Changeset 228 for branches/samba-3.2.x/source/winbindd

Timestamp:

May 26, 2009, 9:44:50 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.6

Location:

branches/samba-3.2.x/source/winbindd

Files:

• idmap_tdb2.c (modified) (4 diffs)
• winbindd.c (modified) (2 diffs)
• winbindd_ads.c (modified) (22 diffs)
• winbindd_async.c (modified) (1 diff)
• winbindd_cm.c (modified) (1 diff)
• winbindd_dual.c (modified) (5 diffs)
• winbindd_group.c (modified) (12 diffs)
• winbindd_pam.c (modified) (1 diff)
• winbindd_passdb.c (modified) (3 diffs)
• winbindd_proto.h (modified) (2 diffs)
• winbindd_rpc.c (modified) (7 diffs)
• winbindd_user.c (modified) (1 diff)
• winbindd_util.c (modified) (7 diffs)

branches/samba-3.2.x/source/winbindd/idmap_tdb2.c

@@ -236 +236 @@
 
         status = idmap_tdb2_open_perm_db();
-        NT_STATUS_NOT_OK_RETURN(status);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         /* Get current high water mark */
@@ -298 +300 @@
         uint32_t hwm;
         uint32_t high_hwm;
+        NTSTATUS status;
+
+        status = idmap_tdb2_open_perm_db();
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         /* Get current high water mark */
@@ -553 +561 @@
         TDB_DATA data;
         char *keystr;
+        NTSTATUS status;
+
+        status = idmap_tdb2_open_perm_db();
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         if (!ctx || !map) {
@@ -648 +662 @@
         char *keystr;
         unsigned long rec_id = 0;
+        NTSTATUS status;
+
+        status = idmap_tdb2_open_perm_db();
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         if ((keystr = sid_string_talloc(ctx, map->sid)) == NULL) {

branches/samba-3.2.x/source/winbindd/winbindd.c

@@ -746 +746 @@
 static void remove_client(struct winbindd_cli_state *state)
 {
+        char c = 0;
+
         /* It's a dead client - hold a funeral */
         
@@ -751 +753 @@
                 return;
         }
-                
+
+        /* tell client, we are closing ... */
+        write(state->sock, &c, sizeof(c));
+
         /* Close socket */
                 

branches/samba-3.2.x/source/winbindd/winbindd_ads.c

@@ -402 +402 @@
 }
 
+/* convert a single name to a sid in a domain - use rpc methods */
+static NTSTATUS name_to_sid(struct winbindd_domain *domain,
+                            TALLOC_CTX *mem_ctx,
+                            enum winbindd_cmd orig_cmd,
+                            const char *domain_name,
+                            const char *name,
+                            DOM_SID *sid,
+                            enum lsa_SidType *type)
+{
+        return reconnect_methods.name_to_sid(domain, mem_ctx, orig_cmd,
+                                             domain_name, name,
+                                             sid, type);
+}
+
+/* convert a domain SID to a user or group name - use rpc methods */
+static NTSTATUS sid_to_name(struct winbindd_domain *domain,
+                            TALLOC_CTX *mem_ctx,
+                            const DOM_SID *sid,
+                            char **domain_name,
+                            char **name,
+                            enum lsa_SidType *type)
+{
+        return reconnect_methods.sid_to_name(domain, mem_ctx, sid,
+                                             domain_name, name, type);
+}
+
+/* convert a list of rids to names - use rpc methods */
+static NTSTATUS rids_to_names(struct winbindd_domain *domain,
+                              TALLOC_CTX *mem_ctx,
+                              const DOM_SID *sid,
+                              uint32 *rids,
+                              size_t num_rids,
+                              char **domain_name,
+                              char ***names,
+                              enum lsa_SidType **types)
+{
+        return reconnect_methods.rids_to_names(domain, mem_ctx, sid,
+                                               rids, num_rids,
+                                               domain_name, names, types);
+}
+
 /* If you are looking for "dn_lookup": Yes, it used to be here!
  * It has gone now since it was a major speed bottleneck in
@@ -642 +683 @@
 static NTSTATUS lookup_usergroups_memberof(struct winbindd_domain *domain,
                                            TALLOC_CTX *mem_ctx,
-                                           const char *user_dn, 
+                                           const char *user_dn,
                                            DOM_SID *primary_group,
-                                           size_t *p_num_groups, DOM_SID **user_sids)
+                                           size_t *p_num_groups,
+                                           DOM_SID **user_sids)
 {
         ADS_STATUS rc;
@@ -653 +695 @@
         DOM_SID *group_sids = NULL;
         int i;
-        char **strings;
-        size_t num_strings = 0;
+        char **strings = NULL;
+        size_t num_strings = 0, num_sids = 0;
 
