                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1427                                                 domain->name,
1428                                                 (*info)[i].acct_name,
1429                                                 &(*info)[i].user_sid,
1430                                                 SID_NAME_USER);
1431                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1432                                                 &(*info)[i].user_sid,
1433                                                 domain->name,
1434                                                 (*info)[i].acct_name,
1435                                                 SID_NAME_USER);
1436                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1437                 }
1438         }
1439         centry_end(centry, "UL/%s", domain->name);
1440         centry_free(centry);
1441
1442 skip_save:
1443         return status;
1444 }
1445
1446 /* list all domain groups */
1447 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1448                                 TALLOC_CTX *mem_ctx,
1449                                 uint32 *num_entries,
1450                                 struct acct_info **info)
1451 {
1452         struct winbind_cache *cache = get_cache(domain);
1453         struct cache_entry *centry = NULL;
1454         NTSTATUS status;
1455         unsigned int i;
1456
1457         if (!cache->tdb)
1458                 goto do_query;
1459
1460         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1461         if (!centry)
1462                 goto do_query;
1463
1464         *num_entries = centry_uint32(centry);
1465
1466         if (*num_entries == 0)
1467                 goto do_cached;
1468
1469         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1470         if (! (*info)) {
1471                 smb_panic_fn("enum_dom_groups out of memory");
1472         }
1473         for (i=0; i<(*num_entries); i++) {
1474                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1475                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1476                 (*info)[i].rid = centry_uint32(centry);
1477         }
1478
1479 do_cached:
1480         status = centry->status;
1481
1482         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1483                 domain->name, nt_errstr(status) ));
1484
1485         centry_free(centry);
1486         return status;
1487
1488 do_query:
1489         *num_entries = 0;
1490         *info = NULL;
1491
1492         /* Return status value returned by seq number check */
1493
1494         if (!NT_STATUS_IS_OK(domain->last_status))
1495                 return domain->last_status;
1496
1497         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1498                 domain->name ));
1499
1500         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1501
1502         /* and save it */
1503         refresh_sequence_number(domain, false);
1504         centry = centry_start(domain, status);
1505         if (!centry)
1506                 goto skip_save;
1507         centry_put_uint32(centry, *num_entries);
1508         for (i=0; i<(*num_entries); i++) {
1509                 centry_put_string(centry, (*info)[i].acct_name);
1510                 centry_put_string(centry, (*info)[i].acct_desc);
1511                 centry_put_uint32(centry, (*info)[i].rid);
1512         }
1513         centry_end(centry, "GL/%s/domain", domain->name);
1514         centry_free(centry);
1515
1516 skip_save:
1517         return status;
1518 }
1519
1520 /* list all domain groups */
1521 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1522                                 TALLOC_CTX *mem_ctx,
1523                                 uint32 *num_entries,
1524                                 struct acct_info **info)
1525 {
1526         struct winbind_cache *cache = get_cache(domain);
1527         struct cache_entry *centry = NULL;
1528         NTSTATUS status;
1529         unsigned int i;
1530
1531         if (!cache->tdb)
1532                 goto do_query;
1533
1534         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1535         if (!centry)
1536                 goto do_query;
1537
1538         *num_entries = centry_uint32(centry);
1539
1540         if (*num_entries == 0)
1541                 goto do_cached;
1542
1543         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1544         if (! (*info)) {
1545                 smb_panic_fn("enum_dom_groups out of memory");
1546         }
1547         for (i=0; i<(*num_entries); i++) {
1548                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1549                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1550                 (*info)[i].rid = centry_uint32(centry);
1551         }
1552
1553 do_cached:
1554
1555         /* If we are returning cached data and the domain controller
1556            is down then we don't know whether the data is up to date
1557            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1558            indicate this. */
1559
1560         if (wcache_server_down(domain)) {
1561                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1562                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1563         } else
1564                 status = centry->status;
1565
1566         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1567                 domain->name, nt_errstr(status) ));
1568
1569         centry_free(centry);
1570         return status;
1571
1572 do_query:
1573         *num_entries = 0;
1574         *info = NULL;
1575
1576         /* Return status value returned by seq number check */
1577
1578         if (!NT_STATUS_IS_OK(domain->last_status))
1579                 return domain->last_status;
1580
1581         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1582                 domain->name ));
1583
1584         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1585
1586         /* and save it */
1587         refresh_sequence_number(domain, false);
1588         centry = centry_start(domain, status);
1589         if (!centry)
1590                 goto skip_save;
1591         centry_put_uint32(centry, *num_entries);
1592         for (i=0; i<(*num_entries); i++) {
1593                 centry_put_string(centry, (*info)[i].acct_name);
1594                 centry_put_string(centry, (*info)[i].acct_desc);
1595                 centry_put_uint32(centry, (*info)[i].rid);
1596         }
1597         centry_end(centry, "GL/%s/local", domain->name);
1598         centry_free(centry);
1599
1600 skip_save:
1601         return status;
1602 }
1603
1604 /* convert a single name to a sid in a domain */
1605 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1606                             TALLOC_CTX *mem_ctx,
1607                             enum winbindd_cmd orig_cmd,
1608                             const char *domain_name,
1609                             const char *name,
1610                             DOM_SID *sid,
1611                             enum lsa_SidType *type)
1612 {
1613         struct winbind_cache *cache = get_cache(domain);
1614         struct cache_entry *centry = NULL;
1615         NTSTATUS status;
1616         fstring uname;
1617
1618         if (!cache->tdb)
1619                 goto do_query;
1620
1621         fstrcpy(uname, name);
1622         strupper_m(uname);
1623         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1624         if (!centry)
1625                 goto do_query;
1626
1627         status = centry->status;
1628         if (NT_STATUS_IS_OK(status)) {
1629                 *type = (enum lsa_SidType)centry_uint32(centry);
1630                 centry_sid(centry, mem_ctx, sid);
1631         }
1632
1633         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: %s\n",
1634                 domain->name, nt_errstr(status) ));
1635
1636         centry_free(centry);
1637         return status;
1638
1639 do_query:
1640         ZERO_STRUCTP(sid);
1641
1642         /* If the seq number check indicated that there is a problem
1643          * with this DC, then return that status... except for
1644          * access_denied.  This is special because the dc may be in
1645          * "restrict anonymous = 1" mode, in which case it will deny
1646          * most unauthenticated operations, but *will* allow the LSA
1647          * name-to-sid that we try as a fallback. */
1648
1649         if (!(NT_STATUS_IS_OK(domain->last_status)
1650               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1651                 return domain->last_status;
1652
1653         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1654                 domain->name ));
1655
1656         status = domain->backend->name_to_sid(domain, mem_ctx, orig_cmd,
1657                                               domain_name, name, sid, type);
1658
1659         /* and save it */
1660         refresh_sequence_number(domain, false);
1661
1662         if (domain->online &&
1663             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1664                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1665
1666                 /* Only save the reverse mapping if this was not a UPN */
1667                 if (!strchr(name, '@')) {
1668                         strupper_m(CONST_DISCARD(char *,domain_name));
1669                         strlower_m(CONST_DISCARD(char *,name));
1670                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1671                 }
1672         }
1673
1674         return status;
1675 }
1676
1677 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1678    given */
1679 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1680                             TALLOC_CTX *mem_ctx,
1681                             const DOM_SID *sid,
1682                             char **domain_name,
1683                             char **name,
1684                             enum lsa_SidType *type)
1685 {
1686         struct winbind_cache *cache = get_cache(domain);
1687         struct cache_entry *centry = NULL;
1688         NTSTATUS status;
1689         fstring sid_string;
1690
1691         if (!cache->tdb)
1692                 goto do_query;
1693
1694         centry = wcache_fetch(cache, domain, "SN/%s",
1695                               sid_to_fstring(sid_string, sid));
1696         if (!centry)
1697                 goto do_query;
1698
1699         status = centry->status;
1700         if (NT_STATUS_IS_OK(status)) {
1701                 *type = (enum lsa_SidType)centry_uint32(centry);
1702                 *domain_name = centry_string(centry, mem_ctx);
1703                 *name = centry_string(centry, mem_ctx);
1704         }
1705
1706         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: %s\n",
1707                 domain->name, nt_errstr(status) ));
1708
1709         centry_free(centry);
1710         return status;
1711
1712 do_query:
1713         *name = NULL;
1714         *domain_name = NULL;
1715
1716         /* If the seq number check indicated that there is a problem
1717          * with this DC, then return that status... except for
1718          * access_denied.  This is special because the dc may be in
1719          * "restrict anonymous = 1" mode, in which case it will deny
1720          * most unauthenticated operations, but *will* allow the LSA
1721          * sid-to-name that we try as a fallback. */
1722
1723         if (!(NT_STATUS_IS_OK(domain->last_status)
1724               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1725                 return domain->last_status;
1726
1727         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1728                 domain->name ));
1729
1730         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1731
1732         /* and save it */
1733         refresh_sequence_number(domain, false);
1734         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1735
1736         /* We can't save the name to sid mapping here, as with sid history a
1737          * later name2sid would give the wrong sid. */
1738
1739         return status;
1740 }
1741
1742 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1743                               TALLOC_CTX *mem_ctx,
1744                               const DOM_SID *domain_sid,
1745                               uint32 *rids,
1746                               size_t num_rids,
1747                               char **domain_name,
1748                               char ***names,
1749                               enum lsa_SidType **types)
1750 {
1751         struct winbind_cache *cache = get_cache(domain);
1752         size_t i;
1753         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1754         bool have_mapped;
1755         bool have_unmapped;
1756
1757         *domain_name = NULL;
1758         *names = NULL;
1759         *types = NULL;
1760
1761         if (!cache->tdb) {
1762                 goto do_query;
1763         }
1764
1765         if (num_rids == 0) {
1766                 return NT_STATUS_OK;
1767         }
1768
1769         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1770         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1771
1772         if ((*names == NULL) || (*types == NULL)) {
1773                 result = NT_STATUS_NO_MEMORY;
1774                 goto error;
1775         }
1776
1777         have_mapped = have_unmapped = false;
1778
1779         for (i=0; i<num_rids; i++) {
1780                 DOM_SID sid;
1781                 struct cache_entry *centry;
1782                 fstring tmp;
1783
1784                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1785                         result = NT_STATUS_INTERNAL_ERROR;
1786                         goto error;
1787                 }
1788
1789                 centry = wcache_fetch(cache, domain, "SN/%s",
1790                                       sid_to_fstring(tmp, &sid));
1791                 if (!centry) {
1792                         goto do_query;
1793                 }
1794
1795                 (*types)[i] = SID_NAME_UNKNOWN;
1796                 (*names)[i] = talloc_strdup(*names, "");
1797
1798                 if (NT_STATUS_IS_OK(centry->status)) {
1799                         char *dom;
1800                         have_mapped = true;
1801                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1802
1803                         dom = centry_string(centry, mem_ctx);
1804                         if (*domain_name == NULL) {
1805                                 *domain_name = dom;
1806                         } else {
1807                                 talloc_free(dom);
1808                         }
1809
1810                         (*names)[i] = centry_string(centry, *names);
1811
1812                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1813                         have_unmapped = true;
1814
1815                 } else {
1816                         /* something's definitely wrong */
1817                         result = centry->status;
1818                         goto error;
1819                 }
1820
1821                 centry_free(centry);
1822         }
1823
1824         if (!have_mapped) {
1825                 return NT_STATUS_NONE_MAPPED;
1826         }
1827         if (!have_unmapped) {
1828                 return NT_STATUS_OK;
1829         }
1830         return STATUS_SOME_UNMAPPED;
1831
1832  do_query:
1833
1834         TALLOC_FREE(*names);
1835         TALLOC_FREE(*types);
1836
1837         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1838                                                 rids, num_rids, domain_name,
1839                                                 names, types);
1840
1841         /*
1842           None of the queried rids has been found so save all negative entries
1843         */
1844         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1845                 for (i = 0; i < num_rids; i++) {
1846                         DOM_SID sid;
1847                         const char *name = "";
1848                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
1849                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
1850
1851                         if (!sid_compose(&sid, domain_sid, rids[i])) {
1852                                 return NT_STATUS_INTERNAL_ERROR;
1853                         }
1854
1855                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1856                                                 name, type);
1857                 }
1858
1859                 return result;
