source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "tdb_validate.h"
  29 #include "../libcli/auth/libcli_auth.h"
  30 #include "../librpc/gen_ndr/ndr_wbint.h"
  31
  32 #undef DBGC_CLASS
  33 #define DBGC_CLASS DBGC_WINBIND
  34
  35 #define WINBINDD_CACHE_VERSION 1
  36 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  37
  38 extern struct winbindd_methods reconnect_methods;
  39 #ifdef HAVE_ADS
  40 extern struct winbindd_methods ads_methods;
  41 #endif
  42 extern struct winbindd_methods builtin_passdb_methods;
  43
  44 /*
  45  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  46  * Here are the list of entry types that are *not* stored
  47  * as form struct cache_entry in the cache.
  48  */
  49
  50 static const char *non_centry_keys[] = {
  51         "SEQNUM/",
  52         "DR/",
  53         "DE/",
  54         "WINBINDD_OFFLINE",
  55         WINBINDD_CACHE_VERSION_KEYSTR,
  56         NULL
  57 };
  58
  59 /************************************************************************
  60  Is this key a non-centry type ?
  61 ************************************************************************/
  62
  63 static bool is_non_centry_key(TDB_DATA kbuf)
  64 {
  65         int i;
  66
  67         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  68                 return false;
  69         }
  70         for (i = 0; non_centry_keys[i] != NULL; i++) {
  71                 size_t namelen = strlen(non_centry_keys[i]);
  72                 if (kbuf.dsize < namelen) {
  73                         continue;
  74                 }
  75                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  76                         return true;
  77                 }
  78         }
  79         return false;
  80 }
  81
  82 /* Global online/offline state - False when online. winbindd starts up online
  83    and sets this to true if the first query fails and there's an entry in
  84    the cache tdb telling us to stay offline. */
  85
  86 static bool global_winbindd_offline_state;
  87
  88 struct winbind_cache {
  89         TDB_CONTEXT *tdb;
  90 };
  91
  92 struct cache_entry {
  93         NTSTATUS status;
  94         uint32 sequence_number;
  95         uint8 *data;
  96         uint32 len, ofs;
  97 };
  98
  99 void (*smb_panic_fn)(const char *const why) = smb_panic;
 100
 101 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
 102
 103 static struct winbind_cache *wcache;
 104
 105 void winbindd_check_cache_size(time_t t)
 106 {
 107         static time_t last_check_time;
 108         struct stat st;
 109
 110         if (last_check_time == (time_t)0)
 111                 last_check_time = t;
 112
 113         if (t - last_check_time < 60 && t - last_check_time > 0)
 114                 return;
 115
 116         if (wcache == NULL || wcache->tdb == NULL) {
 117                 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
 118                 return;
 119         }
 120
 121         if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
 122                 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
 123                 return;
 124         }
 125
 126         if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
 127                 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
 128                         (unsigned long)st.st_size,
 129                         (unsigned long)WINBINDD_MAX_CACHE_SIZE));
 130                 wcache_flush_cache();
 131         }
 132 }
 133
 134 /* get the winbind_cache structure */
 135 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 136 {
 137         struct winbind_cache *ret = wcache;
 138
 139         /* We have to know what type of domain we are dealing with first. */
 140
 141         if (domain->internal) {
 142                 domain->backend = &builtin_passdb_methods;
 143                 domain->initialized = True;
 144         }
 145         if ( !domain->initialized ) {
 146                 init_dc_connection( domain );
 147         }
 148
 149         /*
 150            OK.  listen up becasue I'm only going to say this once.
 151            We have the following scenarios to consider
 152            (a) trusted AD domains on a Samba DC,
 153            (b) trusted AD domains and we are joined to a non-kerberos domain
 154            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 155
 156            For (a) we can always contact the trusted domain using krb5
 157            since we have the domain trust account password
 158
 159            For (b) we can only use RPC since we have no way of
 160            getting a krb5 ticket in our own domain
 161
 162            For (c) we can always use krb5 since we have a kerberos trust
 163
 164            --jerry
 165          */
 166
 167         if (!domain->backend) {
 168 #ifdef HAVE_ADS
 169                 struct winbindd_domain *our_domain = domain;
 170
 171                 /* find our domain first so we can figure out if we
 172                    are joined to a kerberized domain */
 173
 174                 if ( !domain->primary )
 175                         our_domain = find_our_domain();
 176
 177                 if ((our_domain->active_directory || IS_DC)
 178                     && domain->active_directory
 179                     && !lp_winbind_rpc_only()) {
 180                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 181                         domain->backend = &ads_methods;
 182                 } else {
 183 #endif  /* HAVE_ADS */
 184                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 185                         domain->backend = &reconnect_methods;
 186 #ifdef HAVE_ADS
 187                 }
 188 #endif  /* HAVE_ADS */
 189         }
 190
 191         if (ret)
 192                 return ret;
 193
 194         ret = SMB_XMALLOC_P(struct winbind_cache);
 195         ZERO_STRUCTP(ret);
 196
 197         wcache = ret;
 198         wcache_flush_cache();
 199
 200         return ret;
 201 }
 202
 203 /*
 204   free a centry structure
 205 */
 206 static void centry_free(struct cache_entry *centry)
 207 {
 208         if (!centry)
 209                 return;
 210         SAFE_FREE(centry->data);
 211         free(centry);
 212 }
 213
 214 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 215 {
 216         if (centry->len - centry->ofs < nbytes) {
 217                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 218                          (unsigned int)nbytes,
 219                          centry->len - centry->ofs));
 220                 return false;
 221         }
 222         return true;
 223 }
 224
 225 /*
 226   pull a uint32 from a cache entry
 227 */
 228 static uint32 centry_uint32(struct cache_entry *centry)
 229 {
 230         uint32 ret;
 231
 232         if (!centry_check_bytes(centry, 4)) {
 233                 smb_panic_fn("centry_uint32");
 234         }
 235         ret = IVAL(centry->data, centry->ofs);
 236         centry->ofs += 4;
 237         return ret;
 238 }
 239
 240 /*
 241   pull a uint16 from a cache entry
 242 */
 243 static uint16 centry_uint16(struct cache_entry *centry)
 244 {
 245         uint16 ret;
 246         if (!centry_check_bytes(centry, 2)) {
 247                 smb_panic_fn("centry_uint16");
 248         }
 249         ret = CVAL(centry->data, centry->ofs);
 250         centry->ofs += 2;
 251         return ret;
 252 }
 253
 254 /*
 255   pull a uint8 from a cache entry
 256 */
 257 static uint8 centry_uint8(struct cache_entry *centry)
 258 {
 259         uint8 ret;
 260         if (!centry_check_bytes(centry, 1)) {
 261                 smb_panic_fn("centry_uint8");
 262         }
 263         ret = CVAL(centry->data, centry->ofs);
 264         centry->ofs += 1;
 265         return ret;
 266 }
 267
 268 /*
 269   pull a NTTIME from a cache entry
 270 */
 271 static NTTIME centry_nttime(struct cache_entry *centry)
 272 {
 273         NTTIME ret;
 274         if (!centry_check_bytes(centry, 8)) {
 275                 smb_panic_fn("centry_nttime");
 276         }
 277         ret = IVAL(centry->data, centry->ofs);
 278         centry->ofs += 4;
 279         ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
 280         centry->ofs += 4;
 281         return ret;
 282 }
 283
 284 /*
 285   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 286 */
 287 static time_t centry_time(struct cache_entry *centry)
 288 {
 289         return (time_t)centry_nttime(centry);
 290 }
 291
 292 /* pull a string from a cache entry, using the supplied
 293    talloc context
 294 */
 295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 296 {
 297         uint32 len;
 298         char *ret;
 299
 300         len = centry_uint8(centry);
 301
 302         if (len == 0xFF) {
 303                 /* a deliberate NULL string */
 304                 return NULL;
 305         }
 306
 307         if (!centry_check_bytes(centry, (size_t)len)) {
 308                 smb_panic_fn("centry_string");
 309         }
 310
 311         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 312         if (!ret) {
 313                 smb_panic_fn("centry_string out of memory\n");
 314         }
 315         memcpy(ret,centry->data + centry->ofs, len);
 316         ret[len] = 0;
 317         centry->ofs += len;
 318         return ret;
 319 }
 320
 321 /* pull a hash16 from a cache entry, using the supplied
 322    talloc context
 323 */
 324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 325 {
 326         uint32 len;
 327         char *ret;
 328
 329         len = centry_uint8(centry);
 330
 331         if (len != 16) {
 332                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 333                         len ));
 334                 return NULL;
 335         }
 336
 337         if (!centry_check_bytes(centry, 16)) {
 338                 return NULL;
 339         }
 340
 341         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 342         if (!ret) {
 343                 smb_panic_fn("centry_hash out of memory\n");
 344         }
 345         memcpy(ret,centry->data + centry->ofs, 16);
 346         centry->ofs += 16;
 347         return ret;
 348 }
 349
 350 /* pull a sid from a cache entry, using the supplied
 351    talloc context
 352 */
 353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
 354 {
 355         char *sid_string;
 356         bool ret;
 357
 358         sid_string = centry_string(centry, talloc_tos());
 359         if (sid_string == NULL) {
 360                 return false;
 361         }
 362         ret = string_to_sid(sid, sid_string);
 363         TALLOC_FREE(sid_string);
 364         return ret;
 365 }
 366
 367
 368 /*
 369   pull a NTSTATUS from a cache entry
 370 */
 371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 372 {
 373         NTSTATUS status;
 374
 375         status = NT_STATUS(centry_uint32(centry));
 376         return status;
 377 }
 378
 379
 380 /* the server is considered down if it can't give us a sequence number */
 381 static bool wcache_server_down(struct winbindd_domain *domain)
 382 {
 383         bool ret;
 384
 385         if (!wcache->tdb)
 386                 return false;
 387
 388         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 389
 390         if (ret)
 391                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 392                         domain->name ));
 393         return ret;
 394 }
 395
 396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
 397                                 uint32_t *last_seq_check)
 398 {
 399         char *key;
 400         TDB_DATA data;
 401
 402         if (wcache->tdb == NULL) {
 403                 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
 404                 return false;
 405         }
 406
 407         key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 408         if (key == NULL) {
 409                 DEBUG(10, ("talloc failed\n"));
 410                 return false;
 411         }
 412
 413         data = tdb_fetch_bystring(wcache->tdb, key);
 414         TALLOC_FREE(key);
 415
 416         if (data.dptr == NULL) {
 417                 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
 418                            domain_name));
 419                 return false;
 420         }
 421         if (data.dsize != 8) {
 422                 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
 423                            (int)data.dsize));
 424                 SAFE_FREE(data.dptr);
 425                 return false;
 426         }
 427
 428         *seqnum = IVAL(data.dptr, 0);
 429         *last_seq_check = IVAL(data.dptr, 4);
 430         SAFE_FREE(data.dptr);
 431
 432         return true;
 433 }
 434
 435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 436 {
 437         uint32 last_check, time_diff;
 438
 439         if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
 440                                  &last_check)) {
 441                 return NT_STATUS_UNSUCCESSFUL;
 442         }
 443         domain->last_seq_check = last_check;
 444
 445         /* have we expired? */
 446
 447         time_diff = now - domain->last_seq_check;
 448         if ( time_diff > lp_winbind_cache_time() ) {
 449                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 450                         domain->name, domain->sequence_number,
 451                         (uint32)domain->last_seq_check));
 452                 return NT_STATUS_UNSUCCESSFUL;
 453         }
 454
 455         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 456                 domain->name, domain->sequence_number,
 457                 (uint32)domain->last_seq_check));
 458
 459         return NT_STATUS_OK;
 460 }
 461
 462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
 463                          time_t last_seq_check)
 464 {
 465         char *key_str;
 466         uint8_t buf[8];
 467         int ret;
 468
 469         if (wcache->tdb == NULL) {
 470                 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
 471                 return false;
 472         }
 473
 474         key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 475         if (key_str == NULL) {
 476                 DEBUG(10, ("talloc_asprintf failed\n"));
 477                 return false;
 478         }
 479
 480         SIVAL(buf, 0, seqnum);
 481         SIVAL(buf, 4, last_seq_check);
 482
 483         ret = tdb_store_bystring(wcache->tdb, key_str,
 484                                  make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
 485         TALLOC_FREE(key_str);
 486         if (ret == -1) {
 487                 DEBUG(10, ("tdb_store_bystring failed: %s\n",
 488                            tdb_errorstr(wcache->tdb)));
 489                 TALLOC_FREE(key_str);
 490                 return false;
 491         }
 492
 493         DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
 494                    domain_name, seqnum, (unsigned)last_seq_check));
 495
 496         return true;
 497 }
 498
 499 static bool store_cache_seqnum( struct winbindd_domain *domain )
 500 {
 501         return wcache_store_seqnum(domain->name, domain->sequence_number,
 502                                    domain->last_seq_check);
 503 }
 504
 505 /*
 506   refresh the domain sequence number. If force is true
 507   then always refresh it, no matter how recently we fetched it
 508 */
 509
 510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 511 {
 512         NTSTATUS status;
 513         unsigned time_diff;
 514         time_t t = time(NULL);
 515         unsigned cache_time = lp_winbind_cache_time();
 516
 517         if (is_domain_offline(domain)) {
 518                 return;
 519         }
 520
 521         get_cache( domain );
 522
 523 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 524         /* trying to reconnect is expensive, don't do it too often */
 525         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 526                 cache_time *= 8;
 527         }
 528 #endif
 529
 530         time_diff = t - domain->last_seq_check;
 531
 532         /* see if we have to refetch the domain sequence number */
 533         if (!force && (time_diff < cache_time) &&
 534                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 535                         NT_STATUS_IS_OK(domain->last_status)) {
 536                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 537                 goto done;
 538         }
 539
 540         /* try to get the sequence number from the tdb cache first */
 541         /* this will update the timestamp as well */
 542
 543         status = fetch_cache_seqnum( domain, t );
 544         if (NT_STATUS_IS_OK(status) &&
 545                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 546                         NT_STATUS_IS_OK(domain->last_status)) {
 547                 goto done;
 548         }
 549
 550         /* important! make sure that we know if this is a native
 551            mode domain or not.  And that we can contact it. */
 552
 553         if ( winbindd_can_contact_domain( domain ) ) {
 554                 status = domain->backend->sequence_number(domain,
 555                                                           &domain->sequence_number);
 556         } else {
 557                 /* just use the current time */
 558                 status = NT_STATUS_OK;
 559                 domain->sequence_number = time(NULL);
 560         }
 561
 562
 563         /* the above call could have set our domain->backend to NULL when
 564          * coming from offline to online mode, make sure to reinitialize the
 565          * backend - Guenther */
 566         get_cache( domain );
 567
 568         if (!NT_STATUS_IS_OK(status)) {
 569                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 570                 domain->sequence_number = DOM_SEQUENCE_NONE;
 571         }
 572
 573         domain->last_status = status;
 574         domain->last_seq_check = time(NULL);
 575
 576         /* save the new sequence number in the cache */
 577         store_cache_seqnum( domain );
 578
 579 done:
 580         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 581                    domain->name, domain->sequence_number));
 582
 583         return;
 584 }
 585
 586 /*
 587   decide if a cache entry has expired
 588 */
 589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 590 {
 591         /* If we've been told to be offline - stay in that state... */
 592         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 593                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 594                         keystr, domain->name ));
 595                 return false;
 596         }
 597
 598         /* when the domain is offline return the cached entry.