 
@@ -660 +702 @@
 
         if ( !winbindd_can_contact_domain( domain ) ) {
-                DEBUG(10,("lookup_usergroups_memberof: No incoming trust for domain %s\n",
-                          domain->name));               
+                DEBUG(10,("lookup_usergroups_memberof: No incoming trust for "
+                          "domain %s\n", domain->name));
                 return NT_STATUS_OK;
         }
@@ -669 +711 @@
         if (!ads) {
                 domain->last_status = NT_STATUS_SERVER_DISABLED;
-                goto done;
-        }
-
-        rc = ads_search_retry_extended_dn_ranged(ads, mem_ctx, user_dn, attrs, 
-                                                 ADS_EXTENDED_DN_HEX_STRING, 
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        rc = ads_search_retry_extended_dn_ranged(ads, mem_ctx, user_dn, attrs,
+                                                 ADS_EXTENDED_DN_HEX_STRING,
                                                  &strings, &num_strings);
 
         if (!ADS_ERR_OK(rc)) {
-                DEBUG(1,("lookup_usergroups_memberof ads_search member=%s: %s\n", 
-                        user_dn, ads_errstr(rc)));
+                DEBUG(1,("lookup_usergroups_memberof ads_search "
+                        "member=%s: %s\n", user_dn, ads_errstr(rc)));
                 return ads_ntstatus(rc);
         }
-        
+
         *user_sids = NULL;
         num_groups = 0;
@@ -694 +736 @@
         group_sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_strings + 1);
         if (!group_sids) {
-                TALLOC_FREE(strings);
                 status = NT_STATUS_NO_MEMORY;
                 goto done;
@@ -700 +741 @@
 
         for (i=0; i<num_strings; i++) {
-
-                if (!ads_get_sid_from_extended_dn(mem_ctx, strings[i], 
-                                                  ADS_EXTENDED_DN_HEX_STRING, 
-                                                  &(group_sids)[i])) {
-                        TALLOC_FREE(group_sids);
-                        TALLOC_FREE(strings);
-                        status = NT_STATUS_NO_MEMORY;
-                        goto done;
-                }
+                rc = ads_get_sid_from_extended_dn(mem_ctx, strings[i],
+                                                  ADS_EXTENDED_DN_HEX_STRING,
+                                                  &(group_sids)[i]);
+                if (!ADS_ERR_OK(rc)) {
+                        /* ignore members without SIDs */
+                        if (NT_STATUS_EQUAL(ads_ntstatus(rc),
+                            NT_STATUS_NOT_FOUND)) {
+                                continue;
+                        }
+                        else {
+                                status = ads_ntstatus(rc);
+                                goto done;
+                        }
+                }
+                num_sids++;
         }
 
@@ -717 +764 @@
         }
 
-        for (i=0; i<num_strings; i++) {
+        for (i=0; i<num_sids; i++) {
 
                 /* ignore Builtin groups from ADS - Guenther */
@@ -729 +776 @@
                         goto done;
                 }
-        
+
         }
 
@@ -735 +782 @@
         status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 
-        DEBUG(3,("ads lookup_usergroups (memberof) succeeded for dn=%s\n", user_dn));
+        DEBUG(3,("ads lookup_usergroups (memberof) succeeded for dn=%s\n",
+                user_dn));
+
 done:
+        TALLOC_FREE(strings);
         TALLOC_FREE(group_sids);
 
@@ -895 +945 @@
 }
 
+/* Lookup aliases a user is member of - use rpc methods */
+static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
+                                   TALLOC_CTX *mem_ctx,
+                                   uint32 num_sids, const DOM_SID *sids,
+                                   uint32 *num_aliases, uint32 **alias_rids)
+{
+        return reconnect_methods.lookup_useraliases(domain, mem_ctx,
+                                                    num_sids, sids,
+                                                    num_aliases,
+                                                    alias_rids);
+}
+
 /*
   find the members of a group, given a group rid and domain
@@ -900 +962 @@
 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                const DOM_SID *group_sid, uint32 *num_names, 
-                                DOM_SID **sid_mem, char ***names, 
+                                const DOM_SID *group_sid, uint32 *num_names,
+                                DOM_SID **sid_mem, char ***names,
                                 uint32 **name_types)
 {
@@ -922 +984 @@
         TALLOC_CTX *tmp_ctx = NULL;
 
