Changeset 745 for trunk/server/source3/winbindd/winbindd_ads.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/winbindd/winbindd_ads.c (modified) (40 diffs)

trunk/server/source3/winbindd/winbindd_ads.c

@@ -24 +24 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "../librpc/gen_ndr/cli_netlogon.h"
+#include "rpc_client/rpc_client.h"
+#include "../librpc/gen_ndr/ndr_netlogon_c.h"
+#include "../libds/common/flags.h"
+#include "ads.h"
+#include "secrets.h"
+#include "../libcli/ldap/ldap_ndr.h"
+#include "../libcli/security/security.h"
+#include "../libds/common/flag_mapping.h"
+#include "passdb.h"
 
 #ifdef HAVE_ADS
@@ -153 +161 @@
                                TALLOC_CTX *mem_ctx,
                                uint32 *num_entries, 
-                               struct wbint_userinfo **info)
+                               struct wbint_userinfo **pinfo)
 {
         ADS_STRUCT *ads = NULL;
@@ -192 +200 @@
         }
 
-        (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct wbint_userinfo, count);
-        if (!*info) {
+        (*pinfo) = TALLOC_ZERO_ARRAY(mem_ctx, struct wbint_userinfo, count);
+        if (!*pinfo) {
                 status = NT_STATUS_NO_MEMORY;
                 goto done;
         }
 
-        i = 0;
+        count = 0;
 
         for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
-                const char *name;
-                const char *gecos = NULL;
-                const char *homedir = NULL;
-                const char *shell = NULL;
+                struct wbint_userinfo *info = &((*pinfo)[count]);
                 uint32 group;
                 uint32 atype;
-                DOM_SID user_sid;
-                gid_t primary_gid = (gid_t)-1;
 
                 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
@@ -216 +219 @@
                 }
 
-                name = ads_pull_username(ads, mem_ctx, msg);
-
-                if ( ads_pull_sid( ads, msg, "objectSid", &user_sid ) ) {
-                        status = nss_get_info_cached( domain, &user_sid, mem_ctx, 
-                                               ads, msg, &homedir, &shell, &gecos,
-                                               &primary_gid );
-                }
-
-                if (gecos == NULL) {
-                        gecos = ads_pull_string(ads, mem_ctx, msg, "name");
-                }
+                info->acct_name = ads_pull_username(ads, mem_ctx, msg);
+                info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
+                info->homedir = NULL;
+                info->shell = NULL;
+                info->primary_gid = (gid_t)-1;
 
                 if (!ads_pull_sid(ads, msg, "objectSid",
-                                  &(*info)[i].user_sid)) {
-                        DEBUG(1,("No sid for %s !?\n", name));
+                                  &info->user_sid)) {
+                        DEBUG(1, ("No sid for %s !?\n", info->acct_name));
                         continue;
                 }
+
                 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
-                        DEBUG(1,("No primary group for %s !?\n", name));
+                        DEBUG(1, ("No primary group for %s !?\n",
+                                  info->acct_name));
                         continue;
                 }
-
-                (*info)[i].acct_name = name;
-                (*info)[i].full_name = gecos;
-                (*info)[i].homedir = homedir;
-                (*info)[i].shell = shell;
-                (*info)[i].primary_gid = primary_gid;
-                sid_compose(&(*info)[i].group_sid, &domain->sid, group);
-                i++;
-        }
-
-        (*num_entries) = i;
+                sid_compose(&info->group_sid, &domain->sid, group);
+
+                count += 1;
+        }
+
+        (*num_entries) = count;
+        ads_msgfree(ads, res);
+
+        for (i=0; i<count; i++) {
+                struct wbint_userinfo *info = &((*pinfo)[i]);
+                const char *gecos = NULL;
+                gid_t primary_gid = (gid_t)-1;
+
+                status = nss_get_info_cached(domain, &info->user_sid, mem_ctx,
+                                             &info->homedir, &info->shell,
+                                             &gecos, &primary_gid);
+                if (!NT_STATUS_IS_OK(status)) {
+                        /*
+                         * Deliberately ignore this error, there might be more
+                         * users to fill
+                         */
+                        continue;
+                }
+
+                if (gecos != NULL) {
+                        info->full_name = gecos;
+                }
+                info->primary_gid = primary_gid;
+        }
+
         status = NT_STATUS_OK;
 