1860         }
1861
1862         /*
1863           Some or all of the queried rids have been found.
1864         */
1865         if (!NT_STATUS_IS_OK(result) &&
1866             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1867                 return result;
1868         }
1869
1870         refresh_sequence_number(domain, false);
1871
1872         for (i=0; i<num_rids; i++) {
1873                 DOM_SID sid;
1874                 NTSTATUS status;
1875
1876                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1877                         result = NT_STATUS_INTERNAL_ERROR;
1878                         goto error;
1879                 }
1880
1881                 status = (*types)[i] == SID_NAME_UNKNOWN ?
1882                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1883
1884                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1885                                         (*names)[i], (*types)[i]);
1886         }
1887
1888         return result;
1889
1890  error:
1891
1892         TALLOC_FREE(*names);
1893         TALLOC_FREE(*types);
1894         return result;
1895 }
1896
1897 /* Lookup user information from a rid */
1898 static NTSTATUS query_user(struct winbindd_domain *domain,
1899                            TALLOC_CTX *mem_ctx,
1900                            const DOM_SID *user_sid,
1901                            WINBIND_USERINFO *info)
1902 {
1903         struct winbind_cache *cache = get_cache(domain);
1904         struct cache_entry *centry = NULL;
1905         NTSTATUS status;
1906         fstring tmp;
1907
1908         if (!cache->tdb)
1909                 goto do_query;
1910
1911         centry = wcache_fetch(cache, domain, "U/%s",
1912                               sid_to_fstring(tmp, user_sid));
1913
1914         /* If we have an access denied cache entry and a cached info3 in the
1915            samlogon cache then do a query.  This will force the rpc back end
1916            to return the info3 data. */
1917
1918         if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1919             netsamlogon_cache_have(user_sid)) {
1920                 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1921                 domain->last_status = NT_STATUS_OK;
1922                 centry_free(centry);
1923                 goto do_query;
1924         }
1925
1926         if (!centry)
1927                 goto do_query;
1928
1929         /* if status is not ok then this is a negative hit
1930            and the rest of the data doesn't matter */
1931         status = centry->status;
1932         if (NT_STATUS_IS_OK(status)) {
1933                 info->acct_name = centry_string(centry, mem_ctx);
1934                 info->full_name = centry_string(centry, mem_ctx);
1935                 info->homedir = centry_string(centry, mem_ctx);
1936                 info->shell = centry_string(centry, mem_ctx);
1937                 info->primary_gid = centry_uint32(centry);
1938                 centry_sid(centry, mem_ctx, &info->user_sid);
1939                 centry_sid(centry, mem_ctx, &info->group_sid);
1940         }
1941
1942         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: %s\n",
1943                 domain->name, nt_errstr(status) ));
1944
1945         centry_free(centry);
1946         return status;
1947
1948 do_query:
1949         ZERO_STRUCTP(info);
1950
1951         /* Return status value returned by seq number check */
1952
1953         if (!NT_STATUS_IS_OK(domain->last_status))
1954                 return domain->last_status;
1955
1956         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
1957                 domain->name ));
1958
1959         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
1960
1961         /* and save it */
1962         refresh_sequence_number(domain, false);
1963         wcache_save_user(domain, status, info);
1964
1965         return status;
1966 }
1967
1968
1969 /* Lookup groups a user is a member of. */
1970 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
1971                                   TALLOC_CTX *mem_ctx,
1972                                   const DOM_SID *user_sid,
1973                                   uint32 *num_groups, DOM_SID **user_gids)
1974 {
1975         struct winbind_cache *cache = get_cache(domain);
1976         struct cache_entry *centry = NULL;
1977         NTSTATUS status;
1978         unsigned int i;
1979         fstring sid_string;
1980
1981         if (!cache->tdb)
1982                 goto do_query;
1983
1984         centry = wcache_fetch(cache, domain, "UG/%s",
1985                               sid_to_fstring(sid_string, user_sid));
1986
1987         /* If we have an access denied cache entry and a cached info3 in the
1988            samlogon cache then do a query.  This will force the rpc back end
1989            to return the info3 data. */
1990
1991         if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1992             netsamlogon_cache_have(user_sid)) {
1993                 DEBUG(10, ("lookup_usergroups: cached access denied and have cached info3\n"));
1994                 domain->last_status = NT_STATUS_OK;
1995                 centry_free(centry);
1996                 goto do_query;
1997         }
1998
1999         if (!centry)
2000                 goto do_query;
2001
2002         *num_groups = centry_uint32(centry);
2003
2004         if (*num_groups == 0)
2005                 goto do_cached;
2006
2007         (*user_gids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_groups);
2008         if (! (*user_gids)) {
2009                 smb_panic_fn("lookup_usergroups out of memory");
2010         }
2011         for (i=0; i<(*num_groups); i++) {
2012                 centry_sid(centry, mem_ctx, &(*user_gids)[i]);
2013         }
2014
2015 do_cached:
2016         status = centry->status;
2017
2018         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status: %s\n",
2019                 domain->name, nt_errstr(status) ));
2020
2021         centry_free(centry);
2022         return status;
2023
2024 do_query:
2025         (*num_groups) = 0;
2026         (*user_gids) = NULL;
2027
2028         /* Return status value returned by seq number check */
2029
2030         if (!NT_STATUS_IS_OK(domain->last_status))
2031                 return domain->last_status;
2032
2033         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2034                 domain->name ));
2035
2036         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2037
2038         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2039                 goto skip_save;
2040
2041         /* and save it */
2042         refresh_sequence_number(domain, false);
2043         centry = centry_start(domain, status);
2044         if (!centry)
2045                 goto skip_save;
2046
2047         centry_put_uint32(centry, *num_groups);
2048         for (i=0; i<(*num_groups); i++) {
2049                 centry_put_sid(centry, &(*user_gids)[i]);
2050         }
2051
2052         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2053         centry_free(centry);
2054
2055 skip_save:
2056         return status;
2057 }
2058
2059 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2060                                    TALLOC_CTX *mem_ctx,
2061                                    uint32 num_sids, const DOM_SID *sids,
2062                                    uint32 *num_aliases, uint32 **alias_rids)
2063 {
2064         struct winbind_cache *cache = get_cache(domain);
2065         struct cache_entry *centry = NULL;
2066         NTSTATUS status;
2067         char *sidlist = talloc_strdup(mem_ctx, "");
2068         int i;
2069
2070         if (!cache->tdb)
2071                 goto do_query;
2072
2073         if (num_sids == 0) {
2074                 *num_aliases = 0;
2075                 *alias_rids = NULL;
2076                 return NT_STATUS_OK;
2077         }
2078
2079         /* We need to cache indexed by the whole list of SIDs, the aliases
2080          * resulting might come from any of the SIDs. */
2081
2082         for (i=0; i<num_sids; i++) {
2083                 fstring tmp;
2084                 sidlist = talloc_asprintf(mem_ctx, "%s/%s", sidlist,
2085                                           sid_to_fstring(tmp, &sids[i]));
2086                 if (sidlist == NULL)
2087                         return NT_STATUS_NO_MEMORY;
2088         }
2089
2090         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2091
2092         if (!centry)
2093                 goto do_query;
2094
2095         *num_aliases = centry_uint32(centry);
2096         *alias_rids = NULL;
2097
2098         if (*num_aliases) {
2099                 (*alias_rids) = TALLOC_ARRAY(mem_ctx, uint32, *num_aliases);
2100
2101                 if ((*alias_rids) == NULL) {
2102                         centry_free(centry);
2103                         return NT_STATUS_NO_MEMORY;
2104                 }
2105         } else {
2106                 (*alias_rids) = NULL;
2107         }
2108
2109         for (i=0; i<(*num_aliases); i++)
2110                 (*alias_rids)[i] = centry_uint32(centry);
2111
2112         status = centry->status;
2113
2114         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2115                   "status %s\n", domain->name, nt_errstr(status)));
2116
2117         centry_free(centry);
2118         return status;
2119
2120  do_query:
2121         (*num_aliases) = 0;
2122         (*alias_rids) = NULL;
2123
2124         if (!NT_STATUS_IS_OK(domain->last_status))
2125                 return domain->last_status;
2126
2127         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2128                   "for domain %s\n", domain->name ));
2129
2130         status = domain->backend->lookup_useraliases(domain, mem_ctx,
2131                                                      num_sids, sids,
2132                                                      num_aliases, alias_rids);
2133
2134         /* and save it */
2135         refresh_sequence_number(domain, false);
2136         centry = centry_start(domain, status);
2137         if (!centry)
2138                 goto skip_save;
2139         centry_put_uint32(centry, *num_aliases);
2140         for (i=0; i<(*num_aliases); i++)
2141                 centry_put_uint32(centry, (*alias_rids)[i]);
2142         centry_end(centry, "UA%s", sidlist);
2143         centry_free(centry);
2144
2145  skip_save:
2146         return status;
2147 }
2148
2149
2150 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2151                                 TALLOC_CTX *mem_ctx,
2152                                 const DOM_SID *group_sid, uint32 *num_names,
2153                                 DOM_SID **sid_mem, char ***names,
2154                                 uint32 **name_types)
2155 {
2156         struct winbind_cache *cache = get_cache(domain);
2157         struct cache_entry *centry = NULL;
2158         NTSTATUS status;
2159         unsigned int i;
2160         fstring sid_string;
2161
2162         if (!cache->tdb)
2163                 goto do_query;
2164
2165         centry = wcache_fetch(cache, domain, "GM/%s",
2166                               sid_to_fstring(sid_string, group_sid));
2167         if (!centry)
2168                 goto do_query;
2169
2170         *num_names = centry_uint32(centry);
2171
2172         if (*num_names == 0)
2173                 goto do_cached;
2174
