Changeset 988 for vendor/current/nsswitch

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/nsswitch

Files:

• libwbclient/ABI (added)
• libwbclient/ABI/wbclient-0.10.sigs (added)
• libwbclient/ABI/wbclient-0.11.sigs (added)
• libwbclient/ABI/wbclient-0.12.sigs (added)
• libwbclient/ABI/wbclient-0.9.sigs (added)
• libwbclient/tests/wbclient.c (modified) (41 diffs)
• libwbclient/wbc_err_internal.h (modified) (2 diffs)
• libwbclient/wbc_idmap.c (modified) (21 diffs)
• libwbclient/wbc_pam.c (modified) (30 diffs)
• libwbclient/wbc_pwd.c (modified) (28 diffs)
• libwbclient/wbc_sid.c (modified) (27 diffs)
• libwbclient/wbc_util.c (modified) (27 diffs)
• libwbclient/wbclient.c (modified) (7 diffs)
• libwbclient/wbclient.h (modified) (82 diffs)
• libwbclient/wbclient.pc.in (added)
• libwbclient/wbclient_internal.h (modified) (2 diffs)
• libwbclient/wscript (added)
• libwbclient/wscript_build (deleted)
• nsstest.c (modified) (5 diffs)
• pam_winbind.c (modified) (56 diffs)
• pam_winbind.h (modified) (4 diffs)
• tests/test_idmap_rfc2307.sh (added)
• tests/test_rfc2307_mapping.sh (added)
• tests/test_wbinfo.sh (modified) (5 diffs)
• tests/test_wbinfo_simple.sh (added)
• wb_common.c (modified) (36 diffs)
• wbinfo.c (modified) (35 diffs)
• winbind_client.h (modified) (2 diffs)
• winbind_krb5_locator.c (modified) (1 diff)
• winbind_nss_aix.c (modified) (10 diffs)
• winbind_nss_config.h (modified) (2 diffs)
• winbind_nss_freebsd.c (modified) (7 diffs)
• winbind_nss_linux.c (modified) (22 diffs)
• winbind_nss_netbsd.c (modified) (1 diff)
• winbind_nss_solaris.c (modified) (8 diffs)
• winbind_nss_solaris.h (modified) (1 diff)
• winbind_struct_protocol.h (modified) (4 diffs)
• wins.c (modified) (14 diffs)
• wins_freebsd.c (added)
• wscript_build (modified) (4 diffs)
• wscript_configure (modified) (1 diff)

vendor/current/nsswitch/libwbclient/tests/wbclient.c

@@ -23 +23 @@
 #include "lib/util/data_blob.h"
 #include "lib/util/time.h"
+#include "libcli/resolve/resolve.h"
 #include "nsswitch/libwbclient/wbclient.h"
 #include "torture/smbtorture.h"
@@ -29 +30 @@
 #include "lib/util/charset/charset.h"
 #include "libcli/auth/libcli_auth.h"
-#include "source4/param/param.h"
-#include "lib/util/util.h"
+#include "lib/param/param.h"
+#include "lib/util/samba_util.h"
 #include "lib/crypto/arcfour.h"
+#include "auth/credentials/credentials.h"
+#include "lib/cmdline/popt_common.h"
 
 #define WBC_ERROR_EQUAL(x,y) (x == y)
 
-#define torture_assert_wbc_equal(torture_ctx, got, expected, cmt) \
+#define torture_assert_wbc_equal(torture_ctx, got, expected, cmt, cmt_arg)      \
         do { wbcErr __got = got, __expected = expected; \
         if (!WBC_ERROR_EQUAL(__got, __expected)) { \
-                torture_result(torture_ctx, TORTURE_FAIL, __location__": "#got" was %s, expected %s: %s", wbcErrorString(__got), wbcErrorString(__expected), cmt); \
+                torture_result(torture_ctx, TORTURE_FAIL, __location__": "#got" was %s, expected %s: " cmt, wbcErrorString(__got), wbcErrorString(__expected), cmt_arg); \
                 return false; \
         } \
         } while (0)
 
-#define torture_assert_wbc_ok(torture_ctx,expr,cmt) \
-                torture_assert_wbc_equal(torture_ctx,expr,WBC_ERR_SUCCESS,cmt)
+#define torture_assert_wbc_ok(torture_ctx,expr,cmt,cmt_arg)                     \
+        torture_assert_wbc_equal(torture_ctx,expr,WBC_ERR_SUCCESS,cmt,cmt_arg)
 
 static bool test_wbc_ping(struct torture_context *tctx)
 {
         torture_assert_wbc_ok(tctx, wbcPing(),
-                "wbcPing failed");
+                "%s", "wbcPing failed");
 
         return true;
@@ -56 +59 @@
 static bool test_wbc_pingdc(struct torture_context *tctx)
 {
-        torture_assert_wbc_equal(tctx, wbcPingDc("random_string", NULL), WBC_ERR_NOT_IMPLEMENTED,
-                "wbcPingDc failed");
+        struct wbcInterfaceDetails *details;
+
+        torture_assert_wbc_equal(tctx, wbcPingDc("random_string", NULL), WBC_ERR_DOMAIN_NOT_FOUND,
+                                 "%s", "wbcPingDc failed");
         torture_assert_wbc_ok(tctx, wbcPingDc(NULL, NULL),
-                "wbcPingDc failed");
+                "%s", "wbcPingDc failed");
+
+        torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
+                "%s", "wbcInterfaceDetails failed");
+        torture_assert(tctx, details,
+                       "wbcInterfaceDetails returned NULL pointer");
+        torture_assert(tctx, details->netbios_domain,
+                       "wbcInterfaceDetails returned NULL netbios_domain");
+
+        torture_assert_wbc_ok(tctx, wbcPingDc(details->netbios_domain, NULL),
+                "wbcPingDc(%s) failed", details->netbios_domain);
+
+        torture_assert_wbc_ok(tctx, wbcPingDc("BUILTIN", NULL),
+                "%s", "wbcPingDc(BUILTIN) failed");
+
+        wbcFreeMemory(details);
+        return true;
+}
+
+static bool test_wbc_pingdc2(struct torture_context *tctx)
+{
+        struct wbcInterfaceDetails *details;
+        char *name = NULL;
+
+        torture_assert_wbc_equal(tctx, wbcPingDc2("random_string", NULL, &name),
+                                 WBC_ERR_DOMAIN_NOT_FOUND, "%s",
+                                 "wbcPingDc2 failed");
+        torture_assert_wbc_ok(tctx, wbcPingDc2(NULL, NULL, &name), "%s",
+                              "wbcPingDc2 failed");
+
+        wbcFreeMemory(name);
+
+        torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
+                "%s", "wbcInterfaceDetails failed");
+        torture_assert(tctx, details,
+                       "wbcInterfaceDetails returned NULL pointer");
+        torture_assert(tctx, details->netbios_domain,
+                       "wbcInterfaceDetails returned NULL netbios_domain");
+
+        torture_assert_wbc_ok(tctx, wbcPingDc2(details->netbios_domain, NULL, &name),
+                "wbcPingDc2(%s) failed", details->netbios_domain);
+        wbcFreeMemory(name);
+
+        torture_assert_wbc_ok(tctx, wbcPingDc2("BUILTIN", NULL, &name),
+                "%s", "wbcPingDc2(BUILTIN) failed");
+        wbcFreeMemory(name);
+
+        wbcFreeMemory(details);
 