-        DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name, 
+        DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
                   sid_string_dbg(group_sid)));
 
@@ -936 +998 @@
         if ( !winbindd_can_contact_domain( domain ) ) {
                 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
-                          domain->name));               
+                          domain->name));
                 return NT_STATUS_OK;
         }
 
         ads = ads_cached_connection(domain);
-        
+
         if (!ads) {
                 domain->last_status = NT_STATUS_SERVER_DISABLED;
@@ -953 +1015 @@
 
         /* search for all members of the group */
-        if (!(ldap_exp = talloc_asprintf(tmp_ctx, "(objectSid=%s)", 
-                                         sidbinstr))) 
+        if (!(ldap_exp = talloc_asprintf(tmp_ctx, "(objectSid=%s)",
+                                         sidbinstr)))
         {
                 SAFE_FREE(sidbinstr);
@@ -967 +1029 @@
         args.critical = True;
 
-        rc = ads_ranged_search(ads, tmp_ctx, LDAP_SCOPE_SUBTREE, ads->config.bind_path, 
+        rc = ads_ranged_search(ads, tmp_ctx, LDAP_SCOPE_SUBTREE, ads->config.bind_path,
                                ldap_exp, &args, "member", &members, &num_members);
 
@@ -974 +1036 @@
                 status = NT_STATUS_UNSUCCESSFUL;
                 goto done;
-        } 
-        
+        }
+
         DEBUG(10, ("ads lookup_groupmem: got %d sids via extended dn call\n", (int)num_members));
-        
+
         /* Now that we have a list of sids, we need to get the
          * lists of names and name_types belonging to these sids.
-         * even though conceptually not quite clean,  we use the 
-         * RPC call lsa_lookup_sids for this since it can handle a 
+         * even though conceptually not quite clean,  we use the
+         * RPC call lsa_lookup_sids for this since it can handle a
          * list of sids. ldap calls can just resolve one sid at a time.
          *
@@ -989 +1051 @@
          * we try to resolve as many sids as possible from the
          * cache. Only the rest is passed to the lsa_lookup_sids call. */
-        
+
         if (num_members) {
                 (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
@@ -1016 +1078 @@
                 DOM_SID sid;
 
-                if (!ads_get_sid_from_extended_dn(tmp_ctx, members[i], args.val, &sid)) {
-                        status = NT_STATUS_INVALID_PARAMETER;
-                        goto done;
-                }
-                if (lookup_cached_sid(mem_ctx, &sid, &domain_name, &name, &name_type)) {
+                rc = ads_get_sid_from_extended_dn(tmp_ctx, members[i], args.val,
+                    &sid);
+                if (!ADS_ERR_OK(rc)) {
+                        if (NT_STATUS_EQUAL(ads_ntstatus(rc),
+                            NT_STATUS_NOT_FOUND)) {
+                                /* Group members can be objects, like Exchange
+                                 * Public Folders, that don't have a SID.  Skip
+                                 * them. */
+                                continue;
+                        }
+                        else {
+                                status = ads_ntstatus(rc);
+                                goto done;
+                        }
+                }
+                if (lookup_cached_sid(mem_ctx, &sid, &domain_name, &name,
+                    &name_type)) {
                         DEBUG(10,("ads: lookup_groupmem: got sid %s from "
                                   "cache\n", sid_string_dbg(&sid)));
                         sid_copy(&(*sid_mem)[*num_names], &sid);
-                        (*names)[*num_names] = talloc_asprintf(*names, "%s%c%s",
-                                                               domain_name,
-                                                               *lp_winbind_separator(),
-                                                               name );
+                        (*names)[*num_names] = fill_domain_username_talloc(
+                                                        *names,
+                                                        domain_name,
+                                                        name,
+                                                        true);
 