 599          * This deals with transient offline states... */
 600
 601         if (!domain->online) {
 602                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 603                         keystr, domain->name ));
 604                 return false;
 605         }
 606
 607         /* if the server is OK and our cache entry came from when it was down then
 608            the entry is invalid */
 609         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 610             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 611                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 612                         keystr, domain->name ));
 613                 return true;
 614         }
 615
 616         /* if the server is down or the cache entry is not older than the
 617            current sequence number then it is OK */
 618         if (wcache_server_down(domain) ||
 619             centry->sequence_number == domain->sequence_number) {
 620                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 621                         keystr, domain->name ));
 622                 return false;
 623         }
 624
 625         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 626                 keystr, domain->name ));
 627
 628         /* it's expired */
 629         return true;
 630 }
 631
 632 static struct cache_entry *wcache_fetch_raw(char *kstr)
 633 {
 634         TDB_DATA data;
 635         struct cache_entry *centry;
 636         TDB_DATA key;
 637
 638         key = string_tdb_data(kstr);
 639         data = tdb_fetch(wcache->tdb, key);
 640         if (!data.dptr) {
 641                 /* a cache miss */
 642                 return NULL;
 643         }
 644
 645         centry = SMB_XMALLOC_P(struct cache_entry);
 646         centry->data = (unsigned char *)data.dptr;
 647         centry->len = data.dsize;
 648         centry->ofs = 0;
 649
 650         if (centry->len < 8) {
 651                 /* huh? corrupt cache? */
 652                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
 653                 centry_free(centry);
 654                 return NULL;
 655         }
 656
 657         centry->status = centry_ntstatus(centry);
 658         centry->sequence_number = centry_uint32(centry);
 659
 660         return centry;
 661 }
 662
 663 /*
 664   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 665   number and return status
 666 */
 667 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 668                                         struct winbindd_domain *domain,
 669                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 670 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 671                                         struct winbindd_domain *domain,
 672                                         const char *format, ...)
 673 {
 674         va_list ap;
 675         char *kstr;
 676         struct cache_entry *centry;
 677
 678         if (!winbindd_use_cache()) {
 679                 return NULL;
 680         }
 681
 682         refresh_sequence_number(domain, false);
 683
 684         va_start(ap, format);
 685         smb_xvasprintf(&kstr, format, ap);
 686         va_end(ap);
 687
 688         centry = wcache_fetch_raw(kstr);
 689         if (centry == NULL) {
 690                 free(kstr);
 691                 return NULL;
 692         }
 693
 694         if (centry_expired(domain, kstr, centry)) {
 695
 696                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 697                          kstr, domain->name ));
 698
 699                 centry_free(centry);
 700                 free(kstr);
 701                 return NULL;
 702         }
 703
 704         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 705                  kstr, domain->name ));
 706
 707         free(kstr);
 708         return centry;
 709 }
 710
 711 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 712 static void wcache_delete(const char *format, ...)
 713 {
 714         va_list ap;
 715         char *kstr;
 716         TDB_DATA key;
 717
 718         va_start(ap, format);
 719         smb_xvasprintf(&kstr, format, ap);
 720         va_end(ap);
 721
 722         key = string_tdb_data(kstr);
 723
 724         tdb_delete(wcache->tdb, key);
 725         free(kstr);
 726 }
 727
 728 /*
 729   make sure we have at least len bytes available in a centry
 730 */
 731 static void centry_expand(struct cache_entry *centry, uint32 len)
 732 {
 733         if (centry->len - centry->ofs >= len)
 734                 return;
 735         centry->len *= 2;
 736         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 737                                          centry->len);
 738         if (!centry->data) {
 739                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 740                 smb_panic_fn("out of memory in centry_expand");
 741         }
 742 }
 743
 744 /*
 745   push a uint32 into a centry
 746 */
 747 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 748 {
 749         centry_expand(centry, 4);
 750         SIVAL(centry->data, centry->ofs, v);
 751         centry->ofs += 4;
 752 }
 753
 754 /*
 755   push a uint16 into a centry
 756 */
 757 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 758 {
 759         centry_expand(centry, 2);
 760         SIVAL(centry->data, centry->ofs, v);
 761         centry->ofs += 2;
 762 }
 763
 764 /*
 765   push a uint8 into a centry
 766 */
 767 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 768 {
 769         centry_expand(centry, 1);
 770         SCVAL(centry->data, centry->ofs, v);
 771         centry->ofs += 1;
 772 }
 773
 774 /*
 775    push a string into a centry
 776  */
 777 static void centry_put_string(struct cache_entry *centry, const char *s)
 778 {
 779         int len;
 780
 781         if (!s) {
 782                 /* null strings are marked as len 0xFFFF */
 783                 centry_put_uint8(centry, 0xFF);
 784                 return;
 785         }
 786
 787         len = strlen(s);
 788         /* can't handle more than 254 char strings. Truncating is probably best */
 789         if (len > 254) {
 790                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 791                 len = 254;
 792         }
 793         centry_put_uint8(centry, len);
 794         centry_expand(centry, len);
 795         memcpy(centry->data + centry->ofs, s, len);
 796         centry->ofs += len;
 797 }
 798
 799 /*
 800    push a 16 byte hash into a centry - treat as 16 byte string.
 801  */
 802 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 803 {
 804         centry_put_uint8(centry, 16);
 805         centry_expand(centry, 16);
 806         memcpy(centry->data + centry->ofs, val, 16);
 807         centry->ofs += 16;
 808 }
 809
 810 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
 811 {
 812         fstring sid_string;
 813         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 814 }
 815
 816
 817 /*
 818   put NTSTATUS into a centry
 819 */
 820 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 821 {
 822         uint32 status_value = NT_STATUS_V(status);
 823         centry_put_uint32(centry, status_value);
 824 }
 825
 826
 827 /*
 828   push a NTTIME into a centry
 829 */
 830 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 831 {
 832         centry_expand(centry, 8);
 833         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 834         centry->ofs += 4;
 835         SIVAL(centry->data, centry->ofs, nt >> 32);
 836         centry->ofs += 4;
 837 }
 838
 839 /*
 840   push a time_t into a centry - use a 64 bit size.
 841   NTTIME here is being used as a convenient 64-bit size.
 842 */
 843 static void centry_put_time(struct cache_entry *centry, time_t t)
 844 {
 845         NTTIME nt = (NTTIME)t;
 846         centry_put_nttime(centry, nt);
 847 }
 848
 849 /*
 850   start a centry for output. When finished, call centry_end()
 851 */
 852 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 853 {
 854         struct cache_entry *centry;
 855
 856         if (!wcache->tdb)
 857                 return NULL;
 858
 859         centry = SMB_XMALLOC_P(struct cache_entry);
 860
 861         centry->len = 8192; /* reasonable default */
 862         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 863         centry->ofs = 0;
 864         centry->sequence_number = domain->sequence_number;
 865         centry_put_ntstatus(centry, status);
 866         centry_put_uint32(centry, centry->sequence_number);
 867         return centry;
 868 }
 869
 870 /*
 871   finish a centry and write it to the tdb
 872 */
 873 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 874 static void centry_end(struct cache_entry *centry, const char *format, ...)
 875 {
 876         va_list ap;
 877         char *kstr;
 878         TDB_DATA key, data;
 879
 880         if (!winbindd_use_cache()) {
 881                 return;
 882         }
 883
 884         va_start(ap, format);
 885         smb_xvasprintf(&kstr, format, ap);
 886         va_end(ap);
 887
 888         key = string_tdb_data(kstr);
 889         data.dptr = centry->data;
 890         data.dsize = centry->ofs;
 891
 892         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 893         free(kstr);
 894 }
 895
 896 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 897                                     NTSTATUS status, const char *domain_name,
 898                                     const char *name, const DOM_SID *sid,
 899                                     enum lsa_SidType type)
 900 {
 901         struct cache_entry *centry;
 902         fstring uname;
 903
 904         centry = centry_start(domain, status);
 905         if (!centry)
 906                 return;
 907         centry_put_uint32(centry, type);
 908         centry_put_sid(centry, sid);
 909         fstrcpy(uname, name);
 910         strupper_m(uname);
 911         centry_end(centry, "NS/%s/%s", domain_name, uname);
 912         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 913                   uname, sid_string_dbg(sid), nt_errstr(status)));
 914         centry_free(centry);
 915 }
 916
 917 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 918                                     const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 919 {
 920         struct cache_entry *centry;
 921         fstring sid_string;
 922
 923         centry = centry_start(domain, status);
 924         if (!centry)
 925                 return;
 926
 927         if (NT_STATUS_IS_OK(status)) {
 928                 centry_put_uint32(centry, type);
 929                 centry_put_string(centry, domain_name);
 930                 centry_put_string(centry, name);
 931         }
 932
 933         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 934         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 935                   name, nt_errstr(status)));
 936         centry_free(centry);
 937 }
 938
 939
 940 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
 941                              struct wbint_userinfo *info)
 942 {
 943         struct cache_entry *centry;
 944         fstring sid_string;
 945
 946         if (is_null_sid(&info->user_sid)) {
 947                 return;
 948         }
 949
 950         centry = centry_start(domain, status);
 951         if (!centry)
 952                 return;
 953         centry_put_string(centry, info->acct_name);
 954         centry_put_string(centry, info->full_name);
 955         centry_put_string(centry, info->homedir);
 956         centry_put_string(centry, info->shell);
 957         centry_put_uint32(centry, info->primary_gid);
 958         centry_put_sid(centry, &info->user_sid);
 959         centry_put_sid(centry, &info->group_sid);
 960         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 961                                                   &info->user_sid));
 962         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 963         centry_free(centry);
 964 }
 965
 966 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
 967                                        NTSTATUS status,
 968                                        struct samr_DomInfo12 *lockout_policy)
 969 {
 970         struct cache_entry *centry;
 971
 972         centry = centry_start(domain, status);
 973         if (!centry)
 974                 return;
 975
 976         centry_put_nttime(centry, lockout_policy->lockout_duration);
 977         centry_put_nttime(centry, lockout_policy->lockout_window);
 978         centry_put_uint16(centry, lockout_policy->lockout_threshold);
 979
 980         centry_end(centry, "LOC_POL/%s", domain->name);
 981
 982         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
 983
 984         centry_free(centry);
 985 }
 986
 987
 988
 989 static void wcache_save_password_policy(struct winbindd_domain *domain,
 990                                         NTSTATUS status,
 991                                         struct samr_DomInfo1 *policy)
 992 {
 993         struct cache_entry *centry;
 994
 995         centry = centry_start(domain, status);
 996         if (!centry)
 997                 return;
 998
 999         centry_put_uint16(centry, policy->min_password_length);
1000         centry_put_uint16(centry, policy->password_history_length);
1001         centry_put_uint32(centry, policy->password_properties);
1002         centry_put_nttime(centry, policy->max_password_age);
1003         centry_put_nttime(centry, policy->min_password_age);
1004
1005         centry_end(centry, "PWD_POL/%s", domain->name);
1006
1007         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1008
1009         centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013  ***************************************************************************/
1014
1015 static void wcache_save_username_alias(struct winbindd_domain *domain,
1016                                        NTSTATUS status,
1017                                        const char *name, const char *alias)
1018 {
1019         struct cache_entry *centry;
1020         fstring uname;
1021
1022         if ( (centry = centry_start(domain, status)) == NULL )
1023                 return;
1024
1025         centry_put_string( centry, alias );
1026
1027         fstrcpy(uname, name);
1028         strupper_m(uname);
1029         centry_end(centry, "NSS/NA/%s", uname);
1030
1031         DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1032
1033         centry_free(centry);
1034 }
1035
1036 static void wcache_save_alias_username(struct winbindd_domain *domain,
1037                                        NTSTATUS status,
1038                                        const char *alias, const char *name)
1039 {
1040         struct cache_entry *centry;
1041         fstring uname;
1042
1043         if ( (centry = centry_start(domain, status)) == NULL )
1044                 return;
1045
1046         centry_put_string( centry, name );
1047
1048         fstrcpy(uname, alias);
1049         strupper_m(uname);
1050         centry_end(centry, "NSS/AN/%s", uname);
1051
1052         DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1053
1054         centry_free(centry);
1055 }
1056
1057 /***************************************************************************
1058  ***************************************************************************/
1059
1060 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1061                                     struct winbindd_domain *domain,
1062                                     const char *name, char **alias )
1063 {
1064         struct winbind_cache *cache = get_cache(domain);
1065         struct cache_entry *centry = NULL;
1066         NTSTATUS status;
1067         char *upper_name;
1068
1069         if ( domain->internal )
1070                 return NT_STATUS_NOT_SUPPORTED;
1071
1072         if (!cache->tdb)
1073                 goto do_query;
1074
1075         if ( (upper_name = SMB_STRDUP(name)) == NULL )
1076                 return NT_STATUS_NO_MEMORY;
1077         strupper_m(upper_name);
1078
1079         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1080
1081         SAFE_FREE( upper_name );
1082
1083         if (!centry)
1084                 goto do_query;
1085
1086         status = centry->status;
1087
1088         if (!NT_STATUS_IS_OK(status)) {
1089                 centry_free(centry);
1090                 return status;
1091         }
1092
1093         *alias = centry_string( centry, mem_ctx );
1094
1095         centry_free(centry);
1096
1097         DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1098                   name, *alias ? *alias : "(none)"));
1099
1100         return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1101
1102 do_query:
1103
1104         /* If its not in cache and we are offline, then fail */
1105
1106         if ( get_global_winbindd_state_offline() || !domain->online ) {
