Changeset 860 for vendor/current/source3/winbindd

Timestamp:

May 12, 2014, 8:58:38 PM (11 years ago)

Author:

Silvan Scherrer

Message:

Samba 3.6: updated vendor to latest version

Location:

vendor/current/source3/winbindd

Files:

• idmap_ad.c (modified) (2 diffs)
• wb_lookupsids.c (modified) (1 diff)
• winbindd.c (modified) (1 diff)
• winbindd_cache.c (modified) (4 diffs)
• winbindd_cm.c (modified) (8 diffs)
• winbindd_dual.c (modified) (1 diff)
• winbindd_msrpc.c (modified) (14 diffs)
• winbindd_pam.c (modified) (3 diffs)
• winbindd_proto.h (modified) (3 diffs)
• winbindd_rpc.c (modified) (8 diffs)

vendor/current/source3/winbindd/idmap_ad.c

@@ -458 +458 @@
                                      &id)) 
                 {
-                        DEBUG(1, ("Could not get unix ID\n"));
+                        DEBUG(1, ("Could not get SID for unix ID %u\n", (unsigned) id));
                         continue;
                 }
@@ -655 +655 @@
                                      &id)) 
                 {
-                        DEBUG(1, ("Could not get unix ID\n"));
+                        DEBUG(1, ("Could not get unix ID for SID %s\n",
+                                sid_string_dbg(map->sid)));
                         continue;
                 }

vendor/current/source3/winbindd/wb_lookupsids.c

@@ -403 +403 @@
 
         src_domain_index = src_name->sid_index;
+        if (src_domain_index >= src_domains->count) {
+                return false;
+        }
         src_domain = &src_domains->domains[src_domain_index];
 

vendor/current/source3/winbindd/winbindd.c

@@ -1079 +1079 @@
                            MSG_WINBIND_ONLINESTATUS, winbind_msg_onlinestatus);
 
+        /* Handle domain online/offline messages for domains */
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_WINBIND_DOMAIN_OFFLINE, winbind_msg_domain_offline);
+        messaging_register(winbind_messaging_context(), NULL,
+                           MSG_WINBIND_DOMAIN_ONLINE, winbind_msg_domain_online);
+
         messaging_register(winbind_messaging_context(), NULL,
                            MSG_DUMP_EVENT_LIST, winbind_msg_dump_event_list);

vendor/current/source3/winbindd/winbindd_cache.c

@@ -946 +946 @@
         if (!centry)
                 return;
+
+        if ((domain_name == NULL) || (domain_name[0] == '\0')) {
+                struct winbindd_domain *mydomain =
+                        find_domain_from_sid_noinit(sid);
+                if (mydomain != NULL) {
+                        domain_name = mydomain->name;
+                }
+        }
+
         centry_put_uint32(centry, type);
         centry_put_sid(centry, sid);
@@ -965 +974 @@
         if (!centry)
                 return;
+
+        if ((domain_name == NULL) || (domain_name[0] == '\0')) {
+                struct winbindd_domain *mydomain =
+                        find_domain_from_sid_noinit(sid);
+                if (mydomain != NULL) {
+                        domain_name = mydomain->name;
+                }
+        }
 
         if (NT_STATUS_IS_OK(status)) {
@@ -1782 +1799 @@
         }
 
+        if ((domain_name == NULL) || (domain_name[0] == '\0')) {
+                domain_name = domain->name;
+        }
+
         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
         TALLOC_FREE(uname);
@@ -2131 +2152 @@
                                         /* something's definitely wrong */
                                         result = centry->status;
+                                        centry_free(centry);
                                         goto error;
                                 }