                         (*name_types)[*num_names] = name_type;
@@ -1052 +1127 @@
                 }
 
-                status = rpccli_lsa_lookup_sids(cli, tmp_ctx, 
+                status = rpccli_lsa_lookup_sids(cli, tmp_ctx,
                                                 &lsa_policy,
-                                                num_nocache, 
-                                                sid_mem_nocache, 
-                                                &domains_nocache, 
-                                                &names_nocache, 
+                                                num_nocache,
+                                                sid_mem_nocache,
+                                                &domains_nocache,
+                                                &names_nocache,
                                                 &name_types_nocache);
 
+                if (!(NT_STATUS_IS_OK(status) ||
+                      NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED) ||
+                      NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)))
+                {
+                        DEBUG(1, ("lsa_lookupsids call failed with %s "
+                                  "- retrying...\n", nt_errstr(status)));
+
+                        status = cm_connect_lsa(domain, tmp_ctx, &cli,
+                                                &lsa_policy);
+
+                        if (!NT_STATUS_IS_OK(status)) {
+                                goto done;
+                        }
+
+                        status = rpccli_lsa_lookup_sids(cli, tmp_ctx,
+                                                        &lsa_policy,
+                                                        num_nocache,
+                                                        sid_mem_nocache,
+                                                        &domains_nocache,
+                                                        &names_nocache,
+                                                        &name_types_nocache);
+                }
+
                 if (NT_STATUS_IS_OK(status) ||
-                    NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) 
+                    NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED))
                 {
-                        /* Copy the entries over from the "_nocache" arrays 
-                         * to the result arrays, skipping the gaps the 
+                        /* Copy the entries over from the "_nocache" arrays
+                         * to the result arrays, skipping the gaps the
                          * lookup_sids call left. */
                         for (i=0; i < num_nocache; i++) {
-                                if (((names_nocache)[i] != NULL) && 
-                                    ((name_types_nocache)[i] != SID_NAME_UNKNOWN)) 
+                                if (((names_nocache)[i] != NULL) &&
+                                    ((name_types_nocache)[i] != SID_NAME_UNKNOWN))
                                 {
                                         sid_copy(&(*sid_mem)[*num_names],
                                                  &sid_mem_nocache[i]);
-                                        (*names)[*num_names] = talloc_asprintf( *names, 
-                                                                                "%s%c%s",
-                                                                                domains_nocache[i],
-                                                                                *lp_winbind_separator(),
-                                                                                names_nocache[i] );
+                                        (*names)[*num_names] =
+                                                fill_domain_username_talloc(
+                                                        *names,
+                                                        domains_nocache[i],
+                                                        names_nocache[i],
+                                                        true);
                                         (*name_types)[*num_names] = name_types_nocache[i];
                                         (*num_names)++;
@@ -1147 +1246 @@
         }
         return ads_ntstatus(rc);
+}
+
+/* find the lockout policy of a domain - use rpc methods */
+static NTSTATUS lockout_policy(struct winbindd_domain *domain,
+                               TALLOC_CTX *mem_ctx,
+                               struct samr_DomInfo12 *policy)
+{
+        return reconnect_methods.lockout_policy(domain, mem_ctx, policy);
+}
+
+/* find the password policy of a domain - use rpc methods */
+static NTSTATUS password_policy(struct winbindd_domain *domain,
+                                TALLOC_CTX *mem_ctx,
+                                struct samr_DomInfo1 *policy)
+{
+        return reconnect_methods.password_policy(domain, mem_ctx, policy);
 }
 
@@ -1339 +1454 @@
         enum_dom_groups,
         enum_local_groups,
-        msrpc_name_to_sid,
-        msrpc_sid_to_name,
-        msrpc_rids_to_names,
+        name_to_sid,
+        sid_to_name,
+        rids_to_names,
         query_user,
         lookup_usergroups,
-        msrpc_lookup_useraliases,
+        lookup_useraliases,
         lookup_groupmem,
         sequence_number,
-        msrpc_lockout_policy,
-        msrpc_password_policy,
+        lockout_policy,
+        password_policy,
         trusted_domains,
 };

branches/samba-3.2.x/source/winbindd/winbindd_async.c

@@ -367 +367 @@
 /********************************************************************
  The lookup name call first contacts a DC in its own domain
- and fallbacks to contact a DC in the forest in our domain doesn't
+ and fallbacks to contact a DC if the forest in our domain doesn't
  know the name.
 ********************************************************************/

branches/samba-3.2.x/source/winbindd/winbindd_cm.c

@@ -1010 +1010 @@
         /* Make sure there's no duplicates in the list */
         for (i=0; i<*num; i++)
-                if (addr_equal(&(*dcs)[i].ss, pss))
+                if (sockaddr_equal(&(*dcs)[i].ss, pss))
                         return False;
 

branches/samba-3.2.x/source/winbindd/winbindd_dual.c

@@ -121 +121 @@
         SMB_ASSERT(continuation != NULL);
 