1107                 DEBUG(8,("resolve_username_to_alias: rejecting query "
1108                          "in offline mode\n"));
1109                 return NT_STATUS_NOT_FOUND;
1110         }
1111
1112         status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1113
1114         if ( NT_STATUS_IS_OK( status ) ) {
1115                 wcache_save_username_alias(domain, status, name, *alias);
1116         }
1117
1118         if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1119                 wcache_save_username_alias(domain, status, name, "(NULL)");
1120         }
1121
1122         DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1123                  nt_errstr(status)));
1124
1125         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1126                 set_domain_offline( domain );
1127         }
1128
1129         return status;
1130 }
1131
1132 /***************************************************************************
1133  ***************************************************************************/
1134
1135 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1136                                     struct winbindd_domain *domain,
1137                                     const char *alias, char **name )
1138 {
1139         struct winbind_cache *cache = get_cache(domain);
1140         struct cache_entry *centry = NULL;
1141         NTSTATUS status;
1142         char *upper_name;
1143
1144         if ( domain->internal )
1145                 return  NT_STATUS_NOT_SUPPORTED;
1146
1147         if (!cache->tdb)
1148                 goto do_query;
1149
1150         if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1151                 return NT_STATUS_NO_MEMORY;
1152         strupper_m(upper_name);
1153
1154         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1155
1156         SAFE_FREE( upper_name );
1157
1158         if (!centry)
1159                 goto do_query;
1160
1161         status = centry->status;
1162
1163         if (!NT_STATUS_IS_OK(status)) {
1164                 centry_free(centry);
1165                 return status;
1166         }
1167
1168         *name = centry_string( centry, mem_ctx );
1169
1170         centry_free(centry);
1171
1172         DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1173                   alias, *name ? *name : "(none)"));
1174
1175         return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1176
1177 do_query:
1178
1179         /* If its not in cache and we are offline, then fail */
1180
1181         if ( get_global_winbindd_state_offline() || !domain->online ) {
1182                 DEBUG(8,("resolve_alias_to_username: rejecting query "
1183                          "in offline mode\n"));
1184                 return NT_STATUS_NOT_FOUND;
1185         }
1186
1187         /* an alias cannot contain a domain prefix or '@' */
1188
1189         if (strchr(alias, '\\') || strchr(alias, '@')) {
1190                 DEBUG(10,("resolve_alias_to_username: skipping fully "
1191                           "qualified name %s\n", alias));
1192                 return NT_STATUS_OBJECT_NAME_INVALID;
1193         }
1194
1195         status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1196
1197         if ( NT_STATUS_IS_OK( status ) ) {
1198                 wcache_save_alias_username( domain, status, alias, *name );
1199         }
1200
1201         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1202                 wcache_save_alias_username(domain, status, alias, "(NULL)");
1203         }
1204
1205         DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1206                  nt_errstr(status)));
1207
1208         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1209                 set_domain_offline( domain );
1210         }
1211
1212         return status;
1213 }
1214
1215 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1216 {
1217         struct winbind_cache *cache = get_cache(domain);
1218         TDB_DATA data;
1219         fstring key_str, tmp;
1220         uint32 rid;
1221
1222         if (!cache->tdb) {
1223                 return NT_STATUS_INTERNAL_DB_ERROR;
1224         }
1225
1226         if (is_null_sid(sid)) {
1227                 return NT_STATUS_INVALID_SID;
1228         }
1229
1230         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1231                 return NT_STATUS_INVALID_SID;
1232         }
1233
1234         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1235
1236         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1237         if (!data.dptr) {
1238                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1239         }
1240
1241         SAFE_FREE(data.dptr);
1242         return NT_STATUS_OK;
1243 }
1244
1245 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1246    as new salted ones. */
1247
1248 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1249                           TALLOC_CTX *mem_ctx,
1250                           const DOM_SID *sid,
1251                           const uint8 **cached_nt_pass,
1252                           const uint8 **cached_salt)
1253 {
1254         struct winbind_cache *cache = get_cache(domain);
1255         struct cache_entry *centry = NULL;
1256         NTSTATUS status;
1257         time_t t;
1258         uint32 rid;
1259         fstring tmp;
1260
1261         if (!cache->tdb) {
1262                 return NT_STATUS_INTERNAL_DB_ERROR;
1263         }
1264
1265         if (is_null_sid(sid)) {
1266                 return NT_STATUS_INVALID_SID;
1267         }
1268
1269         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1270                 return NT_STATUS_INVALID_SID;
1271         }
1272
1273         /* Try and get a salted cred first. If we can't
1274            fall back to an unsalted cred. */
1275
1276         centry = wcache_fetch(cache, domain, "CRED/%s",
1277                               sid_to_fstring(tmp, sid));
1278         if (!centry) {
1279                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1280                           sid_string_dbg(sid)));
1281                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1282         }
1283
1284         t = centry_time(centry);
1285
1286         /* In the salted case this isn't actually the nt_hash itself,
1287            but the MD5 of the salt + nt_hash. Let the caller
1288            sort this out. It can tell as we only return the cached_salt
1289            if we are returning a salted cred. */
1290
1291         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1292         if (*cached_nt_pass == NULL) {
1293                 fstring sidstr;
1294
1295                 sid_to_fstring(sidstr, sid);
1296
1297                 /* Bad (old) cred cache. Delete and pretend we
1298                    don't have it. */
1299                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1300                                 sidstr));
1301                 wcache_delete("CRED/%s", sidstr);
1302                 centry_free(centry);
1303                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1304         }
1305
1306         /* We only have 17 bytes more data in the salted cred case. */
1307         if (centry->len - centry->ofs == 17) {
1308                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1309         } else {
1310                 *cached_salt = NULL;
1311         }
1312
1313         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1314         if (*cached_salt) {
1315                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1316         }
1317
1318         status = centry->status;
1319
1320         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1321                   sid_string_dbg(sid), nt_errstr(status) ));
1322
1323         centry_free(centry);
1324         return status;
1325 }
1326
1327 /* Store creds for a SID - only writes out new salted ones. */
1328
1329 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1330                            TALLOC_CTX *mem_ctx,
1331                            const DOM_SID *sid,
1332                            const uint8 nt_pass[NT_HASH_LEN])
1333 {
1334         struct cache_entry *centry;
1335         fstring sid_string;
1336         uint32 rid;
1337         uint8 cred_salt[NT_HASH_LEN];
1338         uint8 salted_hash[NT_HASH_LEN];
1339
1340         if (is_null_sid(sid)) {
1341                 return NT_STATUS_INVALID_SID;
1342         }
1343
1344         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1345                 return NT_STATUS_INVALID_SID;
1346         }
1347
1348         centry = centry_start(domain, NT_STATUS_OK);
1349         if (!centry) {
1350                 return NT_STATUS_INTERNAL_DB_ERROR;
1351         }
1352
1353         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1354
1355         centry_put_time(centry, time(NULL));
1356
1357         /* Create a salt and then salt the hash. */
1358         generate_random_buffer(cred_salt, NT_HASH_LEN);
1359         E_md5hash(cred_salt, nt_pass, salted_hash);
1360
1361         centry_put_hash16(centry, salted_hash);
1362         centry_put_hash16(centry, cred_salt);
1363         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1364
1365         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1366
1367         centry_free(centry);
1368
1369         return NT_STATUS_OK;
1370 }
1371
1372
1373 /* Query display info. This is the basic user list fn */
1374 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1375                                 TALLOC_CTX *mem_ctx,
1376                                 uint32 *num_entries,
1377                                 struct wbint_userinfo **info)
1378 {
1379         struct winbind_cache *cache = get_cache(domain);
1380         struct cache_entry *centry = NULL;
1381         NTSTATUS status;
1382         unsigned int i, retry;
1383
1384         if (!cache->tdb)
1385                 goto do_query;
1386
1387         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1388         if (!centry)
1389                 goto do_query;
1390
1391         *num_entries = centry_uint32(centry);
1392
1393         if (*num_entries == 0)
1394                 goto do_cached;
1395
1396         (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1397         if (! (*info)) {
1398                 smb_panic_fn("query_user_list out of memory");
1399         }
1400         for (i=0; i<(*num_entries); i++) {
1401                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1402                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1403                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1404                 (*info)[i].shell = centry_string(centry, mem_ctx);
1405                 centry_sid(centry, &(*info)[i].user_sid);
1406                 centry_sid(centry, &(*info)[i].group_sid);
1407         }
1408
1409 do_cached:
1410         status = centry->status;
1411
1412         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1413                 domain->name, nt_errstr(status) ));
1414
1415         centry_free(centry);
1416         return status;
1417
1418 do_query:
1419         *num_entries = 0;
1420         *info = NULL;
1421
1422         /* Return status value returned by seq number check */
1423
1424         if (!NT_STATUS_IS_OK(domain->last_status))
1425                 return domain->last_status;
1426
1427         /* Put the query_user_list() in a retry loop.  There appears to be
1428          * some bug either with Windows 2000 or Samba's handling of large
1429          * rpc replies.  This manifests itself as sudden disconnection
1430          * at a random point in the enumeration of a large (60k) user list.
1431          * The retry loop simply tries the operation again. )-:  It's not
1432          * pretty but an acceptable workaround until we work out what the
1433          * real problem is. */
1434
1435         retry = 0;
1436         do {
1437
1438                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1439                         domain->name ));
1440
1441                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1442                 if (!NT_STATUS_IS_OK(status)) {
1443                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1444                                   "retrying\n", NT_STATUS_V(status)));
1445                 }
1446                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1447                         DEBUG(3, ("query_user_list: flushing "
1448                                   "connection cache\n"));
1449                         invalidate_cm_connection(&domain->conn);
1450                 }
1451
1452         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1453                  (retry++ < 5));
1454
1455         /* and save it */
1456         refresh_sequence_number(domain, false);
1457         centry = centry_start(domain, status);
1458         if (!centry)
1459                 goto skip_save;
1460         centry_put_uint32(centry, *num_entries);
1461         for (i=0; i<(*num_entries); i++) {
1462                 centry_put_string(centry, (*info)[i].acct_name);
1463                 centry_put_string(centry, (*info)[i].full_name);
1464                 centry_put_string(centry, (*info)[i].homedir);
1465                 centry_put_string(centry, (*info)[i].shell);
1466                 centry_put_sid(centry, &(*info)[i].user_sid);
1467                 centry_put_sid(centry, &(*info)[i].group_sid);
1468                 if (domain->backend && domain->backend->consistent) {
1469                         /* when the backend is consistent we can pre-prime some mappings */
1470                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1471                                                 domain->name,
1472                                                 (*info)[i].acct_name,
1473                                                 &(*info)[i].user_sid,
1474                                                 SID_NAME_USER);
1475                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1476                                                 &(*info)[i].user_sid,
1477                                                 domain->name,
1478                                                 (*info)[i].acct_name,
1479                                                 SID_NAME_USER);
1480                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1481                 }
1482         }
1483         centry_end(centry, "UL/%s", domain->name);
1484         centry_free(centry);
1485
1486 skip_save:
1487         return status;
1488 }
1489
1490 /* list all domain groups */
1491 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1492                                 TALLOC_CTX *mem_ctx,
1493                                 uint32 *num_entries,
1494                                 struct acct_info **info)
1495 {
1496         struct winbind_cache *cache = get_cache(domain);
1497         struct cache_entry *centry = NULL;
1498         NTSTATUS status;
1499         unsigned int i;
1500
1501         if (!cache->tdb)
1502                 goto do_query;
1503
1504         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1505         if (!centry)
1506                 goto do_query;
1507
1508         *num_entries = centry_uint32(centry);
1509
1510         if (*num_entries == 0)
1511                 goto do_cached;
1512
1513         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1514         if (! (*info)) {
1515                 smb_panic_fn("enum_dom_groups out of memory");
1516         }
1517         for (i=0; i<(*num_entries); i++) {
1518                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1519                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1520                 (*info)[i].rid = centry_uint32(centry);
1521         }
1522
1523 do_cached:
1524         status = centry->status;
1525
1526         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1527                 domain->name, nt_errstr(status) ));
1528
1529         centry_free(centry);
1530         return status;
1531
1532 do_query:
1533         *num_entries = 0;
1534         *info = NULL;
1535
1536         /* Return status value returned by seq number check */
1537
1538         if (!NT_STATUS_IS_OK(domain->last_status))
1539                 return domain->last_status;
1540
1541         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1542                 domain->name ));
1543
1544         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1545
1546         /* and save it */
1547         refresh_sequence_number(domain, false);
1548         centry = centry_start(domain, status);
1549         if (!centry)
1550                 goto skip_save;
1551         centry_put_uint32(centry, *num_entries);
1552         for (i=0; i<(*num_entries); i++) {
1553                 centry_put_string(centry, (*info)[i].acct_name);
1554                 centry_put_string(centry, (*info)[i].acct_desc);