@@ -253 +271 @@
 
 done:
-        if (res) 
-                ads_msgfree(ads, res);
-
         return status;
 }
@@ -263 +278 @@
                                 TALLOC_CTX *mem_ctx,
                                 uint32 *num_entries, 
-                                struct acct_info **info)
+                                struct wb_acct_info **info)
 {
         ADS_STRUCT *ads = NULL;
@@ -337 +352 @@
         }
 
-        (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
+        (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct wb_acct_info, count);
         if (!*info) {
                 status = NT_STATUS_NO_MEMORY;
@@ -347 +362 @@
         for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
                 char *name, *gecos;
-                DOM_SID sid;
+                struct dom_sid sid;
                 uint32 rid;
 
@@ -385 +400 @@
                                 TALLOC_CTX *mem_ctx,
                                 uint32 *num_entries, 
-                                struct acct_info **info)
+                                struct wb_acct_info **info)
 {
         /*
@@ -408 +423 @@
                             const char *name,
                             uint32_t flags,
-                            DOM_SID *sid,
+                            struct dom_sid *sid,
                             enum lsa_SidType *type)
 {
@@ -419 +434 @@
 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
                             TALLOC_CTX *mem_ctx,
-                            const DOM_SID *sid,
+                            const struct dom_sid *sid,
                             char **domain_name,
                             char **name,
@@ -431 +446 @@
 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
                               TALLOC_CTX *mem_ctx,
-                              const DOM_SID *sid,
+                              const struct dom_sid *sid,
                               uint32 *rids,
                               size_t num_rids,
@@ -451 +466 @@
 static NTSTATUS query_user(struct winbindd_domain *domain, 
                            TALLOC_CTX *mem_ctx, 
-                           const DOM_SID *sid, 
+                           const struct dom_sid *sid,
                            struct wbint_userinfo *info)
 {
@@ -464 +479 @@
         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
         struct netr_SamInfo3 *user = NULL;
-        gid_t gid;
+        gid_t gid = -1;
+        int ret;
+        char *ads_name;
 
         DEBUG(3,("ads: query_user\n"));
@@ -470 +487 @@
         info->homedir = NULL;
         info->shell = NULL;
-        info->primary_gid = (gid_t)-1;
 
         /* try netsamlogon cache first */
@@ -485 +501 @@
                 info->full_name = talloc_strdup(mem_ctx, user->base.full_name.string);
 
-                nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL, 
+                nss_get_info_cached( domain, sid, mem_ctx,
                               &info->homedir, &info->shell, &info->full_name, 
                               &gid );
@@ -507 +523 @@
                 /* Assume "Domain Users" for the primary group */
 
-                sid_compose(&info->group_sid, &domain->sid, DOMAIN_GROUP_RID_USERS );
+                sid_compose(&info->group_sid, &domain->sid, DOMAIN_RID_USERS );
 
                 /* Try to fill in what the nss_info backend can do */
 
-                nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL, 
+                nss_get_info_cached( domain, sid, mem_ctx,
                               &info->homedir, &info->shell, &info->full_name, 
                               &gid);
                 info->primary_gid = gid;
 
-                status = NT_STATUS_OK;
-                goto done;
+                return NT_STATUS_OK;
         }
 
@@ -524 +539 @@
         if ( (ads = ads_cached_connection(domain)) == NULL ) {
                 domain->last_status = NT_STATUS_SERVER_DISABLED;
-                goto done;
-        }
-
-        sidstr = sid_binstring(talloc_tos(), sid);
-        if (asprintf(&ldap_exp, "(objectSid=%s)", sidstr) == -1) {
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
+                return NT_STATUS_SERVER_DISABLED;
+        }
+
+        sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), sid);
+
+        ret = asprintf(&ldap_exp, "(objectSid=%s)", sidstr);
+        TALLOC_FREE(sidstr);
+        if (ret == -1) {
+                return NT_STATUS_NO_MEMORY;
         }
         rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
-        free(ldap_exp);
-        TALLOC_FREE(sidstr);
+        SAFE_FREE(ldap_exp);
         if (!ADS_ERR_OK(rc) || !msg) {
                 DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
                          sid_string_dbg(sid), ads_errstr(rc)));
-                goto done;
+                return ads_ntstatus(rc);
         }
 
@@ -545 +561 @@
                 DEBUG(1,("query_user(sid=%s): Not found\n",
                          sid_string_dbg(sid)));
-                goto done;
+                ads_msgfree(ads, msg);
+                return NT_STATUS_NO_SUCH_USER;
         }
 
         info->acct_name = ads_pull_username(ads, mem_ctx, msg);
 