+        DEBUG(10, ("Sending request to child pid %d (domain=%s)\n",
+                (int)child->pid,
+                (child->domain != NULL) ? child->domain->name : "''"));
+
         state = TALLOC_P(mem_ctx, struct winbindd_async_request);
 
@@ -197 +201 @@
         TALLOC_FREE(state->reply_timeout_event);
 
-        SMB_ASSERT(state->child_pid != (pid_t)0);
-
-        /* If not already reaped, send kill signal to child. */
-        if (state->child->pid == state->child_pid) {
+        /* If child exists and is not already reaped,
+           send kill signal to child. */
+
+        if ((state->child->pid != (pid_t)0) &&
+                        (state->child->pid != (pid_t)-1) &&
+                        (state->child->pid == state->child_pid)) {
                 kill(state->child_pid, SIGTERM);
 
@@ -295 +301 @@
         }
 
+        /*
+         * This may be a reschedule, so we might
+         * have an existing timeout event pending on
+         * the first entry in the child->requests list
+         * (we only send one request at a time).
+         * Ensure we free it before we reschedule.
+         * Bug #5814, from hargagan <shargagan@novell.com>.
+         * JRA.
+         */
+
+        TALLOC_FREE(request->reply_timeout_event);
+
         if ((child->pid == 0) && (!fork_domain_child(child))) {
-                /* Cancel all outstanding requests */
+                /* fork_domain_child failed.
+                   Cancel all outstanding requests */
 
                 while (request != NULL) {
                         /* request might be free'd in the continuation */
                         struct winbindd_async_request *next = request->next;
-                        request->continuation(request->private_data, False);
+
+                        async_request_fail(request);
                         request = next;
                 }
@@ -487 +507 @@
         child->event.flags = 0;
         child->pid = 0;
+
+        if (child->requests) {
+                /*
+                 * schedule_async_request() will also
+                 * clear this event but the call is
+                 * idempotent so it doesn't hurt to
+                 * cover all possible future code
+                 * paths. JRA.
+                 */
+                TALLOC_FREE(child->requests->reply_timeout_event);
+        }
 
         schedule_async_request(child);
@@ -1118 +1149 @@
                 set_domain_online_request(child->domain);
 
-                if (primary_domain != child->domain) {
+                if (primary_domain && (primary_domain != child->domain)) {
                         /* We need to talk to the primary
                          * domain as well as the trusted

branches/samba-3.2.x/source/winbindd/winbindd_group.c

@@ -36 +36 @@
         fstring name;
 
-        fill_domain_username(name, domain, user, True);
+        if (domain != NULL) {
+                fill_domain_username(name, domain, user, True);
+        } else {
+                fstrcpy(name, user);
+        }
         safe_strcat(name, ",", sizeof(name)-1);
         string_append(pp_members, name);
@@ -135 +139 @@
                 }
 
-                add_member(domain->name, names[i], pp_members, p_num_members);
+                add_member(NULL, names[i], pp_members, p_num_members);
         }
 
@@ -332 +336 @@
 }
 
+static void sort_unique_list(char ***list, uint32 *n_list)
+{
+        uint32_t i;
+
+        /* search for duplicates for sorting and looking for matching
+           neighbors */
+
+        qsort(*list, *n_list, sizeof(char*), QSORT_CAST namecmp);
+
+        for (i=1; i < *n_list; i++) {
+                if (strcmp((*list)[i-1], (*list)[i]) == 0) {
+                        memmove(&((*list)[i-1]), &((*list)[i]),
+                                 sizeof(char*)*((*n_list)-i));
+                        (*n_list)--;
+                }
+        }
+}
+
 static NTSTATUS add_names_to_list( TALLOC_CTX *ctx, 
                                    char ***list, uint32 *n_list, 
@@ -361 +383 @@
         for ( i=*n_list, j=0; i<n_new_list; i++, j++ ) {
                 new_list[i] = talloc_strdup( new_list, names[j] );
-        }
-
-        /* search for duplicates for sorting and looking for matching
-           neighbors */
-        
-        qsort( new_list, n_new_list, sizeof(char*), QSORT_CAST namecmp );
-        
-        for ( i=1; i<n_new_list; i++ ) {
-                if ( strcmp( new_list[i-1], new_list[i] ) == 0 ) {                      
-                        memmove( &new_list[i-1], &new_list[i], 
-                                 sizeof(char*)*(n_new_list-i) );
-                        n_new_list--;
-                }
         }
 