         return true;
@@ -69 +121 @@
 
         torture_assert_wbc_ok(tctx, wbcLibraryDetails(&details),
-                "wbcLibraryDetails failed");
+                "%s", "wbcLibraryDetails failed");
         torture_assert(tctx, details,
                 "wbcLibraryDetails returned NULL pointer");
@@ -83 +135 @@
 
         torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
-                "wbcInterfaceDetails failed");
+                "%s", "wbcInterfaceDetails failed");
         torture_assert(tctx, details,
-                "wbcInterfaceDetails returned NULL pointer");
+                       "wbcInterfaceDetails returned NULL pointer");
 
         wbcFreeMemory(details);
@@ -113 +165 @@
                                  "SID_UNKNOWN", "SID_UNKNOWN failed");
         torture_assert_str_equal(tctx, wbcSidTypeString(WBC_SID_NAME_COMPUTER),
-                                 "SID_COMPUTER", "SID_COMPUTER failed");
+                                 "SID_COMPUTER",  "SID_COMPUTER failed");
         return true;
 }
@@ -124 +176 @@
 
         torture_assert_wbc_ok(tctx, wbcStringToSid(sid_string, &sid),
-                "wbcStringToSid failed");
+                              "wbcStringToSid of %s failed", sid_string);
         torture_assert_wbc_ok(tctx, wbcSidToString(&sid, &sid_string2),
-                "wbcSidToString failed");
+                              "wbcSidToString of %s failed", sid_string);
         torture_assert_str_equal(tctx, sid_string, sid_string2,
                 "sid strings differ");
@@ -141 +193 @@
 
         torture_assert_wbc_ok(tctx, wbcStringToGuid(guid_string, &guid),
-                "wbcStringToGuid failed");
+                              "wbcStringToGuid of %s failed", guid_string);
         torture_assert_wbc_ok(tctx, wbcGuidToString(&guid, &guid_string2),
-                "wbcGuidToString failed");
+                              "wbcGuidToString of %s failed", guid_string);
         torture_assert_str_equal(tctx, guid_string, guid_string2,
-                "guid strings differ");
+                                 "guid strings differ");
         wbcFreeMemory(guid_string2);
 
@@ -157 +209 @@
 
         torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
-                "wbcInterfaceDetails failed");
+                "%s", "wbcInterfaceDetails failed");
         torture_assert_wbc_ok(
                 tctx, wbcDomainInfo(details->netbios_domain, &info),
-                "wbcDomainInfo failed");
+                "%s", "wbcDomainInfo failed");
         wbcFreeMemory(details);
 
@@ -179 +231 @@
 
         torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
-                "wbcInterfaceDetails failed");
+                "%s", "wbcInterfaceDetails failed");
 
         domain_name = talloc_strdup(tctx, details->netbios_domain);
@@ -185 +237 @@
 
         torture_assert_wbc_ok(tctx, wbcListUsers(domain_name, &num_users, &users),
-                "wbcListUsers failed");
+                "%s", "wbcListUsers failed");
         torture_assert(tctx, !(num_users > 0 && !users),
                 "wbcListUsers returned invalid results");
@@ -195 +247 @@
                 char *domain;
                 char *name;
+                char *sid_string;
                 uint32_t num_sids;
 
                 torture_assert_wbc_ok(tctx, wbcLookupName(domain_name, users[i], &sid, &name_type),
-                        "wbcLookupName failed");
+                                      "wbcLookupName of %s failed", users[i]);
                 torture_assert_int_equal(tctx, name_type, WBC_SID_NAME_USER,
-                        "wbcLookupName expected WBC_SID_NAME_USER");
+                                         "wbcLookupName expected WBC_SID_NAME_USER");
+                wbcSidToString(&sid, &sid_string);
                 torture_assert_wbc_ok(tctx, wbcLookupSid(&sid, &domain, &name, &name_type),
-                        "wbcLookupSid failed");
+                                      "wbcLookupSid of %s failed", sid_string);
                 torture_assert_int_equal(tctx, name_type, WBC_SID_NAME_USER,
-                        "wbcLookupSid expected WBC_SID_NAME_USER");
+                                         "wbcLookupSid of expected WBC_SID_NAME_USER");
                 torture_assert(tctx, name,
                         "wbcLookupSid returned no name");
@@ -210 +264 @@
                 wbcFreeMemory(name);
                 torture_assert_wbc_ok(tctx, wbcLookupUserSids(&sid, true, &num_sids, &sids),
-                        "wbcLookupUserSids failed");
+                        "wbcLookupUserSids of %s failed", sid_string);
                 torture_assert_wbc_ok(
                         tctx, wbcGetDisplayName(&sid, &domain, &name,
                                                 &name_type),
-                        "wbcGetDisplayName failed");
+                        "wbcGetDisplayName of %s failed", sid_string);
                 wbcFreeMemory(domain);
                 wbcFreeMemory(name);
                 wbcFreeMemory(sids);
+                wbcFreeMemory(sid_string);
         }
         wbcFreeMemory(users);
@@ -233 +288 @@
 
         torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
-                "wbcInterfaceDetails failed");
+                              "%s", "wbcInterfaceDetails failed");
 
         domain_name = talloc_strdup(tctx, details->netbios_domain);
@@ -239 +294 @@
 
         torture_assert_wbc_ok(tctx, wbcListGroups(domain_name, &num_groups, &groups),
-                "wbcListGroups failed");
+                              "wbcListGroups in %s failed", domain_name);
         torture_assert(tctx, !(num_groups > 0 && !groups),
-                "wbcListGroups returned invalid results");
+                       "wbcListGroups returned invalid results");
 