2175         (*sid_mem) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_names);
2176         (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
2177         (*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
2178
2179         if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
2180                 smb_panic_fn("lookup_groupmem out of memory");
2181         }
2182
2183         for (i=0; i<(*num_names); i++) {
2184                 centry_sid(centry, mem_ctx, &(*sid_mem)[i]);
2185                 (*names)[i] = centry_string(centry, mem_ctx);
2186                 (*name_types)[i] = centry_uint32(centry);
2187         }
2188
2189 do_cached:
2190         status = centry->status;
2191
2192         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status: %s\n",
2193                 domain->name, nt_errstr(status)));
2194
2195         centry_free(centry);
2196         return status;
2197
2198 do_query:
2199         (*num_names) = 0;
2200         (*sid_mem) = NULL;
2201         (*names) = NULL;
2202         (*name_types) = NULL;
2203
2204         /* Return status value returned by seq number check */
2205
2206         if (!NT_STATUS_IS_OK(domain->last_status))
2207                 return domain->last_status;
2208
2209         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2210                 domain->name ));
2211
2212         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2213                                                   sid_mem, names, name_types);
2214
2215         /* and save it */
2216         refresh_sequence_number(domain, false);
2217         centry = centry_start(domain, status);
2218         if (!centry)
2219                 goto skip_save;
2220         centry_put_uint32(centry, *num_names);
2221         for (i=0; i<(*num_names); i++) {
2222                 centry_put_sid(centry, &(*sid_mem)[i]);
2223                 centry_put_string(centry, (*names)[i]);
2224                 centry_put_uint32(centry, (*name_types)[i]);
2225         }
2226         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2227         centry_free(centry);
2228
2229 skip_save:
2230         return status;
2231 }
2232
2233 /* find the sequence number for a domain */
2234 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2235 {
2236         refresh_sequence_number(domain, false);
2237
2238         *seq = domain->sequence_number;
2239
2240         return NT_STATUS_OK;
2241 }
2242
2243 /* enumerate trusted domains
2244  * (we need to have the list of trustdoms in the cache when we go offline) -
2245  * Guenther */
2246 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2247                                 TALLOC_CTX *mem_ctx,
2248                                 uint32 *num_domains,
2249                                 char ***names,
2250                                 char ***alt_names,
2251                                 DOM_SID **dom_sids)
2252 {
2253         struct winbind_cache *cache = get_cache(domain);
2254         struct cache_entry *centry = NULL;
2255         NTSTATUS status;
2256         int i;
2257
2258         if (!cache->tdb)
2259                 goto do_query;
2260
2261         centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2262
2263         if (!centry) {
2264                 goto do_query;
2265         }
2266
2267         *num_domains = centry_uint32(centry);
2268
2269         if (*num_domains) {
2270                 (*names)        = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2271                 (*alt_names)    = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2272                 (*dom_sids)     = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2273
2274                 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2275                         smb_panic_fn("trusted_domains out of memory");
2276                 }
2277         } else {
2278                 (*names) = NULL;
2279                 (*alt_names) = NULL;
2280                 (*dom_sids) = NULL;
2281         }
2282
2283         for (i=0; i<(*num_domains); i++) {
2284                 (*names)[i] = centry_string(centry, mem_ctx);
2285                 (*alt_names)[i] = centry_string(centry, mem_ctx);
2286                 if (!centry_sid(centry, mem_ctx, &(*dom_sids)[i])) {
2287                         sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2288                 }
2289         }
2290
2291         status = centry->status;
2292
2293         DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2294                 domain->name, *num_domains, nt_errstr(status) ));
2295
2296         centry_free(centry);
2297         return status;
2298
2299 do_query:
2300         (*num_domains) = 0;
2301         (*dom_sids) = NULL;
2302         (*names) = NULL;
2303         (*alt_names) = NULL;
2304
2305         /* Return status value returned by seq number check */
2306
2307         if (!NT_STATUS_IS_OK(domain->last_status))
2308                 return domain->last_status;
2309
2310         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2311                 domain->name ));
2312
2313         status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2314                                                 names, alt_names, dom_sids);
2315
2316         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2317          * so that the generic centry handling still applies correctly -
2318          * Guenther*/
2319
2320         if (!NT_STATUS_IS_ERR(status)) {
2321                 status = NT_STATUS_OK;
2322         }
2323
2324
2325 #if 0    /* Disabled as we want the trust dom list to be managed by
2326             the main parent and always to make the query.  --jerry */
2327
2328         /* and save it */
2329         refresh_sequence_number(domain, false);
2330
2331         centry = centry_start(domain, status);
2332         if (!centry)
2333                 goto skip_save;
2334
2335         centry_put_uint32(centry, *num_domains);
2336
2337         for (i=0; i<(*num_domains); i++) {
2338                 centry_put_string(centry, (*names)[i]);
2339                 centry_put_string(centry, (*alt_names)[i]);
2340                 centry_put_sid(centry, &(*dom_sids)[i]);
2341         }
2342
2343         centry_end(centry, "TRUSTDOMS/%s", domain->name);
2344
2345         centry_free(centry);
2346
2347 skip_save:
2348 #endif
2349
2350         return status;
2351 }
2352
2353 /* get lockout policy */
2354 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2355                                TALLOC_CTX *mem_ctx,
2356                                struct samr_DomInfo12 *policy)
2357 {
2358         struct winbind_cache *cache = get_cache(domain);
2359         struct cache_entry *centry = NULL;
2360         NTSTATUS status;
2361
2362         if (!cache->tdb)
2363                 goto do_query;
2364
2365         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2366
2367         if (!centry)
2368                 goto do_query;
2369
2370         policy->lockout_duration = centry_nttime(centry);
2371         policy->lockout_window = centry_nttime(centry);
2372         policy->lockout_threshold = centry_uint16(centry);
2373
2374         status = centry->status;
2375
2376         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2377                 domain->name, nt_errstr(status) ));
2378
2379         centry_free(centry);
2380         return status;
2381
2382 do_query:
2383         ZERO_STRUCTP(policy);
2384
2385         /* Return status value returned by seq number check */
2386
2387         if (!NT_STATUS_IS_OK(domain->last_status))
2388                 return domain->last_status;
2389
2390         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2391                 domain->name ));
2392
2393         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2394
2395         /* and save it */
2396         refresh_sequence_number(domain, false);
2397         wcache_save_lockout_policy(domain, status, policy);
2398
2399         return status;
2400 }
2401
2402 /* get password policy */
2403 static NTSTATUS password_policy(struct winbindd_domain *domain,
2404                                 TALLOC_CTX *mem_ctx,
2405                                 struct samr_DomInfo1 *policy)
2406 {
2407         struct winbind_cache *cache = get_cache(domain);
2408         struct cache_entry *centry = NULL;
2409         NTSTATUS status;
2410
2411         if (!cache->tdb)
2412                 goto do_query;
2413
2414         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2415
2416         if (!centry)
2417                 goto do_query;
2418
2419         policy->min_password_length = centry_uint16(centry);
2420         policy->password_history_length = centry_uint16(centry);
2421         policy->password_properties = centry_uint32(centry);
2422         policy->max_password_age = centry_nttime(centry);
2423         policy->min_password_age = centry_nttime(centry);
2424
2425         status = centry->status;
2426
2427         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2428                 domain->name, nt_errstr(status) ));
2429
2430         centry_free(centry);
2431         return status;
2432
2433 do_query:
2434         ZERO_STRUCTP(policy);
2435
2436         /* Return status value returned by seq number check */
2437
2438         if (!NT_STATUS_IS_OK(domain->last_status))
2439                 return domain->last_status;
2440
2441         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2442                 domain->name ));
2443
2444         status = domain->backend->password_policy(domain, mem_ctx, policy);
2445
2446         /* and save it */
2447         refresh_sequence_number(domain, false);
2448         if (NT_STATUS_IS_OK(status)) {
2449                 wcache_save_password_policy(domain, status, policy);
2450         }
2451
2452         return status;
2453 }
2454
2455
2456 /* Invalidate cached user and group lists coherently */
2457
2458 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2459                        void *state)
2460 {
2461         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2462             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2463                 tdb_delete(the_tdb, kbuf);
2464
2465         return 0;
2466 }
2467
2468 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2469
2470 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2471                                 struct netr_SamInfo3 *info3)
2472 {
2473         DOM_SID sid;
2474         fstring key_str, sid_string;
2475         struct winbind_cache *cache;
2476
2477         /* dont clear cached U/SID and UG/SID entries when we want to logon
2478          * offline - gd */
2479
2480         if (lp_winbind_offline_logon()) {
2481                 return;
2482         }
2483
2484         if (!domain)
2485                 return;
2486
2487         cache = get_cache(domain);
2488
2489         if (!cache->tdb) {
2490                 return;
2491         }
2492
2493         sid_copy(&sid, info3->base.domain_sid);
2494         sid_append_rid(&sid, info3->base.rid);
2495
2496         /* Clear U/SID cache entry */
2497         fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2498         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2499         tdb_delete(cache->tdb, string_tdb_data(key_str));
2500
2501         /* Clear UG/SID cache entry */
