2 Unix SMB/CIFS implementation.
4 Winbind cache backend functions
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
32 #define DBGC_CLASS DBGC_WINBIND
34 #define WINBINDD_CACHE_VERSION 1
35 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
37 extern struct winbindd_methods reconnect_methods;
39 extern struct winbindd_methods ads_methods;
41 extern struct winbindd_methods builtin_passdb_methods;
44 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
45 * Here are the list of entry types that are *not* stored
46 * as form struct cache_entry in the cache.
49 static const char *non_centry_keys[] = {
54 WINBINDD_CACHE_VERSION_KEYSTR,
58 /************************************************************************
59 Is this key a non-centry type ?
60 ************************************************************************/
62 static bool is_non_centry_key(TDB_DATA kbuf)
66 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
69 for (i = 0; non_centry_keys[i] != NULL; i++) {
70 size_t namelen = strlen(non_centry_keys[i]);
71 if (kbuf.dsize < namelen) {
74 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
81 /* Global online/offline state - False when online. winbindd starts up online
82 and sets this to true if the first query fails and there's an entry in
83 the cache tdb telling us to stay offline. */
85 static bool global_winbindd_offline_state;
87 struct winbind_cache {
93 uint32 sequence_number;
98 void (*smb_panic_fn)(const char *const why) = smb_panic;
100 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
102 static struct winbind_cache *wcache;
104 void winbindd_check_cache_size(time_t t)
106 static time_t last_check_time;
109 if (last_check_time == (time_t)0)
112 if (t - last_check_time < 60 && t - last_check_time > 0)
115 if (wcache == NULL || wcache->tdb == NULL) {
116 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
120 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
121 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
125 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
126 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
127 (unsigned long)st.st_size,
128 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
129 wcache_flush_cache();
133 /* get the winbind_cache structure */
134 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
136 struct winbind_cache *ret = wcache;
138 /* We have to know what type of domain we are dealing with first. */
140 if (domain->internal) {
141 domain->backend = &builtin_passdb_methods;
142 domain->initialized = True;
144 if ( !domain->initialized ) {
145 init_dc_connection( domain );
149 OK. listen up becasue I'm only going to say this once.
150 We have the following scenarios to consider
151 (a) trusted AD domains on a Samba DC,
152 (b) trusted AD domains and we are joined to a non-kerberos domain
153 (c) trusted AD domains and we are joined to a kerberos (AD) domain
155 For (a) we can always contact the trusted domain using krb5
156 since we have the domain trust account password
158 For (b) we can only use RPC since we have no way of
159 getting a krb5 ticket in our own domain
161 For (c) we can always use krb5 since we have a kerberos trust
166 if (!domain->backend) {
168 struct winbindd_domain *our_domain = domain;
170 /* find our domain first so we can figure out if we
171 are joined to a kerberized domain */
173 if ( !domain->primary )
174 our_domain = find_our_domain();
176 if ((our_domain->active_directory || IS_DC)
177 && domain->active_directory
178 && !lp_winbind_rpc_only()) {
179 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
180 domain->backend = &ads_methods;
182 #endif /* HAVE_ADS */
183 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
184 domain->backend = &reconnect_methods;
187 #endif /* HAVE_ADS */
193 ret = SMB_XMALLOC_P(struct winbind_cache);
197 wcache_flush_cache();
203 free a centry structure
205 static void centry_free(struct cache_entry *centry)
209 SAFE_FREE(centry->data);
213 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
215 if (centry->len - centry->ofs < nbytes) {
216 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
217 (unsigned int)nbytes,
218 centry->len - centry->ofs));
225 pull a uint32 from a cache entry
227 static uint32 centry_uint32(struct cache_entry *centry)
231 if (!centry_check_bytes(centry, 4)) {
232 smb_panic_fn("centry_uint32");
234 ret = IVAL(centry->data, centry->ofs);
240 pull a uint16 from a cache entry
242 static uint16 centry_uint16(struct cache_entry *centry)
245 if (!centry_check_bytes(centry, 2)) {
246 smb_panic_fn("centry_uint16");
248 ret = CVAL(centry->data, centry->ofs);
254 pull a uint8 from a cache entry
256 static uint8 centry_uint8(struct cache_entry *centry)
259 if (!centry_check_bytes(centry, 1)) {
260 smb_panic_fn("centry_uint8");
262 ret = CVAL(centry->data, centry->ofs);
268 pull a NTTIME from a cache entry
270 static NTTIME centry_nttime(struct cache_entry *centry)
273 if (!centry_check_bytes(centry, 8)) {
274 smb_panic_fn("centry_nttime");
276 ret = IVAL(centry->data, centry->ofs);
278 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
284 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
286 static time_t centry_time(struct cache_entry *centry)
288 return (time_t)centry_nttime(centry);
291 /* pull a string from a cache entry, using the supplied
294 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
299 len = centry_uint8(centry);
302 /* a deliberate NULL string */
306 if (!centry_check_bytes(centry, (size_t)len)) {
307 smb_panic_fn("centry_string");
310 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
312 smb_panic_fn("centry_string out of memory\n");
314 memcpy(ret,centry->data + centry->ofs, len);
320 /* pull a hash16 from a cache entry, using the supplied
323 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
328 len = centry_uint8(centry);
331 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
336 if (!centry_check_bytes(centry, 16)) {
340 ret = TALLOC_ARRAY(mem_ctx, char, 16);
342 smb_panic_fn("centry_hash out of memory\n");
344 memcpy(ret,centry->data + centry->ofs, 16);
349 /* pull a sid from a cache entry, using the supplied
352 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
357 sid_string = centry_string(centry, talloc_tos());
358 if (sid_string == NULL) {
361 ret = string_to_sid(sid, sid_string);
362 TALLOC_FREE(sid_string);
368 pull a NTSTATUS from a cache entry
370 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
374 status = NT_STATUS(centry_uint32(centry));
379 /* the server is considered down if it can't give us a sequence number */
380 static bool wcache_server_down(struct winbindd_domain *domain)
387 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
390 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
395 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
402 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
403 return NT_STATUS_UNSUCCESSFUL;
406 fstr_sprintf( key, "SEQNUM/%s", domain->name );
408 data = tdb_fetch_bystring( wcache->tdb, key );
409 if ( !data.dptr || data.dsize!=8 ) {
410 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key ));
411 return NT_STATUS_UNSUCCESSFUL;
414 domain->sequence_number = IVAL(data.dptr, 0);
415 domain->last_seq_check = IVAL(data.dptr, 4);
417 SAFE_FREE(data.dptr);
419 /* have we expired? */
421 time_diff = now - domain->last_seq_check;
422 if ( time_diff > lp_winbind_cache_time() ) {
423 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
424 domain->name, domain->sequence_number,
425 (uint32)domain->last_seq_check));
426 return NT_STATUS_UNSUCCESSFUL;
429 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
430 domain->name, domain->sequence_number,
431 (uint32)domain->last_seq_check));
436 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
443 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
444 return NT_STATUS_UNSUCCESSFUL;
447 fstr_sprintf( key_str, "SEQNUM/%s", domain->name );
449 SIVAL(buf, 0, domain->sequence_number);
450 SIVAL(buf, 4, domain->last_seq_check);
454 if ( tdb_store_bystring( wcache->tdb, key_str, data, TDB_REPLACE) == -1 ) {
455 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
456 return NT_STATUS_UNSUCCESSFUL;
459 DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
460 domain->name, domain->sequence_number,
461 (uint32)domain->last_seq_check));
467 refresh the domain sequence number. If force is true
468 then always refresh it, no matter how recently we fetched it
471 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
475 time_t t = time(NULL);
476 unsigned cache_time = lp_winbind_cache_time();
478 if ( IS_DOMAIN_OFFLINE(domain) ) {
484 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
485 /* trying to reconnect is expensive, don't do it too often */
486 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
491 time_diff = t - domain->last_seq_check;
493 /* see if we have to refetch the domain sequence number */
494 if (!force && (time_diff < cache_time) &&
495 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
496 NT_STATUS_IS_OK(domain->last_status)) {
497 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
501 /* try to get the sequence number from the tdb cache first */
502 /* this will update the timestamp as well */
504 status = fetch_cache_seqnum( domain, t );
505 if (NT_STATUS_IS_OK(status) &&
506 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
507 NT_STATUS_IS_OK(domain->last_status)) {
511 /* important! make sure that we know if this is a native
512 mode domain or not. And that we can contact it. */
514 if ( winbindd_can_contact_domain( domain ) ) {
515 status = domain->backend->sequence_number(domain,
516 &domain->sequence_number);
518 /* just use the current time */
519 status = NT_STATUS_OK;
520 domain->sequence_number = time(NULL);
524 /* the above call could have set our domain->backend to NULL when
525 * coming from offline to online mode, make sure to reinitialize the
526 * backend - Guenther */
529 if (!NT_STATUS_IS_OK(status)) {
530 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
531 domain->sequence_number = DOM_SEQUENCE_NONE;
534 domain->last_status = status;
535 domain->last_seq_check = time(NULL);
537 /* save the new sequence number in the cache */
538 store_cache_seqnum( domain );
541 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
542 domain->name, domain->sequence_number));
548 decide if a cache entry has expired
550 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
552 /* If we've been told to be offline - stay in that state... */
553 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
554 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
555 keystr, domain->name ));
559 /* when the domain is offline return the cached entry.