         for (i=0; i < MIN(num_groups,100); i++) {
@@ -249 +304 @@
                 char *domain;
                 char *name;
+                char *sid_string;
 
                 torture_assert_wbc_ok(tctx, wbcLookupName(domain_name, groups[i], &sid, &name_type),
-                        "wbcLookupName failed");
+                                      "wbcLookupName for %s failed", domain_name);
+                wbcSidToString(&sid, &sid_string);
                 torture_assert_wbc_ok(tctx, wbcLookupSid(&sid, &domain, &name, &name_type),
-                        "wbcLookupSid failed");
+                                      "wbcLookupSid of %s failed", sid_string);
+                wbcFreeMemory(sid_string);
                 torture_assert(tctx, name,
                         "wbcLookupSid returned no name");
@@ -269 +327 @@
 
         torture_assert_wbc_ok(tctx, wbcListTrusts(&domains, &num_domains),
-                "wbcListTrusts failed");
+                              "%s", "wbcListTrusts failed");
         torture_assert(tctx, !(num_domains > 0 && !domains),
                 "wbcListTrusts returned invalid results");
@@ -283 +341 @@
                 */
                 torture_assert_wbc_ok(tctx, wbcCheckTrustCredentials(domains[i].short_name, &error),
-                        "wbcCheckTrustCredentials failed");
+                                      "%s", "wbcCheckTrustCredentials failed");
                 /*
                 torture_assert_wbc_ok(tctx, wbcLookupName(domains[i].short_name, NULL, &sid, &name_type),
@@ -309 +367 @@
 
         torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
-                "wbcInterfaceDetails failed");
+                "%s", "wbcInterfaceDetails failed");
 
         domain_name = talloc_strdup(tctx, details->netbios_domain);
@@ -315 +373 @@
 
         torture_assert_wbc_ok(tctx, wbcLookupDomainController(domain_name, 0, &dc_info),
-                "wbcLookupDomainController failed");
+                              "wbcLookupDomainController for %s failed", domain_name);
         wbcFreeMemory(dc_info);
 
@@ -328 +386 @@
 
         torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
-                "wbcInterfaceDetails failed");
+                "%s", "wbcInterfaceDetails failed");
 
         domain_name = talloc_strdup(tctx, details->netbios_domain);
@@ -334 +392 @@
 
         torture_assert_wbc_ok(tctx, wbcLookupDomainControllerEx(domain_name, NULL, NULL, 0, &dc_info),
-                "wbcLookupDomainControllerEx failed");
+                "wbcLookupDomainControllerEx for %s failed", domain_name);
         wbcFreeMemory(dc_info);
 
@@ -348 +406 @@
         name = torture_setting_string(tctx, "host", NULL);
 
+        torture_comment(tctx, "test-WinsByName: host='%s'\n", name);
+
         ret = wbcResolveWinsByName(name, &ip);
 
         if (is_ipaddress(name)) {
-                torture_assert_wbc_equal(tctx, ret, WBC_ERR_DOMAIN_NOT_FOUND, "wbcResolveWinsByName failed");
+                torture_assert_wbc_equal(tctx, ret, WBC_ERR_DOMAIN_NOT_FOUND, "wbcResolveWinsByName of %s failed", name);
         } else {
-                torture_assert_wbc_ok(tctx, ret, "wbcResolveWinsByName failed");
+                torture_assert_wbc_ok(tctx, ret, "wbcResolveWinsByName for %s failed", name);
         }
 
@@ -362 +422 @@
 {
         const char *ip;
+        const char *host;
+        struct nbt_name nbt_name;
         char *name;
         wbcErr ret;
-
-        ip = torture_setting_string(tctx, "host", NULL);
+        NTSTATUS status;
+
+        host = torture_setting_string(tctx, "host", NULL);
+
+        torture_comment(tctx, "test-WinsByIp: host='%s'\n", host);
+
+        make_nbt_name_server(&nbt_name, host);
+
+        status = resolve_name_ex(lpcfg_resolve_context(tctx->lp_ctx),
+                                 0, 0, &nbt_name, tctx, &ip, tctx->ev);
+        torture_assert_ntstatus_ok(tctx, status,
+                        talloc_asprintf(tctx,"Failed to resolve %s: %s",
+                                        nbt_name.name, nt_errstr(status)));
+
+        torture_comment(tctx, "test-WinsByIp: ip='%s'\n", ip);
 
         ret = wbcResolveWinsByIP(ip, &name);
 
-        torture_assert_wbc_ok(tctx, ret, "wbcResolveWinsByIP failed");
+        torture_assert_wbc_ok(tctx, ret, "wbcResolveWinsByIP for %s failed", ip);
 
         wbcFreeMemory(name);
@@ -388 +463 @@
         ret = wbcLookupRids(&builtin, 2, rids, &domain_name, &names,
                             &types);
-        torture_assert_wbc_ok(tctx, ret, "wbcLookupRids failed");
+        torture_assert_wbc_ok(tctx, ret, "%s", "wbcLookupRids for 544 and 545 failed");
 
         torture_assert_str_equal(
@@ -396 +471 @@
                 tctx, names[1], "Users", "S-1-5-32-545 not mapped to 'Users'");
 
-        wbcFreeMemory((char *)domain_name);
+        wbcFreeMemory(discard_const_p(char ,domain_name));
         wbcFreeMemory(names);
         wbcFreeMemory(types);
@@ -414 +489 @@
 
         torture_assert_wbc_ok(tctx, wbcInterfaceDetails(&details),
-                "wbcInterfaceDetails failed");
+                              "%s", "wbcInterfaceDetails failed");
         torture_assert_wbc_ok(
                 tctx, wbcDomainInfo(details->netbios_domain, &info),
-                "wbcDomainInfo failed");
+                "wbcDomainInfo of %s failed", details->netbios_domain);
         wbcFreeMemory(details);
 
@@ -428 +503 @@
         torture_assert_wbc_ok(
                 tctx, wbcStringToSid("S-1-5-32", &builtin),
-                "wbcStringToSid failed");
+                "wbcStringToSid of %s failed", "S-1-5-32");
 
         ret = wbcGetSidAliases(&builtin, sids, 2, &rids, &num_rids);
-        torture_assert_wbc_ok(tctx, ret, "wbcGetSidAliases failed");
+        torture_assert_wbc_ok(tctx, ret, "%s", "wbcGetSidAliases failed");
 
         wbcFreeMemory(rids);
@@ -446 +521 @@
         wbcErr ret;
 