2502         fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2503         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2504         tdb_delete(cache->tdb, string_tdb_data(key_str));
2505
2506         /* Samba/winbindd never needs this. */
2507         netsamlogon_clear_cached_user(info3);
2508 }
2509
2510 bool wcache_invalidate_cache(void)
2511 {
2512         struct winbindd_domain *domain;
2513
2514         for (domain = domain_list(); domain; domain = domain->next) {
2515                 struct winbind_cache *cache = get_cache(domain);
2516
2517                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2518                            "entries for %s\n", domain->name));
2519                 if (cache) {
2520                         if (cache->tdb) {
2521                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
2522                         } else {
2523                                 return false;
2524                         }
2525                 }
2526         }
2527         return true;
2528 }
2529
2530 bool init_wcache(void)
2531 {
2532         if (wcache == NULL) {
2533                 wcache = SMB_XMALLOC_P(struct winbind_cache);
2534                 ZERO_STRUCTP(wcache);
2535         }
2536
2537         if (wcache->tdb != NULL)
2538                 return true;
2539
2540         /* when working offline we must not clear the cache on restart */
2541         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2542                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2543                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2544                                 O_RDWR|O_CREAT, 0600);
2545
2546         if (wcache->tdb == NULL) {
2547                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2548                 return false;
2549         }
2550
2551         return true;
2552 }
2553
2554 /************************************************************************
2555  This is called by the parent to initialize the cache file.
2556  We don't need sophisticated locking here as we know we're the
2557  only opener.
2558 ************************************************************************/
2559
2560 bool initialize_winbindd_cache(void)
2561 {
2562         bool cache_bad = true;
2563         uint32 vers;
2564
2565         if (!init_wcache()) {
2566                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2567                 return false;
2568         }
2569
2570         /* Check version number. */
2571         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2572                         vers == WINBINDD_CACHE_VERSION) {
2573                 cache_bad = false;
2574         }
2575
2576         if (cache_bad) {
2577                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2578                         "and re-creating with version number %d\n",
2579                         WINBINDD_CACHE_VERSION ));
2580
2581                 tdb_close(wcache->tdb);
2582                 wcache->tdb = NULL;
2583
2584                 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2585                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2586                                 cache_path("winbindd_cache.tdb"),
2587                                 strerror(errno) ));
2588                         return false;
2589                 }
2590                 if (!init_wcache()) {
2591                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
2592                                         "init_wcache failed.\n"));
2593                         return false;
2594                 }
2595
2596                 /* Write the version. */
2597                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2598                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2599                                 tdb_errorstr(wcache->tdb) ));
2600                         return false;
2601                 }
2602         }
2603
2604         tdb_close(wcache->tdb);
2605         wcache->tdb = NULL;
2606         return true;
2607 }
2608
2609 void close_winbindd_cache(void)
2610 {
2611         if (!wcache) {
2612                 return;
2613         }
2614         if (wcache->tdb) {
2615                 tdb_close(wcache->tdb);
2616                 wcache->tdb = NULL;
2617         }
2618 }
2619
2620 void cache_store_response(pid_t pid, struct winbindd_response *response)
2621 {
2622         fstring key_str;
2623
2624         if (!init_wcache())
2625                 return;
2626
2627         DEBUG(10, ("Storing response for pid %d, len %d\n",
2628                    (int)pid, response->length));
2629
2630         fstr_sprintf(key_str, "DR/%d", (int)pid);
2631         if (tdb_store(wcache->tdb, string_tdb_data(key_str),
2632                       make_tdb_data((uint8 *)response, sizeof(*response)),
2633                       TDB_REPLACE) == -1)
2634                 return;
2635
2636         if (response->length == sizeof(*response))
2637                 return;
2638
2639         /* There's extra data */
2640
2641         DEBUG(10, ("Storing extra data: len=%d\n",
2642                    (int)(response->length - sizeof(*response))));
2643
2644         fstr_sprintf(key_str, "DE/%d", (int)pid);
2645         if (tdb_store(wcache->tdb, string_tdb_data(key_str),
2646                       make_tdb_data((uint8 *)response->extra_data.data,
2647                                     response->length - sizeof(*response)),
2648                       TDB_REPLACE) == 0)
2649                 return;
2650
2651         /* We could not store the extra data, make sure the tdb does not
2652          * contain a main record with wrong dangling extra data */
2653
2654         fstr_sprintf(key_str, "DR/%d", (int)pid);
2655         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2656
2657         return;
2658 }
2659
2660 bool cache_retrieve_response(pid_t pid, struct winbindd_response * response)
2661 {
2662         TDB_DATA data;
2663         fstring key_str;
2664
2665         if (!init_wcache())
2666                 return false;
2667
2668         DEBUG(10, ("Retrieving response for pid %d\n", (int)pid));
2669
2670         fstr_sprintf(key_str, "DR/%d", (int)pid);
2671         data = tdb_fetch(wcache->tdb, string_tdb_data(key_str));
2672
2673         if (data.dptr == NULL)
2674                 return false;
2675
2676         if (data.dsize != sizeof(*response))
2677                 return false;
2678
2679         memcpy(response, data.dptr, data.dsize);
2680         SAFE_FREE(data.dptr);
2681
2682         if (response->length == sizeof(*response)) {
2683                 response->extra_data.data = NULL;
2684                 return true;
2685         }
2686
2687         /* There's extra data */
2688
2689         DEBUG(10, ("Retrieving extra data length=%d\n",
2690                    (int)(response->length - sizeof(*response))));
2691
2692         fstr_sprintf(key_str, "DE/%d", (int)pid);
2693         data = tdb_fetch(wcache->tdb, string_tdb_data(key_str));
2694
2695         if (data.dptr == NULL) {
2696                 DEBUG(0, ("Did not find extra data\n"));
2697                 return false;
2698         }
2699
2700         if (data.dsize != (response->length - sizeof(*response))) {
2701                 DEBUG(0, ("Invalid extra data length: %d\n", (int)data.dsize));
2702                 SAFE_FREE(data.dptr);
2703                 return false;
2704         }
2705
2706         dump_data(11, (uint8 *)data.dptr, data.dsize);
2707
2708         response->extra_data.data = data.dptr;
2709         return true;
2710 }
2711
2712 void cache_cleanup_response(pid_t pid)
2713 {
2714         fstring key_str;
2715
2716         if (!init_wcache())
2717                 return;
2718
2719         fstr_sprintf(key_str, "DR/%d", (int)pid);
2720         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2721
2722         fstr_sprintf(key_str, "DE/%d", (int)pid);
2723         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2724
2725         return;
2726 }
2727
2728
2729 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2730                        char **domain_name, char **name,
2731                        enum lsa_SidType *type)
2732 {
2733         struct winbindd_domain *domain;
2734         struct winbind_cache *cache;
2735         struct cache_entry *centry = NULL;
2736         NTSTATUS status;
2737         fstring tmp;
2738
2739         domain = find_lookup_domain_from_sid(sid);
2740         if (domain == NULL) {
2741                 return false;
2742         }
2743
2744         cache = get_cache(domain);
2745
2746         if (cache->tdb == NULL) {
2747                 return false;
2748         }
2749
2750         centry = wcache_fetch(cache, domain, "SN/%s",
2751                               sid_to_fstring(tmp, sid));
2752         if (centry == NULL) {
2753                 return false;
2754         }
2755
2756         if (NT_STATUS_IS_OK(centry->status)) {
2757                 *type = (enum lsa_SidType)centry_uint32(centry);
2758                 *domain_name = centry_string(centry, mem_ctx);
2759                 *name = centry_string(centry, mem_ctx);
2760         }
2761
2762         status = centry->status;
2763         centry_free(centry);
2764         return NT_STATUS_IS_OK(status);
2765 }
2766
2767 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2768                         const char *domain_name,
2769                         const char *name,
2770                         DOM_SID *sid,
2771                         enum lsa_SidType *type)
2772 {
2773         struct winbindd_domain *domain;
2774         struct winbind_cache *cache;
2775         struct cache_entry *centry = NULL;
2776         NTSTATUS status;
2777         fstring uname;
2778         bool original_online_state;
2779
2780         domain = find_lookup_domain_from_name(domain_name);
2781         if (domain == NULL) {
2782                 return false;
2783         }
2784
2785         cache = get_cache(domain);
2786
2787         if (cache->tdb == NULL) {
2788                 return false;
2789         }
2790
2791         fstrcpy(uname, name);
2792         strupper_m(uname);
2793
2794         /* If we are doing a cached logon, temporarily set the domain
2795            offline so the cache won't expire the entry */
2796
2797         original_online_state = domain->online;
2798         domain->online = false;
2799         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
2800         domain->online = original_online_state;
2801
2802         if (centry == NULL) {
2803                 return false;
2804         }
2805
2806         if (NT_STATUS_IS_OK(centry->status)) {
2807                 *type = (enum lsa_SidType)centry_uint32(centry);
2808                 centry_sid(centry, mem_ctx, sid);
2809         }
2810
2811         status = centry->status;
2812         centry_free(centry);
2813
2814         return NT_STATUS_IS_OK(status);
2815 }
2816
2817 void cache_name2sid(struct winbindd_domain *domain,
2818                     const char *domain_name, const char *name,
2819                     enum lsa_SidType type, const DOM_SID *sid)
2820 {
2821         refresh_sequence_number(domain, false);
2822         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2823                                 sid, type);
2824 }
2825
2826 /*
2827  * The original idea that this cache only contains centries has
2828  * been blurred - now other stuff gets put in here. Ensure we
2829  * ignore these things on cleanup.