560 * This deals with transient offline states... */
562 if (!domain->online) {
563 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
564 keystr, domain->name ));
568 /* if the server is OK and our cache entry came from when it was down then
569 the entry is invalid */
570 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
571 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
572 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
573 keystr, domain->name ));
577 /* if the server is down or the cache entry is not older than the
578 current sequence number then it is OK */
579 if (wcache_server_down(domain) ||
580 centry->sequence_number == domain->sequence_number) {
581 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
582 keystr, domain->name ));
586 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
587 keystr, domain->name ));
593 static struct cache_entry *wcache_fetch_raw(char *kstr)
596 struct cache_entry *centry;
599 key = string_tdb_data(kstr);
600 data = tdb_fetch(wcache->tdb, key);
606 centry = SMB_XMALLOC_P(struct cache_entry);
607 centry->data = (unsigned char *)data.dptr;
608 centry->len = data.dsize;
611 if (centry->len < 8) {
612 /* huh? corrupt cache? */
613 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
618 centry->status = centry_ntstatus(centry);
619 centry->sequence_number = centry_uint32(centry);
625 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
626 number and return status
628 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
629 struct winbindd_domain *domain,
630 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
631 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
632 struct winbindd_domain *domain,
633 const char *format, ...)
637 struct cache_entry *centry;
639 if (!winbindd_use_cache()) {
643 refresh_sequence_number(domain, false);
645 va_start(ap, format);
646 smb_xvasprintf(&kstr, format, ap);
649 centry = wcache_fetch_raw(kstr);
650 if (centry == NULL) {
655 if (centry_expired(domain, kstr, centry)) {
657 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
658 kstr, domain->name ));
665 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
666 kstr, domain->name ));
672 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
673 static void wcache_delete(const char *format, ...)
679 va_start(ap, format);
680 smb_xvasprintf(&kstr, format, ap);
683 key = string_tdb_data(kstr);
685 tdb_delete(wcache->tdb, key);
690 make sure we have at least len bytes available in a centry
692 static void centry_expand(struct cache_entry *centry, uint32 len)
694 if (centry->len - centry->ofs >= len)
697 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
700 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
701 smb_panic_fn("out of memory in centry_expand");
706 push a uint32 into a centry
708 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
710 centry_expand(centry, 4);
711 SIVAL(centry->data, centry->ofs, v);
716 push a uint16 into a centry
718 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
720 centry_expand(centry, 2);
721 SIVAL(centry->data, centry->ofs, v);
726 push a uint8 into a centry
728 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
730 centry_expand(centry, 1);
731 SCVAL(centry->data, centry->ofs, v);
736 push a string into a centry
738 static void centry_put_string(struct cache_entry *centry, const char *s)
743 /* null strings are marked as len 0xFFFF */
744 centry_put_uint8(centry, 0xFF);
749 /* can't handle more than 254 char strings. Truncating is probably best */
751 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
754 centry_put_uint8(centry, len);
755 centry_expand(centry, len);
756 memcpy(centry->data + centry->ofs, s, len);
761 push a 16 byte hash into a centry - treat as 16 byte string.
763 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
765 centry_put_uint8(centry, 16);
766 centry_expand(centry, 16);
767 memcpy(centry->data + centry->ofs, val, 16);
771 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
774 centry_put_string(centry, sid_to_fstring(sid_string, sid));
779 put NTSTATUS into a centry
781 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
783 uint32 status_value = NT_STATUS_V(status);
784 centry_put_uint32(centry, status_value);
789 push a NTTIME into a centry
791 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
793 centry_expand(centry, 8);
794 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
796 SIVAL(centry->data, centry->ofs, nt >> 32);
801 push a time_t into a centry - use a 64 bit size.
802 NTTIME here is being used as a convenient 64-bit size.
804 static void centry_put_time(struct cache_entry *centry, time_t t)
806 NTTIME nt = (NTTIME)t;
807 centry_put_nttime(centry, nt);
811 start a centry for output. When finished, call centry_end()
813 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
815 struct cache_entry *centry;
820 centry = SMB_XMALLOC_P(struct cache_entry);
822 centry->len = 8192; /* reasonable default */
823 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
825 centry->sequence_number = domain->sequence_number;
826 centry_put_ntstatus(centry, status);
827 centry_put_uint32(centry, centry->sequence_number);
832 finish a centry and write it to the tdb
834 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
835 static void centry_end(struct cache_entry *centry, const char *format, ...)
841 if (!winbindd_use_cache()) {
845 va_start(ap, format);
846 smb_xvasprintf(&kstr, format, ap);
849 key = string_tdb_data(kstr);
850 data.dptr = centry->data;
851 data.dsize = centry->ofs;
853 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
857 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
858 NTSTATUS status, const char *domain_name,
859 const char *name, const DOM_SID *sid,
860 enum lsa_SidType type)
862 struct cache_entry *centry;
865 centry = centry_start(domain, status);
868 centry_put_uint32(centry, type);
869 centry_put_sid(centry, sid);
870 fstrcpy(uname, name);
872 centry_end(centry, "NS/%s/%s", domain_name, uname);
873 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
874 uname, sid_string_dbg(sid), nt_errstr(status)));
878 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
879 const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
881 struct cache_entry *centry;
884 centry = centry_start(domain, status);
888 if (NT_STATUS_IS_OK(status)) {
889 centry_put_uint32(centry, type);
890 centry_put_string(centry, domain_name);
891 centry_put_string(centry, name);
894 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
895 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
896 name, nt_errstr(status)));
901 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WINBIND_USERINFO *info)
903 struct cache_entry *centry;
906 if (is_null_sid(&info->user_sid)) {
910 centry = centry_start(domain, status);
913 centry_put_string(centry, info->acct_name);
914 centry_put_string(centry, info->full_name);
915 centry_put_string(centry, info->homedir);
916 centry_put_string(centry, info->shell);
917 centry_put_uint32(centry, info->primary_gid);
918 centry_put_sid(centry, &info->user_sid);
919 centry_put_sid(centry, &info->group_sid);
920 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
922 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
926 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
928 struct samr_DomInfo12 *lockout_policy)
930 struct cache_entry *centry;
932 centry = centry_start(domain, status);
936 centry_put_nttime(centry, lockout_policy->lockout_duration);
937 centry_put_nttime(centry, lockout_policy->lockout_window);
938 centry_put_uint16(centry, lockout_policy->lockout_threshold);
940 centry_end(centry, "LOC_POL/%s", domain->name);
942 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
949 static void wcache_save_password_policy(struct winbindd_domain *domain,
951 struct samr_DomInfo1 *policy)
953 struct cache_entry *centry;
955 centry = centry_start(domain, status);
959 centry_put_uint16(centry, policy->min_password_length);
960 centry_put_uint16(centry, policy->password_history_length);
961 centry_put_uint32(centry, policy->password_properties);
962 centry_put_nttime(centry, policy->max_password_age);
963 centry_put_nttime(centry, policy->min_password_age);
965 centry_end(centry, "PWD_POL/%s", domain->name);
967 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
972 /***************************************************************************
973 ***************************************************************************/
975 static void wcache_save_username_alias(struct winbindd_domain *domain,
977 const char *name, const char *alias)
979 struct cache_entry *centry;
982 if ( (centry = centry_start(domain, status)) == NULL )
985 centry_put_string( centry, alias );
987 fstrcpy(uname, name);
989 centry_end(centry, "NSS/NA/%s", uname);
991 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
996 static void wcache_save_alias_username(struct winbindd_domain *domain,
998 const char *alias, const char *name)
1000 struct cache_entry *centry;
1003 if ( (centry = centry_start(domain, status)) == NULL )
1006 centry_put_string( centry, name );
1008 fstrcpy(uname, alias);
1010 centry_end(centry, "NSS/AN/%s", uname);
1012 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1014 centry_free(centry);
1017 /***************************************************************************
1018 ***************************************************************************/
1020 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1021 struct winbindd_domain *domain,
1022 const char *name, char **alias )
1024 struct winbind_cache *cache = get_cache(domain);