-        ret = wbcAuthenticateUser(getenv("USERNAME"), correct_password);
-        torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcAuthenticateUser failed");
+        ret = wbcAuthenticateUser(cli_credentials_get_username(cmdline_credentials), correct_password);
+        torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
+                                 "wbcAuthenticateUser of %s failed",
+                                 cli_credentials_get_username(cmdline_credentials));
 
         ZERO_STRUCT(params);
-        params.account_name             = getenv("USERNAME");
+        params.account_name             = cli_credentials_get_username(cmdline_credentials);
         params.level                    = WBC_AUTH_USER_LEVEL_PLAIN;
         params.password.plaintext       = correct_password;
@@ -457 +533 @@
         ret = wbcAuthenticateUserEx(&params, &info, &error);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcAuthenticateUserEx failed");
+                                 "wbcAuthenticateUserEx of %s failed", params.account_name);
         wbcFreeMemory(info);
         info = NULL;
@@ -467 +543 @@
         ret = wbcAuthenticateUserEx(&params, &info, &error);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_AUTH_ERROR,
-                                 "wbcAuthenticateUserEx succeeded where it "
-                                 "should have failed");
+                                 "wbcAuthenticateUserEx for %s succeeded where it "
+                                 "should have failed", params.account_name);
         wbcFreeMemory(info);
         info = NULL;
@@ -480 +556 @@
 static bool test_wbc_authenticate_user(struct torture_context *tctx)
 {
-        return test_wbc_authenticate_user_int(tctx, getenv("PASSWORD"));
+        return test_wbc_authenticate_user_int(tctx, cli_credentials_get_password(cmdline_credentials));
 }
 
@@ -486 +562 @@
 {
         wbcErr ret;
-        const char *oldpass = getenv("PASSWORD");
-        const char *newpass = "Koo8irei";
+        const char *oldpass = cli_credentials_get_password(cmdline_credentials);
+        const char *newpass = "Koo8irei%$";
 
         struct samr_CryptPassword new_nt_password;
@@ -551 +627 @@
 
         params.level = WBC_CHANGE_PASSWORD_LEVEL_RESPONSE;
-        params.account_name = getenv("USERNAME");
-        params.domain_name = "SAMBA-TEST";
+        params.account_name = cli_credentials_get_username(cmdline_credentials);
+        params.domain_name = cli_credentials_get_domain(cmdline_credentials);
 
         ret = wbcChangeUserPasswordEx(&params, NULL, NULL, NULL);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcChangeUserPassword failed");
-
-        if (!test_wbc_authenticate_user_int(tctx, "Koo8irei")) {
+                                 "wbcChangeUserPassword for %s failed", params.account_name);
+
+        if (!test_wbc_authenticate_user_int(tctx, newpass)) {
                 return false;
         }
 
-        ret = wbcChangeUserPassword(getenv("USERNAME"), "Koo8irei",
-                                    getenv("PASSWORD"));
-        torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcChangeUserPassword failed");
-
-        return test_wbc_authenticate_user_int(tctx, getenv("PASSWORD"));
+        ret = wbcChangeUserPassword(cli_credentials_get_username(cmdline_credentials), newpass,
+                                    cli_credentials_get_password(cmdline_credentials));
+        torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
+                                 "wbcChangeUserPassword for %s failed", params.account_name);
+
+        return test_wbc_authenticate_user_int(tctx, cli_credentials_get_password(cmdline_credentials));
 }
 
@@ -586 +662 @@
         ret = wbcLogonUser(&params, &info, &error, &policy);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_INVALID_PARAM,
-                                 "wbcLogonUser succeeded where it should "
+                                 "%s", "wbcLogonUser succeeded for NULL where it should "
                                  "have failed");
 
-        params.username = getenv("USERNAME");
-        params.password = getenv("PASSWORD");
+        params.username = cli_credentials_get_username(cmdline_credentials);
+        params.password = cli_credentials_get_password(cmdline_credentials);
 
         ret = wbcAddNamedBlob(&params.num_blobs, &params.blobs,
                               "foo", 0, discard_const_p(uint8_t, "bar"), 4);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcAddNamedBlob failed");
+                                 "%s", "wbcAddNamedBlob failed");
 
         ret = wbcLogonUser(&params, &info, &error, &policy);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcLogonUser failed");
+                                 "wbcLogonUser for %s failed", params.username);
         wbcFreeMemory(info); info = NULL;
         wbcFreeMemory(error); error = NULL;
@@ -608 +684 @@
         ret = wbcLogonUser(&params, &info, &error, &policy);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_AUTH_ERROR,
-                                 "wbcLogonUser should have failed with "
-                                 "WBC_ERR_AUTH_ERROR");
+                                 "wbcLogonUser for %s should have failed with "
+                                 "WBC_ERR_AUTH_ERROR", params.username);
         wbcFreeMemory(info); info = NULL;
         wbcFreeMemory(error); error = NULL;
@@ -619 +695 @@
                               strlen("S-1-2-3-4")+1);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcAddNamedBlob failed");
-        params.password = getenv("PASSWORD");
+                                 "%s", "wbcAddNamedBlob failed");
+        params.password = cli_credentials_get_password(cmdline_credentials);
         ret = wbcLogonUser(&params, &info, &error, &policy);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_AUTH_ERROR,
-                                 "wbcLogonUser should have failed with "
-                                 "WBC_ERR_AUTH_ERROR");
+                                 "wbcLogonUser for %s should have failed with "
+                                 "WBC_ERR_AUTH_ERROR", params.username);
         wbcFreeMemory(info); info = NULL;
         wbcFreeMemory(error); error = NULL;
@@ -633 +709 @@
         ret = wbcInterfaceDetails(&iface);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcInterfaceDetails failed");
-
-        ret = wbcLookupName(iface->netbios_domain, getenv("USERNAME"), &sid,
+                                 "%s", "wbcInterfaceDetails failed");
+
+        ret = wbcLookupName(iface->netbios_domain, cli_credentials_get_username(cmdline_credentials), &sid,
                             &sidtype);
         wbcFreeMemory(iface);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcLookupName failed");
+                                 "wbcLookupName for %s failed", cli_credentials_get_username(cmdline_credentials));
 
         ret = wbcSidToString(&sid, &sidstr);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcSidToString failed");
+                                 "%s", "wbcSidToString failed");
 
         ret = wbcAddNamedBlob(&params.num_blobs, &params.blobs,
@@ -649 +725 @@
                               (uint8_t *)sidstr, strlen(sidstr)+1);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcAddNamedBlob failed");
+                                 "%s", "wbcAddNamedBlob failed");
         wbcFreeMemory(sidstr);
-        params.password = getenv("PASSWORD");
+        params.password = cli_credentials_get_password(cmdline_credentials);
         ret = wbcLogonUser(&params, &info, &error, &policy);
         torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcLogonUser failed");
+                                 "wbcLogonUser for %s failed", params.username);
         wbcFreeMemory(info); info = NULL;
         wbcFreeMemory(error); error = NULL;
@@ -670 +746 @@
         gid_t *groups;
 