2830  */
2831
2832 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2833                                TDB_DATA dbuf, void *state)
2834 {
2835         struct cache_entry *centry;
2836
2837         if (is_non_centry_key(kbuf)) {
2838                 return 0;
2839         }
2840
2841         centry = wcache_fetch_raw((char *)kbuf.dptr);
2842         if (!centry) {
2843                 return 0;
2844         }
2845
2846         if (!NT_STATUS_IS_OK(centry->status)) {
2847                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2848                 tdb_delete(the_tdb, kbuf);
2849         }
2850
2851         centry_free(centry);
2852         return 0;
2853 }
2854
2855 /* flush the cache */
2856 void wcache_flush_cache(void)
2857 {
2858         if (!wcache)
2859                 return;
2860         if (wcache->tdb) {
2861                 tdb_close(wcache->tdb);
2862                 wcache->tdb = NULL;
2863         }
2864         if (!winbindd_use_cache()) {
2865                 return;
2866         }
2867
2868         /* when working offline we must not clear the cache on restart */
2869         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2870                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2871                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2872                                 O_RDWR|O_CREAT, 0600);
2873
2874         if (!wcache->tdb) {
2875                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2876                 return;
2877         }
2878
2879         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2880
2881         DEBUG(10,("wcache_flush_cache success\n"));
2882 }
2883
2884 /* Count cached creds */
2885
2886 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2887                                     void *state)
2888 {
2889         int *cred_count = (int*)state;
2890
2891         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2892                 (*cred_count)++;
2893         }
2894         return 0;
2895 }
2896
2897 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2898 {
2899         struct winbind_cache *cache = get_cache(domain);
2900
2901         *count = 0;
2902
2903         if (!cache->tdb) {
2904                 return NT_STATUS_INTERNAL_DB_ERROR;
2905         }
2906
2907         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2908
2909         return NT_STATUS_OK;
2910 }
2911
2912 struct cred_list {
2913         struct cred_list *prev, *next;
2914         TDB_DATA key;
2915         fstring name;
2916         time_t created;
2917 };
2918 static struct cred_list *wcache_cred_list;
2919
2920 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2921                                     void *state)
2922 {
2923         struct cred_list *cred;
2924
2925         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2926
2927                 cred = SMB_MALLOC_P(struct cred_list);
2928                 if (cred == NULL) {
2929                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2930                         return -1;
2931                 }
2932
2933                 ZERO_STRUCTP(cred);
2934
2935                 /* save a copy of the key */
2936
2937                 fstrcpy(cred->name, (const char *)kbuf.dptr);
2938                 DLIST_ADD(wcache_cred_list, cred);
2939         }
2940
2941         return 0;
2942 }
2943
2944 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2945 {
2946         struct winbind_cache *cache = get_cache(domain);
2947         NTSTATUS status;
2948         int ret;
2949         struct cred_list *cred, *oldest = NULL;
2950
2951         if (!cache->tdb) {
2952                 return NT_STATUS_INTERNAL_DB_ERROR;
2953         }
2954
2955         /* we possibly already have an entry */
2956         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2957
2958                 fstring key_str, tmp;
2959
2960                 DEBUG(11,("we already have an entry, deleting that\n"));
2961
2962                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2963
2964                 tdb_delete(cache->tdb, string_tdb_data(key_str));
2965
2966                 return NT_STATUS_OK;
2967         }
2968
2969         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2970         if (ret == 0) {
2971                 return NT_STATUS_OK;
2972         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
2973                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2974         }
2975
2976         ZERO_STRUCTP(oldest);
2977
2978         for (cred = wcache_cred_list; cred; cred = cred->next) {
2979
2980                 TDB_DATA data;
2981                 time_t t;
2982
2983                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
2984                 if (!data.dptr) {
2985                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
2986                                 cred->name));
2987                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2988                         goto done;
2989                 }
2990
2991                 t = IVAL(data.dptr, 0);
2992                 SAFE_FREE(data.dptr);
2993
2994                 if (!oldest) {
2995                         oldest = SMB_MALLOC_P(struct cred_list);
2996                         if (oldest == NULL) {
2997                                 status = NT_STATUS_NO_MEMORY;
2998                                 goto done;
2999                         }
3000
3001                         fstrcpy(oldest->name, cred->name);
3002                         oldest->created = t;
3003                         continue;
3004                 }
3005
3006                 if (t < oldest->created) {
3007                         fstrcpy(oldest->name, cred->name);
3008                         oldest->created = t;
3009                 }
3010         }
3011
3012         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3013                 status = NT_STATUS_OK;
3014         } else {
3015                 status = NT_STATUS_UNSUCCESSFUL;
3016         }
3017 done:
3018         SAFE_FREE(wcache_cred_list);
3019         SAFE_FREE(oldest);
3020
3021         return status;
3022 }
3023
3024 /* Change the global online/offline state. */
3025 bool set_global_winbindd_state_offline(void)
3026 {
3027         TDB_DATA data;
3028
3029         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3030
3031         /* Only go offline if someone has created
3032            the key "WINBINDD_OFFLINE" in the cache tdb. */
3033
3034         if (wcache == NULL || wcache->tdb == NULL) {
3035                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3036                 return false;
3037         }
3038
3039         if (!lp_winbind_offline_logon()) {
3040                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3041                 return false;
3042         }
3043
3044         if (global_winbindd_offline_state) {
3045                 /* Already offline. */
3046                 return true;
3047         }
3048
3049         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3050
3051         if (!data.dptr || data.dsize != 4) {
3052                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3053                 SAFE_FREE(data.dptr);
3054                 return false;
3055         } else {
3056                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3057                 global_winbindd_offline_state = true;
3058                 SAFE_FREE(data.dptr);
3059                 return true;
3060         }
3061 }
3062
3063 void set_global_winbindd_state_online(void)
3064 {
3065         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3066
3067         if (!lp_winbind_offline_logon()) {
3068                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3069                 return;
3070         }
3071
3072         if (!global_winbindd_offline_state) {
3073                 /* Already online. */
3074                 return;
3075         }
3076         global_winbindd_offline_state = false;
3077
3078         if (!wcache->tdb) {
3079                 return;
3080         }
3081
3082         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3083         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3084 }
3085
3086 bool get_global_winbindd_state_offline(void)
3087 {
3088         return global_winbindd_offline_state;