vendor/current/source3/winbindd/winbindd_cm.c

@@ -338 +338 @@
 }
 
+void winbind_msg_domain_offline(struct messaging_context *msg_ctx,
+                                void *private_data,
+                                uint32_t msg_type,
+                                struct server_id server_id,
+                                DATA_BLOB *data)
+{
+        const char *domain_name = (const char *)data->data;
+        struct winbindd_domain *domain;
+
+        domain = find_domain_from_name_noinit(domain_name);
+        if (domain == NULL) {
+                return;
+        }
+
+        domain->online = false;
+
+        DEBUG(10, ("Domain %s is marked as offline now.\n",
+                   domain_name));
+}
+
+void winbind_msg_domain_online(struct messaging_context *msg_ctx,
+                                void *private_data,
+                                uint32_t msg_type,
+                                struct server_id server_id,
+                                DATA_BLOB *data)
+{
+        const char *domain_name = (const char *)data->data;
+        struct winbindd_domain *domain;
+
+        domain = find_domain_from_name_noinit(domain_name);
+        if (domain == NULL) {
+                return;
+        }
+
+        domain->online = true;
+
+        DEBUG(10, ("Domain %s is marked as online now.\n",
+                   domain_name));
+}
+
 /****************************************************************
  Set domain offline and also add handler to put us back online
@@ -345 +385 @@
 void set_domain_offline(struct winbindd_domain *domain)
 {
+        pid_t parent_pid = getppid();
+
         DEBUG(10,("set_domain_offline: called for domain %s\n",
                 domain->name ));
@@ -391 +433 @@
         DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
                 domain->name ));
+
+        /* Send a message to the parent that the domain is offline. */
+        if (parent_pid > 1 && !domain->internal) {
+                messaging_send_buf(winbind_messaging_context(),
+                                   pid_to_procid(parent_pid),
+                                   MSG_WINBIND_DOMAIN_OFFLINE,
+                                   (uint8 *)domain->name,
+                                   strlen(domain->name) + 1);
+        }
 
         /* Send an offline message to the idmap child when our
@@ -416 +467 @@
 static void set_domain_online(struct winbindd_domain *domain)
 {
+        pid_t parent_pid = getppid();
+
         DEBUG(10,("set_domain_online: called for domain %s\n",
                 domain->name ));
@@ -466 +519 @@
 
         domain->online = True;
+
+        /* Send a message to the parent that the domain is online. */
+        if (parent_pid > 1 && !domain->internal) {
+                messaging_send_buf(winbind_messaging_context(),
+                                   pid_to_procid(parent_pid),
+                                   MSG_WINBIND_DOMAIN_ONLINE,
+                                   (uint8 *)domain->name,
+                                   strlen(domain->name) + 1);
+        }
 
         /* Send an online message to the idmap child when our
@@ -1024 +1086 @@
                 result = cli_set_domain((*cli), domain->name);
                 if (!NT_STATUS_IS_OK(result)) {
+                        SAFE_FREE(ipc_username);
+                        SAFE_FREE(ipc_domain);
+                        SAFE_FREE(ipc_password);
                         return result;
                 }
@@ -1603 +1668 @@
                 result = cm_prepare_connection(domain, fd, domain->dcname,
                         &new_conn->cli, &retry);
+                if (!NT_STATUS_IS_OK(result)) {
+                        /* Don't leak the smb connection socket */
+                        close(fd);
+                }
 
                 if (!retry)
@@ -2565 +2634 @@
 
 /****************************************************************************
+Open a LSA connection to a DC, suiteable for LSA lookup calls.
+****************************************************************************/
+
+NTSTATUS cm_connect_lsat(struct winbindd_domain *domain,
+                         TALLOC_CTX *mem_ctx,
+                         struct rpc_pipe_client **cli,
+                         struct policy_handle *lsa_policy)
+{
+        NTSTATUS status;
+
+        if (domain->can_do_ncacn_ip_tcp) {
+                status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
+                if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
+                    NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
+                    NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
+                        invalidate_cm_connection(&domain->conn);
+                        status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
+                }
+                if (NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                /*
+                 * we tried twice to connect via ncan_ip_tcp and schannel and
+                 * failed - maybe it is a trusted domain we can't connect to ?
+                 * do not try tcp next time - gd
+                 */
+                domain->can_do_ncacn_ip_tcp = false;
+        }
+
+        status = cm_connect_lsa(domain, mem_ctx, cli, lsa_policy);
+
+        return status;
+}
+
+/****************************************************************************
  Open the netlogon pipe to this DC. Use schannel if specified in client conf.
  session key stored in conn->netlogon_pipe->dc->sess_key.