-        ret = wbcGetGroups(getenv("USERNAME"), &num_groups, &groups);
-        torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
-                                 "wbcGetGroups failed");
+        ret = wbcGetGroups(cli_credentials_get_username(cmdline_credentials), &num_groups, &groups);
+        torture_assert_wbc_equal(tctx, ret, WBC_ERR_SUCCESS,
+                                 "wbcGetGroups for %s failed", cli_credentials_get_username(cmdline_credentials));
         wbcFreeMemory(groups);
         return true;
@@ -683 +759 @@
         torture_suite_add_simple_test(suite, "wbcPing", test_wbc_ping);
         torture_suite_add_simple_test(suite, "wbcPingDc", test_wbc_pingdc);
+        torture_suite_add_simple_test(suite, "wbcPingDc2", test_wbc_pingdc2);
         torture_suite_add_simple_test(suite, "wbcLibraryDetails", test_wbc_library_details);
         torture_suite_add_simple_test(suite, "wbcInterfaceDetails", test_wbc_interface_details);

vendor/current/nsswitch/libwbclient/wbc_err_internal.h

@@ -30 +30 @@
                         goto done;              \
                 }                               \
-        } while(0);
+        } while(0)
 
 #define BAIL_ON_PTR_ERROR(x, status)                    \
@@ -40 +40 @@
                         status = WBC_ERR_SUCCESS;       \
                 }                                       \
-        } while (0);
+        } while (0)
 
 

vendor/current/nsswitch/libwbclient/wbc_idmap.c

@@ -27 +27 @@
 
 /* Convert a Windows SID to a Unix uid, allocating an uid if needed */
-wbcErr wbcSidToUid(const struct wbcDomainSid *sid, uid_t *puid)
+wbcErr wbcCtxSidToUid(struct wbcContext *ctx, const struct wbcDomainSid *sid,
+                      uid_t *puid)
 {
         struct winbindd_request request;
@@ -47 +48 @@
         /* Make request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_SID_TO_UID,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_SID_TO_UID,
                                         &request,
                                         &response);
@@ -58 +59 @@
  done:
         return wbc_status;
+}
+
+wbcErr wbcSidToUid(const struct wbcDomainSid *sid, uid_t *puid)
+{
+        return wbcCtxSidToUid(NULL, sid, puid);
 }
 
@@ -68 +74 @@
 
 /* Convert a Unix uid to a Windows SID, allocating a SID if needed */
-wbcErr wbcUidToSid(uid_t uid, struct wbcDomainSid *sid)
+wbcErr wbcCtxUidToSid(struct wbcContext *ctx, uid_t uid,
+                      struct wbcDomainSid *sid)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -88 +95 @@
         /* Make request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_UID_TO_SID,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_UID_TO_SID,
                                         &request,
                                         &response);
@@ -98 +105 @@
 done:
         return wbc_status;
+}
+
+wbcErr wbcUidToSid(uid_t uid, struct wbcDomainSid *sid)
+{
+        return wbcCtxUidToSid(NULL, uid, sid);
 }
 
@@ -116 +128 @@
  **/
 
-wbcErr wbcSidToGid(const struct wbcDomainSid *sid, gid_t *pgid)
+wbcErr wbcCtxSidToGid(struct wbcContext *ctx, const struct wbcDomainSid *sid,
+                      gid_t *pgid)
 {
         struct winbindd_request request;
@@ -136 +149 @@
         /* Make request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_SID_TO_GID,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_SID_TO_GID,
                                         &request,
                                         &response);
@@ -149 +162 @@
 }
 
+wbcErr wbcSidToGid(const struct wbcDomainSid *sid, gid_t *pgid)
+{
+        return wbcCtxSidToGid(NULL, sid, pgid);
+}
 
 /* Convert a Windows SID to a Unix gid if there already is a mapping */
@@ -160 +177 @@
 
 /* Convert a Unix gid to a Windows SID, allocating a SID if needed */
-wbcErr wbcGidToSid(gid_t gid, struct wbcDomainSid *sid)
+wbcErr wbcCtxGidToSid(struct wbcContext *ctx, gid_t gid,
+                      struct wbcDomainSid *sid)
 {
         struct winbindd_request request;
@@ -180 +198 @@
         /* Make request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_GID_TO_SID,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GID_TO_SID,
                                         &request,
                                         &response);
@@ -190 +208 @@
 done:
         return wbc_status;
+}
+
+wbcErr wbcGidToSid(gid_t gid, struct wbcDomainSid *sid)
+{
+        return wbcCtxGidToSid(NULL, gid, sid);
 }
 
@@ -200 +223 @@
 
 /* Obtain a new uid from Winbind */
-wbcErr wbcAllocateUid(uid_t *puid)
+wbcErr wbcCtxAllocateUid(struct wbcContext *ctx, uid_t *puid)
 {
         struct winbindd_request request;
@@ -216 +239 @@
         /* Make request */
 
-        wbc_status = wbcRequestResponsePriv(WINBINDD_ALLOCATE_UID,
+        wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_ALLOCATE_UID,
                                             &request, &response);
         BAIL_ON_WBC_ERROR(wbc_status);
@@ -229 +252 @@
 }
 
+wbcErr wbcAllocateUid(uid_t *puid)
+{
+        return wbcCtxAllocateUid(NULL, puid);
+}
+
 /* Obtain a new gid from Winbind */
-wbcErr wbcAllocateGid(gid_t *pgid)
+wbcErr wbcCtxAllocateGid(struct wbcContext *ctx, gid_t *pgid)
 {
         struct winbindd_request request;
@@ -246 +274 @@
         /* Make request */
 
-        wbc_status = wbcRequestResponsePriv(WINBINDD_ALLOCATE_GID,
+        wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_ALLOCATE_GID,
                                             &request, &response);
         BAIL_ON_WBC_ERROR(wbc_status);
@@ -257 +285 @@
  done:
         return wbc_status;
+}
+
+wbcErr wbcAllocateGid(gid_t *pgid)
+{
+        return wbcCtxAllocateGid(NULL, pgid);
 }
 