1555                 centry_put_uint32(centry, (*info)[i].rid);
1556         }
1557         centry_end(centry, "GL/%s/domain", domain->name);
1558         centry_free(centry);
1559
1560 skip_save:
1561         return status;
1562 }
1563
1564 /* list all domain groups */
1565 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1566                                 TALLOC_CTX *mem_ctx,
1567                                 uint32 *num_entries,
1568                                 struct acct_info **info)
1569 {
1570         struct winbind_cache *cache = get_cache(domain);
1571         struct cache_entry *centry = NULL;
1572         NTSTATUS status;
1573         unsigned int i;
1574
1575         if (!cache->tdb)
1576                 goto do_query;
1577
1578         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1579         if (!centry)
1580                 goto do_query;
1581
1582         *num_entries = centry_uint32(centry);
1583
1584         if (*num_entries == 0)
1585                 goto do_cached;
1586
1587         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1588         if (! (*info)) {
1589                 smb_panic_fn("enum_dom_groups out of memory");
1590         }
1591         for (i=0; i<(*num_entries); i++) {
1592                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1593                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1594                 (*info)[i].rid = centry_uint32(centry);
1595         }
1596
1597 do_cached:
1598
1599         /* If we are returning cached data and the domain controller
1600            is down then we don't know whether the data is up to date
1601            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1602            indicate this. */
1603
1604         if (wcache_server_down(domain)) {
1605                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1606                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1607         } else
1608                 status = centry->status;
1609
1610         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1611                 domain->name, nt_errstr(status) ));
1612
1613         centry_free(centry);
1614         return status;
1615
1616 do_query:
1617         *num_entries = 0;
1618         *info = NULL;
1619
1620         /* Return status value returned by seq number check */
1621
1622         if (!NT_STATUS_IS_OK(domain->last_status))
1623                 return domain->last_status;
1624
1625         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1626                 domain->name ));
1627
1628         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1629
1630         /* and save it */
1631         refresh_sequence_number(domain, false);
1632         centry = centry_start(domain, status);
1633         if (!centry)
1634                 goto skip_save;
1635         centry_put_uint32(centry, *num_entries);
1636         for (i=0; i<(*num_entries); i++) {
1637                 centry_put_string(centry, (*info)[i].acct_name);
1638                 centry_put_string(centry, (*info)[i].acct_desc);
1639                 centry_put_uint32(centry, (*info)[i].rid);
1640         }
1641         centry_end(centry, "GL/%s/local", domain->name);
1642         centry_free(centry);
1643
1644 skip_save:
1645         return status;
1646 }
1647
1648 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1649                             const char *domain_name,
1650                             const char *name,
1651                             struct dom_sid *sid,
1652                             enum lsa_SidType *type)
1653 {
1654         struct winbind_cache *cache = get_cache(domain);
1655         struct cache_entry *centry;
1656         NTSTATUS status;
1657         char *uname;
1658
1659         if (cache->tdb == NULL) {
1660                 return NT_STATUS_NOT_FOUND;
1661         }
1662
1663         uname = talloc_strdup_upper(talloc_tos(), name);
1664         if (uname == NULL) {
1665                 return NT_STATUS_NO_MEMORY;
1666         }
1667
1668         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1669         TALLOC_FREE(uname);
1670         if (centry == NULL) {
1671                 return NT_STATUS_NOT_FOUND;
1672         }
1673
1674         status = centry->status;
1675         if (NT_STATUS_IS_OK(status)) {
1676                 *type = (enum lsa_SidType)centry_uint32(centry);
1677                 centry_sid(centry, sid);
1678         }
1679
1680         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1681                   "%s\n", domain->name, nt_errstr(status) ));
1682
1683         centry_free(centry);
1684         return status;
1685 }
1686
1687 /* convert a single name to a sid in a domain */
1688 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1689                             TALLOC_CTX *mem_ctx,
1690                             const char *domain_name,
1691                             const char *name,
1692                             uint32_t flags,
1693                             DOM_SID *sid,
1694                             enum lsa_SidType *type)
1695 {
1696         NTSTATUS status;
1697
1698         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1699         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1700                 return status;
1701         }
1702
1703         ZERO_STRUCTP(sid);
1704
1705         /* If the seq number check indicated that there is a problem
1706          * with this DC, then return that status... except for
1707          * access_denied.  This is special because the dc may be in
1708          * "restrict anonymous = 1" mode, in which case it will deny
1709          * most unauthenticated operations, but *will* allow the LSA
1710          * name-to-sid that we try as a fallback. */
1711
1712         if (!(NT_STATUS_IS_OK(domain->last_status)
1713               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1714                 return domain->last_status;
1715
1716         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1717                 domain->name ));
1718
1719         status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1720                                               name, flags, sid, type);
1721
1722         /* and save it */
1723         refresh_sequence_number(domain, false);
1724
1725         if (domain->online &&
1726             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1727                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1728
1729                 /* Only save the reverse mapping if this was not a UPN */
1730                 if (!strchr(name, '@')) {
1731                         strupper_m(CONST_DISCARD(char *,domain_name));
1732                         strlower_m(CONST_DISCARD(char *,name));
1733                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1734                 }
1735         }
1736
1737         return status;
1738 }
1739
1740 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1741                             const struct dom_sid *sid,
1742                             TALLOC_CTX *mem_ctx,
1743                             char **domain_name,
1744                             char **name,
1745                             enum lsa_SidType *type)
1746 {
1747         struct winbind_cache *cache = get_cache(domain);
1748         struct cache_entry *centry;
1749         char *sid_string;
1750         NTSTATUS status;
1751
1752         if (cache->tdb == NULL) {
1753                 return NT_STATUS_NOT_FOUND;
1754         }
1755
1756         sid_string = sid_string_tos(sid);
1757         if (sid_string == NULL) {
1758                 return NT_STATUS_NO_MEMORY;
1759         }
1760
1761         centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1762         TALLOC_FREE(sid_string);
1763         if (centry == NULL) {
1764                 return NT_STATUS_NOT_FOUND;
1765         }
1766
1767         if (NT_STATUS_IS_OK(centry->status)) {
1768                 *type = (enum lsa_SidType)centry_uint32(centry);
1769                 *domain_name = centry_string(centry, mem_ctx);
1770                 *name = centry_string(centry, mem_ctx);
1771         }
1772
1773         status = centry->status;
1774         centry_free(centry);
1775
1776         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1777                   "%s\n", domain->name, nt_errstr(status) ));
1778
1779         return status;
1780 }
1781
1782 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1783    given */
1784 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1785                             TALLOC_CTX *mem_ctx,
1786                             const DOM_SID *sid,
1787                             char **domain_name,
1788                             char **name,
1789                             enum lsa_SidType *type)
1790 {
1791         NTSTATUS status;
1792
1793         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1794                                     type);
1795         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1796                 return status;
1797         }
1798
1799         *name = NULL;
1800         *domain_name = NULL;
1801
1802         /* If the seq number check indicated that there is a problem
1803          * with this DC, then return that status... except for
1804          * access_denied.  This is special because the dc may be in
1805          * "restrict anonymous = 1" mode, in which case it will deny
1806          * most unauthenticated operations, but *will* allow the LSA
1807          * sid-to-name that we try as a fallback. */
1808
1809         if (!(NT_STATUS_IS_OK(domain->last_status)
1810               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1811                 return domain->last_status;
1812
1813         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1814                 domain->name ));
1815
1816         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1817
1818         /* and save it */
1819         refresh_sequence_number(domain, false);
1820         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1821
1822         /* We can't save the name to sid mapping here, as with sid history a
1823          * later name2sid would give the wrong sid. */
1824
1825         return status;
1826 }
1827
1828 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1829                               TALLOC_CTX *mem_ctx,
1830                               const DOM_SID *domain_sid,
1831                               uint32 *rids,
1832                               size_t num_rids,
1833                               char **domain_name,
1834                               char ***names,
1835                               enum lsa_SidType **types)
1836 {
1837         struct winbind_cache *cache = get_cache(domain);
1838         size_t i;
1839         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1840         bool have_mapped;
1841         bool have_unmapped;
1842
1843         *domain_name = NULL;
1844         *names = NULL;
1845         *types = NULL;
1846
1847         if (!cache->tdb) {
1848                 goto do_query;
1849         }
1850
1851         if (num_rids == 0) {
1852                 return NT_STATUS_OK;
1853         }
1854
1855         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1856         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1857
1858         if ((*names == NULL) || (*types == NULL)) {
1859                 result = NT_STATUS_NO_MEMORY;
1860                 goto error;
1861         }
1862
1863         have_mapped = have_unmapped = false;
1864
1865         for (i=0; i<num_rids; i++) {
1866                 DOM_SID sid;
1867                 struct cache_entry *centry;
1868                 fstring tmp;
1869
1870                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1871                         result = NT_STATUS_INTERNAL_ERROR;
1872                         goto error;
1873                 }
1874
1875                 centry = wcache_fetch(cache, domain, "SN/%s",
1876                                       sid_to_fstring(tmp, &sid));
1877                 if (!centry) {
1878                         goto do_query;
1879                 }
1880
1881                 (*types)[i] = SID_NAME_UNKNOWN;
1882                 (*names)[i] = talloc_strdup(*names, "");
1883
1884                 if (NT_STATUS_IS_OK(centry->status)) {
1885                         char *dom;
1886                         have_mapped = true;
1887                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1888
1889                         dom = centry_string(centry, mem_ctx);
1890                         if (*domain_name == NULL) {
1891                                 *domain_name = dom;
1892                         } else {
1893                                 talloc_free(dom);
1894                         }
1895
1896                         (*names)[i] = centry_string(centry, *names);
1897
1898                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1899                         have_unmapped = true;
1900
1901                 } else {
1902                         /* something's definitely wrong */
1903                         result = centry->status;
1904                         goto error;
1905                 }
1906
1907                 centry_free(centry);
1908         }
1909
1910         if (!have_mapped) {
1911                 return NT_STATUS_NONE_MAPPED;
1912         }
1913         if (!have_unmapped) {
1914                 return NT_STATUS_OK;
1915         }
1916         return STATUS_SOME_UNMAPPED;
1917
1918  do_query:
1919
1920         TALLOC_FREE(*names);
1921         TALLOC_FREE(*types);
1922
1923         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1924                                                 rids, num_rids, domain_name,
1925                                                 names, types);
1926
1927         /*
1928           None of the queried rids has been found so save all negative entries
1929         */
1930         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1931                 for (i = 0; i < num_rids; i++) {
1932                         DOM_SID sid;
1933                         const char *name = "";
1934                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
1935                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
1936
1937                         if (!sid_compose(&sid, domain_sid, rids[i])) {
1938                                 return NT_STATUS_INTERNAL_ERROR;
1939                         }
1940
1941                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1942                                                 name, type);
1943                 }
1944
1945                 return result;
1946         }
1947
1948         /*
1949           Some or all of the queried rids have been found.
1950         */
1951         if (!NT_STATUS_IS_OK(result) &&
1952             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1953                 return result;
1954         }
1955
1956         refresh_sequence_number(domain, false);
1957
1958         for (i=0; i<num_rids; i++) {
1959                 DOM_SID sid;
1960                 NTSTATUS status;
1961
1962                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1963                         result = NT_STATUS_INTERNAL_ERROR;
1964                         goto error;
1965                 }
1966
1967                 status = (*types)[i] == SID_NAME_UNKNOWN ?
1968                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1969
1970                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1971                                         (*names)[i], (*types)[i]);
1972         }
1973
1974         return result;
1975
1976  error:
1977         TALLOC_FREE(*names);
1978         TALLOC_FREE(*types);
1979         return result;
1980 }
1981
1982 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
1983                            TALLOC_CTX *mem_ctx,
1984                            const struct dom_sid *user_sid,
1985                            struct wbint_userinfo *info)
1986 {
1987         struct winbind_cache *cache = get_cache(domain);
1988         struct cache_entry *centry = NULL;
1989         NTSTATUS status;
1990         char *sid_string;
1991
1992         if (cache->tdb == NULL) {
1993                 return NT_STATUS_NOT_FOUND;
1994         }
1995
1996         sid_string = sid_string_tos(user_sid);
1997         if (sid_string == NULL) {
1998                 return NT_STATUS_NO_MEMORY;
1999         }
2000
2001         centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2002         TALLOC_FREE(sid_string);
2003         if (centry == NULL) {
2004                 return NT_STATUS_NOT_FOUND;
2005         }
2006
2007         /*
2008          * If we have an access denied cache entry and a cached info3
2009          * in the samlogon cache then do a query.  This will force the
2010          * rpc back end to return the info3 data.