@@ -528 +537 @@
 
         /* Real work goes here.  Create a list of group names to
-           expand startign with the initial one.  Pass that to 
+           expand starting with the initial one.  Pass that to
            expand_groups() which returns a list of more group names
            to expand.  Do this up to the max search depth. */
@@ -577 +586 @@
         }
         TALLOC_FREE( glist );   
-         
+
+        sort_unique_list(&names, &num_names);
+
         DEBUG(10, ("looked up %d names\n", num_names));
 
@@ -697 +708 @@
         /* Get info for the domain */
 
-        if ((domain = find_domain_from_name(name_domain)) == NULL) {
+        if ((domain = find_domain_from_name_noinit(name_domain)) == NULL) {
                 DEBUG(3, ("could not get domain sid for domain %s\n",
                           name_domain));
@@ -730 +741 @@
 
 static void getgrsid_sid2gid_recv(void *private_data, bool success, gid_t gid)
-        {
+{
         struct getgrsid_state *s =
                 (struct getgrsid_state *)private_data;
@@ -780 +791 @@
 
         request_ok(s->state);   
-        }
+}
 
 static void getgrsid_lookupsid_recv( void *private_data, bool success,
@@ -805 +816 @@
                 request_error(s->state);
                 return;
-}
+        }
 
         if ( (s->group_name = talloc_asprintf( s->state->mem_ctx, 
@@ -812 +823 @@
                                                *lp_winbind_separator(),
                                                name)) == NULL )
-{
+        {
                 DEBUG(1, ("getgrsid_lookupsid_recv: talloc_asprintf() Failed!\n"));
                 request_error(s->state);
@@ -822 +833 @@
         winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
                                getgrsid_sid2gid_recv, s);
-        }
+}
 
 static void winbindd_getgrsid( struct winbindd_cli_state *state, const DOM_SID group_sid )
-        {
+{
         struct getgrsid_state *s;
 

branches/samba-3.2.x/source/winbindd/winbindd_pam.c

@@ -1833 +1833 @@
         if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
                 || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
-                DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n", 
-                          state->request.data.auth_crap.lm_resp_len, 
-                          state->request.data.auth_crap.nt_resp_len));
-                result = NT_STATUS_INVALID_PARAMETER;
-                goto done;
+                if (!state->request.flags & WBFLAG_BIG_NTLMV2_BLOB ||
+                     state->request.extra_len != state->request.data.auth_crap.nt_resp_len) {
+                        DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
+                                  state->request.data.auth_crap.lm_resp_len,
+                                  state->request.data.auth_crap.nt_resp_len));
+                                  result = NT_STATUS_INVALID_PARAMETER;
+                        goto done;
+                }
         }
 
         lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
                                         state->request.data.auth_crap.lm_resp_len);
-        nt_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.nt_resp,
-                                        state->request.data.auth_crap.nt_resp_len);
+
+        if (state->request.flags & WBFLAG_BIG_NTLMV2_BLOB) {
+                nt_resp = data_blob_talloc(state->mem_ctx,
+                                           state->request.extra_data.data,
+                                           state->request.data.auth_crap.nt_resp_len);
+        } else {
+                nt_resp = data_blob_talloc(state->mem_ctx,
+                                           state->request.data.auth_crap.nt_resp,
+                                           state->request.data.auth_crap.nt_resp_len);
+        }
 
         /* what domain should we contact? */

branches/samba-3.2.x/source/winbindd/winbindd_passdb.c

@@ -268 +268 @@
 
         if ( !pdb_getsampwsid( user, user_sid ) ) {
+                TALLOC_FREE( user );
                 return NT_STATUS_NO_SUCH_USER;
         }
@@ -639 +640 @@
                         continue;
                 }
-                if (!((*names)[i] = talloc_strdup((*names),
+                if (!((*names)[num_mapped] = talloc_strdup((*names),
                                                   lsa_names[i].name))) {
                         TALLOC_FREE(tmp_ctx);
@@ -645 +646 @@
                 }
 