@@ -300 +333 @@
 
 /* Convert a list of SIDs */
-wbcErr wbcSidsToUnixIds(const struct wbcDomainSid *sids, uint32_t num_sids,
-                        struct wbcUnixId *ids)
+wbcErr wbcCtxSidsToUnixIds(struct wbcContext *ctx,
+                           const struct wbcDomainSid *sids,
+                           uint32_t num_sids, struct wbcUnixId *ids)
 {
         struct winbindd_request request;
@@ -342 +376 @@
         request.extra_len = p - sidlist;
 
-        wbc_status = wbcRequestResponse(WINBINDD_SIDS_TO_XIDS,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_SIDS_TO_XIDS,
                                         &request, &response);
         free(sidlist);
@@ -371 +405 @@
                         id->id.gid = strtoul(p+1, &q, 10);
                         break;
+                case 'B':
+                        id->type = WBC_ID_TYPE_BOTH;
+                        id->id.uid = strtoul(p+1, &q, 10);
+                        break;
                 default:
                         id->type = WBC_ID_TYPE_NOT_SPECIFIED;
-                        q = p;
+                        q = strchr(p, '\n');
                         break;
                 };
-                if (q[0] != '\n') {
+                if (q == NULL || q[0] != '\n') {
                         goto wbc_err_invalid;
                 }
@@ -390 +428 @@
         return wbc_status;
 }
+
+wbcErr wbcSidsToUnixIds(const struct wbcDomainSid *sids, uint32_t num_sids,
+                        struct wbcUnixId *ids)
+{
+        return wbcCtxSidsToUnixIds(NULL, sids, num_sids, ids);
+}

vendor/current/nsswitch/libwbclient/wbc_pam.c

@@ -29 +29 @@
 
 /* Authenticate a username/password pair */
-wbcErr wbcAuthenticateUser(const char *username,
-                           const char *password)
+wbcErr wbcCtxAuthenticateUser(struct wbcContext *ctx,
+                              const char *username, const char *password)
 {
         wbcErr wbc_status = WBC_ERR_SUCCESS;
@@ -41 +41 @@
         params.password.plaintext       = password;
 
-        wbc_status = wbcAuthenticateUserEx(&params, NULL, NULL);
+        wbc_status = wbcCtxAuthenticateUserEx(ctx, &params, NULL, NULL);
         BAIL_ON_WBC_ERROR(wbc_status);
 
 done:
         return wbc_status;
+}
+
+wbcErr wbcAuthenticateUser(const char *username, const char *password)
+{
+        return wbcCtxAuthenticateUser(NULL, username, password);
 }
 
@@ -343 +348 @@
 
 /* Authenticate with more detailed information */
-wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
-                             struct wbcAuthUserInfo **info,
-                             struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxAuthenticateUserEx(struct wbcContext *ctx,
+                                const struct wbcAuthUserParams *params,
+                                struct wbcAuthUserInfo **info,
+                                struct wbcAuthErrorInfo **error)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -364 +370 @@
         }
 
-        if (!params->account_name) {
+        if (params->level != WBC_AUTH_USER_LEVEL_PAC && !params->account_name) {
                 wbc_status = WBC_ERR_INVALID_PARAM;
                 BAIL_ON_WBC_ERROR(wbc_status);
@@ -389 +395 @@
                         ZERO_STRUCT(sep_response);
 
-                        wbc_status = wbcRequestResponse(WINBINDD_INFO,
+                        wbc_status = wbcRequestResponse(ctx, WINBINDD_INFO,
                                                         NULL, &sep_response);
                         BAIL_ON_WBC_ERROR(wbc_status);
@@ -491 +497 @@
                 }
                 break;
+
+        case WBC_AUTH_USER_LEVEL_PAC:
+                cmd = WINBINDD_PAM_AUTH_CRAP;
+                request.flags = WBFLAG_PAM_AUTH_PAC | WBFLAG_PAM_INFO3_TEXT;
+                request.extra_data.data = malloc(params->password.pac.length);
+                if (request.extra_data.data == NULL) {
+                        wbc_status = WBC_ERR_NO_MEMORY;
+                        BAIL_ON_WBC_ERROR(wbc_status);
+                }
+                memcpy(request.extra_data.data, params->password.pac.data,
+                       params->password.pac.length);
+                request.extra_len = params->password.pac.length;
+                break;
+
         default:
                 break;
@@ -505 +525 @@
 
         if (cmd == WINBINDD_PAM_AUTH_CRAP) {
-                wbc_status = wbcRequestResponsePriv(cmd, &request, &response);
+                wbc_status = wbcRequestResponsePriv(ctx, cmd,
+                                                    &request, &response);
         } else {
-                wbc_status = wbcRequestResponse(cmd, &request, &response);
+                wbc_status = wbcRequestResponse(ctx, cmd,
+                                                &request, &response);
         }
         if (response.data.auth.nt_status != 0) {
@@ -534 +556 @@
 }
 
+wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
+                             struct wbcAuthUserInfo **info,
+                             struct wbcAuthErrorInfo **error)
+{
+        return wbcCtxAuthenticateUserEx(NULL, params, info, error);
+}
+
 /* Trigger a verification of the trust credentials of a specific domain */
-wbcErr wbcCheckTrustCredentials(const char *domain,
-                                struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxCheckTrustCredentials(struct wbcContext *ctx, const char *domain,
+                                   struct wbcAuthErrorInfo **error)
 {
         struct winbindd_request request;
@@ -552 +581 @@
         /* Send request */
 
-        wbc_status = wbcRequestResponsePriv(WINBINDD_CHECK_MACHACC,
+        wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_CHECK_MACHACC,
                                             &request, &response);
         if (response.data.auth.nt_status != 0) {
@@ -570 +599 @@
 }
 
+wbcErr wbcCheckTrustCredentials(const char *domain,
+                                struct wbcAuthErrorInfo **error)
+{
+        return wbcCtxCheckTrustCredentials(NULL, domain, error);
+}
+
 /* Trigger a change of the trust credentials for a specific domain */
-wbcErr wbcChangeTrustCredentials(const char *domain,
-                                 struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxChangeTrustCredentials(struct wbcContext *ctx, const char *domain,
+                                    struct wbcAuthErrorInfo **error)
 {
         struct winbindd_request request;
@@ -588 +623 @@
         /* Send request */
 