1025 struct cache_entry *centry = NULL;
1029 if ( domain->internal )
1030 return NT_STATUS_NOT_SUPPORTED;
1035 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1036 return NT_STATUS_NO_MEMORY;
1037 strupper_m(upper_name);
1039 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1041 SAFE_FREE( upper_name );
1046 status = centry->status;
1048 if (!NT_STATUS_IS_OK(status)) {
1049 centry_free(centry);
1053 *alias = centry_string( centry, mem_ctx );
1055 centry_free(centry);
1057 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1058 name, *alias ? *alias : "(none)"));
1060 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1064 /* If its not in cache and we are offline, then fail */
1066 if ( get_global_winbindd_state_offline() || !domain->online ) {
1067 DEBUG(8,("resolve_username_to_alias: rejecting query "
1068 "in offline mode\n"));
1069 return NT_STATUS_NOT_FOUND;
1072 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1074 if ( NT_STATUS_IS_OK( status ) ) {
1075 wcache_save_username_alias(domain, status, name, *alias);
1078 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1079 wcache_save_username_alias(domain, status, name, "(NULL)");
1082 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1083 nt_errstr(status)));
1085 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1086 set_domain_offline( domain );
1092 /***************************************************************************
1093 ***************************************************************************/
1095 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1096 struct winbindd_domain *domain,
1097 const char *alias, char **name )
1099 struct winbind_cache *cache = get_cache(domain);
1100 struct cache_entry *centry = NULL;
1104 if ( domain->internal )
1105 return NT_STATUS_NOT_SUPPORTED;
1110 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1111 return NT_STATUS_NO_MEMORY;
1112 strupper_m(upper_name);
1114 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1116 SAFE_FREE( upper_name );
1121 status = centry->status;
1123 if (!NT_STATUS_IS_OK(status)) {
1124 centry_free(centry);
1128 *name = centry_string( centry, mem_ctx );
1130 centry_free(centry);
1132 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1133 alias, *name ? *name : "(none)"));
1135 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1139 /* If its not in cache and we are offline, then fail */
1141 if ( get_global_winbindd_state_offline() || !domain->online ) {
1142 DEBUG(8,("resolve_alias_to_username: rejecting query "
1143 "in offline mode\n"));
1144 return NT_STATUS_NOT_FOUND;
1147 /* an alias cannot contain a domain prefix or '@' */
1149 if (strchr(alias, '\\') || strchr(alias, '@')) {
1150 DEBUG(10,("resolve_alias_to_username: skipping fully "
1151 "qualified name %s\n", alias));
1152 return NT_STATUS_OBJECT_NAME_INVALID;
1155 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1157 if ( NT_STATUS_IS_OK( status ) ) {
1158 wcache_save_alias_username( domain, status, alias, *name );
1161 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1162 wcache_save_alias_username(domain, status, alias, "(NULL)");
1165 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1166 nt_errstr(status)));
1168 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1169 set_domain_offline( domain );
1175 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1177 struct winbind_cache *cache = get_cache(domain);
1179 fstring key_str, tmp;
1183 return NT_STATUS_INTERNAL_DB_ERROR;
1186 if (is_null_sid(sid)) {
1187 return NT_STATUS_INVALID_SID;
1190 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1191 return NT_STATUS_INVALID_SID;
1194 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1196 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1198 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1201 SAFE_FREE(data.dptr);
1202 return NT_STATUS_OK;
1205 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1206 as new salted ones. */
1208 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1209 TALLOC_CTX *mem_ctx,
1211 const uint8 **cached_nt_pass,
1212 const uint8 **cached_salt)
1214 struct winbind_cache *cache = get_cache(domain);
1215 struct cache_entry *centry = NULL;
1222 return NT_STATUS_INTERNAL_DB_ERROR;
1225 if (is_null_sid(sid)) {
1226 return NT_STATUS_INVALID_SID;
1229 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1230 return NT_STATUS_INVALID_SID;
1233 /* Try and get a salted cred first. If we can't
1234 fall back to an unsalted cred. */
1236 centry = wcache_fetch(cache, domain, "CRED/%s",
1237 sid_to_fstring(tmp, sid));
1239 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1240 sid_string_dbg(sid)));
1241 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1244 t = centry_time(centry);
1246 /* In the salted case this isn't actually the nt_hash itself,
1247 but the MD5 of the salt + nt_hash. Let the caller
1248 sort this out. It can tell as we only return the cached_salt
1249 if we are returning a salted cred. */
1251 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1252 if (*cached_nt_pass == NULL) {
1255 sid_to_fstring(sidstr, sid);
1257 /* Bad (old) cred cache. Delete and pretend we
1259 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1261 wcache_delete("CRED/%s", sidstr);
1262 centry_free(centry);
1263 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1266 /* We only have 17 bytes more data in the salted cred case. */
1267 if (centry->len - centry->ofs == 17) {
1268 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1270 *cached_salt = NULL;
1273 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1275 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1278 status = centry->status;
1280 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1281 sid_string_dbg(sid), nt_errstr(status) ));
1283 centry_free(centry);
1287 /* Store creds for a SID - only writes out new salted ones. */
1289 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1290 TALLOC_CTX *mem_ctx,
1292 const uint8 nt_pass[NT_HASH_LEN])
1294 struct cache_entry *centry;
1297 uint8 cred_salt[NT_HASH_LEN];
1298 uint8 salted_hash[NT_HASH_LEN];
1300 if (is_null_sid(sid)) {
1301 return NT_STATUS_INVALID_SID;
1304 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1305 return NT_STATUS_INVALID_SID;
1308 centry = centry_start(domain, NT_STATUS_OK);
1310 return NT_STATUS_INTERNAL_DB_ERROR;
1313 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1315 centry_put_time(centry, time(NULL));
1317 /* Create a salt and then salt the hash. */
1318 generate_random_buffer(cred_salt, NT_HASH_LEN);
1319 E_md5hash(cred_salt, nt_pass, salted_hash);
1321 centry_put_hash16(centry, salted_hash);
1322 centry_put_hash16(centry, cred_salt);
1323 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1325 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1327 centry_free(centry);
1329 return NT_STATUS_OK;
1333 /* Query display info. This is the basic user list fn */
1334 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1335 TALLOC_CTX *mem_ctx,
1336 uint32 *num_entries,
1337 WINBIND_USERINFO **info)
1339 struct winbind_cache *cache = get_cache(domain);
1340 struct cache_entry *centry = NULL;
1342 unsigned int i, retry;
1347 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1351 *num_entries = centry_uint32(centry);
1353 if (*num_entries == 0)
1356 (*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
1358 smb_panic_fn("query_user_list out of memory");
1360 for (i=0; i<(*num_entries); i++) {
1361 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1362 (*info)[i].full_name = centry_string(centry, mem_ctx);
1363 (*info)[i].homedir = centry_string(centry, mem_ctx);
1364 (*info)[i].shell = centry_string(centry, mem_ctx);
1365 centry_sid(centry, &(*info)[i].user_sid);
1366 centry_sid(centry, &(*info)[i].group_sid);
1370 status = centry->status;
1372 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1373 domain->name, nt_errstr(status) ));
1375 centry_free(centry);
1382 /* Return status value returned by seq number check */
1384 if (!NT_STATUS_IS_OK(domain->last_status))
1385 return domain->last_status;
1387 /* Put the query_user_list() in a retry loop. There appears to be
1388 * some bug either with Windows 2000 or Samba's handling of large
1389 * rpc replies. This manifests itself as sudden disconnection
1390 * at a random point in the enumeration of a large (60k) user list.
1391 * The retry loop simply tries the operation again. )-: It's not
1392 * pretty but an acceptable workaround until we work out what the
1393 * real problem is. */
1398 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1401 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1402 if (!NT_STATUS_IS_OK(status)) {
1403 DEBUG(3, ("query_user_list: returned 0x%08x, "
1404 "retrying\n", NT_STATUS_V(status)));
1406 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1407 DEBUG(3, ("query_user_list: flushing "
1408 "connection cache\n"));
1409 invalidate_cm_connection(&domain->conn);
1412 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1416 refresh_sequence_number(domain, false);
1417 centry = centry_start(domain, status);
1420 centry_put_uint32(centry, *num_entries);
1421 for (i=0; i<(*num_entries); i++) {
1422 centry_put_string(centry, (*info)[i].acct_name);
1423 centry_put_string(centry, (*info)[i].full_name);
1424 centry_put_string(centry, (*info)[i].homedir);
1425 centry_put_string(centry, (*info)[i].shell);
1426 centry_put_sid(centry, &(*info)[i].user_sid);
1427 centry_put_sid(centry, &(*info)[i].group_sid);
1428 if (domain->backend && domain->backend->consistent) {