2011          */
2012
2013         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2014             netsamlogon_cache_have(user_sid)) {
2015                 DEBUG(10, ("query_user: cached access denied and have cached "
2016                            "info3\n"));
2017                 domain->last_status = NT_STATUS_OK;
2018                 centry_free(centry);
2019                 return NT_STATUS_NOT_FOUND;
2020         }
2021
2022         /* if status is not ok then this is a negative hit
2023            and the rest of the data doesn't matter */
2024         status = centry->status;
2025         if (NT_STATUS_IS_OK(status)) {
2026                 info->acct_name = centry_string(centry, mem_ctx);
2027                 info->full_name = centry_string(centry, mem_ctx);
2028                 info->homedir = centry_string(centry, mem_ctx);
2029                 info->shell = centry_string(centry, mem_ctx);
2030                 info->primary_gid = centry_uint32(centry);
2031                 centry_sid(centry, &info->user_sid);
2032                 centry_sid(centry, &info->group_sid);
2033         }
2034
2035         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2036                   "%s\n", domain->name, nt_errstr(status) ));
2037
2038         centry_free(centry);
2039         return status;
2040 }
2041
2042 /* Lookup user information from a rid */
2043 static NTSTATUS query_user(struct winbindd_domain *domain,
2044                            TALLOC_CTX *mem_ctx,
2045                            const DOM_SID *user_sid,
2046                            struct wbint_userinfo *info)
2047 {
2048         NTSTATUS status;
2049
2050         status = wcache_query_user(domain, mem_ctx, user_sid, info);
2051         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2052                 return status;
2053         }
2054
2055         ZERO_STRUCTP(info);
2056
2057         /* Return status value returned by seq number check */
2058
2059         if (!NT_STATUS_IS_OK(domain->last_status))
2060                 return domain->last_status;
2061
2062         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2063                 domain->name ));
2064
2065         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2066
2067         /* and save it */
2068         refresh_sequence_number(domain, false);
2069         wcache_save_user(domain, status, info);
2070
2071         return status;
2072 }
2073
2074 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2075                                   TALLOC_CTX *mem_ctx,
2076                                   const struct dom_sid *user_sid,
2077                                   uint32_t *pnum_sids,
2078                                   struct dom_sid **psids)
2079 {
2080         struct winbind_cache *cache = get_cache(domain);
2081         struct cache_entry *centry = NULL;
2082         NTSTATUS status;
2083         uint32_t i, num_sids;
2084         struct dom_sid *sids;
2085         fstring sid_string;
2086
2087         if (cache->tdb == NULL) {
2088                 return NT_STATUS_NOT_FOUND;
2089         }
2090
2091         centry = wcache_fetch(cache, domain, "UG/%s",
2092                               sid_to_fstring(sid_string, user_sid));
2093         if (centry == NULL) {
2094                 return NT_STATUS_NOT_FOUND;
2095         }
2096
2097         /* If we have an access denied cache entry and a cached info3 in the
2098            samlogon cache then do a query.  This will force the rpc back end
2099            to return the info3 data. */
2100
2101         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2102             && netsamlogon_cache_have(user_sid)) {
2103                 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2104                            "cached info3\n"));
2105                 domain->last_status = NT_STATUS_OK;
2106                 centry_free(centry);
2107                 return NT_STATUS_NOT_FOUND;
2108         }
2109
2110         num_sids = centry_uint32(centry);
2111         sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2112         if (sids == NULL) {
2113                 centry_free(centry);
2114                 return NT_STATUS_NO_MEMORY;
2115         }
2116
2117         for (i=0; i<num_sids; i++) {
2118                 centry_sid(centry, &sids[i]);
2119         }
2120
2121         status = centry->status;
2122
2123         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2124                   "status: %s\n", domain->name, nt_errstr(status)));
2125
2126         centry_free(centry);
2127
2128         *pnum_sids = num_sids;
2129         *psids = sids;
2130         return status;
2131 }
2132
2133 /* Lookup groups a user is a member of. */
2134 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2135                                   TALLOC_CTX *mem_ctx,
2136                                   const DOM_SID *user_sid,
2137                                   uint32 *num_groups, DOM_SID **user_gids)
2138 {
2139         struct cache_entry *centry = NULL;
2140         NTSTATUS status;
2141         unsigned int i;
2142         fstring sid_string;
2143
2144         status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2145                                           num_groups, user_gids);
2146         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2147                 return status;
2148         }
2149
2150         (*num_groups) = 0;
2151         (*user_gids) = NULL;
2152
2153         /* Return status value returned by seq number check */
2154
2155         if (!NT_STATUS_IS_OK(domain->last_status))
2156                 return domain->last_status;
2157
2158         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2159                 domain->name ));
2160
2161         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2162
2163         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2164                 goto skip_save;
2165
2166         /* and save it */
2167         refresh_sequence_number(domain, false);
2168         centry = centry_start(domain, status);
2169         if (!centry)
2170                 goto skip_save;
2171
2172         centry_put_uint32(centry, *num_groups);
2173         for (i=0; i<(*num_groups); i++) {
2174                 centry_put_sid(centry, &(*user_gids)[i]);
2175         }
2176
2177         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2178         centry_free(centry);
2179
2180 skip_save:
2181         return status;
2182 }
2183
2184 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2185                                  const struct dom_sid *sids)
2186 {
2187         uint32_t i;
2188         char *sidlist;
2189
2190         sidlist = talloc_strdup(mem_ctx, "");
2191         if (sidlist == NULL) {
2192                 return NULL;
2193         }
2194         for (i=0; i<num_sids; i++) {
2195                 fstring tmp;
2196                 sidlist = talloc_asprintf_append_buffer(
2197                         sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2198                 if (sidlist == NULL) {
2199                         return NULL;
2200                 }
2201         }
2202         return sidlist;
2203 }
2204
2205 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2206                                    TALLOC_CTX *mem_ctx, uint32_t num_sids,
2207                                    const struct dom_sid *sids,
2208                                    uint32_t *pnum_aliases, uint32_t **paliases)
2209 {
2210         struct winbind_cache *cache = get_cache(domain);
2211         struct cache_entry *centry = NULL;
2212         uint32_t num_aliases;
2213         uint32_t *aliases;
2214         NTSTATUS status;
2215         char *sidlist;
2216         int i;
2217
2218         if (cache->tdb == NULL) {
2219                 return NT_STATUS_NOT_FOUND;
2220         }
2221
2222         if (num_sids == 0) {
2223                 *pnum_aliases = 0;
2224                 *paliases = NULL;
2225                 return NT_STATUS_OK;
2226         }
2227
2228         /* We need to cache indexed by the whole list of SIDs, the aliases
2229          * resulting might come from any of the SIDs. */
2230
2231         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2232         if (sidlist == NULL) {
2233                 return NT_STATUS_NO_MEMORY;
2234         }
2235
2236         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2237         TALLOC_FREE(sidlist);
2238         if (centry == NULL) {
2239                 return NT_STATUS_NOT_FOUND;
2240         }
2241
2242         num_aliases = centry_uint32(centry);
2243         aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2244         if (aliases == NULL) {
2245                 centry_free(centry);
2246                 return NT_STATUS_NO_MEMORY;
2247         }
2248
2249         for (i=0; i<num_aliases; i++) {
2250                 aliases[i] = centry_uint32(centry);
2251         }
2252
2253         status = centry->status;
2254
2255         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2256                   "status %s\n", domain->name, nt_errstr(status)));
2257
2258         centry_free(centry);
2259
2260         *pnum_aliases = num_aliases;
2261         *paliases = aliases;
2262
2263         return status;
2264 }
2265
2266 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2267                                    TALLOC_CTX *mem_ctx,
2268                                    uint32 num_sids, const DOM_SID *sids,
2269                                    uint32 *num_aliases, uint32 **alias_rids)
2270 {
2271         struct cache_entry *centry = NULL;
2272         NTSTATUS status;
2273         char *sidlist;
2274         int i;
2275
2276         status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2277                                            num_aliases, alias_rids);
2278         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2279                 return status;
2280         }
2281
2282         (*num_aliases) = 0;
2283         (*alias_rids) = NULL;
2284
2285         if (!NT_STATUS_IS_OK(domain->last_status))
2286                 return domain->last_status;
2287
2288         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2289                   "for domain %s\n", domain->name ));
2290
2291         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2292         if (sidlist == NULL) {
2293                 return NT_STATUS_NO_MEMORY;
2294         }
2295
2296         status = domain->backend->lookup_useraliases(domain, mem_ctx,
2297                                                      num_sids, sids,
2298                                                      num_aliases, alias_rids);
2299
2300         /* and save it */
2301         refresh_sequence_number(domain, false);
2302         centry = centry_start(domain, status);
2303         if (!centry)
2304                 goto skip_save;
2305         centry_put_uint32(centry, *num_aliases);
2306         for (i=0; i<(*num_aliases); i++)
2307                 centry_put_uint32(centry, (*alias_rids)[i]);
2308         centry_end(centry, "UA%s", sidlist);
2309         centry_free(centry);
2310
2311  skip_save:
2312         return status;
2313 }
2314
2315 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2316                                 TALLOC_CTX *mem_ctx,
2317                                 const struct dom_sid *group_sid,
2318                                 uint32_t *num_names,
2319                                 struct dom_sid **sid_mem, char ***names,
2320                                 uint32_t **name_types)
2321 {
2322         struct winbind_cache *cache = get_cache(domain);
2323         struct cache_entry *centry = NULL;
2324         NTSTATUS status;
2325         unsigned int i;
2326         char *sid_string;
2327
2328         if (cache->tdb == NULL) {
2329                 return NT_STATUS_NOT_FOUND;
2330         }
2331
2332         sid_string = sid_string_tos(group_sid);
2333         if (sid_string == NULL) {
2334                 return NT_STATUS_NO_MEMORY;
2335         }
2336
2337         centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2338         TALLOC_FREE(sid_string);
2339         if (centry == NULL) {
2340                 return NT_STATUS_NOT_FOUND;
2341         }
2342
2343         *sid_mem = NULL;
2344         *names = NULL;
2345         *name_types = NULL;
2346
2347         *num_names = centry_uint32(centry);
2348         if (*num_names == 0) {
2349                 centry_free(centry);
2350                 return NT_STATUS_OK;
2351         }
2352
2353         *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2354         *names = talloc_array(mem_ctx, char *, *num_names);
2355         *name_types = talloc_array(mem_ctx, uint32, *num_names);
2356
2357         if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2358                 TALLOC_FREE(*sid_mem);
2359                 TALLOC_FREE(*names);
2360                 TALLOC_FREE(*name_types);
2361                 centry_free(centry);
2362                 return NT_STATUS_NO_MEMORY;
2363         }
2364
2365         for (i=0; i<(*num_names); i++) {
2366                 centry_sid(centry, &(*sid_mem)[i]);
2367                 (*names)[i] = centry_string(centry, mem_ctx);
2368                 (*name_types)[i] = centry_uint32(centry);
2369         }
2370
2371         status = centry->status;
2372
2373         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2374                   "status: %s\n", domain->name, nt_errstr(status)));
2375
2376         centry_free(centry);
2377         return status;
2378 }
2379
2380 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2381                                 TALLOC_CTX *mem_ctx,
2382                                 const DOM_SID *group_sid,
2383                                 enum lsa_SidType type,
2384                                 uint32 *num_names,
2385                                 DOM_SID **sid_mem, char ***names,
2386                                 uint32 **name_types)
2387 {
2388         struct cache_entry *centry = NULL;
2389         NTSTATUS status;
2390         unsigned int i;
2391         fstring sid_string;
2392
2393         status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2394                                         sid_mem, names, name_types);
2395         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2396                 return status;
2397         }
2398
2399         (*num_names) = 0;
2400         (*sid_mem) = NULL;
2401         (*names) = NULL;
2402         (*name_types) = NULL;
2403
2404         /* Return status value returned by seq number check */
2405
2406         if (!NT_STATUS_IS_OK(domain->last_status))
2407                 return domain->last_status;
2408
2409         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2410                 domain->name ));
2411
2412         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2413                                                   type, num_names,
2414                                                   sid_mem, names, name_types);
2415
2416         /* and save it */
2417         refresh_sequence_number(domain, false);
2418         centry = centry_start(domain, status);
2419         if (!centry)
2420                 goto skip_save;
2421         centry_put_uint32(centry, *num_names);
2422         for (i=0; i<(*num_names); i++) {
2423                 centry_put_sid(centry, &(*sid_mem)[i]);
2424                 centry_put_string(centry, (*names)[i]);
2425                 centry_put_uint32(centry, (*name_types)[i]);
2426         }
2427         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2428         centry_free(centry);
2429
2430 skip_save:
2431         return status;
2432 }
2433
2434 /* find the sequence number for a domain */
2435 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2436 {
2437         refresh_sequence_number(domain, false);
2438
2439         *seq = domain->sequence_number;
2440
2441         return NT_STATUS_OK;
2442 }
2443
2444 /* enumerate trusted domains
2445  * (we need to have the list of trustdoms in the cache when we go offline) -
2446  * Guenther */
2447 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2448                                 TALLOC_CTX *mem_ctx,
2449                                 struct netr_DomainTrustList *trusts)
2450 {
2451         NTSTATUS status;
2452
2453         /* Return status value returned by seq number check */
2454
2455         if (!NT_STATUS_IS_OK(domain->last_status))
2456                 return domain->last_status;
2457
2458         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2459                 domain->name ));
2460
2461         status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2462
2463         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2464          * so that the generic centry handling still applies correctly -
2465          * Guenther*/
2466
2467         if (!NT_STATUS_IS_ERR(status)) {
2468                 status = NT_STATUS_OK;
2469         }
2470         return status;
2471 }
2472
2473 /* get lockout policy */
2474 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2475                                TALLOC_CTX *mem_ctx,
2476                                struct samr_DomInfo12 *policy)
2477 {
2478         struct winbind_cache *cache = get_cache(domain);
2479         struct cache_entry *centry = NULL;
2480         NTSTATUS status;
2481
2482         if (!cache->tdb)
2483                 goto do_query;
2484
2485         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2486
2487         if (!centry)
2488                 goto do_query;
2489
2490         policy->lockout_duration = centry_nttime(centry);
2491         policy->lockout_window = centry_nttime(centry);
2492         policy->lockout_threshold = centry_uint16(centry);
2493
2494         status = centry->status;
2495
2496         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2497                 domain->name, nt_errstr(status) ));
2498
2499         centry_free(centry);
2500         return status;
2501
2502 do_query:
2503         ZERO_STRUCTP(policy);
2504
2505         /* Return status value returned by seq number check */
2506
2507         if (!NT_STATUS_IS_OK(domain->last_status))
2508                 return domain->last_status;
2509
2510         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2511                 domain->name ));
2512
2513         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2514
2515         /* and save it */
2516         refresh_sequence_number(domain, false);
2517         wcache_save_lockout_policy(domain, status, policy);
2518
2519         return status;
2520 }
2521
2522 /* get password policy */
2523 static NTSTATUS password_policy(struct winbindd_domain *domain,
2524                                 TALLOC_CTX *mem_ctx,
2525                                 struct samr_DomInfo1 *policy)
2526 {
2527         struct winbind_cache *cache = get_cache(domain);
2528         struct cache_entry *centry = NULL;
2529         NTSTATUS status;
2530
2531         if (!cache->tdb)
2532                 goto do_query;
2533
2534         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2535
2536         if (!centry)
2537                 goto do_query;
2538
2539         policy->min_password_length = centry_uint16(centry);
2540         policy->password_history_length = centry_uint16(centry);
2541         policy->password_properties = centry_uint32(centry);
2542         policy->max_password_age = centry_nttime(centry);
2543         policy->min_password_age = centry_nttime(centry);
2544
2545         status = centry->status;
2546
2547         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2548                 domain->name, nt_errstr(status) ));
2549
2550         centry_free(centry);
2551         return status;
2552
2553 do_query:
2554         ZERO_STRUCTP(policy);
2555
2556         /* Return status value returned by seq number check */
2557
2558         if (!NT_STATUS_IS_OK(domain->last_status))
2559                 return domain->last_status;
2560
2561         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2562                 domain->name ));
2563
2564         status = domain->backend->password_policy(domain, mem_ctx, policy);
2565
2566         /* and save it */
2567         refresh_sequence_number(domain, false);
2568         if (NT_STATUS_IS_OK(status)) {
2569                 wcache_save_password_policy(domain, status, policy);
2570         }
2571
2572         return status;
2573 }
2574
2575
2576 /* Invalidate cached user and group lists coherently */
2577
2578 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2579                        void *state)
2580 {
2581         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2582             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2583                 tdb_delete(the_tdb, kbuf);
2584
2585         return 0;
2586 }
2587
2588 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2589
2590 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2591                                 struct netr_SamInfo3 *info3)
2592 {
2593         DOM_SID sid;
2594         fstring key_str, sid_string;
2595         struct winbind_cache *cache;
2596
2597         /* dont clear cached U/SID and UG/SID entries when we want to logon
2598          * offline - gd */
2599
2600         if (lp_winbind_offline_logon()) {
2601                 return;
2602         }
2603
2604         if (!domain)
2605                 return;
2606
2607         cache = get_cache(domain);
2608
2609         if (!cache->tdb) {
2610                 return;
2611         }
2612
2613         sid_copy(&sid, info3->base.domain_sid);
2614         sid_append_rid(&sid, info3->base.rid);
2615
2616         /* Clear U/SID cache entry */
2617         fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2618         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2619         tdb_delete(cache->tdb, string_tdb_data(key_str));
2620
2621         /* Clear UG/SID cache entry */
2622         fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2623         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2624         tdb_delete(cache->tdb, string_tdb_data(key_str));
2625
2626         /* Samba/winbindd never needs this. */
2627         netsamlogon_clear_cached_user(info3);
2628 }
2629
2630 bool wcache_invalidate_cache(void)
2631 {
2632         struct winbindd_domain *domain;
2633
2634         for (domain = domain_list(); domain; domain = domain->next) {
2635                 struct winbind_cache *cache = get_cache(domain);
2636
2637                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2638                            "entries for %s\n", domain->name));
2639                 if (cache) {
2640                         if (cache->tdb) {
2641                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
2642                         } else {
2643                                 return false;
2644                         }
2645                 }
2646         }
2647         return true;
2648 }
2649
2650 bool init_wcache(void)
2651 {
2652         if (wcache == NULL) {
2653                 wcache = SMB_XMALLOC_P(struct winbind_cache);
2654                 ZERO_STRUCTP(wcache);
2655         }
2656
2657         if (wcache->tdb != NULL)
2658                 return true;
2659
2660         /* when working offline we must not clear the cache on restart */
2661         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2662                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2663                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2664                                 O_RDWR|O_CREAT, 0600);
2665
2666         if (wcache->tdb == NULL) {
2667                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2668                 return false;
2669         }
2670
2671         return true;
2672 }
2673
2674 /************************************************************************
2675  This is called by the parent to initialize the cache file.
2676  We don't need sophisticated locking here as we know we're the
2677  only opener.