-                (*name_types)[i] = lsa_names[i].type;
+                (*name_types)[num_mapped] = lsa_names[i].type;
 
                 num_mapped += 1;

branches/samba-3.2.x/source/winbindd/winbindd_proto.h

@@ -447 +447 @@
 /* The following definitions come from winbindd/winbindd_rpc.c  */
 
-NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
-                           TALLOC_CTX *mem_ctx,
-                           enum winbindd_cmd original_cmd,
-                           const char *domain_name,
-                           const char *name,
-                           DOM_SID *sid,
-                           enum lsa_SidType *type);
-NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
-                            TALLOC_CTX *mem_ctx,
-                            const DOM_SID *sid,
-                            char **domain_name,
-                            char **name,
-                            enum lsa_SidType *type);
-NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
-                             TALLOC_CTX *mem_ctx,
-                             const DOM_SID *sid,
-                             uint32 *rids,
-                             size_t num_rids,
-                             char **domain_name,
-                             char ***names,
-                             enum lsa_SidType **types);
-NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
-                                  TALLOC_CTX *mem_ctx,
-                                  uint32 num_sids, const DOM_SID *sids,
-                                  uint32 *num_aliases, uint32 **alias_rids);
-NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
-                              TALLOC_CTX *mem_ctx,
-                              struct samr_DomInfo12 *lockout_policy);
-NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
-                               TALLOC_CTX *mem_ctx,
-                               struct samr_DomInfo1 *password_policy);
 
 /* The following definitions come from winbindd/winbindd_sid.c  */
@@ -550 +519 @@
 bool canonicalize_username(fstring username_inout, fstring domain, fstring user);
 void fill_domain_username(fstring name, const char *domain, const char *user, bool can_assume);
+char *fill_domain_username_talloc(TALLOC_CTX *mem_ctx,
+                                  const char *domain,
+                                  const char *user,
+                                  bool can_assume);
 const char *get_winbind_pipe_dir(void) ;
 char *get_winbind_priv_pipe_dir(void) ;

branches/samba-3.2.x/source/winbindd/winbindd_rpc.c

@@ -266 +266 @@
 
 /* convert a single name to a sid in a domain */
-NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
-                           TALLOC_CTX *mem_ctx,
-                           enum winbindd_cmd original_cmd,
-                           const char *domain_name,
-                           const char *name,
-                           DOM_SID *sid,
-                           enum lsa_SidType *type)
+static NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
+                                  TALLOC_CTX *mem_ctx,
+                                  enum winbindd_cmd original_cmd,
+                                  const char *domain_name,
+                                  const char *name,
+                                  DOM_SID *sid,
+                                  enum lsa_SidType *type)
 {
         NTSTATUS result;
@@ -320 +320 @@
   convert a domain SID to a user or group name
 */
-NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
-                            TALLOC_CTX *mem_ctx,
-                            const DOM_SID *sid,
-                            char **domain_name,
-                            char **name,
-                            enum lsa_SidType *type)
+static NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
+                                  TALLOC_CTX *mem_ctx,
+                                  const DOM_SID *sid,
+                                  char **domain_name,
+                                  char **name,
+                                  enum lsa_SidType *type)
 {
         char **domains;
@@ -363 +363 @@
 }
 
-NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
-                             TALLOC_CTX *mem_ctx,
-                             const DOM_SID *sid,
-                             uint32 *rids,
-                             size_t num_rids,
-                             char **domain_name,
-                             char ***names,
-                             enum lsa_SidType **types)
+static NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
+                                    TALLOC_CTX *mem_ctx,
+                                    const DOM_SID *sid,
+                                    uint32 *rids,
+                                    size_t num_rids,
+                                    char **domain_name,
+                                    char ***names,
+                                    enum lsa_SidType **types)
 {
         char **domains;
@@ -603 +603 @@
 }
 
-NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
-                                  TALLOC_CTX *mem_ctx,
-                                  uint32 num_sids, const DOM_SID *sids,
-                                  uint32 *num_aliases, uint32 **alias_rids)
+static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
+                                         TALLOC_CTX *mem_ctx,
+                                         uint32 num_sids, const DOM_SID *sids,
+                                         uint32 *num_aliases,
+                                         uint32 **alias_rids)
 {
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
@@ -821 +822 @@
 
                 for (r=0; r<tmp_names.count; r++) {
-                        (*names)[i+r] = CONST_DISCARD(char *, tmp_names.names[r].string);
+                        (*names)[i+r] = fill_domain_username_talloc(mem_ctx,
+                                                domain->name,
+                                                tmp_names.names[r].string,
+                                                true);
                         (*name_types)[i+r] = tmp_types.ids[r];
                 }
@@ -1066 +1070 @@
 
 /* find the lockout policy for a domain */
-NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
-                              TALLOC_CTX *mem_ctx,
-                              struct samr_DomInfo12 *lockout_policy)
+static NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
+                                     TALLOC_CTX *mem_ctx,
+                                     struct samr_DomInfo12 *lockout_policy)
 {
         NTSTATUS result;
@@ -1107 +1111 @@
 
 /* find the password policy for a domain */
-NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
-                               TALLOC_CTX *mem_ctx,
-                               struct samr_DomInfo1 *password_policy)
+static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
+                                      TALLOC_CTX *mem_ctx,
+                                      struct samr_DomInfo1 *password_policy)
 {
         NTSTATUS result;

branches/samba-3.2.x/source/winbindd/winbindd_user.c

@@ -385 +385 @@
         /* Get info for the domain */
 
-        domain = find_domain_from_name(domname);
+        domain = find_domain_from_name_noinit(domname);
 
         if (domain == NULL) {

branches/samba-3.2.x/source/winbindd/winbindd_util.c

@@ -110 +110 @@
         struct winbindd_domain *domain;
         const char *alternative_name = NULL;
-        
+        const char **ignored_domains, **dom;
+
+        ignored_domains = lp_parm_string_list(-1, "winbind", "ignore domains", NULL);
+        for (dom=ignored_domains; dom && *dom; dom++) {
+                if (gen_fnmatch(*dom, domain_name) == 0) {
+                        DEBUG(2,("Ignoring domain '%s'\n", domain_name));
+                        return NULL;
+                }
+        }
+
         /* ignore alt_name if we are not in an AD domain */
-        
+
         if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) {
                 alternative_name = alt_name;
         }
-        
+
         /* We can't call domain_list() as this function is called from
            init_domain_list() and we'll get stuck in a loop. */
@@ -403 +412 @@
                 }
 
+                if (d == NULL) {
+                        continue;
+                }
+
                 DEBUG(10,("rescan_forest_root_trusts: Following trust path "
                           "for domain tree root %s (%s)\n",
@@ -466 +479 @@
                                                         &cache_methods,
                                                         &dom_list[i].sid );
+                        }
+
+                        if (d == NULL) {
+                                continue;
                         }
                         
@@ -1025 +1042 @@
 
         while(temp != NULL) {
-                struct getent_state *next;
+                struct getent_state *next = temp->next;
 
                 /* Free sam entries then list entry */
@@ -1031 +1048 @@
                 SAFE_FREE(state->sam_entries);
                 DLIST_REMOVE(state, state);
-                next = temp->next;
 
                 SAFE_FREE(temp);
@@ -1127 +1143 @@
         }
 
-        safe_strcpy(buf, user, *len);
+        safe_strcpy((char *)buf, user, *len);
 }
 
@@ -1180 +1196 @@
 }
 
+/**
+ * talloc version of fill_domain_username()
+ * return NULL on talloc failure.
+ */
+char *fill_domain_username_talloc(TALLOC_CTX *mem_ctx,
+                                  const char *domain,
+                                  const char *user,
+                                  bool can_assume)
+{
+        char *tmp_user, *name;
+
+        tmp_user = talloc_strdup(mem_ctx, user);
+        strlower_m(tmp_user);
+
+        if (can_assume && assume_domain(domain)) {
+                name = tmp_user;
+        } else {
+                name = talloc_asprintf(mem_ctx, "%s%c%s",
+                                       domain,
+                                       *lp_winbind_separator(),
+                                       tmp_user);
+                TALLOC_FREE(tmp_user);
+        }
+
+        return name;
+}
+
 /*
  * Winbindd socket accessor functions