3089 }
3090
3091 /***********************************************************************
3092  Validate functions for all possible cache tdb keys.
3093 ***********************************************************************/
3094
3095 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3096                                                   struct tdb_validation_status *state)
3097 {
3098         struct cache_entry *centry;
3099
3100         centry = SMB_XMALLOC_P(struct cache_entry);
3101         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3102         if (!centry->data) {
3103                 SAFE_FREE(centry);
3104                 return NULL;
3105         }
3106         centry->len = data.dsize;
3107         centry->ofs = 0;
3108
3109         if (centry->len < 8) {
3110                 /* huh? corrupt cache? */
3111                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3112                 centry_free(centry);
3113                 state->bad_entry = true;
3114                 state->success = false;
3115                 return NULL;
3116         }
3117
3118         centry->status = NT_STATUS(centry_uint32(centry));
3119         centry->sequence_number = centry_uint32(centry);
3120         return centry;
3121 }
3122
3123 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3124                            struct tdb_validation_status *state)
3125 {
3126         if (dbuf.dsize != 8) {
3127                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3128                                 keystr, (unsigned int)dbuf.dsize ));
3129                 state->bad_entry = true;
3130                 return 1;
3131         }
3132         return 0;
3133 }
3134
3135 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3136                        struct tdb_validation_status *state)
3137 {
3138         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3139         if (!centry) {
3140                 return 1;
3141         }
3142
3143         (void)centry_uint32(centry);
3144         if (NT_STATUS_IS_OK(centry->status)) {
3145                 DOM_SID sid;
3146                 (void)centry_sid(centry, mem_ctx, &sid);
3147         }
3148
3149         centry_free(centry);
3150
3151         if (!(state->success)) {
3152                 return 1;
3153         }
3154         DEBUG(10,("validate_ns: %s ok\n", keystr));
3155         return 0;
3156 }
3157
3158 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3159                        struct tdb_validation_status *state)
3160 {
3161         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3162         if (!centry) {
3163                 return 1;
3164         }
3165
3166         if (NT_STATUS_IS_OK(centry->status)) {
3167                 (void)centry_uint32(centry);
3168                 (void)centry_string(centry, mem_ctx);
3169                 (void)centry_string(centry, mem_ctx);
3170         }
3171
3172         centry_free(centry);
3173
3174         if (!(state->success)) {
3175                 return 1;
3176         }
3177         DEBUG(10,("validate_sn: %s ok\n", keystr));
3178         return 0;
3179 }
3180
3181 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3182                       struct tdb_validation_status *state)
3183 {
3184         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3185         DOM_SID sid;
3186
3187         if (!centry) {
3188                 return 1;
3189         }
3190
3191         (void)centry_string(centry, mem_ctx);
3192         (void)centry_string(centry, mem_ctx);
3193         (void)centry_string(centry, mem_ctx);
3194         (void)centry_string(centry, mem_ctx);
3195         (void)centry_uint32(centry);
3196         (void)centry_sid(centry, mem_ctx, &sid);
3197         (void)centry_sid(centry, mem_ctx, &sid);
3198
3199         centry_free(centry);
3200
3201         if (!(state->success)) {
3202                 return 1;
3203         }
3204         DEBUG(10,("validate_u: %s ok\n", keystr));
3205         return 0;
3206 }
3207
3208 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3209                             struct tdb_validation_status *state)
3210 {
3211         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3212
3213         if (!centry) {
3214                 return 1;
3215         }
3216
3217         (void)centry_nttime(centry);
3218         (void)centry_nttime(centry);
3219         (void)centry_uint16(centry);
3220
3221         centry_free(centry);
3222
3223         if (!(state->success)) {
3224                 return 1;
3225         }
3226         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3227         return 0;
3228 }
3229
3230 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3231                             struct tdb_validation_status *state)
3232 {
3233         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3234
3235         if (!centry) {
3236                 return 1;
3237         }
3238
3239         (void)centry_uint16(centry);
3240         (void)centry_uint16(centry);
3241         (void)centry_uint32(centry);
3242         (void)centry_nttime(centry);
3243         (void)centry_nttime(centry);
3244
3245         centry_free(centry);
3246
3247         if (!(state->success)) {
3248                 return 1;
3249         }
3250         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3251         return 0;
3252 }
3253
3254 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3255                          struct tdb_validation_status *state)
3256 {
3257         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3258
3259         if (!centry) {
3260                 return 1;
3261         }
3262
3263         (void)centry_time(centry);
3264         (void)centry_hash16(centry, mem_ctx);
3265
3266         /* We only have 17 bytes more data in the salted cred case. */
3267         if (centry->len - centry->ofs == 17) {
3268                 (void)centry_hash16(centry, mem_ctx);
3269         }
3270
3271         centry_free(centry);
3272
3273         if (!(state->success)) {
3274                 return 1;
3275         }
3276         DEBUG(10,("validate_cred: %s ok\n", keystr));
3277         return 0;
3278 }
3279
3280 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3281                        struct tdb_validation_status *state)
3282 {
3283         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3284         int32 num_entries, i;
3285
3286         if (!centry) {
3287                 return 1;
3288         }
3289
3290         num_entries = (int32)centry_uint32(centry);
3291
3292         for (i=0; i< num_entries; i++) {
3293                 DOM_SID sid;
3294                 (void)centry_string(centry, mem_ctx);
3295                 (void)centry_string(centry, mem_ctx);
3296                 (void)centry_string(centry, mem_ctx);
3297                 (void)centry_string(centry, mem_ctx);
3298                 (void)centry_sid(centry, mem_ctx, &sid);
3299                 (void)centry_sid(centry, mem_ctx, &sid);
3300         }
3301
3302         centry_free(centry);
3303
3304         if (!(state->success)) {
3305                 return 1;
3306         }
3307         DEBUG(10,("validate_ul: %s ok\n", keystr));
3308         return 0;
3309 }
3310
3311 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3312                        struct tdb_validation_status *state)
3313 {
3314         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3315         int32 num_entries, i;
3316
3317         if (!centry) {
3318                 return 1;
3319         }
3320
3321         num_entries = centry_uint32(centry);
3322
3323         for (i=0; i< num_entries; i++) {
3324                 (void)centry_string(centry, mem_ctx);
3325                 (void)centry_string(centry, mem_ctx);
3326                 (void)centry_uint32(centry);
3327         }
3328
3329         centry_free(centry);
3330
3331         if (!(state->success)) {
3332                 return 1;
3333         }
3334         DEBUG(10,("validate_gl: %s ok\n", keystr));
3335         return 0;
3336 }
3337
3338 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3339                        struct tdb_validation_status *state)
3340 {
3341         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3342         int32 num_groups, i;
3343
3344         if (!centry) {
3345                 return 1;
3346         }
3347
3348         num_groups = centry_uint32(centry);
3349
3350         for (i=0; i< num_groups; i++) {
3351                 DOM_SID sid;
3352                 centry_sid(centry, mem_ctx, &sid);
3353         }
3354
3355         centry_free(centry);
3356
3357         if (!(state->success)) {
3358                 return 1;
3359         }
3360         DEBUG(10,("validate_ug: %s ok\n", keystr));
3361         return 0;
3362 }
3363
3364 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3365                        struct tdb_validation_status *state)
3366 {
3367         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3368         int32 num_aliases, i;
3369
3370         if (!centry) {
3371                 return 1;
3372         }
3373
3374         num_aliases = centry_uint32(centry);
3375
3376         for (i=0; i < num_aliases; i++) {
3377                 (void)centry_uint32(centry);
3378         }
3379
3380         centry_free(centry);
3381
3382         if (!(state->success)) {
3383                 return 1;
3384         }
3385         DEBUG(10,("validate_ua: %s ok\n", keystr));
3386         return 0;
3387 }
3388
3389 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3390                        struct tdb_validation_status *state)
3391 {
3392         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3393         int32 num_names, i;
3394
3395         if (!centry) {
3396                 return 1;
3397         }
3398
3399         num_names = centry_uint32(centry);
3400
3401         for (i=0; i< num_names; i++) {
3402                 DOM_SID sid;
3403                 centry_sid(centry, mem_ctx, &sid);
3404                 (void)centry_string(centry, mem_ctx);
3405                 (void)centry_uint32(centry);
3406         }
3407
3408         centry_free(centry);
3409
3410         if (!(state->success)) {
3411                 return 1;
3412         }
3413         DEBUG(10,("validate_gm: %s ok\n", keystr));
3414         return 0;
3415 }
3416
3417 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3418                        struct tdb_validation_status *state)
3419 {
3420         /* Can't say anything about this other than must be nonzero. */
3421         if (dbuf.dsize == 0) {
3422                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3423                                 keystr));
3424                 state->bad_entry = true;
3425                 state->success = false;
3426                 return 1;
3427         }
3428
3429         DEBUG(10,("validate_dr: %s ok\n", keystr));
3430         return 0;
3431 }
3432
3433 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3434                        struct tdb_validation_status *state)
3435 {
3436         /* Can't say anything about this other than must be nonzero. */
3437         if (dbuf.dsize == 0) {
3438                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3439                                 keystr));
3440                 state->bad_entry = true;
3441                 state->success = false;
3442                 return 1;
3443         }
3444
3445         DEBUG(10,("validate_de: %s ok\n", keystr));
3446         return 0;
3447 }
3448
3449 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3450                            TDB_DATA dbuf, struct tdb_validation_status *state)
3451 {
3452         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3453
3454         if (!centry) {
3455                 return 1;
3456         }
3457
3458         (void)centry_string(centry, mem_ctx);
3459         (void)centry_string(centry, mem_ctx);
3460         (void)centry_string(centry, mem_ctx);
3461         (void)centry_uint32(centry);
3462
3463         centry_free(centry);
3464
3465         if (!(state->success)) {
3466                 return 1;
3467         }
3468         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3469         return 0;
3470 }
3471
3472 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3473                            TDB_DATA dbuf,
3474                            struct tdb_validation_status *state)
3475 {
3476         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3477
3478         if (!centry) {
3479                 return 1;
3480         }
3481
3482         (void)centry_string( centry, mem_ctx );
3483
3484         centry_free(centry);
3485
3486         if (!(state->success)) {
3487                 return 1;
3488         }
3489         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3490         return 0;
3491 }
3492
3493 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3494                            TDB_DATA dbuf,
3495                            struct tdb_validation_status *state)
3496 {
3497         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3498
3499         if (!centry) {
3500                 return 1;
3501         }
3502
3503         (void)centry_string( centry, mem_ctx );
3504
3505         centry_free(centry);
3506
3507         if (!(state->success)) {
3508                 return 1;
3509         }
3510         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3511         return 0;
3512 }
3513
3514 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3515                               struct tdb_validation_status *state)
3516 {
3517         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3518         int32 num_domains, i;
3519
3520         if (!centry) {
3521                 return 1;
3522         }
3523
3524         num_domains = centry_uint32(centry);
3525
3526         for (i=0; i< num_domains; i++) {
3527                 DOM_SID sid;
3528                 (void)centry_string(centry, mem_ctx);
3529                 (void)centry_string(centry, mem_ctx);
3530                 (void)centry_sid(centry, mem_ctx, &sid);
3531         }
3532
3533         centry_free(centry);
3534
3535         if (!(state->success)) {
3536                 return 1;
3537         }
3538         DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3539         return 0;
3540 }
3541
3542 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3543                                   TDB_DATA dbuf,
3544                                   struct tdb_validation_status *state)
3545 {
3546         if (dbuf.dsize == 0) {
3547                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3548                           "key %s (len ==0) ?\n", keystr));
3549                 state->bad_entry = true;
3550                 state->success = false;
3551                 return 1;
3552         }
3553
3554         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3555         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3556         return 0;
3557 }
3558
3559 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3560                             struct tdb_validation_status *state)
3561 {
3562         if (dbuf.dsize != 4) {
3563                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3564                                 keystr, (unsigned int)dbuf.dsize ));
3565                 state->bad_entry = true;
3566                 state->success = false;
3567                 return 1;
3568         }
3569         DEBUG(10,("validate_offline: %s ok\n", keystr));
3570         return 0;
3571 }
3572
3573 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3574                                   struct tdb_validation_status *state)
3575 {
3576         if (dbuf.dsize != 4) {
3577                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3578                           "key %s (len %u != 4) ?\n",
3579                           keystr, (unsigned int)dbuf.dsize));
3580                 state->bad_entry = true;
3581                 state->success = false;
3582                 return 1;
3583         }
3584
3585         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3586         return 0;
3587 }
3588
3589 /***********************************************************************
3590  A list of all possible cache tdb keys with associated validation
3591  functions.