1429 /* when the backend is consistent we can pre-prime some mappings */
1430 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1432 (*info)[i].acct_name,
1433 &(*info)[i].user_sid,
1435 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1436 &(*info)[i].user_sid,
1438 (*info)[i].acct_name,
1440 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1443 centry_end(centry, "UL/%s", domain->name);
1444 centry_free(centry);
1450 /* list all domain groups */
1451 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1452 TALLOC_CTX *mem_ctx,
1453 uint32 *num_entries,
1454 struct acct_info **info)
1456 struct winbind_cache *cache = get_cache(domain);
1457 struct cache_entry *centry = NULL;
1464 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1468 *num_entries = centry_uint32(centry);
1470 if (*num_entries == 0)
1473 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1475 smb_panic_fn("enum_dom_groups out of memory");
1477 for (i=0; i<(*num_entries); i++) {
1478 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1479 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1480 (*info)[i].rid = centry_uint32(centry);
1484 status = centry->status;
1486 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1487 domain->name, nt_errstr(status) ));
1489 centry_free(centry);
1496 /* Return status value returned by seq number check */
1498 if (!NT_STATUS_IS_OK(domain->last_status))
1499 return domain->last_status;
1501 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1504 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1507 refresh_sequence_number(domain, false);
1508 centry = centry_start(domain, status);
1511 centry_put_uint32(centry, *num_entries);
1512 for (i=0; i<(*num_entries); i++) {
1513 centry_put_string(centry, (*info)[i].acct_name);
1514 centry_put_string(centry, (*info)[i].acct_desc);
1515 centry_put_uint32(centry, (*info)[i].rid);
1517 centry_end(centry, "GL/%s/domain", domain->name);
1518 centry_free(centry);
1524 /* list all domain groups */
1525 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1526 TALLOC_CTX *mem_ctx,
1527 uint32 *num_entries,
1528 struct acct_info **info)
1530 struct winbind_cache *cache = get_cache(domain);
1531 struct cache_entry *centry = NULL;
1538 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1542 *num_entries = centry_uint32(centry);
1544 if (*num_entries == 0)
1547 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1549 smb_panic_fn("enum_dom_groups out of memory");
1551 for (i=0; i<(*num_entries); i++) {
1552 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1553 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1554 (*info)[i].rid = centry_uint32(centry);
1559 /* If we are returning cached data and the domain controller
1560 is down then we don't know whether the data is up to date
1561 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1564 if (wcache_server_down(domain)) {
1565 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1566 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1568 status = centry->status;
1570 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1571 domain->name, nt_errstr(status) ));
1573 centry_free(centry);
1580 /* Return status value returned by seq number check */
1582 if (!NT_STATUS_IS_OK(domain->last_status))
1583 return domain->last_status;
1585 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1588 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1591 refresh_sequence_number(domain, false);
1592 centry = centry_start(domain, status);
1595 centry_put_uint32(centry, *num_entries);
1596 for (i=0; i<(*num_entries); i++) {
1597 centry_put_string(centry, (*info)[i].acct_name);
1598 centry_put_string(centry, (*info)[i].acct_desc);
1599 centry_put_uint32(centry, (*info)[i].rid);
1601 centry_end(centry, "GL/%s/local", domain->name);
1602 centry_free(centry);
1608 /* convert a single name to a sid in a domain */
1609 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1610 TALLOC_CTX *mem_ctx,
1611 enum winbindd_cmd orig_cmd,
1612 const char *domain_name,
1615 enum lsa_SidType *type)
1617 struct winbind_cache *cache = get_cache(domain);
1618 struct cache_entry *centry = NULL;
1625 fstrcpy(uname, name);
1627 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1631 status = centry->status;
1632 if (NT_STATUS_IS_OK(status)) {
1633 *type = (enum lsa_SidType)centry_uint32(centry);
1634 centry_sid(centry, sid);
1637 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: %s\n",
1638 domain->name, nt_errstr(status) ));
1640 centry_free(centry);
1646 /* If the seq number check indicated that there is a problem
1647 * with this DC, then return that status... except for
1648 * access_denied. This is special because the dc may be in
1649 * "restrict anonymous = 1" mode, in which case it will deny
1650 * most unauthenticated operations, but *will* allow the LSA
1651 * name-to-sid that we try as a fallback. */
1653 if (!(NT_STATUS_IS_OK(domain->last_status)
1654 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1655 return domain->last_status;
1657 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1660 status = domain->backend->name_to_sid(domain, mem_ctx, orig_cmd,
1661 domain_name, name, sid, type);
1664 refresh_sequence_number(domain, false);
1666 if (domain->online &&
1667 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1668 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1670 /* Only save the reverse mapping if this was not a UPN */
1671 if (!strchr(name, '@')) {
1672 strupper_m(CONST_DISCARD(char *,domain_name));
1673 strlower_m(CONST_DISCARD(char *,name));
1674 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1681 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1683 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1684 TALLOC_CTX *mem_ctx,
1688 enum lsa_SidType *type)
1690 struct winbind_cache *cache = get_cache(domain);
1691 struct cache_entry *centry = NULL;
1698 centry = wcache_fetch(cache, domain, "SN/%s",
1699 sid_to_fstring(sid_string, sid));
1703 status = centry->status;
1704 if (NT_STATUS_IS_OK(status)) {
1705 *type = (enum lsa_SidType)centry_uint32(centry);
1706 *domain_name = centry_string(centry, mem_ctx);
1707 *name = centry_string(centry, mem_ctx);
1710 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: %s\n",
1711 domain->name, nt_errstr(status) ));
1713 centry_free(centry);
1718 *domain_name = NULL;
1720 /* If the seq number check indicated that there is a problem
1721 * with this DC, then return that status... except for
1722 * access_denied. This is special because the dc may be in
1723 * "restrict anonymous = 1" mode, in which case it will deny
1724 * most unauthenticated operations, but *will* allow the LSA
1725 * sid-to-name that we try as a fallback. */
1727 if (!(NT_STATUS_IS_OK(domain->last_status)
1728 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1729 return domain->last_status;
1731 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1734 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1737 refresh_sequence_number(domain, false);
1738 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1740 /* We can't save the name to sid mapping here, as with sid history a
1741 * later name2sid would give the wrong sid. */
1746 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1747 TALLOC_CTX *mem_ctx,
1748 const DOM_SID *domain_sid,
1753 enum lsa_SidType **types)
1755 struct winbind_cache *cache = get_cache(domain);
1757 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1761 *domain_name = NULL;
1769 if (num_rids == 0) {
1770 return NT_STATUS_OK;
1773 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1774 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1776 if ((*names == NULL) || (*types == NULL)) {
1777 result = NT_STATUS_NO_MEMORY;
1781 have_mapped = have_unmapped = false;
1783 for (i=0; i<num_rids; i++) {
1785 struct cache_entry *centry;
1788 if (!sid_compose(&sid, domain_sid, rids[i])) {
1789 result = NT_STATUS_INTERNAL_ERROR;
1793 centry = wcache_fetch(cache, domain, "SN/%s",
1794 sid_to_fstring(tmp, &sid));
1799 (*types)[i] = SID_NAME_UNKNOWN;
1800 (*names)[i] = talloc_strdup(*names, "");
1802 if (NT_STATUS_IS_OK(centry->status)) {
1805 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1807 dom = centry_string(centry, mem_ctx);
1808 if (*domain_name == NULL) {
1814 (*names)[i] = centry_string(centry, *names);
1816 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1817 have_unmapped = true;
1820 /* something's definitely wrong */
1821 result = centry->status;
1825 centry_free(centry);
1829 return NT_STATUS_NONE_MAPPED;
1831 if (!have_unmapped) {
1832 return NT_STATUS_OK;
1834 return STATUS_SOME_UNMAPPED;
1838 TALLOC_FREE(*names);
1839 TALLOC_FREE(*types);
1841 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1842 rids, num_rids, domain_name,
1846 None of the queried rids has been found so save all negative entries
1848 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1849 for (i = 0; i < num_rids; i++) {
1851 const char *name = "";
1852 const enum lsa_SidType type = SID_NAME_UNKNOWN;
1853 NTSTATUS status = NT_STATUS_NONE_MAPPED;
1855 if (!sid_compose(&sid, domain_sid, rids[i])) {
1856 return NT_STATUS_INTERNAL_ERROR;
1859 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1867 Some or all of the queried rids have been found.
1869 if (!NT_STATUS_IS_OK(result) &&
1870 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1874 refresh_sequence_number(domain, false);
1876 for (i=0; i<num_rids; i++) {
1880 if (!sid_compose(&sid, domain_sid, rids[i])) {
1881 result = NT_STATUS_INTERNAL_ERROR;
1885 status = (*types)[i] == SID_NAME_UNKNOWN ?