vendor/current/source3/winbindd/winbindd_dual.c

@@ -1223 +1223 @@
         messaging_deregister(winbind_messaging_context(),
                              MSG_DEBUG, NULL);
+
+        messaging_deregister(winbind_messaging_context(),
+                             MSG_WINBIND_DOMAIN_OFFLINE, NULL);
+        messaging_deregister(winbind_messaging_context(),
+                             MSG_WINBIND_DOMAIN_ONLINE, NULL);
 
         /* We have destroyed all events in the winbindd_event_context

vendor/current/source3/winbindd/winbindd_msrpc.c

@@ -36 +36 @@
 #define DBGC_CLASS DBGC_WINBIND
 
+static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
+                                      struct winbindd_domain *domain,
+                                      uint32_t num_names,
+                                      const char **names,
+                                      const char ***domains,
+                                      struct dom_sid **sids,
+                                      enum lsa_SidType **types);
 
 /* Query display info for a domain.  This returns enough information plus a
@@ -738 +745 @@
                    care of freeing the temporary arrays later on. */
 
-                if (tmp_names.count != tmp_types.count) {
-                        return NT_STATUS_UNSUCCESSFUL;
+                if (tmp_names.count != num_lookup_rids) {
+                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                }
+                if (tmp_types.count != num_lookup_rids) {
+                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
                 }
 
@@ -745 +755 @@
                         if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
                                 continue;
+                        }
+                        if (total_names >= *num_names) {
+                                break;
                         }
                         (*names)[total_names] = fill_domain_username_talloc(
@@ -938 +951 @@
 
         status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
-        if (!NT_STATUS_IS_OK(status))
-                return status;
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
 
         status = rpc_trusted_domains(tmp_ctx,
@@ -1057 +1071 @@
         return status;
 }
-
-typedef NTSTATUS (*lookup_sids_fn_t)(struct dcerpc_binding_handle *h,
-                                     TALLOC_CTX *mem_ctx,
-                                     struct policy_handle *pol,
-                                     int num_sids,
-                                     const struct dom_sid *sids,
-                                     char ***pdomains,
-                                     char ***pnames,
-                                     enum lsa_SidType **ptypes,
-                                     NTSTATUS *result);
 
 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
@@ -1082 +1086 @@
         struct policy_handle lsa_policy;
         unsigned int orig_timeout;
-        lookup_sids_fn_t lookup_sids_fn = dcerpc_lsa_lookup_sids;
-
-        if (domain->can_do_ncacn_ip_tcp) {
-                status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
-                if (NT_STATUS_IS_OK(status)) {
-                        lookup_sids_fn = dcerpc_lsa_lookup_sids3;
-                        goto lookup;
-                }
-                domain->can_do_ncacn_ip_tcp = false;
-        }
-        status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
-
+        bool use_lookupsids3 = false;
+        bool retried = false;
+
+ connect:
+        status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
- lookup:
         b = cli->binding_handle;
+
+        if (cli->transport->transport == NCACN_IP_TCP) {
+                use_lookupsids3 = true;
+        }
 
         /*
@@ -1108 +1108 @@
         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
 
-        status = lookup_sids_fn(b,
-                                mem_ctx,
-                                &lsa_policy,
-                                num_sids,
-                                sids,
-                                domains,
-                                names,
-                                types,
-                                &result);
+        status = dcerpc_lsa_lookup_sids_generic(b,
+                                                mem_ctx,
+                                                &lsa_policy,
+                                                num_sids,
+                                                sids,
+                                                domains,
+                                                names,
+                                                types,
+                                                use_lookupsids3,
+                                                &result);
 