2678 ************************************************************************/
2679
2680 bool initialize_winbindd_cache(void)
2681 {
2682         bool cache_bad = true;
2683         uint32 vers;
2684
2685         if (!init_wcache()) {
2686                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2687                 return false;
2688         }
2689
2690         /* Check version number. */
2691         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2692                         vers == WINBINDD_CACHE_VERSION) {
2693                 cache_bad = false;
2694         }
2695
2696         if (cache_bad) {
2697                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2698                         "and re-creating with version number %d\n",
2699                         WINBINDD_CACHE_VERSION ));
2700
2701                 tdb_close(wcache->tdb);
2702                 wcache->tdb = NULL;
2703
2704                 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2705                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2706                                 cache_path("winbindd_cache.tdb"),
2707                                 strerror(errno) ));
2708                         return false;
2709                 }
2710                 if (!init_wcache()) {
2711                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
2712                                         "init_wcache failed.\n"));
2713                         return false;
2714                 }
2715
2716                 /* Write the version. */
2717                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2718                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2719                                 tdb_errorstr(wcache->tdb) ));
2720                         return false;
2721                 }
2722         }
2723
2724         tdb_close(wcache->tdb);
2725         wcache->tdb = NULL;
2726         return true;
2727 }
2728
2729 void close_winbindd_cache(void)
2730 {
2731         if (!wcache) {
2732                 return;
2733         }
2734         if (wcache->tdb) {
2735                 tdb_close(wcache->tdb);
2736                 wcache->tdb = NULL;
2737         }
2738 }
2739
2740 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2741                        char **domain_name, char **name,
2742                        enum lsa_SidType *type)
2743 {
2744         struct winbindd_domain *domain;
2745         NTSTATUS status;
2746
2747         domain = find_lookup_domain_from_sid(sid);
2748         if (domain == NULL) {
2749                 return false;
2750         }
2751         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
2752                                     type);
2753         return NT_STATUS_IS_OK(status);
2754 }
2755
2756 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2757                         const char *domain_name,
2758                         const char *name,
2759                         DOM_SID *sid,
2760                         enum lsa_SidType *type)
2761 {
2762         struct winbindd_domain *domain;
2763         NTSTATUS status;
2764         bool original_online_state;
2765
2766         domain = find_lookup_domain_from_name(domain_name);
2767         if (domain == NULL) {
2768                 return false;
2769         }
2770
2771         /* If we are doing a cached logon, temporarily set the domain
2772            offline so the cache won't expire the entry */
2773
2774         original_online_state = domain->online;
2775         domain->online = false;
2776         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
2777         domain->online = original_online_state;
2778
2779         return NT_STATUS_IS_OK(status);
2780 }
2781
2782 void cache_name2sid(struct winbindd_domain *domain,
2783                     const char *domain_name, const char *name,
2784                     enum lsa_SidType type, const DOM_SID *sid)
2785 {
2786         refresh_sequence_number(domain, false);
2787         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2788                                 sid, type);
2789 }
2790
2791 /*
2792  * The original idea that this cache only contains centries has
2793  * been blurred - now other stuff gets put in here. Ensure we
2794  * ignore these things on cleanup.
2795  */
2796
2797 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2798                                TDB_DATA dbuf, void *state)
2799 {
2800         struct cache_entry *centry;
2801
2802         if (is_non_centry_key(kbuf)) {
2803                 return 0;
2804         }
2805
2806         centry = wcache_fetch_raw((char *)kbuf.dptr);
2807         if (!centry) {
2808                 return 0;
2809         }
2810
2811         if (!NT_STATUS_IS_OK(centry->status)) {
2812                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2813                 tdb_delete(the_tdb, kbuf);
2814         }
2815
2816         centry_free(centry);
2817         return 0;
2818 }
2819
2820 /* flush the cache */
2821 void wcache_flush_cache(void)
2822 {
2823         if (!wcache)
2824                 return;
2825         if (wcache->tdb) {
2826                 tdb_close(wcache->tdb);
2827                 wcache->tdb = NULL;
2828         }
2829         if (!winbindd_use_cache()) {
2830                 return;
2831         }
2832
2833         /* when working offline we must not clear the cache on restart */
2834         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2835                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2836                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2837                                 O_RDWR|O_CREAT, 0600);
2838
2839         if (!wcache->tdb) {
2840                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2841                 return;
2842         }
2843
2844         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2845
2846         DEBUG(10,("wcache_flush_cache success\n"));
2847 }
2848
2849 /* Count cached creds */
2850
2851 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2852                                     void *state)
2853 {
2854         int *cred_count = (int*)state;
2855
2856         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2857                 (*cred_count)++;
2858         }
2859         return 0;
2860 }
2861
2862 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2863 {
2864         struct winbind_cache *cache = get_cache(domain);
2865
2866         *count = 0;
2867
2868         if (!cache->tdb) {
2869                 return NT_STATUS_INTERNAL_DB_ERROR;
2870         }
2871
2872         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2873
2874         return NT_STATUS_OK;
2875 }
2876
2877 struct cred_list {
2878         struct cred_list *prev, *next;
2879         TDB_DATA key;
2880         fstring name;
2881         time_t created;
2882 };
2883 static struct cred_list *wcache_cred_list;
2884
2885 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2886                                     void *state)
2887 {
2888         struct cred_list *cred;
2889
2890         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2891
2892                 cred = SMB_MALLOC_P(struct cred_list);
2893                 if (cred == NULL) {
2894                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2895                         return -1;
2896                 }
2897
2898                 ZERO_STRUCTP(cred);
2899
2900                 /* save a copy of the key */
2901
2902                 fstrcpy(cred->name, (const char *)kbuf.dptr);
2903                 DLIST_ADD(wcache_cred_list, cred);
2904         }
2905
2906         return 0;
2907 }
2908
2909 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2910 {
2911         struct winbind_cache *cache = get_cache(domain);
2912         NTSTATUS status;
2913         int ret;
2914         struct cred_list *cred, *oldest = NULL;
2915
2916         if (!cache->tdb) {
2917                 return NT_STATUS_INTERNAL_DB_ERROR;
2918         }
2919
2920         /* we possibly already have an entry */
2921         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2922
2923                 fstring key_str, tmp;
2924
2925                 DEBUG(11,("we already have an entry, deleting that\n"));
2926
2927                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2928
2929                 tdb_delete(cache->tdb, string_tdb_data(key_str));
2930
2931                 return NT_STATUS_OK;
2932         }
2933
2934         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2935         if (ret == 0) {
2936                 return NT_STATUS_OK;
2937         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
2938                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2939         }
2940
2941         ZERO_STRUCTP(oldest);
2942
2943         for (cred = wcache_cred_list; cred; cred = cred->next) {
2944
2945                 TDB_DATA data;
2946                 time_t t;
2947
2948                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
2949                 if (!data.dptr) {
2950                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
2951                                 cred->name));
2952                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2953                         goto done;
2954                 }
2955
2956                 t = IVAL(data.dptr, 0);
2957                 SAFE_FREE(data.dptr);
2958
2959                 if (!oldest) {
2960                         oldest = SMB_MALLOC_P(struct cred_list);
2961                         if (oldest == NULL) {
2962                                 status = NT_STATUS_NO_MEMORY;
2963                                 goto done;
2964                         }
2965
2966                         fstrcpy(oldest->name, cred->name);
2967                         oldest->created = t;
2968                         continue;
2969                 }
2970
2971                 if (t < oldest->created) {
2972                         fstrcpy(oldest->name, cred->name);
2973                         oldest->created = t;
2974                 }
2975         }
2976
2977         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
2978                 status = NT_STATUS_OK;
2979         } else {
2980                 status = NT_STATUS_UNSUCCESSFUL;
2981         }
2982 done:
2983         SAFE_FREE(wcache_cred_list);
2984         SAFE_FREE(oldest);
2985
2986         return status;
2987 }
2988
2989 /* Change the global online/offline state. */
2990 bool set_global_winbindd_state_offline(void)
2991 {
2992         TDB_DATA data;
2993
2994         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
2995
2996         /* Only go offline if someone has created
2997            the key "WINBINDD_OFFLINE" in the cache tdb. */
2998
2999         if (wcache == NULL || wcache->tdb == NULL) {
3000                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3001                 return false;
3002         }
3003
3004         if (!lp_winbind_offline_logon()) {
3005                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3006                 return false;
3007         }
3008
3009         if (global_winbindd_offline_state) {
3010                 /* Already offline. */
3011                 return true;
3012         }
3013
3014         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3015
3016         if (!data.dptr || data.dsize != 4) {
3017                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3018                 SAFE_FREE(data.dptr);
3019                 return false;
3020         } else {
3021                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3022                 global_winbindd_offline_state = true;
3023                 SAFE_FREE(data.dptr);
3024                 return true;
3025         }
3026 }
3027
3028 void set_global_winbindd_state_online(void)
3029 {
3030         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3031
3032         if (!lp_winbind_offline_logon()) {
3033                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3034                 return;
3035         }
3036
3037         if (!global_winbindd_offline_state) {
3038                 /* Already online. */
3039                 return;
3040         }
3041         global_winbindd_offline_state = false;
3042
3043         if (!wcache->tdb) {
3044                 return;
3045         }
3046
3047         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3048         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3049 }
3050
3051 bool get_global_winbindd_state_offline(void)
3052 {
3053         return global_winbindd_offline_state;