1886 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1888 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1889 (*names)[i], (*types)[i]);
1895 TALLOC_FREE(*names);
1896 TALLOC_FREE(*types);
1900 /* Lookup user information from a rid */
1901 static NTSTATUS query_user(struct winbindd_domain *domain,
1902 TALLOC_CTX *mem_ctx,
1903 const DOM_SID *user_sid,
1904 WINBIND_USERINFO *info)
1906 struct winbind_cache *cache = get_cache(domain);
1907 struct cache_entry *centry = NULL;
1914 centry = wcache_fetch(cache, domain, "U/%s",
1915 sid_to_fstring(tmp, user_sid));
1917 /* If we have an access denied cache entry and a cached info3 in the
1918 samlogon cache then do a query. This will force the rpc back end
1919 to return the info3 data. */
1921 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1922 netsamlogon_cache_have(user_sid)) {
1923 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1924 domain->last_status = NT_STATUS_OK;
1925 centry_free(centry);
1932 /* if status is not ok then this is a negative hit
1933 and the rest of the data doesn't matter */
1934 status = centry->status;
1935 if (NT_STATUS_IS_OK(status)) {
1936 info->acct_name = centry_string(centry, mem_ctx);
1937 info->full_name = centry_string(centry, mem_ctx);
1938 info->homedir = centry_string(centry, mem_ctx);
1939 info->shell = centry_string(centry, mem_ctx);
1940 info->primary_gid = centry_uint32(centry);
1941 centry_sid(centry, &info->user_sid);
1942 centry_sid(centry, &info->group_sid);
1945 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: %s\n",
1946 domain->name, nt_errstr(status) ));
1948 centry_free(centry);
1954 /* Return status value returned by seq number check */
1956 if (!NT_STATUS_IS_OK(domain->last_status))
1957 return domain->last_status;
1959 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
1962 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
1965 refresh_sequence_number(domain, false);
1966 wcache_save_user(domain, status, info);
1972 /* Lookup groups a user is a member of. */
1973 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
1974 TALLOC_CTX *mem_ctx,
1975 const DOM_SID *user_sid,
1976 uint32 *num_groups, DOM_SID **user_gids)
1978 struct winbind_cache *cache = get_cache(domain);
1979 struct cache_entry *centry = NULL;
1987 centry = wcache_fetch(cache, domain, "UG/%s",
1988 sid_to_fstring(sid_string, user_sid));
1990 /* If we have an access denied cache entry and a cached info3 in the
1991 samlogon cache then do a query. This will force the rpc back end
1992 to return the info3 data. */
1994 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1995 netsamlogon_cache_have(user_sid)) {
1996 DEBUG(10, ("lookup_usergroups: cached access denied and have cached info3\n"));
1997 domain->last_status = NT_STATUS_OK;
1998 centry_free(centry);
2005 *num_groups = centry_uint32(centry);
2007 if (*num_groups == 0)
2010 (*user_gids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_groups);
2011 if (! (*user_gids)) {
2012 smb_panic_fn("lookup_usergroups out of memory");
2014 for (i=0; i<(*num_groups); i++) {
2015 centry_sid(centry, &(*user_gids)[i]);
2019 status = centry->status;
2021 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status: %s\n",
2022 domain->name, nt_errstr(status) ));
2024 centry_free(centry);
2029 (*user_gids) = NULL;
2031 /* Return status value returned by seq number check */
2033 if (!NT_STATUS_IS_OK(domain->last_status))
2034 return domain->last_status;
2036 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2039 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2041 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2045 refresh_sequence_number(domain, false);
2046 centry = centry_start(domain, status);
2050 centry_put_uint32(centry, *num_groups);
2051 for (i=0; i<(*num_groups); i++) {
2052 centry_put_sid(centry, &(*user_gids)[i]);
2055 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2056 centry_free(centry);
2062 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2063 TALLOC_CTX *mem_ctx,
2064 uint32 num_sids, const DOM_SID *sids,
2065 uint32 *num_aliases, uint32 **alias_rids)
2067 struct winbind_cache *cache = get_cache(domain);
2068 struct cache_entry *centry = NULL;
2070 char *sidlist = talloc_strdup(mem_ctx, "");
2076 if (num_sids == 0) {
2079 return NT_STATUS_OK;
2082 /* We need to cache indexed by the whole list of SIDs, the aliases
2083 * resulting might come from any of the SIDs. */
2085 for (i=0; i<num_sids; i++) {
2087 sidlist = talloc_asprintf(mem_ctx, "%s/%s", sidlist,
2088 sid_to_fstring(tmp, &sids[i]));
2089 if (sidlist == NULL)
2090 return NT_STATUS_NO_MEMORY;
2093 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2098 *num_aliases = centry_uint32(centry);
2102 (*alias_rids) = TALLOC_ARRAY(mem_ctx, uint32, *num_aliases);
2104 if ((*alias_rids) == NULL) {
2105 centry_free(centry);
2106 return NT_STATUS_NO_MEMORY;
2109 (*alias_rids) = NULL;
2112 for (i=0; i<(*num_aliases); i++)
2113 (*alias_rids)[i] = centry_uint32(centry);
2115 status = centry->status;
2117 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2118 "status %s\n", domain->name, nt_errstr(status)));
2120 centry_free(centry);
2125 (*alias_rids) = NULL;
2127 if (!NT_STATUS_IS_OK(domain->last_status))
2128 return domain->last_status;
2130 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2131 "for domain %s\n", domain->name ));
2133 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2135 num_aliases, alias_rids);
2138 refresh_sequence_number(domain, false);
2139 centry = centry_start(domain, status);
2142 centry_put_uint32(centry, *num_aliases);
2143 for (i=0; i<(*num_aliases); i++)
2144 centry_put_uint32(centry, (*alias_rids)[i]);
2145 centry_end(centry, "UA%s", sidlist);
2146 centry_free(centry);
2153 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2154 TALLOC_CTX *mem_ctx,
2155 const DOM_SID *group_sid, uint32 *num_names,
2156 DOM_SID **sid_mem, char ***names,
2157 uint32 **name_types)
2159 struct winbind_cache *cache = get_cache(domain);
2160 struct cache_entry *centry = NULL;
2168 centry = wcache_fetch(cache, domain, "GM/%s",
2169 sid_to_fstring(sid_string, group_sid));
2173 *num_names = centry_uint32(centry);
2175 if (*num_names == 0)
2178 (*sid_mem) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_names);
2179 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
2180 (*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
2182 if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
2183 smb_panic_fn("lookup_groupmem out of memory");
2186 for (i=0; i<(*num_names); i++) {
2187 centry_sid(centry, &(*sid_mem)[i]);
2188 (*names)[i] = centry_string(centry, mem_ctx);
2189 (*name_types)[i] = centry_uint32(centry);
2193 status = centry->status;
2195 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status: %s\n",
2196 domain->name, nt_errstr(status)));
2198 centry_free(centry);
2205 (*name_types) = NULL;
2207 /* Return status value returned by seq number check */
2209 if (!NT_STATUS_IS_OK(domain->last_status))
2210 return domain->last_status;
2212 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2215 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2216 sid_mem, names, name_types);
2219 refresh_sequence_number(domain, false);
2220 centry = centry_start(domain, status);
2223 centry_put_uint32(centry, *num_names);
2224 for (i=0; i<(*num_names); i++) {
2225 centry_put_sid(centry, &(*sid_mem)[i]);
2226 centry_put_string(centry, (*names)[i]);
2227 centry_put_uint32(centry, (*name_types)[i]);
2229 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2230 centry_free(centry);
2236 /* find the sequence number for a domain */
2237 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2239 refresh_sequence_number(domain, false);
2241 *seq = domain->sequence_number;
2243 return NT_STATUS_OK;
2246 /* enumerate trusted domains
2247 * (we need to have the list of trustdoms in the cache when we go offline) -
2249 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2250 TALLOC_CTX *mem_ctx,
2251 uint32 *num_domains,
2256 struct winbind_cache *cache = get_cache(domain);
2257 struct cache_entry *centry = NULL;
2264 centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2270 *num_domains = centry_uint32(centry);
2273 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2274 (*alt_names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2275 (*dom_sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2277 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2278 smb_panic_fn("trusted_domains out of memory");
2282 (*alt_names) = NULL;
2286 for (i=0; i<(*num_domains); i++) {
2287 (*names)[i] = centry_string(centry, mem_ctx);
2288 (*alt_names)[i] = centry_string(centry, mem_ctx);
2289 if (!centry_sid(centry, &(*dom_sids)[i])) {
2290 sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2294 status = centry->status;
2296 DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2297 domain->name, *num_domains, nt_errstr(status) ));
2299 centry_free(centry);
2306 (*alt_names) = NULL;
2308 /* Return status value returned by seq number check */
2310 if (!NT_STATUS_IS_OK(domain->last_status))
2311 return domain->last_status;
2313 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2316 status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2317 names, alt_names, dom_sids);
2319 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2320 * so that the generic centry handling still applies correctly -
2323 if (!NT_STATUS_IS_ERR(status)) {
2324 status = NT_STATUS_OK;
2328 #if 0 /* Disabled as we want the trust dom list to be managed by
2329 the main parent and always to make the query. --jerry */
2332 refresh_sequence_number(domain, false);
2334 centry = centry_start(domain, status);
2338 centry_put_uint32(centry, *num_domains);
2340 for (i=0; i<(*num_domains); i++) {
2341 centry_put_string(centry, (*names)[i]);
2342 centry_put_string(centry, (*alt_names)[i]);
2343 centry_put_sid(centry, &(*dom_sids)[i]);
2346 centry_end(centry, "TRUSTDOMS/%s", domain->name);
2348 centry_free(centry);
2356 /* get lockout policy */
2357 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2358 TALLOC_CTX *mem_ctx,
2359 struct samr_DomInfo12 *policy)
2361 struct winbind_cache *cache = get_cache(domain);
2362 struct cache_entry *centry = NULL;
2368 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2373 policy->lockout_duration = centry_nttime(centry);
2374 policy->lockout_window = centry_nttime(centry);
2375 policy->lockout_threshold = centry_uint16(centry);
2377 status = centry->status;
2379 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2380 domain->name, nt_errstr(status) ));
2382 centry_free(centry);
2386 ZERO_STRUCTP(policy);
2388 /* Return status value returned by seq number check */
2390 if (!NT_STATUS_IS_OK(domain->last_status))
2391 return domain->last_status;
2393 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2396 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2399 refresh_sequence_number(domain, false);
2400 wcache_save_lockout_policy(domain, status, policy);
2405 /* get password policy */
2406 static NTSTATUS password_policy(struct winbindd_domain *domain,
2407 TALLOC_CTX *mem_ctx,
2408 struct samr_DomInfo1 *policy)
2410 struct winbind_cache *cache = get_cache(domain);
2411 struct cache_entry *centry = NULL;
2417 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2422 policy->min_password_length = centry_uint16(centry);
2423 policy->password_history_length = centry_uint16(centry);
2424 policy->password_properties = centry_uint32(centry);
2425 policy->max_password_age = centry_nttime(centry);
2426 policy->min_password_age = centry_nttime(centry);
2428 status = centry->status;
2430 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2431 domain->name, nt_errstr(status) ));
2433 centry_free(centry);
2437 ZERO_STRUCTP(policy);
2439 /* Return status value returned by seq number check */
2441 if (!NT_STATUS_IS_OK(domain->last_status))
2442 return domain->last_status;
2444 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2447 status = domain->backend->password_policy(domain, mem_ctx, policy);
2450 refresh_sequence_number(domain, false);
2451 if (NT_STATUS_IS_OK(status)) {
2452 wcache_save_password_policy(domain, status, policy);
2459 /* Invalidate cached user and group lists coherently */
2461 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2464 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2465 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2466 tdb_delete(the_tdb, kbuf);
2471 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2473 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2474 struct netr_SamInfo3 *info3)
2477 fstring key_str, sid_string;
2478 struct winbind_cache *cache;
2480 /* dont clear cached U/SID and UG/SID entries when we want to logon
2483 if (lp_winbind_offline_logon()) {
2490 cache = get_cache(domain);
2496 sid_copy(&sid, info3->base.domain_sid);
2497 sid_append_rid(&sid, info3->base.rid);
2499 /* Clear U/SID cache entry */
2500 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2501 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2502 tdb_delete(cache->tdb, string_tdb_data(key_str));
2504 /* Clear UG/SID cache entry */
2505 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2506 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2507 tdb_delete(cache->tdb, string_tdb_data(key_str));
2509 /* Samba/winbindd never needs this. */
2510 netsamlogon_clear_cached_user(info3);
2513 bool wcache_invalidate_cache(void)
2515 struct winbindd_domain *domain;
2517 for (domain = domain_list(); domain; domain = domain->next) {
2518 struct winbind_cache *cache = get_cache(domain);
2520 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2521 "entries for %s\n", domain->name));
2524 tdb_traverse(cache->tdb, traverse_fn, NULL);
2533 bool init_wcache(void)
2535 if (wcache == NULL) {
2536 wcache = SMB_XMALLOC_P(struct winbind_cache);
2537 ZERO_STRUCTP(wcache);
2540 if (wcache->tdb != NULL)
2543 /* when working offline we must not clear the cache on restart */
2544 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2545 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2546 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2547 O_RDWR|O_CREAT, 0600);
2549 if (wcache->tdb == NULL) {
2550 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2557 /************************************************************************
