Changeset 862 for trunk/server/source3/winbindd/winbindd_msrpc.c

Timestamp:

May 13, 2014, 11:39:04 AM (11 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update trunk to 3.6.23

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/winbindd/winbindd_msrpc.c (modified) (14 diffs)

trunk/server/source3/winbindd/winbindd_msrpc.c

@@ -36 +36 @@
 #define DBGC_CLASS DBGC_WINBIND
 
+static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
+                                      struct winbindd_domain *domain,
+                                      uint32_t num_names,
+                                      const char **names,
+                                      const char ***domains,
+                                      struct dom_sid **sids,
+                                      enum lsa_SidType **types);
 
 /* Query display info for a domain.  This returns enough information plus a
@@ -738 +745 @@
                    care of freeing the temporary arrays later on. */
 
-                if (tmp_names.count != tmp_types.count) {
-                        return NT_STATUS_UNSUCCESSFUL;
+                if (tmp_names.count != num_lookup_rids) {
+                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                }
+                if (tmp_types.count != num_lookup_rids) {
+                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
                 }
 
@@ -745 +755 @@
                         if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
                                 continue;
+                        }
+                        if (total_names >= *num_names) {
+                                break;
                         }
                         (*names)[total_names] = fill_domain_username_talloc(
@@ -938 +951 @@
 
         status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
-        if (!NT_STATUS_IS_OK(status))
-                return status;
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
 
         status = rpc_trusted_domains(tmp_ctx,
@@ -1057 +1071 @@
         return status;
 }
-
-typedef NTSTATUS (*lookup_sids_fn_t)(struct dcerpc_binding_handle *h,
-                                     TALLOC_CTX *mem_ctx,
-                                     struct policy_handle *pol,
-                                     int num_sids,
-                                     const struct dom_sid *sids,
-                                     char ***pdomains,
-                                     char ***pnames,
-                                     enum lsa_SidType **ptypes,
-                                     NTSTATUS *result);
 
 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
@@ -1082 +1086 @@
         struct policy_handle lsa_policy;
         unsigned int orig_timeout;
-        lookup_sids_fn_t lookup_sids_fn = dcerpc_lsa_lookup_sids;
-
-        if (domain->can_do_ncacn_ip_tcp) {
-                status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
-                if (NT_STATUS_IS_OK(status)) {
-                        lookup_sids_fn = dcerpc_lsa_lookup_sids3;
-                        goto lookup;
-                }
-                domain->can_do_ncacn_ip_tcp = false;
-        }
-        status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
-
+        bool use_lookupsids3 = false;
+        bool retried = false;
+
+ connect:
+        status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
- lookup:
         b = cli->binding_handle;
+
+        if (cli->transport->transport == NCACN_IP_TCP) {
+                use_lookupsids3 = true;
+        }
 
         /*
@@ -1108 +1108 @@
         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
 
-        status = lookup_sids_fn(b,
-                                mem_ctx,
-                                &lsa_policy,
-                                num_sids,
-                                sids,
-                                domains,
-                                names,
-                                types,
-                                &result);
+        status = dcerpc_lsa_lookup_sids_generic(b,
+                                                mem_ctx,
+                                                &lsa_policy,
+                                                num_sids,
+                                                sids,
+                                                domains,
+                                                names,
+                                                types,
+                                                use_lookupsids3,
+                                                &result);
 
         /* And restore our original timeout. */
@@ -1122 +1123 @@
 
         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
-            NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
+            NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
+            NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
                 /*
                  * This can happen if the schannel key is not
@@ -1130 +1132 @@
                  */
                 invalidate_cm_connection(&domain->conn);
+                domain->can_do_ncacn_ip_tcp = domain->active_directory;
+                if (!retried) {
+                        retried = true;
+                        goto connect;
+                }
                 status = NT_STATUS_ACCESS_DENIED;
         }
@@ -1144 +1151 @@
 }
 
-typedef NTSTATUS (*lookup_names_fn_t)(struct dcerpc_binding_handle *h,
-                                      TALLOC_CTX *mem_ctx,
-                                      struct policy_handle *pol,
+static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
+                                      struct winbindd_domain *domain,
                                       uint32_t num_names,
                                       const char **names,
-                                      const char ***dom_names,
-                                      enum lsa_LookupNamesLevel level,
+                                      const char ***domains,
                                       struct dom_sid **sids,
-                                      enum lsa_SidType **types,
-                                      NTSTATUS *result);
-
-NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
-                               struct winbindd_domain *domain,
-                               uint32_t num_names,
-                               const char **names,
-                               const char ***domains,
-                               struct dom_sid **sids,
-                               enum lsa_SidType **types)
+                                      enum lsa_SidType **types)
 {
         NTSTATUS status;
@@ -1169 +1165 @@
         struct policy_handle lsa_policy;
         unsigned int orig_timeout = 0;
-        lookup_names_fn_t lookup_names_fn = dcerpc_lsa_lookup_names;
-
-        if (domain->can_do_ncacn_ip_tcp) {
-                status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
-                if (NT_STATUS_IS_OK(status)) {
-                        lookup_names_fn = dcerpc_lsa_lookup_names4;
-                        goto lookup;
-                }
-                domain->can_do_ncacn_ip_tcp = false;
-        }
-        status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
-
+        bool use_lookupnames4 = false;
+        bool retried = false;
+
+ connect:
+        status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
- lookup:
         b = cli->binding_handle;
+
+        if (cli->transport->transport == NCACN_IP_TCP) {
+                use_lookupnames4 = true;
+        }
 
         /*
@@ -1195 +1187 @@
         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
 
-        status = lookup_names_fn(b,
-                                 mem_ctx,
-                                 &lsa_policy,
-                                 num_names,
-                                 (const char **) names,
-                                 domains,
-                                 1,
-                                 sids,
-                                 types,
-                                 &result);
+        status = dcerpc_lsa_lookup_names_generic(b,
+                                                 mem_ctx,
+                                                 &lsa_policy,
+                                                 num_names,
+                                                 (const char **) names,
+                                                 domains,
+                                                 1,
+                                                 sids,
+                                                 types,
+                                                 use_lookupnames4,
+                                                 &result);
 
         /* And restore our original timeout. */
@@ -1210 +1203 @@
 
         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
-            NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
+            NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
+            NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
                 /*
                  * This can happen if the schannel key is not
@@ -1218 +1212 @@
                  */
                 invalidate_cm_connection(&domain->conn);
+                if (!retried) {
+                        retried = true;
+                        goto connect;
+                }
                 status = NT_STATUS_ACCESS_DENIED;
         }