3054 }
3055
3056 /***********************************************************************
3057  Validate functions for all possible cache tdb keys.
3058 ***********************************************************************/
3059
3060 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3061                                                   struct tdb_validation_status *state)
3062 {
3063         struct cache_entry *centry;
3064
3065         centry = SMB_XMALLOC_P(struct cache_entry);
3066         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3067         if (!centry->data) {
3068                 SAFE_FREE(centry);
3069                 return NULL;
3070         }
3071         centry->len = data.dsize;
3072         centry->ofs = 0;
3073
3074         if (centry->len < 8) {
3075                 /* huh? corrupt cache? */
3076                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3077                 centry_free(centry);
3078                 state->bad_entry = true;
3079                 state->success = false;
3080                 return NULL;
3081         }
3082
3083         centry->status = NT_STATUS(centry_uint32(centry));
3084         centry->sequence_number = centry_uint32(centry);
3085         return centry;
3086 }
3087
3088 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3089                            struct tdb_validation_status *state)
3090 {
3091         if (dbuf.dsize != 8) {
3092                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3093                                 keystr, (unsigned int)dbuf.dsize ));
3094                 state->bad_entry = true;
3095                 return 1;
3096         }
3097         return 0;
3098 }
3099
3100 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3101                        struct tdb_validation_status *state)
3102 {
3103         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3104         if (!centry) {
3105                 return 1;
3106         }
3107
3108         (void)centry_uint32(centry);
3109         if (NT_STATUS_IS_OK(centry->status)) {
3110                 DOM_SID sid;
3111                 (void)centry_sid(centry, &sid);
3112         }
3113
3114         centry_free(centry);
3115
3116         if (!(state->success)) {
3117                 return 1;
3118         }
3119         DEBUG(10,("validate_ns: %s ok\n", keystr));
3120         return 0;
3121 }
3122
3123 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3124                        struct tdb_validation_status *state)
3125 {
3126         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3127         if (!centry) {
3128                 return 1;
3129         }
3130
3131         if (NT_STATUS_IS_OK(centry->status)) {
3132                 (void)centry_uint32(centry);
3133                 (void)centry_string(centry, mem_ctx);
3134                 (void)centry_string(centry, mem_ctx);
3135         }
3136
3137         centry_free(centry);
3138
3139         if (!(state->success)) {
3140                 return 1;
3141         }
3142         DEBUG(10,("validate_sn: %s ok\n", keystr));
3143         return 0;
3144 }
3145
3146 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3147                       struct tdb_validation_status *state)
3148 {
3149         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3150         DOM_SID sid;
3151
3152         if (!centry) {
3153                 return 1;
3154         }
3155
3156         (void)centry_string(centry, mem_ctx);
3157         (void)centry_string(centry, mem_ctx);
3158         (void)centry_string(centry, mem_ctx);
3159         (void)centry_string(centry, mem_ctx);
3160         (void)centry_uint32(centry);
3161         (void)centry_sid(centry, &sid);
3162         (void)centry_sid(centry, &sid);
3163
3164         centry_free(centry);
3165
3166         if (!(state->success)) {
3167                 return 1;
3168         }
3169         DEBUG(10,("validate_u: %s ok\n", keystr));
3170         return 0;
3171 }
3172
3173 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3174                             struct tdb_validation_status *state)
3175 {
3176         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3177
3178         if (!centry) {
3179                 return 1;
3180         }
3181
3182         (void)centry_nttime(centry);
3183         (void)centry_nttime(centry);
3184         (void)centry_uint16(centry);
3185
3186         centry_free(centry);
3187
3188         if (!(state->success)) {
3189                 return 1;
3190         }
3191         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3192         return 0;
3193 }
3194
3195 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3196                             struct tdb_validation_status *state)
3197 {
3198         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3199
3200         if (!centry) {
3201                 return 1;
3202         }
3203
3204         (void)centry_uint16(centry);
3205         (void)centry_uint16(centry);
3206         (void)centry_uint32(centry);
3207         (void)centry_nttime(centry);
3208         (void)centry_nttime(centry);
3209
3210         centry_free(centry);
3211
3212         if (!(state->success)) {
3213                 return 1;
3214         }
3215         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3216         return 0;
3217 }
3218
3219 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3220                          struct tdb_validation_status *state)
3221 {
3222         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3223
3224         if (!centry) {
3225                 return 1;
3226         }
3227
3228         (void)centry_time(centry);
3229         (void)centry_hash16(centry, mem_ctx);
3230
3231         /* We only have 17 bytes more data in the salted cred case. */
3232         if (centry->len - centry->ofs == 17) {
3233                 (void)centry_hash16(centry, mem_ctx);
3234         }
3235
3236         centry_free(centry);
3237
3238         if (!(state->success)) {
3239                 return 1;
3240         }
3241         DEBUG(10,("validate_cred: %s ok\n", keystr));
3242         return 0;
3243 }
3244
3245 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3246                        struct tdb_validation_status *state)
3247 {
3248         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3249         int32 num_entries, i;
3250
3251         if (!centry) {
3252                 return 1;
3253         }
3254
3255         num_entries = (int32)centry_uint32(centry);
3256
3257         for (i=0; i< num_entries; i++) {
3258                 DOM_SID sid;
3259                 (void)centry_string(centry, mem_ctx);
3260                 (void)centry_string(centry, mem_ctx);
3261                 (void)centry_string(centry, mem_ctx);
3262                 (void)centry_string(centry, mem_ctx);
3263                 (void)centry_sid(centry, &sid);
3264                 (void)centry_sid(centry, &sid);
3265         }
3266
3267         centry_free(centry);
3268
3269         if (!(state->success)) {
3270                 return 1;
3271         }
3272         DEBUG(10,("validate_ul: %s ok\n", keystr));
3273         return 0;
3274 }
3275
3276 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3277                        struct tdb_validation_status *state)
3278 {
3279         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3280         int32 num_entries, i;
3281
3282         if (!centry) {
3283                 return 1;
3284         }
3285
3286         num_entries = centry_uint32(centry);
3287
3288         for (i=0; i< num_entries; i++) {
3289                 (void)centry_string(centry, mem_ctx);
3290                 (void)centry_string(centry, mem_ctx);
3291                 (void)centry_uint32(centry);
3292         }
3293
3294         centry_free(centry);
3295
3296         if (!(state->success)) {
3297                 return 1;
3298         }
3299         DEBUG(10,("validate_gl: %s ok\n", keystr));
3300         return 0;
3301 }
3302
3303 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3304                        struct tdb_validation_status *state)
3305 {
3306         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3307         int32 num_groups, i;
3308
3309         if (!centry) {
3310                 return 1;
3311         }
3312
3313         num_groups = centry_uint32(centry);
3314
3315         for (i=0; i< num_groups; i++) {
3316                 DOM_SID sid;
3317                 centry_sid(centry, &sid);
3318         }
3319
3320         centry_free(centry);
3321
3322         if (!(state->success)) {
3323                 return 1;
3324         }
3325         DEBUG(10,("validate_ug: %s ok\n", keystr));
3326         return 0;
3327 }
3328
3329 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3330                        struct tdb_validation_status *state)
3331 {
3332         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3333         int32 num_aliases, i;
3334
3335         if (!centry) {
3336                 return 1;
3337         }
3338
3339         num_aliases = centry_uint32(centry);
3340
3341         for (i=0; i < num_aliases; i++) {
3342                 (void)centry_uint32(centry);
3343         }
3344
3345         centry_free(centry);
3346
3347         if (!(state->success)) {
3348                 return 1;
3349         }
3350         DEBUG(10,("validate_ua: %s ok\n", keystr));
3351         return 0;
3352 }
3353
3354 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3355                        struct tdb_validation_status *state)
3356 {
3357         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3358         int32 num_names, i;
3359
3360         if (!centry) {
3361                 return 1;
3362         }
3363
3364         num_names = centry_uint32(centry);
3365
3366         for (i=0; i< num_names; i++) {
3367                 DOM_SID sid;
3368                 centry_sid(centry, &sid);
3369                 (void)centry_string(centry, mem_ctx);
3370                 (void)centry_uint32(centry);
3371         }
3372
3373         centry_free(centry);
3374
3375         if (!(state->success)) {
3376                 return 1;
3377         }
3378         DEBUG(10,("validate_gm: %s ok\n", keystr));
3379         return 0;
3380 }
3381
3382 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3383                        struct tdb_validation_status *state)
3384 {
3385         /* Can't say anything about this other than must be nonzero. */
3386         if (dbuf.dsize == 0) {
3387                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3388                                 keystr));
3389                 state->bad_entry = true;
3390                 state->success = false;
3391                 return 1;
3392         }
3393
3394         DEBUG(10,("validate_dr: %s ok\n", keystr));
3395         return 0;
3396 }
3397
3398 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3399                        struct tdb_validation_status *state)
3400 {
3401         /* Can't say anything about this other than must be nonzero. */
3402         if (dbuf.dsize == 0) {
3403                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3404                                 keystr));
3405                 state->bad_entry = true;
3406                 state->success = false;
3407                 return 1;
3408         }
3409
3410         DEBUG(10,("validate_de: %s ok\n", keystr));
3411         return 0;
3412 }
3413
3414 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3415                            TDB_DATA dbuf, struct tdb_validation_status *state)
3416 {
3417         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3418
3419         if (!centry) {
3420                 return 1;
3421         }
3422
3423         (void)centry_string(centry, mem_ctx);
3424         (void)centry_string(centry, mem_ctx);
3425         (void)centry_string(centry, mem_ctx);
3426         (void)centry_uint32(centry);
3427
3428         centry_free(centry);
3429
3430         if (!(state->success)) {
3431                 return 1;
3432         }
3433         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3434         return 0;
3435 }
3436
3437 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3438                            TDB_DATA dbuf,
3439                            struct tdb_validation_status *state)
3440 {
3441         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3442
3443         if (!centry) {
3444                 return 1;
3445         }
3446
3447         (void)centry_string( centry, mem_ctx );
3448
3449         centry_free(centry);
3450
3451         if (!(state->success)) {
3452                 return 1;
3453         }
3454         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3455         return 0;
3456 }
3457
3458 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3459                            TDB_DATA dbuf,
3460                            struct tdb_validation_status *state)
3461 {
3462         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3463
3464         if (!centry) {
3465                 return 1;
3466         }
3467
3468         (void)centry_string( centry, mem_ctx );
3469
3470         centry_free(centry);
3471
3472         if (!(state->success)) {
3473                 return 1;
3474         }
3475         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3476         return 0;
3477 }
3478
3479 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3480                                   TDB_DATA dbuf,
3481                                   struct tdb_validation_status *state)
3482 {
3483         if (dbuf.dsize == 0) {
3484                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3485                           "key %s (len ==0) ?\n", keystr));
3486                 state->bad_entry = true;
3487                 state->success = false;
3488                 return 1;
3489         }
3490
3491         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3492         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3493         return 0;
3494 }
3495
3496 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3497                             struct tdb_validation_status *state)
3498 {
3499         if (dbuf.dsize != 4) {
3500                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3501                                 keystr, (unsigned int)dbuf.dsize ));
3502                 state->bad_entry = true;
3503                 state->success = false;
3504                 return 1;
3505         }
3506         DEBUG(10,("validate_offline: %s ok\n", keystr));
3507         return 0;
3508 }
3509
3510 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3511                         struct tdb_validation_status *state)
3512 {
3513         /*
3514          * Ignore validation for now. The proper way to do this is with a
3515          * checksum. Just pure parsing does not really catch much.
3516          */
3517         return 0;
3518 }
3519
3520 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3521                                   struct tdb_validation_status *state)
3522 {
3523         if (dbuf.dsize != 4) {
3524                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3525                           "key %s (len %u != 4) ?\n",
3526                           keystr, (unsigned int)dbuf.dsize));
3527                 state->bad_entry = true;
3528                 state->success = false;
3529                 return 1;
3530         }
3531
3532         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3533         return 0;
3534 }
3535
3536 /***********************************************************************
3537  A list of all possible cache tdb keys with associated validation
3538  functions.
3539 ***********************************************************************/
3540
3541 struct key_val_struct {
3542         const char *keyname;
3543         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3544 } key_val[] = {
3545         {"SEQNUM/", validate_seqnum},
3546         {"NS/", validate_ns},
3547         {"SN/", validate_sn},
3548         {"U/", validate_u},
3549         {"LOC_POL/", validate_loc_pol},
3550         {"PWD_POL/", validate_pwd_pol},
3551         {"CRED/", validate_cred},
3552         {"UL/", validate_ul},
3553         {"GL/", validate_gl},
3554         {"UG/", validate_ug},
3555         {"UA", validate_ua},
3556         {"GM/", validate_gm},
3557         {"DR/", validate_dr},
3558         {"DE/", validate_de},
3559         {"NSS/PWINFO/", validate_pwinfo},
3560         {"TRUSTDOMCACHE/", validate_trustdomcache},
3561         {"NSS/NA/", validate_nss_na},
3562         {"NSS/AN/", validate_nss_an},
3563         {"WINBINDD_OFFLINE", validate_offline},
3564         {"NDR/", validate_ndr},
3565         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3566         {NULL, NULL}
3567 };
3568
3569 /***********************************************************************
3570  Function to look at every entry in the tdb and validate it as far as
3571  possible.
3572 ***********************************************************************/
3573
3574 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3575 {
3576         int i;
3577         unsigned int max_key_len = 1024;
3578         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3579
3580         /* Paranoia check. */
3581         if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3582                 max_key_len = 1024 * 1024;
3583         }
3584         if (kbuf.dsize > max_key_len) {
3585                 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3586                           "(%u) > (%u)\n\n",
3587                           (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3588                 return 1;
3589         }
3590
3591         for (i = 0; key_val[i].keyname; i++) {
3592                 size_t namelen = strlen(key_val[i].keyname);
3593                 if (kbuf.dsize >= namelen && (
3594                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3595                         TALLOC_CTX *mem_ctx;
3596                         char *keystr;
3597                         int ret;
3598
3599                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3600                         if (!keystr) {
3601                                 return 1;
3602                         }
3603                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
3604                         keystr[kbuf.dsize] = '\0';
3605
3606                         mem_ctx = talloc_init("validate_ctx");
3607                         if (!mem_ctx) {
3608                                 SAFE_FREE(keystr);
3609                                 return 1;
3610                         }
3611
3612                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3613                                                           v_state);
3614
3615                         SAFE_FREE(keystr);
3616                         talloc_destroy(mem_ctx);
3617                         return ret;
3618                 }
3619         }
3620
3621         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3622         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3623         DEBUG(0,("data :\n"));
3624         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3625         v_state->unknown_key = true;
3626         v_state->success = false;
3627         return 1; /* terminate. */
3628 }
3629
3630 static void validate_panic(const char *const why)
3631 {
3632         DEBUG(0,("validating cache: would panic %s\n", why ));
3633         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3634         exit(47);
3635 }
3636
3637 /***********************************************************************
3638  Try and validate every entry in the winbindd cache. If we fail here,
3639  delete the cache tdb and return non-zero.
3640 ***********************************************************************/
3641
3642 int winbindd_validate_cache(void)
3643 {
3644         int ret = -1;
3645         const char *tdb_path = cache_path("winbindd_cache.tdb");
3646         TDB_CONTEXT *tdb = NULL;
3647
3648         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3649         smb_panic_fn = validate_panic;
3650
3651
3652         tdb = tdb_open_log(tdb_path,
3653                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3654                            ( lp_winbind_offline_logon()
3655                              ? TDB_DEFAULT
3656                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3657                            O_RDWR|O_CREAT,
3658                            0600);
3659         if (!tdb) {
3660                 DEBUG(0, ("winbindd_validate_cache: "
3661                           "error opening/initializing tdb\n"));
3662                 goto done;
3663         }
3664         tdb_close(tdb);
3665
3666         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3667
3668         if (ret != 0) {
3669                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3670                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3671                 unlink(tdb_path);
3672         }
3673
3674 done:
3675         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3676         smb_panic_fn = smb_panic;
3677         return ret;