-        nss_get_info_cached( domain, sid, mem_ctx, ads, msg, 
+        if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
+                DEBUG(1,("No primary group for %s !?\n",
+                         sid_string_dbg(sid)));
+                ads_msgfree(ads, msg);
+                return NT_STATUS_NO_SUCH_USER;
+        }
+        sid_copy(&info->user_sid, sid);
+        sid_compose(&info->group_sid, &domain->sid, group_rid);
+
+        /*
+         * We have to fetch the "name" attribute before doing the
+         * nss_get_info_cached call. nss_get_info_cached might destroy
+         * the ads struct, potentially invalidating the ldap message.
+         */
+        ads_name = ads_pull_string(ads, mem_ctx, msg, "name");
+
+        ads_msgfree(ads, msg);
+        msg = NULL;
+
+        status = nss_get_info_cached( domain, sid, mem_ctx,
                       &info->homedir, &info->shell, &info->full_name, 
                       &gid);
         info->primary_gid = gid;
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("nss_get_info_cached failed: %s\n",
+                          nt_errstr(status)));
+                return status;
+        }
 
         if (info->full_name == NULL) {
-                info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
-        }
-
-        if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
-                DEBUG(1,("No primary group for %s !?\n",
-                         sid_string_dbg(sid)));
-                goto done;
-        }
-
-        sid_copy(&info->user_sid, sid);
-        sid_compose(&info->group_sid, &domain->sid, group_rid);
+                info->full_name = ads_name;
+        } else {
+                TALLOC_FREE(ads_name);
+        }
 
         status = NT_STATUS_OK;
 
         DEBUG(3,("ads query_user gave %s\n", info->acct_name));
-done:
-        if (msg) 
-                ads_msgfree(ads, msg);
-
-        return status;
+        return NT_STATUS_OK;
 }
 
@@ -583 +613 @@
                                          TALLOC_CTX *mem_ctx,
                                          const char *user_dn, 
-                                         DOM_SID *primary_group,
-                                         size_t *p_num_groups, DOM_SID **user_sids)
+                                         struct dom_sid *primary_group,
+                                         uint32_t *p_num_groups, struct dom_sid **user_sids)
 {
         ADS_STATUS rc;
@@ -595 +625 @@
         const char *group_attrs[] = {"objectSid", NULL};
         char *escaped_dn;
-        size_t num_groups = 0;
+        uint32_t num_groups = 0;
 
         DEBUG(3,("ads: lookup_usergroups_member\n"));
@@ -653 +683 @@
                 for (msg = ads_first_entry(ads, res); msg;
                      msg = ads_next_entry(ads, msg)) {
-                        DOM_SID group_sid;
+                        struct dom_sid group_sid;
 
                         if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
@@ -690 +720 @@
                                            TALLOC_CTX *mem_ctx,
                                            const char *user_dn,
-                                           DOM_SID *primary_group,
-                                           size_t *p_num_groups,
-                                           DOM_SID **user_sids)
+                                           struct dom_sid *primary_group,
+                                           uint32_t *p_num_groups,
+                                           struct dom_sid **user_sids)
 {
         ADS_STATUS rc;
@@ -698 +728 @@
         ADS_STRUCT *ads;
         const char *attrs[] = {"memberOf", NULL};
-        size_t num_groups = 0;
-        DOM_SID *group_sids = NULL;
+        uint32_t num_groups = 0;
+        struct dom_sid *group_sids = NULL;
         int i;
         char **strings = NULL;
@@ -740 +770 @@
         }
 
-        group_sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_strings + 1);
+        group_sids = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, num_strings + 1);
         if (!group_sids) {
                 status = NT_STATUS_NO_MEMORY;
@@ -802 +832 @@
 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
                                   TALLOC_CTX *mem_ctx,
-                                  const DOM_SID *sid, 
-                                  uint32 *p_num_groups, DOM_SID **user_sids)
+                                  const struct dom_sid *sid,
+                                  uint32 *p_num_groups, struct dom_sid **user_sids)
 {
         ADS_STRUCT *ads = NULL;
@@ -811 +841 @@
         LDAPMessage *msg = NULL;
         char *user_dn = NULL;
-        DOM_SID *sids;
+        struct dom_sid *sids;
         int i;
-        DOM_SID primary_group;
+        struct dom_sid primary_group;
         uint32 primary_group_rid;
         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
-        size_t num_groups = 0;
+        uint32_t num_groups = 0;
 