3592 ***********************************************************************/
3593
3594 struct key_val_struct {
3595         const char *keyname;
3596         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3597 } key_val[] = {
3598         {"SEQNUM/", validate_seqnum},
3599         {"NS/", validate_ns},
3600         {"SN/", validate_sn},
3601         {"U/", validate_u},
3602         {"LOC_POL/", validate_loc_pol},
3603         {"PWD_POL/", validate_pwd_pol},
3604         {"CRED/", validate_cred},
3605         {"UL/", validate_ul},
3606         {"GL/", validate_gl},
3607         {"UG/", validate_ug},
3608         {"UA", validate_ua},
3609         {"GM/", validate_gm},
3610         {"DR/", validate_dr},
3611         {"DE/", validate_de},
3612         {"NSS/PWINFO/", validate_pwinfo},
3613         {"TRUSTDOMS/", validate_trustdoms},
3614         {"TRUSTDOMCACHE/", validate_trustdomcache},
3615         {"NSS/NA/", validate_nss_na},
3616         {"NSS/AN/", validate_nss_an},
3617         {"WINBINDD_OFFLINE", validate_offline},
3618         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3619         {NULL, NULL}
3620 };
3621
3622 /***********************************************************************
3623  Function to look at every entry in the tdb and validate it as far as
3624  possible.
3625 ***********************************************************************/
3626
3627 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3628 {
3629         int i;
3630         unsigned int max_key_len = 1024;
3631         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3632
3633         /* Paranoia check. */
3634         if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3635                 max_key_len = 1024 * 1024;
3636         }
3637         if (kbuf.dsize > max_key_len) {
3638                 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3639                           "(%u) > (%u)\n\n",
3640                           (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3641                 return 1;
3642         }
3643
3644         for (i = 0; key_val[i].keyname; i++) {
3645                 size_t namelen = strlen(key_val[i].keyname);
3646                 if (kbuf.dsize >= namelen && (
3647                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3648                         TALLOC_CTX *mem_ctx;
3649                         char *keystr;
3650                         int ret;
3651
3652                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3653                         if (!keystr) {
3654                                 return 1;
3655                         }
3656                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
3657                         keystr[kbuf.dsize] = '\0';
3658
3659                         mem_ctx = talloc_init("validate_ctx");
3660                         if (!mem_ctx) {
3661                                 SAFE_FREE(keystr);
3662                                 return 1;
3663                         }
3664
3665                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3666                                                           v_state);
3667
3668                         SAFE_FREE(keystr);
3669                         talloc_destroy(mem_ctx);
3670                         return ret;
3671                 }
3672         }
3673
3674         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3675         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3676         DEBUG(0,("data :\n"));
3677         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3678         v_state->unknown_key = true;
3679         v_state->success = false;
3680         return 1; /* terminate. */
3681 }
3682
3683 static void validate_panic(const char *const why)
3684 {
3685         DEBUG(0,("validating cache: would panic %s\n", why ));
3686         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3687         exit(47);
3688 }
3689
3690 /***********************************************************************
3691  Try and validate every entry in the winbindd cache. If we fail here,
3692  delete the cache tdb and return non-zero.
3693 ***********************************************************************/
3694
3695 int winbindd_validate_cache(void)
3696 {
3697         int ret = -1;
3698         const char *tdb_path = cache_path("winbindd_cache.tdb");
3699         TDB_CONTEXT *tdb = NULL;
3700
3701         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3702         smb_panic_fn = validate_panic;
3703
3704
3705         tdb = tdb_open_log(tdb_path,
3706                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3707                            ( lp_winbind_offline_logon()
3708                              ? TDB_DEFAULT
3709                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3710                            O_RDWR|O_CREAT,
3711                            0600);
3712         if (!tdb) {
3713                 DEBUG(0, ("winbindd_validate_cache: "
3714                           "error opening/initializing tdb\n"));
3715                 goto done;
3716         }
3717         tdb_close(tdb);
3718
3719         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3720
3721         if (ret != 0) {
3722                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3723                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3724                 unlink(tdb_path);
3725         }
3726
3727 done:
3728         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3729         smb_panic_fn = smb_panic;
3730         return ret;
3731 }
3732
3733 /***********************************************************************
3734  Try and validate every entry in the winbindd cache.
3735 ***********************************************************************/
3736
3737 int winbindd_validate_cache_nobackup(void)
3738 {
3739         int ret = -1;
3740         const char *tdb_path = cache_path("winbindd_cache.tdb");
3741
3742         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3743         smb_panic_fn = validate_panic;
3744
3745
3746         if (wcache == NULL || wcache->tdb == NULL) {
3747                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3748         } else {
3749                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3750         }
3751
3752         if (ret != 0) {
3753                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3754                            "successful.\n"));
3755         }
3756
3757         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3758                    "function\n"));
3759         smb_panic_fn = smb_panic;
3760         return ret;
3761 }
3762
3763 bool winbindd_cache_validate_and_initialize(void)
3764 {
3765         close_winbindd_cache();
3766
3767         if (lp_winbind_offline_logon()) {
3768                 if (winbindd_validate_cache() < 0) {
3769                         DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3770                                   "could be restored.\n"));
3771                 }
3772         }
3773
3774         return initialize_winbindd_cache();
3775 }
3776
3777 /*********************************************************************
3778  ********************************************************************/
3779
3780 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3781                                        struct winbindd_tdc_domain **domains,
3782                                        size_t *num_domains )
3783 {
3784         struct winbindd_tdc_domain *list = NULL;
3785         size_t idx;
3786         int i;
3787         bool set_only = false;
3788
3789         /* don't allow duplicates */
3790
3791         idx = *num_domains;
3792         list = *domains;
3793
3794         for ( i=0; i< (*num_domains); i++ ) {
3795                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3796                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3797                                   new_dom->name));
3798                         idx = i;
3799                         set_only = true;
3800
3801                         break;
3802                 }
3803         }
3804
3805         if ( !set_only ) {
3806                 if ( !*domains ) {
3807                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3808                         idx = 0;
3809                 } else {
3810                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3811                                                      struct winbindd_tdc_domain,
3812                                                      (*num_domains)+1);
3813                         idx = *num_domains;
3814                 }
3815
3816                 ZERO_STRUCT( list[idx] );
3817         }
3818
3819         if ( !list )
3820                 return false;
3821
3822         list[idx].domain_name = talloc_strdup( list, new_dom->name );
3823         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3824
3825         if ( !is_null_sid( &new_dom->sid ) ) {
3826                 sid_copy( &list[idx].sid, &new_dom->sid );
3827         } else {
3828                 sid_copy(&list[idx].sid, &global_sid_NULL);
3829         }
3830
3831         if ( new_dom->domain_flags != 0x0 )
3832                 list[idx].trust_flags = new_dom->domain_flags;
3833
3834         if ( new_dom->domain_type != 0x0 )
3835                 list[idx].trust_type = new_dom->domain_type;
3836
3837         if ( new_dom->domain_trust_attribs != 0x0 )
3838                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3839
3840         if ( !set_only ) {
3841                 *domains = list;
3842                 *num_domains = idx + 1;
3843         }
3844
3845         return true;
3846 }
3847
3848 /*********************************************************************
3849  ********************************************************************/
3850
3851 static TDB_DATA make_tdc_key( const char *domain_name )
3852 {
3853         char *keystr = NULL;
3854         TDB_DATA key = { NULL, 0 };
3855
3856         if ( !domain_name ) {
3857                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3858                 return key;
3859         }
3860
3861
3862         if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3863                 return key;
3864         }
3865         key = string_term_tdb_data(keystr);
3866
3867         return key;
3868 }
3869
3870 /*********************************************************************
3871  ********************************************************************/
3872
3873 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3874                              size_t num_domains,
3875                              unsigned char **buf )
3876 {
3877         unsigned char *buffer = NULL;
3878         int len = 0;
3879         int buflen = 0;
3880         int i = 0;
3881
3882         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3883                   (int)num_domains));
3884
3885         buflen = 0;
3886
3887  again:
3888         len = 0;
3889
3890         /* Store the number of array items first */
3891         len += tdb_pack( buffer+len, buflen-len, "d",
3892                          num_domains );
3893
3894         /* now pack each domain trust record */
3895         for ( i=0; i<num_domains; i++ ) {
3896
3897                 fstring tmp;
3898
3899                 if ( buflen > 0 ) {
3900                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3901                                   domains[i].domain_name,
3902                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3903                 }
3904
3905                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3906                                  domains[i].domain_name,
3907                                  domains[i].dns_name,
3908                                  sid_to_fstring(tmp, &domains[i].sid),
3909                                  domains[i].trust_flags,
3910                                  domains[i].trust_attribs,
3911                                  domains[i].trust_type );
3912         }
3913
3914         if ( buflen < len ) {
3915                 SAFE_FREE(buffer);