         /* And restore our original timeout. */
@@ -1122 +1123 @@
 
         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
-            NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
+            NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
+            NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
                 /*
                  * This can happen if the schannel key is not
@@ -1130 +1132 @@
                  */
                 invalidate_cm_connection(&domain->conn);
+                domain->can_do_ncacn_ip_tcp = domain->active_directory;
+                if (!retried) {
+                        retried = true;
+                        goto connect;
+                }
                 status = NT_STATUS_ACCESS_DENIED;
         }
@@ -1144 +1151 @@
 }
 
-typedef NTSTATUS (*lookup_names_fn_t)(struct dcerpc_binding_handle *h,
-                                      TALLOC_CTX *mem_ctx,
-                                      struct policy_handle *pol,
+static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
+                                      struct winbindd_domain *domain,
                                       uint32_t num_names,
                                       const char **names,
-                                      const char ***dom_names,
-                                      enum lsa_LookupNamesLevel level,
+                                      const char ***domains,
                                       struct dom_sid **sids,
-                                      enum lsa_SidType **types,
-                                      NTSTATUS *result);
-
-NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
-                               struct winbindd_domain *domain,
-                               uint32_t num_names,
-                               const char **names,
-                               const char ***domains,
-                               struct dom_sid **sids,
-                               enum lsa_SidType **types)
+                                      enum lsa_SidType **types)
 {
         NTSTATUS status;
@@ -1169 +1165 @@
         struct policy_handle lsa_policy;
         unsigned int orig_timeout = 0;
-        lookup_names_fn_t lookup_names_fn = dcerpc_lsa_lookup_names;
-
-        if (domain->can_do_ncacn_ip_tcp) {
-                status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
-                if (NT_STATUS_IS_OK(status)) {
-                        lookup_names_fn = dcerpc_lsa_lookup_names4;
-                        goto lookup;
-                }
-                domain->can_do_ncacn_ip_tcp = false;
-        }
-        status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
-
+        bool use_lookupnames4 = false;
+        bool retried = false;
+
+ connect:
+        status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
- lookup:
         b = cli->binding_handle;
+
+        if (cli->transport->transport == NCACN_IP_TCP) {
+                use_lookupnames4 = true;
+        }
 
         /*
@@ -1195 +1187 @@
         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
 
-        status = lookup_names_fn(b,
-                                 mem_ctx,
-                                 &lsa_policy,
-                                 num_names,
-                                 (const char **) names,
-                                 domains,
-                                 1,
-                                 sids,
-                                 types,
-                                 &result);
+        status = dcerpc_lsa_lookup_names_generic(b,
+                                                 mem_ctx,
+                                                 &lsa_policy,
+                                                 num_names,
+                                                 (const char **) names,
+                                                 domains,
+                                                 1,
+                                                 sids,
+                                                 types,
+                                                 use_lookupnames4,
+                                                 &result);
 
         /* And restore our original timeout. */
@@ -1210 +1203 @@
 
         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
-            NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
+            NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
+            NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
                 /*
                  * This can happen if the schannel key is not
@@ -1218 +1212 @@
                  */
                 invalidate_cm_connection(&domain->conn);
+                if (!retried) {
+                        retried = true;
+                        goto connect;
+                }
                 status = NT_STATUS_ACCESS_DENIED;
         }

vendor/current/source3/winbindd/winbindd_pam.c

@@ -669 +669 @@
 
 failed:
+        /*
+         * Do not delete an existing valid credential cache, if the user
+         * e.g. enters a wrong password
+         */
+        if ((strequal(krb5_cc_type, "FILE") || strequal(krb5_cc_type, "WRFILE"))
+            && user_ccache_file != NULL) {
+                return result;
+        }
 