2558 This is called by the parent to initialize the cache file.
2559 We don't need sophisticated locking here as we know we're the
2561 ************************************************************************/
2563 bool initialize_winbindd_cache(void)
2565 bool cache_bad = true;
2568 if (!init_wcache()) {
2569 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2573 /* Check version number. */
2574 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2575 vers == WINBINDD_CACHE_VERSION) {
2580 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2581 "and re-creating with version number %d\n",
2582 WINBINDD_CACHE_VERSION ));
2584 tdb_close(wcache->tdb);
2587 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2588 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2589 cache_path("winbindd_cache.tdb"),
2593 if (!init_wcache()) {
2594 DEBUG(0,("initialize_winbindd_cache: re-initialization "
2595 "init_wcache failed.\n"));
2599 /* Write the version. */
2600 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2601 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2602 tdb_errorstr(wcache->tdb) ));
2607 tdb_close(wcache->tdb);
2612 void close_winbindd_cache(void)
2618 tdb_close(wcache->tdb);
2623 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2624 char **domain_name, char **name,
2625 enum lsa_SidType *type)
2627 struct winbindd_domain *domain;
2628 struct winbind_cache *cache;
2629 struct cache_entry *centry = NULL;
2633 domain = find_lookup_domain_from_sid(sid);
2634 if (domain == NULL) {
2638 cache = get_cache(domain);
2640 if (cache->tdb == NULL) {
2644 centry = wcache_fetch(cache, domain, "SN/%s",
2645 sid_to_fstring(tmp, sid));
2646 if (centry == NULL) {
2650 if (NT_STATUS_IS_OK(centry->status)) {
2651 *type = (enum lsa_SidType)centry_uint32(centry);
2652 *domain_name = centry_string(centry, mem_ctx);
2653 *name = centry_string(centry, mem_ctx);
2656 status = centry->status;
2657 centry_free(centry);
2658 return NT_STATUS_IS_OK(status);
2661 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2662 const char *domain_name,
2665 enum lsa_SidType *type)
2667 struct winbindd_domain *domain;
2668 struct winbind_cache *cache;
2669 struct cache_entry *centry = NULL;
2672 bool original_online_state;
2674 domain = find_lookup_domain_from_name(domain_name);
2675 if (domain == NULL) {
2679 cache = get_cache(domain);
2681 if (cache->tdb == NULL) {
2685 fstrcpy(uname, name);
2688 /* If we are doing a cached logon, temporarily set the domain
2689 offline so the cache won't expire the entry */
2691 original_online_state = domain->online;
2692 domain->online = false;
2693 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
2694 domain->online = original_online_state;
2696 if (centry == NULL) {
2700 if (NT_STATUS_IS_OK(centry->status)) {
2701 *type = (enum lsa_SidType)centry_uint32(centry);
2702 centry_sid(centry, sid);
2705 status = centry->status;
2706 centry_free(centry);
2708 return NT_STATUS_IS_OK(status);
2711 void cache_name2sid(struct winbindd_domain *domain,
2712 const char *domain_name, const char *name,
2713 enum lsa_SidType type, const DOM_SID *sid)
2715 refresh_sequence_number(domain, false);
2716 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2721 * The original idea that this cache only contains centries has
2722 * been blurred - now other stuff gets put in here. Ensure we
2723 * ignore these things on cleanup.
2726 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2727 TDB_DATA dbuf, void *state)
2729 struct cache_entry *centry;
2731 if (is_non_centry_key(kbuf)) {
2735 centry = wcache_fetch_raw((char *)kbuf.dptr);
2740 if (!NT_STATUS_IS_OK(centry->status)) {
2741 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2742 tdb_delete(the_tdb, kbuf);
2745 centry_free(centry);
2749 /* flush the cache */
2750 void wcache_flush_cache(void)
2755 tdb_close(wcache->tdb);
2758 if (!winbindd_use_cache()) {
2762 /* when working offline we must not clear the cache on restart */
2763 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2764 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2765 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2766 O_RDWR|O_CREAT, 0600);
2769 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2773 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2775 DEBUG(10,("wcache_flush_cache success\n"));
2778 /* Count cached creds */
2780 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2783 int *cred_count = (int*)state;
2785 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2791 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2793 struct winbind_cache *cache = get_cache(domain);
2798 return NT_STATUS_INTERNAL_DB_ERROR;
2801 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2803 return NT_STATUS_OK;
2807 struct cred_list *prev, *next;
2812 static struct cred_list *wcache_cred_list;
2814 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2817 struct cred_list *cred;
2819 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2821 cred = SMB_MALLOC_P(struct cred_list);
2823 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2829 /* save a copy of the key */
2831 fstrcpy(cred->name, (const char *)kbuf.dptr);
2832 DLIST_ADD(wcache_cred_list, cred);
2838 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2840 struct winbind_cache *cache = get_cache(domain);
2843 struct cred_list *cred, *oldest = NULL;
2846 return NT_STATUS_INTERNAL_DB_ERROR;
2849 /* we possibly already have an entry */
2850 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2852 fstring key_str, tmp;
2854 DEBUG(11,("we already have an entry, deleting that\n"));
2856 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2858 tdb_delete(cache->tdb, string_tdb_data(key_str));
2860 return NT_STATUS_OK;
2863 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2865 return NT_STATUS_OK;
2866 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
2867 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2870 ZERO_STRUCTP(oldest);
2872 for (cred = wcache_cred_list; cred; cred = cred->next) {
2877 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
2879 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
2881 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2885 t = IVAL(data.dptr, 0);
2886 SAFE_FREE(data.dptr);
2889 oldest = SMB_MALLOC_P(struct cred_list);
2890 if (oldest == NULL) {
2891 status = NT_STATUS_NO_MEMORY;
2895 fstrcpy(oldest->name, cred->name);
2896 oldest->created = t;
2900 if (t < oldest->created) {
2901 fstrcpy(oldest->name, cred->name);
2902 oldest->created = t;
2906 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
2907 status = NT_STATUS_OK;
2909 status = NT_STATUS_UNSUCCESSFUL;
2912 SAFE_FREE(wcache_cred_list);
2918 /* Change the global online/offline state. */
2919 bool set_global_winbindd_state_offline(void)
2923 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
2925 /* Only go offline if someone has created
2926 the key "WINBINDD_OFFLINE" in the cache tdb. */
2928 if (wcache == NULL || wcache->tdb == NULL) {
2929 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
2933 if (!lp_winbind_offline_logon()) {
2934 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
2938 if (global_winbindd_offline_state) {
2939 /* Already offline. */
2943 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
2945 if (!data.dptr || data.dsize != 4) {
2946 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
2947 SAFE_FREE(data.dptr);
2950 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
2951 global_winbindd_offline_state = true;
2952 SAFE_FREE(data.dptr);
2957 void set_global_winbindd_state_online(void)
2959 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
2961 if (!lp_winbind_offline_logon()) {
2962 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
2966 if (!global_winbindd_offline_state) {
2967 /* Already online. */
2970 global_winbindd_offline_state = false;
2976 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
2977 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
2980 bool get_global_winbindd_state_offline(void)
2982 return global_winbindd_offline_state;