         DEBUG(3,("ads: lookup_usergroups\n"));
@@ -881 +911 @@
         }
 
-        sid_copy(&primary_group, &domain->sid);
-        sid_append_rid(&primary_group, primary_group_rid);
+        sid_compose(&primary_group, &domain->sid, primary_group_rid);
 
         count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
@@ -902 +931 @@
                                                     &primary_group,
                                                     &num_groups, user_sids);
-                *p_num_groups = (uint32)num_groups;
+                *p_num_groups = num_groups;
                 if (NT_STATUS_IS_OK(status)) {
                         goto done;
@@ -913 +942 @@
                                                   &primary_group,
                                                   &num_groups, user_sids);
-                *p_num_groups = (uint32)num_groups;
+                *p_num_groups = num_groups;
                 goto done;
         }
@@ -954 +983 @@
 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
                                    TALLOC_CTX *mem_ctx,
-                                   uint32 num_sids, const DOM_SID *sids,
+                                   uint32 num_sids, const struct dom_sid *sids,
                                    uint32 *num_aliases, uint32 **alias_rids)
 {
@@ -968 +997 @@
 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                const DOM_SID *group_sid,
+                                const struct dom_sid *group_sid,
                                 enum lsa_SidType type,
                                 uint32 *num_names,
-                                DOM_SID **sid_mem, char ***names,
+                                struct dom_sid **sid_mem, char ***names,
                                 uint32 **name_types)
 {
@@ -983 +1012 @@
         size_t num_members = 0;
         ads_control args;
-        DOM_SID *sid_mem_nocache = NULL;
+        struct dom_sid *sid_mem_nocache = NULL;
         char **names_nocache = NULL;
         enum lsa_SidType *name_types_nocache = NULL;
@@ -1015 +1044 @@
         }
 
-        if ((sidbinstr = sid_binstring(talloc_tos(), group_sid)) == NULL) {
+        if ((sidbinstr = ldap_encode_ndr_dom_sid(talloc_tos(), group_sid)) == NULL) {
                 status = NT_STATUS_NO_MEMORY;
                 goto done;
@@ -1057 +1086 @@
 
         if (num_members) {
-                (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
+                (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, num_members);
                 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
                 (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
-                (sid_mem_nocache) = TALLOC_ZERO_ARRAY(tmp_ctx, DOM_SID, num_members);
+                (sid_mem_nocache) = TALLOC_ZERO_ARRAY(tmp_ctx, struct dom_sid, num_members);
 
                 if ((members == NULL) || (*sid_mem == NULL) ||
@@ -1080 +1109 @@
                 enum lsa_SidType name_type;
                 char *name, *domain_name;
-                DOM_SID sid;
+                struct dom_sid sid;
 
                 rc = ads_get_sid_from_extended_dn(tmp_ctx, members[i], args.val,
@@ -1261 +1290 @@
 {
         NTSTATUS                result = NT_STATUS_UNSUCCESSFUL;
+        WERROR werr;
         int                     i;
         uint32                  flags;  
         struct rpc_pipe_client *cli;
-        uint32                 fr_flags = (NETR_TRUST_FLAG_IN_FOREST | NETR_TRUST_FLAG_TREEROOT);
         int ret_count;
+        struct dcerpc_binding_handle *b;
 
         DEBUG(3,("ads: trusted_domains\n"));
@@ -1275 +1305 @@
            trusts in the target forest */
 
-        if ( domain->primary ||
-                ((domain->domain_flags&fr_flags) == fr_flags) ) 
-        {
+        if (domain->primary || domain_is_forest_root(domain)) {
                 flags = NETR_TRUST_FLAG_OUTBOUND |
                         NETR_TRUST_FLAG_INBOUND |
@@ -1294 +1322 @@
         }
 
-        result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
+        b = cli->binding_handle;
+
+        result = dcerpc_netr_DsrEnumerateDomainTrusts(b, mem_ctx,
                                                       cli->desthost,
                                                       flags,
                                                       trusts,
-                                                      NULL);
+                                                      &werr);
         if (!NT_STATUS_IS_OK(result)) {
                 return result;
+        }
+
+        if (!W_ERROR_IS_OK(werr)) {
+                return werror_to_ntstatus(werr);
         }
         if (trusts->count == 0) {
@@ -1355 +1389 @@
                         wcache_tdc_add_domain( &d );
                         ret_count++;
-                } else if ( (domain->domain_flags&fr_flags) == fr_flags ) {
+                } else if (domain_is_forest_root(domain)) {
                         /* Check if we already have this record. If
                          * we are following our forest root that is not