3678 }
3679
3680 /***********************************************************************
3681  Try and validate every entry in the winbindd cache.
3682 ***********************************************************************/
3683
3684 int winbindd_validate_cache_nobackup(void)
3685 {
3686         int ret = -1;
3687         const char *tdb_path = cache_path("winbindd_cache.tdb");
3688
3689         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3690         smb_panic_fn = validate_panic;
3691
3692
3693         if (wcache == NULL || wcache->tdb == NULL) {
3694                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3695         } else {
3696                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3697         }
3698
3699         if (ret != 0) {
3700                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3701                            "successful.\n"));
3702         }
3703
3704         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3705                    "function\n"));
3706         smb_panic_fn = smb_panic;
3707         return ret;
3708 }
3709
3710 bool winbindd_cache_validate_and_initialize(void)
3711 {
3712         close_winbindd_cache();
3713
3714         if (lp_winbind_offline_logon()) {
3715                 if (winbindd_validate_cache() < 0) {
3716                         DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3717                                   "could be restored.\n"));
3718                 }
3719         }
3720
3721         return initialize_winbindd_cache();
3722 }
3723
3724 /*********************************************************************
3725  ********************************************************************/
3726
3727 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3728                                        struct winbindd_tdc_domain **domains,
3729                                        size_t *num_domains )
3730 {
3731         struct winbindd_tdc_domain *list = NULL;
3732         size_t idx;
3733         int i;
3734         bool set_only = false;
3735
3736         /* don't allow duplicates */
3737
3738         idx = *num_domains;
3739         list = *domains;
3740
3741         for ( i=0; i< (*num_domains); i++ ) {
3742                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3743                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3744                                   new_dom->name));
3745                         idx = i;
3746                         set_only = true;
3747
3748                         break;
3749                 }
3750         }
3751
3752         if ( !set_only ) {
3753                 if ( !*domains ) {
3754                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3755                         idx = 0;
3756                 } else {
3757                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3758                                                      struct winbindd_tdc_domain,
3759                                                      (*num_domains)+1);
3760                         idx = *num_domains;
3761                 }
3762
3763                 ZERO_STRUCT( list[idx] );
3764         }
3765
3766         if ( !list )
3767                 return false;
3768
3769         list[idx].domain_name = talloc_strdup( list, new_dom->name );
3770         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3771
3772         if ( !is_null_sid( &new_dom->sid ) ) {
3773                 sid_copy( &list[idx].sid, &new_dom->sid );
3774         } else {
3775                 sid_copy(&list[idx].sid, &global_sid_NULL);
3776         }
3777
3778         if ( new_dom->domain_flags != 0x0 )
3779                 list[idx].trust_flags = new_dom->domain_flags;
3780
3781         if ( new_dom->domain_type != 0x0 )
3782                 list[idx].trust_type = new_dom->domain_type;
3783
3784         if ( new_dom->domain_trust_attribs != 0x0 )
3785                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3786
3787         if ( !set_only ) {
3788                 *domains = list;
3789                 *num_domains = idx + 1;
3790         }
3791
3792         return true;
3793 }
3794
3795 /*********************************************************************
3796  ********************************************************************/
3797
3798 static TDB_DATA make_tdc_key( const char *domain_name )
3799 {
3800         char *keystr = NULL;
3801         TDB_DATA key = { NULL, 0 };
3802
3803         if ( !domain_name ) {
3804                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3805                 return key;
3806         }
3807
3808         if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3809                 return key;
3810         }
3811         key = string_term_tdb_data(keystr);
3812
3813         return key;
3814 }
3815
3816 /*********************************************************************
3817  ********************************************************************/
3818
3819 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3820                              size_t num_domains,
3821                              unsigned char **buf )
3822 {
3823         unsigned char *buffer = NULL;
3824         int len = 0;
3825         int buflen = 0;
3826         int i = 0;
3827
3828         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3829                   (int)num_domains));
3830
3831         buflen = 0;
3832
3833  again:
3834         len = 0;
3835
3836         /* Store the number of array items first */
3837         len += tdb_pack( buffer+len, buflen-len, "d",
3838                          num_domains );
3839
3840         /* now pack each domain trust record */
3841         for ( i=0; i<num_domains; i++ ) {
3842
3843                 fstring tmp;
3844
3845                 if ( buflen > 0 ) {
3846                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3847                                   domains[i].domain_name,
3848                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3849                 }
3850
3851                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3852                                  domains[i].domain_name,
3853                                  domains[i].dns_name,
3854                                  sid_to_fstring(tmp, &domains[i].sid),
3855                                  domains[i].trust_flags,
3856                                  domains[i].trust_attribs,
3857                                  domains[i].trust_type );
3858         }
3859
3860         if ( buflen < len ) {
3861                 SAFE_FREE(buffer);
3862                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3863                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3864                         buflen = -1;
3865                         goto done;
3866                 }
3867                 buflen = len;
3868                 goto again;
3869         }
3870
3871         *buf = buffer;
3872
3873  done:
3874         return buflen;
3875 }
3876
3877 /*********************************************************************
3878  ********************************************************************/
3879
3880 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3881                                   struct winbindd_tdc_domain **domains )
3882 {
3883         fstring domain_name, dns_name, sid_string;
3884         uint32 type, attribs, flags;
3885         int num_domains;
3886         int len = 0;
3887         int i;
3888         struct winbindd_tdc_domain *list = NULL;
3889
3890         /* get the number of domains */
3891         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3892         if ( len == -1 ) {
3893                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3894                 return 0;
3895         }
3896
3897         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3898         if ( !list ) {
3899                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3900                 return 0;
3901         }
3902
3903         for ( i=0; i<num_domains; i++ ) {
3904                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3905                                    domain_name,
3906                                    dns_name,
3907                                    sid_string,
3908                                    &flags,
3909                                    &attribs,
3910                                    &type );
3911
3912                 if ( len == -1 ) {
3913                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3914                         TALLOC_FREE( list );
3915                         return 0;
3916                 }
3917
3918                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
3919                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
3920                           domain_name, dns_name, sid_string,
3921                           flags, attribs, type));
3922
3923                 list[i].domain_name = talloc_strdup( list, domain_name );
3924                 list[i].dns_name = talloc_strdup( list, dns_name );
3925                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
3926                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
3927                                   domain_name));
3928                 }
3929                 list[i].trust_flags = flags;
3930                 list[i].trust_attribs = attribs;
3931                 list[i].trust_type = type;
3932         }
3933
3934         *domains = list;
3935
3936         return num_domains;
3937 }
3938
3939 /*********************************************************************
3940  ********************************************************************/
3941
3942 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
3943 {
3944         TDB_DATA key = make_tdc_key( lp_workgroup() );
3945         TDB_DATA data = { NULL, 0 };
3946         int ret;
3947
3948         if ( !key.dptr )
3949                 return false;
3950
3951         /* See if we were asked to delete the cache entry */
3952
3953         if ( !domains ) {
3954                 ret = tdb_delete( wcache->tdb, key );
3955                 goto done;
3956         }
3957
3958         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
3959
3960         if ( !data.dptr ) {
3961                 ret = -1;
3962                 goto done;
3963         }
3964
3965         ret = tdb_store( wcache->tdb, key, data, 0 );
3966
3967  done:
3968         SAFE_FREE( data.dptr );
3969         SAFE_FREE( key.dptr );
3970
3971         return ( ret != -1 );
3972 }
3973
3974 /*********************************************************************
3975  ********************************************************************/
3976
3977 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
3978 {
3979         TDB_DATA key = make_tdc_key( lp_workgroup() );
3980         TDB_DATA data = { NULL, 0 };
3981
3982         *domains = NULL;
3983         *num_domains = 0;
3984
3985         if ( !key.dptr )
3986                 return false;
3987
3988         data = tdb_fetch( wcache->tdb, key );
3989
3990         SAFE_FREE( key.dptr );
3991
3992         if ( !data.dptr )
3993                 return false;
3994
3995         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
3996
3997         SAFE_FREE( data.dptr );
3998
3999         if ( !*domains )
4000                 return false;
4001
4002         return true;
4003 }
4004
4005 /*********************************************************************
4006  ********************************************************************/
4007
4008 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4009 {
4010         struct winbindd_tdc_domain *dom_list = NULL;
4011         size_t num_domains = 0;
4012         bool ret = false;
4013
4014         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4015                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4016                   domain->name, domain->alt_name,
4017                   sid_string_dbg(&domain->sid),
4018                   domain->domain_flags,
4019                   domain->domain_trust_attribs,
4020                   domain->domain_type));
4021
4022         if ( !init_wcache() ) {
4023                 return false;
4024         }
4025
4026         /* fetch the list */
4027
4028         wcache_tdc_fetch_list( &dom_list, &num_domains );
4029
4030         /* add the new domain */
4031
4032         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4033                 goto done;
4034         }
4035
4036         /* pack the domain */
4037
4038         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4039                 goto done;
4040         }
4041
4042         /* Success */
4043
4044         ret = true;
4045  done:
4046         TALLOC_FREE( dom_list );
4047
4048         return ret;
4049 }
4050
4051 /*********************************************************************
4052  ********************************************************************/
4053
4054 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4055 {
4056         struct winbindd_tdc_domain *dom_list = NULL;
4057         size_t num_domains = 0;
4058         int i;
4059         struct winbindd_tdc_domain *d = NULL;
4060
4061         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4062
4063         if ( !init_wcache() ) {
4064                 return false;
4065         }
4066
4067         /* fetch the list */
4068
4069         wcache_tdc_fetch_list( &dom_list, &num_domains );
4070
4071         for ( i=0; i<num_domains; i++ ) {
4072                 if ( strequal(name, dom_list[i].domain_name) ||
4073                      strequal(name, dom_list[i].dns_name) )
4074                 {
4075                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4076                                   name));
4077
4078                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4079                         if ( !d )
4080                                 break;
4081
4082                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4083                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4084                         sid_copy( &d->sid, &dom_list[i].sid );
4085                         d->trust_flags   = dom_list[i].trust_flags;
4086                         d->trust_type    = dom_list[i].trust_type;
4087                         d->trust_attribs = dom_list[i].trust_attribs;
4088
4089                         break;
4090                 }
4091         }
4092
4093         TALLOC_FREE( dom_list );
4094
4095         return d;
4096 }
4097
4098
4099 /*********************************************************************
4100  ********************************************************************/
4101
4102 void wcache_tdc_clear( void )
4103 {
4104         if ( !init_wcache() )
4105                 return;
4106
4107         wcache_tdc_store_list( NULL, 0 );
4108
4109         return;
4110 }
4111
4112
4113 /*********************************************************************
4114  ********************************************************************/
4115
4116 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4117                                     NTSTATUS status,
4118                                     const DOM_SID *user_sid,
4119                                     const char *homedir,
4120                                     const char *shell,
4121                                     const char *gecos,
4122                                     uint32 gid)
4123 {
4124         struct cache_entry *centry;
4125         fstring tmp;
4126
4127         if ( (centry = centry_start(domain, status)) == NULL )
4128                 return;
4129
4130         centry_put_string( centry, homedir );
4131         centry_put_string( centry, shell );
4132         centry_put_string( centry, gecos );
4133         centry_put_uint32( centry, gid );
4134
4135         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4136
4137         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4138
4139         centry_free(centry);
4140 }
4141
4142 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4143                               const DOM_SID *user_sid,
4144                               TALLOC_CTX *ctx,
4145                               ADS_STRUCT *ads, LDAPMessage *msg,
4146                               const char **homedir, const char **shell,
4147                               const char **gecos, gid_t *p_gid)
4148 {
4149         struct winbind_cache *cache = get_cache(domain);
4150         struct cache_entry *centry = NULL;
4151         NTSTATUS nt_status;
4152         fstring tmp;
4153
4154         if (!cache->tdb)
4155                 goto do_query;
4156
4157         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4158                               sid_to_fstring(tmp, user_sid));
4159
4160         if (!centry)
4161                 goto do_query;
4162
4163         *homedir = centry_string( centry, ctx );
4164         *shell   = centry_string( centry, ctx );
4165         *gecos   = centry_string( centry, ctx );
4166         *p_gid   = centry_uint32( centry );
4167
4168         centry_free(centry);
4169
4170         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4171                   sid_string_dbg(user_sid)));
4172
4173         return NT_STATUS_OK;
4174
4175 do_query:
4176
4177         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4178                                   homedir, shell, gecos, p_gid );
4179
4180         DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4181
4182         if ( NT_STATUS_IS_OK(nt_status) ) {
4183                 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4184                 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4185                 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4186                 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4187
4188                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4189                                          *homedir, *shell, *gecos, *p_gid );
4190         }
4191
4192         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4193                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4194                          domain->name ));
4195                 set_domain_offline( domain );
4196         }
4197
4198         return nt_status;
4199 }
4200
4201
4202 /* the cache backend methods are exposed via this structure */
4203 struct winbindd_methods cache_methods = {
4204         true,
4205         query_user_list,
4206         enum_dom_groups,
4207         enum_local_groups,
4208         name_to_sid,
4209         sid_to_name,
4210         rids_to_names,
4211         query_user,
4212         lookup_usergroups,
4213         lookup_useraliases,
4214         lookup_groupmem,
4215         sequence_number,
4216         lockout_policy,
4217         password_policy,
4218         trusted_domains
4219 };
4220
4221 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4222                            uint32_t opnum, const DATA_BLOB *req,
4223                            TDB_DATA *pkey)
4224 {
4225         char *key;
4226         size_t keylen;
4227
4228         key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4229         if (key == NULL) {
4230                 return false;
4231         }
4232         keylen = talloc_get_size(key) - 1;
4233
4234         key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4235         if (key == NULL) {
4236                 return false;
4237         }
4238         memcpy(key + keylen, req->data, req->length);
4239
4240         pkey->dptr = (uint8_t *)key;
4241         pkey->dsize = talloc_get_size(key);
4242         return true;
4243 }
4244
4245 static bool wcache_opnum_cacheable(uint32_t opnum)
4246 {
4247         switch (opnum) {
4248         case NDR_WBINT_PING:
4249         case NDR_WBINT_QUERYSEQUENCENUMBER:
4250         case NDR_WBINT_ALLOCATEUID:
4251         case NDR_WBINT_ALLOCATEGID:
4252         case NDR_WBINT_CHECKMACHINEACCOUNT:
4253         case NDR_WBINT_CHANGEMACHINEACCOUNT:
4254         case NDR_WBINT_PINGDC:
4255                 return false;
4256         }
4257         return true;
4258 }
4259
4260 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4261                       uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4262 {
4263         TDB_DATA key, data;
4264         bool ret = false;
4265
4266         if (!wcache_opnum_cacheable(opnum)) {
4267                 return false;
4268         }
4269
4270         if (wcache->tdb == NULL) {
4271                 return false;
4272         }
4273
4274         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4275                 return false;
4276         }
4277         data = tdb_fetch(wcache->tdb, key);
4278         TALLOC_FREE(key.dptr);
4279
4280         if (data.dptr == NULL) {
4281                 return false;
4282         }
4283         if (data.dsize < 4) {
4284                 goto fail;
4285         }
4286
4287         if (!is_domain_offline(domain)) {
4288                 uint32_t entry_seqnum, dom_seqnum, last_check;
4289
4290                 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4291                                          &last_check)) {
4292                         goto fail;
4293                 }
4294                 entry_seqnum = IVAL(data.dptr, 0);
4295                 if (entry_seqnum != dom_seqnum) {
4296                         DEBUG(10, ("Entry has wrong sequence number: %d\n",
4297                                    (int)entry_seqnum));
4298                         goto fail;
4299                 }
4300         }
4301
4302         resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4303                                               data.dsize - 4);
4304         if (resp->data == NULL) {
4305                 DEBUG(10, ("talloc failed\n"));
4306                 goto fail;
4307         }
4308         resp->length = data.dsize - 4;
4309
4310         ret = true;
4311 fail:
4312         SAFE_FREE(data.dptr);
4313         return ret;
4314 }
4315
4316 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4317                       const DATA_BLOB *req, const DATA_BLOB *resp)
4318 {
4319         TDB_DATA key, data;
4320         uint32_t dom_seqnum, last_check;
4321
4322         if (!wcache_opnum_cacheable(opnum)) {
4323                 return;
4324         }
4325
4326         if (wcache->tdb == NULL) {
4327                 return;
4328         }
4329
4330         if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4331                 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4332                            domain->name));
4333                 return;
4334         }
4335
4336         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4337                 return;
4338         }
4339
4340         data.dsize = resp->length + 4;
4341         data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4342         if (data.dptr == NULL) {
4343                 goto done;
4344         }
4345
4346         SIVAL(data.dptr, 0, dom_seqnum);
4347         memcpy(data.dptr+4, resp->data, resp->length);
4348
4349         tdb_store(wcache->tdb, key, data, 0);
4350
4351 done:
4352         TALLOC_FREE(key.dptr);
4353         return;
4354 }