2985 /***********************************************************************
2986 Validate functions for all possible cache tdb keys.
2987 ***********************************************************************/
2989 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
2990 struct tdb_validation_status *state)
2992 struct cache_entry *centry;
2994 centry = SMB_XMALLOC_P(struct cache_entry);
2995 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
2996 if (!centry->data) {
3000 centry->len = data.dsize;
3003 if (centry->len < 8) {
3004 /* huh? corrupt cache? */
3005 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3006 centry_free(centry);
3007 state->bad_entry = true;
3008 state->success = false;
3012 centry->status = NT_STATUS(centry_uint32(centry));
3013 centry->sequence_number = centry_uint32(centry);
3017 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3018 struct tdb_validation_status *state)
3020 if (dbuf.dsize != 8) {
3021 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3022 keystr, (unsigned int)dbuf.dsize ));
3023 state->bad_entry = true;
3029 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3030 struct tdb_validation_status *state)
3032 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3037 (void)centry_uint32(centry);
3038 if (NT_STATUS_IS_OK(centry->status)) {
3040 (void)centry_sid(centry, &sid);
3043 centry_free(centry);
3045 if (!(state->success)) {
3048 DEBUG(10,("validate_ns: %s ok\n", keystr));
3052 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3053 struct tdb_validation_status *state)
3055 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3060 if (NT_STATUS_IS_OK(centry->status)) {
3061 (void)centry_uint32(centry);
3062 (void)centry_string(centry, mem_ctx);
3063 (void)centry_string(centry, mem_ctx);
3066 centry_free(centry);
3068 if (!(state->success)) {
3071 DEBUG(10,("validate_sn: %s ok\n", keystr));
3075 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3076 struct tdb_validation_status *state)
3078 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3085 (void)centry_string(centry, mem_ctx);
3086 (void)centry_string(centry, mem_ctx);
3087 (void)centry_string(centry, mem_ctx);
3088 (void)centry_string(centry, mem_ctx);
3089 (void)centry_uint32(centry);
3090 (void)centry_sid(centry, &sid);
3091 (void)centry_sid(centry, &sid);
3093 centry_free(centry);
3095 if (!(state->success)) {
3098 DEBUG(10,("validate_u: %s ok\n", keystr));
3102 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3103 struct tdb_validation_status *state)
3105 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3111 (void)centry_nttime(centry);
3112 (void)centry_nttime(centry);
3113 (void)centry_uint16(centry);
3115 centry_free(centry);
3117 if (!(state->success)) {
3120 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3124 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3125 struct tdb_validation_status *state)
3127 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3133 (void)centry_uint16(centry);
3134 (void)centry_uint16(centry);
3135 (void)centry_uint32(centry);
3136 (void)centry_nttime(centry);
3137 (void)centry_nttime(centry);
3139 centry_free(centry);
3141 if (!(state->success)) {
3144 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3148 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3149 struct tdb_validation_status *state)
3151 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3157 (void)centry_time(centry);
3158 (void)centry_hash16(centry, mem_ctx);
3160 /* We only have 17 bytes more data in the salted cred case. */
3161 if (centry->len - centry->ofs == 17) {
3162 (void)centry_hash16(centry, mem_ctx);
3165 centry_free(centry);
3167 if (!(state->success)) {
3170 DEBUG(10,("validate_cred: %s ok\n", keystr));
3174 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3175 struct tdb_validation_status *state)
3177 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3178 int32 num_entries, i;
3184 num_entries = (int32)centry_uint32(centry);
3186 for (i=0; i< num_entries; i++) {
3188 (void)centry_string(centry, mem_ctx);
3189 (void)centry_string(centry, mem_ctx);
3190 (void)centry_string(centry, mem_ctx);
3191 (void)centry_string(centry, mem_ctx);
3192 (void)centry_sid(centry, &sid);
3193 (void)centry_sid(centry, &sid);
3196 centry_free(centry);
3198 if (!(state->success)) {
3201 DEBUG(10,("validate_ul: %s ok\n", keystr));
3205 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3206 struct tdb_validation_status *state)
3208 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3209 int32 num_entries, i;
3215 num_entries = centry_uint32(centry);
3217 for (i=0; i< num_entries; i++) {
3218 (void)centry_string(centry, mem_ctx);
3219 (void)centry_string(centry, mem_ctx);
3220 (void)centry_uint32(centry);
3223 centry_free(centry);
3225 if (!(state->success)) {
3228 DEBUG(10,("validate_gl: %s ok\n", keystr));
3232 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3233 struct tdb_validation_status *state)
3235 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3236 int32 num_groups, i;
3242 num_groups = centry_uint32(centry);
3244 for (i=0; i< num_groups; i++) {
3246 centry_sid(centry, &sid);
3249 centry_free(centry);
3251 if (!(state->success)) {
3254 DEBUG(10,("validate_ug: %s ok\n", keystr));
3258 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3259 struct tdb_validation_status *state)
3261 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3262 int32 num_aliases, i;
3268 num_aliases = centry_uint32(centry);
3270 for (i=0; i < num_aliases; i++) {
3271 (void)centry_uint32(centry);
3274 centry_free(centry);
3276 if (!(state->success)) {
3279 DEBUG(10,("validate_ua: %s ok\n", keystr));
3283 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3284 struct tdb_validation_status *state)
3286 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3293 num_names = centry_uint32(centry);
3295 for (i=0; i< num_names; i++) {
3297 centry_sid(centry, &sid);
3298 (void)centry_string(centry, mem_ctx);
3299 (void)centry_uint32(centry);
3302 centry_free(centry);
3304 if (!(state->success)) {
3307 DEBUG(10,("validate_gm: %s ok\n", keystr));
3311 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3312 struct tdb_validation_status *state)
3314 /* Can't say anything about this other than must be nonzero. */
3315 if (dbuf.dsize == 0) {
3316 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3318 state->bad_entry = true;
3319 state->success = false;
3323 DEBUG(10,("validate_dr: %s ok\n", keystr));
3327 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3328 struct tdb_validation_status *state)
3330 /* Can't say anything about this other than must be nonzero. */
3331 if (dbuf.dsize == 0) {
3332 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3334 state->bad_entry = true;
3335 state->success = false;
3339 DEBUG(10,("validate_de: %s ok\n", keystr));
3343 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3344 TDB_DATA dbuf, struct tdb_validation_status *state)
3346 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3352 (void)centry_string(centry, mem_ctx);
3353 (void)centry_string(centry, mem_ctx);
3354 (void)centry_string(centry, mem_ctx);
3355 (void)centry_uint32(centry);
3357 centry_free(centry);
3359 if (!(state->success)) {
3362 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3366 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3368 struct tdb_validation_status *state)
3370 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3376 (void)centry_string( centry, mem_ctx );
3378 centry_free(centry);
3380 if (!(state->success)) {
3383 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3387 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3389 struct tdb_validation_status *state)
3391 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3397 (void)centry_string( centry, mem_ctx );
3399 centry_free(centry);
3401 if (!(state->success)) {
3404 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3408 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3409 struct tdb_validation_status *state)
3411 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3412 int32 num_domains, i;
3418 num_domains = centry_uint32(centry);
3420 for (i=0; i< num_domains; i++) {
3422 (void)centry_string(centry, mem_ctx);
3423 (void)centry_string(centry, mem_ctx);
3424 (void)centry_sid(centry, &sid);
3427 centry_free(centry);
3429 if (!(state->success)) {
3432 DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3436 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3438 struct tdb_validation_status *state)
3440 if (dbuf.dsize == 0) {
3441 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3442 "key %s (len ==0) ?\n", keystr));
3443 state->bad_entry = true;
3444 state->success = false;
3448 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3449 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3453 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3454 struct tdb_validation_status *state)
3456 if (dbuf.dsize != 4) {
3457 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3458 keystr, (unsigned int)dbuf.dsize ));
3459 state->bad_entry = true;
3460 state->success = false;
3463 DEBUG(10,("validate_offline: %s ok\n", keystr));
3467 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3468 struct tdb_validation_status *state)
3470 if (dbuf.dsize != 4) {
3471 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3472 "key %s (len %u != 4) ?\n",
3473 keystr, (unsigned int)dbuf.dsize));
3474 state->bad_entry = true;
3475 state->success = false;
3479 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3483 /***********************************************************************
3484 A list of all possible cache tdb keys with associated validation
3486 ***********************************************************************/
3488 struct key_val_struct {
3489 const char *keyname;
3490 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3492 {"SEQNUM/", validate_seqnum},
3493 {"NS/", validate_ns},
3494 {"SN/", validate_sn},
3496 {"LOC_POL/", validate_loc_pol},
3497 {"PWD_POL/", validate_pwd_pol},
3498 {"CRED/", validate_cred},
3499 {"UL/", validate_ul},
3500 {"GL/", validate_gl},
3501 {"UG/", validate_ug},
3502 {"UA", validate_ua},
3503 {"GM/", validate_gm},
3504 {"DR/", validate_dr},
3505 {"DE/", validate_de},
3506 {"NSS/PWINFO/", validate_pwinfo},
3507 {"TRUSTDOMS/", validate_trustdoms},
3508 {"TRUSTDOMCACHE/", validate_trustdomcache},
3509 {"NSS/NA/", validate_nss_na},
3510 {"NSS/AN/", validate_nss_an},
3511 {"WINBINDD_OFFLINE", validate_offline},
3512 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3516 /***********************************************************************
3517 Function to look at every entry in the tdb and validate it as far as
3519 ***********************************************************************/
3521 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3524 unsigned int max_key_len = 1024;
3525 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3527 /* Paranoia check. */
3528 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3529 max_key_len = 1024 * 1024;
3531 if (kbuf.dsize > max_key_len) {
3532 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3534 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3538 for (i = 0; key_val[i].keyname; i++) {
3539 size_t namelen = strlen(key_val[i].keyname);
3540 if (kbuf.dsize >= namelen && (
3541 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3542 TALLOC_CTX *mem_ctx;
3546 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3550 memcpy(keystr, kbuf.dptr, kbuf.dsize);
3551 keystr[kbuf.dsize] = '\0';
3553 mem_ctx = talloc_init("validate_ctx");
3559 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3563 talloc_destroy(mem_ctx);
3568 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3569 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3570 DEBUG(0,("data :\n"));
3571 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3572 v_state->unknown_key = true;
3573 v_state->success = false;
3574 return 1; /* terminate. */
3577 static void validate_panic(const char *const why)
3579 DEBUG(0,("validating cache: would panic %s\n", why ));
3580 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3584 /***********************************************************************
3585 Try and validate every entry in the winbindd cache. If we fail here,
3586 delete the cache tdb and return non-zero.