3916                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3917                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3918                         buflen = -1;
3919                         goto done;
3920                 }
3921                 buflen = len;
3922                 goto again;
3923         }
3924
3925         *buf = buffer;
3926
3927  done:
3928         return buflen;
3929 }
3930
3931 /*********************************************************************
3932  ********************************************************************/
3933
3934 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3935                                   struct winbindd_tdc_domain **domains )
3936 {
3937         fstring domain_name, dns_name, sid_string;
3938         uint32 type, attribs, flags;
3939         int num_domains;
3940         int len = 0;
3941         int i;
3942         struct winbindd_tdc_domain *list = NULL;
3943
3944         /* get the number of domains */
3945         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3946         if ( len == -1 ) {
3947                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3948                 return 0;
3949         }
3950
3951         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3952         if ( !list ) {
3953                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3954                 return 0;
3955         }
3956
3957         for ( i=0; i<num_domains; i++ ) {
3958                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3959                                    domain_name,
3960                                    dns_name,
3961                                    sid_string,
3962                                    &flags,
3963                                    &attribs,
3964                                    &type );
3965
3966                 if ( len == -1 ) {
3967                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3968                         TALLOC_FREE( list );
3969                         return 0;
3970                 }
3971
3972                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
3973                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
3974                           domain_name, dns_name, sid_string,
3975                           flags, attribs, type));
3976
3977                 list[i].domain_name = talloc_strdup( list, domain_name );
3978                 list[i].dns_name = talloc_strdup( list, dns_name );
3979                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
3980                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
3981                                   domain_name));
3982                 }
3983                 list[i].trust_flags = flags;
3984                 list[i].trust_attribs = attribs;
3985                 list[i].trust_type = type;
3986         }
3987
3988         *domains = list;
3989
3990         return num_domains;
3991 }
3992
3993 /*********************************************************************
3994  ********************************************************************/
3995
3996 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
3997 {
3998         TDB_DATA key = make_tdc_key( lp_workgroup() );
3999         TDB_DATA data = { NULL, 0 };
4000         int ret;
4001
4002         if ( !key.dptr )
4003                 return false;
4004
4005         /* See if we were asked to delete the cache entry */
4006
4007         if ( !domains ) {
4008                 ret = tdb_delete( wcache->tdb, key );
4009                 goto done;
4010         }
4011
4012         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4013
4014         if ( !data.dptr ) {
4015                 ret = -1;
4016                 goto done;
4017         }
4018
4019         ret = tdb_store( wcache->tdb, key, data, 0 );
4020
4021  done:
4022         SAFE_FREE( data.dptr );
4023         SAFE_FREE( key.dptr );
4024
4025         return ( ret != -1 );
4026 }
4027
4028 /*********************************************************************
4029  ********************************************************************/
4030
4031 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4032 {
4033         TDB_DATA key = make_tdc_key( lp_workgroup() );
4034         TDB_DATA data = { NULL, 0 };
4035
4036         *domains = NULL;
4037         *num_domains = 0;
4038
4039         if ( !key.dptr )
4040                 return false;
4041
4042         data = tdb_fetch( wcache->tdb, key );
4043
4044         SAFE_FREE( key.dptr );
4045
4046         if ( !data.dptr )
4047                 return false;
4048
4049         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4050
4051         SAFE_FREE( data.dptr );
4052
4053         if ( !*domains )
4054                 return false;
4055
4056         return true;
4057 }
4058
4059 /*********************************************************************
4060  ********************************************************************/
4061
4062 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4063 {
4064         struct winbindd_tdc_domain *dom_list = NULL;
4065         size_t num_domains = 0;
4066         bool ret = false;
4067
4068         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4069                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4070                   domain->name, domain->alt_name,
4071                   sid_string_dbg(&domain->sid),
4072                   domain->domain_flags,
4073                   domain->domain_trust_attribs,
4074                   domain->domain_type));
4075
4076         if ( !init_wcache() ) {
4077                 return false;
4078         }
4079
4080         /* fetch the list */
4081
4082         wcache_tdc_fetch_list( &dom_list, &num_domains );
4083
4084         /* add the new domain */
4085
4086         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4087                 goto done;
4088         }
4089
4090         /* pack the domain */
4091
4092         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4093                 goto done;
4094         }
4095
4096         /* Success */
4097
4098         ret = true;
4099  done:
4100         TALLOC_FREE( dom_list );
4101
4102         return ret;
4103 }
4104
4105 /*********************************************************************
4106  ********************************************************************/
4107
4108 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4109 {
4110         struct winbindd_tdc_domain *dom_list = NULL;
4111         size_t num_domains = 0;
4112         int i;
4113         struct winbindd_tdc_domain *d = NULL;
4114
4115         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4116
4117         if ( !init_wcache() ) {
4118                 return false;
4119         }
4120
4121         /* fetch the list */
4122
4123         wcache_tdc_fetch_list( &dom_list, &num_domains );
4124
4125         for ( i=0; i<num_domains; i++ ) {
4126                 if ( strequal(name, dom_list[i].domain_name) ||
4127                      strequal(name, dom_list[i].dns_name) )
4128                 {
4129                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4130                                   name));
4131
4132                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4133                         if ( !d )
4134                                 break;
4135
4136                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4137                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4138                         sid_copy( &d->sid, &dom_list[i].sid );
4139                         d->trust_flags   = dom_list[i].trust_flags;
4140                         d->trust_type    = dom_list[i].trust_type;
4141                         d->trust_attribs = dom_list[i].trust_attribs;
4142
4143                         break;
4144                 }
4145         }
4146
4147         TALLOC_FREE( dom_list );
4148
4149         return d;
4150 }
4151
4152
4153 /*********************************************************************
4154  ********************************************************************/
4155
4156 void wcache_tdc_clear( void )
4157 {
4158         if ( !init_wcache() )
4159                 return;
4160
4161         wcache_tdc_store_list( NULL, 0 );
4162
4163         return;
4164 }
4165
4166
4167 /*********************************************************************
4168  ********************************************************************/
4169
4170 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4171                                     NTSTATUS status,
4172                                     const DOM_SID *user_sid,
4173                                     const char *homedir,
4174                                     const char *shell,
4175                                     const char *gecos,
4176                                     uint32 gid)
4177 {
4178         struct cache_entry *centry;
4179         fstring tmp;
4180
4181         if ( (centry = centry_start(domain, status)) == NULL )
4182                 return;
4183
4184         centry_put_string( centry, homedir );
4185         centry_put_string( centry, shell );
4186         centry_put_string( centry, gecos );
4187         centry_put_uint32( centry, gid );
4188
4189         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4190
4191         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4192
4193         centry_free(centry);
4194 }
4195
4196 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4197                               const DOM_SID *user_sid,
4198                               TALLOC_CTX *ctx,
4199                               ADS_STRUCT *ads, LDAPMessage *msg,
4200                               char **homedir, char **shell, char **gecos,
4201                               gid_t *p_gid)
4202 {
4203         struct winbind_cache *cache = get_cache(domain);
4204         struct cache_entry *centry = NULL;
4205         NTSTATUS nt_status;
4206         fstring tmp;
4207
4208         if (!cache->tdb)
4209                 goto do_query;
4210
4211         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4212                               sid_to_fstring(tmp, user_sid));
4213
4214         if (!centry)
4215                 goto do_query;
4216
4217         *homedir = centry_string( centry, ctx );
4218         *shell   = centry_string( centry, ctx );
4219         *gecos   = centry_string( centry, ctx );
4220         *p_gid   = centry_uint32( centry );
4221
4222         centry_free(centry);
4223
4224         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4225                   sid_string_dbg(user_sid)));
4226
4227         return NT_STATUS_OK;
4228
4229 do_query:
4230
4231         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4232                                   homedir, shell, gecos, p_gid );
4233
4234         DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4235
4236         if ( NT_STATUS_IS_OK(nt_status) ) {
4237                 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4238                 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4239                 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4240                 DEBUGADD(10, ("\tgid = '%u'\n", *p_gid));
4241
4242                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4243                                          *homedir, *shell, *gecos, *p_gid );
4244         }
4245
4246         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4247                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4248                          domain->name ));
4249                 set_domain_offline( domain );
4250         }
4251
4252         return nt_status;
4253 }
4254
4255
4256 /* the cache backend methods are exposed via this structure */
4257 struct winbindd_methods cache_methods = {
4258         true,
4259         query_user_list,
4260         enum_dom_groups,
4261         enum_local_groups,
4262         name_to_sid,
4263         sid_to_name,
4264         rids_to_names,
4265         query_user,
4266         lookup_usergroups,
4267         lookup_useraliases,
4268         lookup_groupmem,
4269         sequence_number,
4270         lockout_policy,
4271         password_policy,
4272         trusted_domains
4273 };