         /* we could have created a new credential cache with a valid tgt in it
@@ -1153 +1161 @@
 {
         int attempts = 0;
+        int netr_attempts = 0;
         bool retry = false;
         NTSTATUS result;
@@ -1167 +1176 @@
 
                 if (!NT_STATUS_IS_OK(result)) {
-                        DEBUG(3,("could not open handle to NETLOGON pipe (error: %s)\n",
-                                  nt_errstr(result)));
-                        if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT)) {
-                                if (attempts > 0) {
-                                        DEBUG(3, ("This is the second problem for this "
-                                                "particular call, forcing the close of "
-                                                "this connection\n"));
-                                        invalidate_cm_connection(&domain->conn);
-                                } else {
-                                        DEBUG(3, ("First call to cm_connect_netlogon "
-                                                "has timed out, retrying\n"));
-                                        continue;
-                                }
+                        DEBUG(3,("Could not open handle to NETLOGON pipe "
+                                 "(error: %s, attempts: %d)\n",
+                                  nt_errstr(result), netr_attempts));
+
+                        /* After the first retry always close the connection */
+                        if (netr_attempts > 0) {
+                                DEBUG(3, ("This is again a problem for this "
+                                          "particular call, forcing the close "
+                                          "of this connection\n"));
+                                invalidate_cm_connection(&domain->conn);
+                        }
+
+                        /* After the second retry failover to the next DC */
+                        if (netr_attempts > 1) {
+                                /*
+                                 * If the netlogon server is not reachable then
+                                 * it is possible that the DC is rebuilding
+                                 * sysvol and shutdown netlogon for that time.
+                                 * We should failover to the next dc.
+                                 */
+                                DEBUG(3, ("This is the third problem for this "
+                                          "particular call, adding DC to the "
+                                          "negative cache list\n"));
+                                add_failed_connection_entry(domain->name,
+                                                            domain->dcname,
+                                                            result);
+                                saf_delete(domain->name);
+                        }
+
+                        /* Only allow 3 retries */
+                        if (netr_attempts < 3) {
+                                DEBUG(3, ("The connection to netlogon "
+                                          "failed, retrying\n"));
+                                netr_attempts++;
+                                retry = true;
+                                continue;
                         }
                         return result;
                 }
+                netr_attempts = 0;
+
                 auth = netlogon_pipe->auth;
                 if (netlogon_pipe->dc) {

vendor/current/source3/winbindd/winbindd_proto.h

@@ -48 +48 @@
                               char ***names,
                               enum lsa_SidType **types);
-NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
-                               struct winbindd_domain *domain,
-                               uint32_t num_names,
-                               const char **names,
-                               const char ***domains,
-                               struct dom_sid **sids,
-                               enum lsa_SidType **types);
 NTSTATUS rpc_lookup_sids(TALLOC_CTX *mem_ctx,
                          struct winbindd_domain *domain,
@@ -158 +151 @@
 
 /* The following definitions come from winbindd/winbindd_cm.c  */
+void winbind_msg_domain_offline(struct messaging_context *msg_ctx,
+                                void *private_data,
+                                uint32_t msg_type,
+                                struct server_id server_id,
+                                DATA_BLOB *data);
+void winbind_msg_domain_online(struct messaging_context *msg_ctx,
+                                void *private_data,
+                                uint32_t msg_type,
+                                struct server_id server_id,
+                                DATA_BLOB *data);
 
 void set_domain_offline(struct winbindd_domain *domain);
@@ -171 +174 @@
                             TALLOC_CTX *mem_ctx,
                             struct rpc_pipe_client **cli);
+NTSTATUS cm_connect_lsat(struct winbindd_domain *domain,
+                         TALLOC_CTX *mem_ctx,
+                         struct rpc_pipe_client **cli,
+                         struct policy_handle *lsa_policy);
 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
                              struct rpc_pipe_client **cli);

vendor/current/source3/winbindd/winbindd_rpc.c

@@ -872 +872 @@
         /* Copy result into array.  The talloc system will take
            care of freeing the temporary arrays later on. */
-        if (tmp_names.count != tmp_types.count) {
-                return NT_STATUS_UNSUCCESSFUL;
+        if (tmp_names.count != num_names) {
+                return NT_STATUS_INVALID_NETWORK_RESPONSE;
+        }
+        if (tmp_types.count != num_names) {
+                return NT_STATUS_INVALID_NETWORK_RESPONSE;
         }
 