3587 ***********************************************************************/
3589 int winbindd_validate_cache(void)
3592 const char *tdb_path = cache_path("winbindd_cache.tdb");
3593 TDB_CONTEXT *tdb = NULL;
3595 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3596 smb_panic_fn = validate_panic;
3599 tdb = tdb_open_log(tdb_path,
3600 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3601 ( lp_winbind_offline_logon()
3603 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3607 DEBUG(0, ("winbindd_validate_cache: "
3608 "error opening/initializing tdb\n"));
3613 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3616 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3617 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3622 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3623 smb_panic_fn = smb_panic;
3627 /***********************************************************************
3628 Try and validate every entry in the winbindd cache.
3629 ***********************************************************************/
3631 int winbindd_validate_cache_nobackup(void)
3634 const char *tdb_path = cache_path("winbindd_cache.tdb");
3636 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3637 smb_panic_fn = validate_panic;
3640 if (wcache == NULL || wcache->tdb == NULL) {
3641 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3643 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3647 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3651 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3653 smb_panic_fn = smb_panic;
3657 bool winbindd_cache_validate_and_initialize(void)
3659 close_winbindd_cache();
3661 if (lp_winbind_offline_logon()) {
3662 if (winbindd_validate_cache() < 0) {
3663 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3664 "could be restored.\n"));
3668 return initialize_winbindd_cache();
3671 /*********************************************************************
3672 ********************************************************************/
3674 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3675 struct winbindd_tdc_domain **domains,
3676 size_t *num_domains )
3678 struct winbindd_tdc_domain *list = NULL;
3681 bool set_only = false;
3683 /* don't allow duplicates */
3688 for ( i=0; i< (*num_domains); i++ ) {
3689 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3690 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3701 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3704 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3705 struct winbindd_tdc_domain,
3710 ZERO_STRUCT( list[idx] );
3716 list[idx].domain_name = talloc_strdup( list, new_dom->name );
3717 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3719 if ( !is_null_sid( &new_dom->sid ) ) {
3720 sid_copy( &list[idx].sid, &new_dom->sid );
3722 sid_copy(&list[idx].sid, &global_sid_NULL);
3725 if ( new_dom->domain_flags != 0x0 )
3726 list[idx].trust_flags = new_dom->domain_flags;
3728 if ( new_dom->domain_type != 0x0 )
3729 list[idx].trust_type = new_dom->domain_type;
3731 if ( new_dom->domain_trust_attribs != 0x0 )
3732 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3736 *num_domains = idx + 1;
3742 /*********************************************************************
3743 ********************************************************************/
3745 static TDB_DATA make_tdc_key( const char *domain_name )
3747 char *keystr = NULL;
3748 TDB_DATA key = { NULL, 0 };
3750 if ( !domain_name ) {
3751 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3755 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3758 key = string_term_tdb_data(keystr);
3763 /*********************************************************************
3764 ********************************************************************/
3766 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3768 unsigned char **buf )
3770 unsigned char *buffer = NULL;
3775 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3783 /* Store the number of array items first */
3784 len += tdb_pack( buffer+len, buflen-len, "d",
3787 /* now pack each domain trust record */
3788 for ( i=0; i<num_domains; i++ ) {
3793 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3794 domains[i].domain_name,
3795 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3798 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3799 domains[i].domain_name,
3800 domains[i].dns_name,
3801 sid_to_fstring(tmp, &domains[i].sid),
3802 domains[i].trust_flags,
3803 domains[i].trust_attribs,
3804 domains[i].trust_type );
3807 if ( buflen < len ) {
3809 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3810 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3824 /*********************************************************************
3825 ********************************************************************/
3827 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3828 struct winbindd_tdc_domain **domains )
3830 fstring domain_name, dns_name, sid_string;
3831 uint32 type, attribs, flags;
3835 struct winbindd_tdc_domain *list = NULL;
3837 /* get the number of domains */
3838 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3840 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3844 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3846 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3850 for ( i=0; i<num_domains; i++ ) {
3851 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3860 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3861 TALLOC_FREE( list );
3865 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
3866 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
3867 domain_name, dns_name, sid_string,
3868 flags, attribs, type));
3870 list[i].domain_name = talloc_strdup( list, domain_name );
3871 list[i].dns_name = talloc_strdup( list, dns_name );
3872 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
3873 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
3876 list[i].trust_flags = flags;
3877 list[i].trust_attribs = attribs;
3878 list[i].trust_type = type;
3886 /*********************************************************************
3887 ********************************************************************/
3889 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
3891 TDB_DATA key = make_tdc_key( lp_workgroup() );
3892 TDB_DATA data = { NULL, 0 };
3898 /* See if we were asked to delete the cache entry */
3901 ret = tdb_delete( wcache->tdb, key );
3905 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
3912 ret = tdb_store( wcache->tdb, key, data, 0 );
3915 SAFE_FREE( data.dptr );
3916 SAFE_FREE( key.dptr );
3918 return ( ret != -1 );
3921 /*********************************************************************
3922 ********************************************************************/
3924 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
3926 TDB_DATA key = make_tdc_key( lp_workgroup() );
3927 TDB_DATA data = { NULL, 0 };
3935 data = tdb_fetch( wcache->tdb, key );
3937 SAFE_FREE( key.dptr );
3942 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
3944 SAFE_FREE( data.dptr );
3952 /*********************************************************************
3953 ********************************************************************/
3955 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
3957 struct winbindd_tdc_domain *dom_list = NULL;
3958 size_t num_domains = 0;
3961 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
3962 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
3963 domain->name, domain->alt_name,
3964 sid_string_dbg(&domain->sid),
3965 domain->domain_flags,
3966 domain->domain_trust_attribs,
3967 domain->domain_type));
3969 if ( !init_wcache() ) {
3973 /* fetch the list */
3975 wcache_tdc_fetch_list( &dom_list, &num_domains );
3977 /* add the new domain */
3979 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
3983 /* pack the domain */
3985 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
3993 TALLOC_FREE( dom_list );
3998 /*********************************************************************
3999 ********************************************************************/
4001 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4003 struct winbindd_tdc_domain *dom_list = NULL;
4004 size_t num_domains = 0;
4006 struct winbindd_tdc_domain *d = NULL;
4008 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4010 if ( !init_wcache() ) {
4014 /* fetch the list */
4016 wcache_tdc_fetch_list( &dom_list, &num_domains );
4018 for ( i=0; i<num_domains; i++ ) {
4019 if ( strequal(name, dom_list[i].domain_name) ||
4020 strequal(name, dom_list[i].dns_name) )
4022 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4025 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4029 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4030 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4031 sid_copy( &d->sid, &dom_list[i].sid );
4032 d->trust_flags = dom_list[i].trust_flags;
4033 d->trust_type = dom_list[i].trust_type;
4034 d->trust_attribs = dom_list[i].trust_attribs;
4040 TALLOC_FREE( dom_list );
4046 /*********************************************************************
4047 ********************************************************************/
4049 void wcache_tdc_clear( void )
4051 if ( !init_wcache() )
4054 wcache_tdc_store_list( NULL, 0 );
4060 /*********************************************************************
4061 ********************************************************************/
4063 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4065 const DOM_SID *user_sid,
4066 const char *homedir,
4071 struct cache_entry *centry;
4074 if ( (centry = centry_start(domain, status)) == NULL )
4077 centry_put_string( centry, homedir );
4078 centry_put_string( centry, shell );
4079 centry_put_string( centry, gecos );
4080 centry_put_uint32( centry, gid );
4082 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4084 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4086 centry_free(centry);
4089 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4090 const DOM_SID *user_sid,
4092 ADS_STRUCT *ads, LDAPMessage *msg,
4093 char **homedir, char **shell, char **gecos,
4096 struct winbind_cache *cache = get_cache(domain);
4097 struct cache_entry *centry = NULL;
4104 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4105 sid_to_fstring(tmp, user_sid));
4110 *homedir = centry_string( centry, ctx );
4111 *shell = centry_string( centry, ctx );
4112 *gecos = centry_string( centry, ctx );
4113 *p_gid = centry_uint32( centry );
4115 centry_free(centry);
4117 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4118 sid_string_dbg(user_sid)));
4120 return NT_STATUS_OK;
4124 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4125 homedir, shell, gecos, p_gid );
4127 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4129 if ( NT_STATUS_IS_OK(nt_status) ) {
4130 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4131 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4132 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4133 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4135 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4136 *homedir, *shell, *gecos, *p_gid );
4139 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4140 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4142 set_domain_offline( domain );
4149 /* the cache backend methods are exposed via this structure */
4150 struct winbindd_methods cache_methods = {