@@ -879 +882 @@
                 if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
                         continue;
+                }
+                if (total_names >= num_names) {
+                        break;
                 }
                 names[total_names] = fill_domain_username_talloc(names,
@@ -1034 +1040 @@
 static NTSTATUS rpc_try_lookup_sids3(TALLOC_CTX *mem_ctx,
                                      struct winbindd_domain *domain,
+                                     struct rpc_pipe_client *cli,
                                      struct lsa_SidArray *sids,
                                      struct lsa_RefDomainList **pdomains,
@@ -1039 +1046 @@
 {
         struct lsa_TransNameArray2 lsa_names2;
-        struct lsa_TransNameArray *names;
+        struct lsa_TransNameArray *names = *pnames;
         uint32_t i, count;
-        struct rpc_pipe_client *cli;
         NTSTATUS status, result;
-
-        status = cm_connect_lsa_tcp(domain, talloc_tos(), &cli);
-        if (!NT_STATUS_IS_OK(status)) {
-                domain->can_do_ncacn_ip_tcp = false;
-                return status;
-        }
 
         ZERO_STRUCT(lsa_names2);
@@ -1067 +1067 @@
                 return result;
         }
-        names = TALLOC_ZERO_P(mem_ctx, struct lsa_TransNameArray);
-        if (names == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
+        if (sids->num_sids != lsa_names2.count) {
+                return NT_STATUS_INVALID_NETWORK_RESPONSE;
+        }
+
         names->count = lsa_names2.count;
         names->names = talloc_array(names, struct lsa_TranslatedName,
@@ -1082 +1082 @@
                         names->names, &lsa_names2.names[i].name.string);
                 names->names[i].sid_index = lsa_names2.names[i].sid_index;
-        }
-        *pnames = names;
+
+                if (names->names[i].sid_index == UINT32_MAX) {
+                        continue;
+                }
+                if ((*pdomains) == NULL) {
+                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                }
+                if (names->names[i].sid_index >= (*pdomains)->count) {
+                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                }
+        }
         return result;
 }
@@ -1093 +1102 @@
                          struct lsa_TransNameArray **pnames)
 {
-        struct lsa_TransNameArray *names;
+        struct lsa_TransNameArray *names = *pnames;
         struct rpc_pipe_client *cli = NULL;
         struct policy_handle lsa_policy;
         uint32_t count;
+        uint32_t i;
         NTSTATUS status, result;
 
-        if (domain->can_do_ncacn_ip_tcp) {
-                status = rpc_try_lookup_sids3(mem_ctx, domain, sids,
-                                              pdomains, pnames);
-                if (!NT_STATUS_IS_ERR(status)) {
-                        return status;
-                }
-        }
-
-        status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
+        status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
-        names = TALLOC_ZERO_P(mem_ctx, struct lsa_TransNameArray);
-        if (names == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
+        if (cli->transport->transport == NCACN_IP_TCP) {
+                return rpc_try_lookup_sids3(mem_ctx, domain, cli, sids,
+                                            pdomains, pnames);
+        }
+
         status = dcerpc_lsa_LookupSids(cli->binding_handle, mem_ctx,
                                        &lsa_policy, sids, pdomains,
@@ -1126 +1129 @@
                 return result;
         }
-        *pnames = names;
+
+        if (sids->num_sids != names->count) {
+                return NT_STATUS_INVALID_NETWORK_RESPONSE;
+        }
+
+        for (i=0; i < names->count; i++) {
+                if (names->names[i].sid_index == UINT32_MAX) {
+                        continue;
+                }
+                if ((*pdomains) == NULL) {
+                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                }
+                if (names->names[i].sid_index >= (*pdomains)->count) {
+                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                }
+        }
+
         return result;
 }