-        wbc_status = wbcRequestResponsePriv(WINBINDD_CHANGE_MACHACC,
-                                        &request, &response);
+        wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_CHANGE_MACHACC,
+                                            &request, &response);
         if (response.data.auth.nt_status != 0) {
                 if (error) {
@@ -606 +641 @@
 }
 
+wbcErr wbcChangeTrustCredentials(const char *domain,
+                                 struct wbcAuthErrorInfo **error)
+{
+        return wbcCtxChangeTrustCredentials(NULL, domain, error);
+}
+
 /*
  * Trigger a no-op NETLOGON call. Lightweight version of
  * wbcCheckTrustCredentials
  */
+wbcErr wbcCtxPingDc(struct wbcContext *ctx, const char *domain,
+                    struct wbcAuthErrorInfo **error)
+{
+        return wbcCtxPingDc2(ctx, domain, error, NULL);
+}
+
 wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
+{
+        return wbcPingDc2(domain, error, NULL);
+}
+
+/*
+ * Trigger a no-op NETLOGON call. Lightweight version of
+ * wbcCheckTrustCredentials, optionally return attempted DC
+ */
+wbcErr wbcCtxPingDc2(struct wbcContext *ctx, const char *domain,
+                     struct wbcAuthErrorInfo **error, char **dcname)
 {
         struct winbindd_request request;
@@ -616 +673 @@
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 
-        if (domain) {
-                /*
-                 * the current protocol doesn't support
-                 * specifying a domain
-                 */
-                wbc_status = WBC_ERR_NOT_IMPLEMENTED;
-                BAIL_ON_WBC_ERROR(wbc_status);
-        }
-
         ZERO_STRUCT(request);
         ZERO_STRUCT(response);
 
+        if (domain) {
+                strncpy(request.domain_name, domain,
+                        sizeof(request.domain_name)-1);
+        }
+
         /* Send request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_PING_DC,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_PING_DC,
                                         &request,
                                         &response);
+
+        if (dcname && response.extra_data.data) {
+                size_t len;
+
+                len = response.length - sizeof(struct winbindd_response);
+                *dcname = wbcAllocateMemory(1, len, NULL);
+                BAIL_ON_PTR_ERROR(*dcname, wbc_status);
+
+                strlcpy(*dcname, response.extra_data.data, len);
+        }
+
         if (response.data.auth.nt_status != 0) {
                 if (error) {
@@ -649 +713 @@
 }
 
+wbcErr wbcPingDc2(const char *domain, struct wbcAuthErrorInfo **error,
+                  char **dcname)
+{
+        return wbcCtxPingDc2(NULL, domain, error, dcname);
+}
+
 /* Trigger an extended logoff notification to Winbind for a specific user */
-wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
-                       struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxLogoffUserEx(struct wbcContext *ctx,
+                          const struct wbcLogoffUserParams *params,
+                          struct wbcAuthErrorInfo **error)
 {
         struct winbindd_request request;
@@ -714 +785 @@
         /* Send request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_LOGOFF,
                                         &request,
                                         &response);
@@ -735 +806 @@
 }
 
+wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
+                       struct wbcAuthErrorInfo **error)
+{
+        return wbcCtxLogoffUserEx(NULL, params, error);
+}
+
 /* Trigger a logoff notification to Winbind for a specific user */
+wbcErr wbcCtxLogoffUser(struct wbcContext *ctx,
+                        const char *username, uid_t uid,
+                        const char *ccfilename)
+{
+        struct winbindd_request request;
+        struct winbindd_response response;
+        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+        /* validate input */
+
+        if (!username) {
+                wbc_status = WBC_ERR_INVALID_PARAM;
+                BAIL_ON_WBC_ERROR(wbc_status);
+        }
+
+        ZERO_STRUCT(request);
+        ZERO_STRUCT(response);
+
+        strncpy(request.data.logoff.user, username,
+                sizeof(request.data.logoff.user)-1);
+        request.data.logoff.uid = uid;
+
+        if (ccfilename) {
+                strncpy(request.data.logoff.krb5ccname, ccfilename,
+                        sizeof(request.data.logoff.krb5ccname)-1);
+        }
+
+        /* Send request */
+
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_LOGOFF,
+                                        &request,
+                                        &response);
+
+        /* Take the response above and return it to the caller */
+
+ done:
+        return wbc_status;
+}
+
 wbcErr wbcLogoffUser(const char *username,
                      uid_t uid,
                      const char *ccfilename)
 {
-        struct winbindd_request request;
-        struct winbindd_response response;
-        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
-
-        /* validate input */
-
-        if (!username) {
-                wbc_status = WBC_ERR_INVALID_PARAM;
-                BAIL_ON_WBC_ERROR(wbc_status);
-        }
-
-        ZERO_STRUCT(request);
-        ZERO_STRUCT(response);
-
-        strncpy(request.data.logoff.user, username,
-                sizeof(request.data.logoff.user)-1);
-        request.data.logoff.uid = uid;
-
-        if (ccfilename) {
-                strncpy(request.data.logoff.krb5ccname, ccfilename,
-                        sizeof(request.data.logoff.krb5ccname)-1);
-        }
-
-        /* Send request */
-
-        wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
-                                        &request,
-                                        &response);
-
-        /* Take the response above and return it to the caller */
-
- done:
-        return wbc_status;
+        return wbcCtxLogoffUser(NULL, username, uid, ccfilename);
 }
 
 /* Change a password for a user with more detailed information upon failure */
-wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
-                               struct wbcAuthErrorInfo **error,
-                               enum wbcPasswordChangeRejectReason *reject_reason,
-                               struct wbcUserPasswordPolicyInfo **policy)
+wbcErr wbcCtxChangeUserPasswordEx(struct wbcContext *ctx,
+                        const struct wbcChangePasswordParams *params,
+                        struct wbcAuthErrorInfo **error,
+                        enum wbcPasswordChangeRejectReason *reject_reason,
+                        struct wbcUserPasswordPolicyInfo **policy)
 {
         struct winbindd_request request;
@@ -938 +1023 @@
         /* Send request */
 
-        wbc_status = wbcRequestResponse(cmd,
+        wbc_status = wbcRequestResponse(ctx, cmd,
                                         &request,
                                         &response);
@@ -973 +1058 @@
 }
 
+wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
+                              struct wbcAuthErrorInfo **error,
+                              enum wbcPasswordChangeRejectReason *reject_reason,
+                              struct wbcUserPasswordPolicyInfo **policy)
+{
+        return wbcCtxChangeUserPasswordEx(NULL, params, error,
+                                          reject_reason, policy);
+}
+
 /* Change a password for a user */
-wbcErr wbcChangeUserPassword(const char *username,
-                             const char *old_password,
-                             const char *new_password)
+wbcErr wbcCtxChangeUserPassword(struct wbcContext *ctx,
+                                const char *username,
+                                const char *old_password,
+                                const char *new_password)
 {
         wbcErr wbc_status = WBC_ERR_SUCCESS;
@@ -988 +1083 @@
         params.new_password.plaintext   = new_password;
 
-        wbc_status = wbcChangeUserPasswordEx(&params,
-                                             NULL,
-                                             NULL,
-                                             NULL);
+        wbc_status = wbcCtxChangeUserPasswordEx(ctx, &params,
+                                                NULL,
+                                                NULL,
+                                                NULL);
         BAIL_ON_WBC_ERROR(wbc_status);
 
@@ -998 +1093 @@
 }
 
+wbcErr wbcChangeUserPassword(const char *username,
+                             const char *old_password,
+                             const char *new_password)
+{
+        return wbcCtxChangeUserPassword(NULL, username,
+                                        old_password, new_password);
+}
+
 /* Logon a User */
-wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
-                    struct wbcLogonUserInfo **info,
-                    struct wbcAuthErrorInfo **error,
-                    struct wbcUserPasswordPolicyInfo **policy)
+wbcErr wbcCtxLogonUser(struct wbcContext *ctx,
+                       const struct wbcLogonUserParams *params,
+                       struct wbcLogonUserInfo **info,
+                       struct wbcAuthErrorInfo **error,
+                       struct wbcUserPasswordPolicyInfo **policy)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -1104 +1208 @@
         }
 
-        wbc_status = wbcRequestResponse(WINBINDD_PAM_AUTH,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_AUTH,
                                         &request,
                                         &response);
@@ -1138 +1242 @@
 }
 
+wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
+                    struct wbcLogonUserInfo **info,
+                    struct wbcAuthErrorInfo **error,
+                    struct wbcUserPasswordPolicyInfo **policy)
+{
+        return wbcCtxLogonUser(NULL, params, info, error, policy);
+}
+
 static void wbcCredentialCacheInfoDestructor(void *ptr)
 {
@@ -1146 +1258 @@
 
 /* Authenticate a user with cached credentials */
-wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
-                          struct wbcCredentialCacheInfo **info,
-                          struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxCredentialCache(struct wbcContext *ctx,
+                             struct wbcCredentialCacheParams *params,
+                             struct wbcCredentialCacheInfo **info,
+                             struct wbcAuthErrorInfo **error)
 {
         wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
@@ -1161 +1274 @@
         ZERO_STRUCT(response);
 
-        if (info != NULL) {
-                *info = NULL;
-        }
+        *info = NULL;
+
         if (error != NULL) {
                 *error = NULL;
@@ -1174 +1286 @@
         }
 
+        for (i=0; i<params->num_blobs; i++) {
+                /*
+                 * Older callers may used to provide the NEGOTIATE request
+                 * as "initial_blob", but it was completely ignored by winbindd.
+                 *
+                 * So we keep ignoring it.
+                 *
+                 * A new callers that is capable to support "new_spnego",
+                 * will provide the NEGOTIATE request as "negotiate_blob"
+                 * instead.
+                 */
+                if (strcasecmp(params->blobs[i].name, "negotiate_blob") == 0) {
+                        if (initial_blob != NULL) {
+                                status = WBC_ERR_INVALID_PARAM;
+                                goto fail;
+                        }
+                        initial_blob = &params->blobs[i];
+                        continue;
+                }
+                if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
+                        if (challenge_blob != NULL) {
+                                status = WBC_ERR_INVALID_PARAM;
+                                goto fail;
+                        }
+                        challenge_blob = &params->blobs[i];
+                        continue;
+                }
+        }
+
         if (params->domain_name != NULL) {
-                status = wbcRequestResponse(WINBINDD_INFO, NULL, &response);
+                status = wbcRequestResponse(ctx, WINBINDD_INFO,
+                                            NULL, &response);
                 if (!WBC_ERROR_IS_OK(status)) {
                         goto fail;
@@ -1191 +1333 @@
         request.data.ccache_ntlm_auth.uid = getuid();
 
-        for (i=0; i<params->num_blobs; i++) {
-                if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) {
-                        initial_blob = &params->blobs[i];
-                        break;
-                }
-                if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
-                        challenge_blob = &params->blobs[i];
-                        break;
-                }
-        }
-
         request.data.ccache_ntlm_auth.initial_blob_len = 0;
         request.data.ccache_ntlm_auth.challenge_blob_len = 0;
@@ -1235 +1366 @@
         }
 
-        status = wbcRequestResponse(WINBINDD_CCACHE_NTLMAUTH, &request,
-                                    &response);
+        status = wbcRequestResponse(ctx, WINBINDD_CCACHE_NTLMAUTH,
+                                    &request, &response);
         if (!WBC_ERROR_IS_OK(status)) {
                 goto fail;
@@ -1264 +1395 @@
                 goto fail;
         }
+        if (response.data.ccache_ntlm_auth.new_spnego) {
+                status = wbcAddNamedBlob(
+                        &result->num_blobs, &result->blobs, "new_spnego", 0,
+                        &response.data.ccache_ntlm_auth.new_spnego,
+                        sizeof(response.data.ccache_ntlm_auth.new_spnego));
+                if (!WBC_ERROR_IS_OK(status)) {
+                        goto fail;
+                }
+        }
 
         *info = result;
@@ -1275 +1415 @@
 }
 
+wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
+                          struct wbcCredentialCacheInfo **info,
+                          struct wbcAuthErrorInfo **error)
+{
+        return wbcCtxCredentialCache(NULL, params, info, error);
+}
+
 /* Authenticate a user with cached credentials */
-wbcErr wbcCredentialSave(const char *user, const char *password)
+wbcErr wbcCtxCredentialSave(struct wbcContext *ctx,
+                            const char *user, const char *password)
 {
         struct winbindd_request request;
@@ -1290 +1438 @@
         request.data.ccache_save.uid = getuid();
 
-        return wbcRequestResponse(WINBINDD_CCACHE_SAVE, &request, &response);
-}
+        return wbcRequestResponse(ctx, WINBINDD_CCACHE_SAVE, &request, &response);
+}
+
+wbcErr wbcCredentialSave(const char *user, const char *password)
+{
+        return wbcCtxCredentialSave(NULL, user, password);
+}

vendor/current/nsswitch/libwbclient/wbc_pwd.c

@@ -5 +5 @@
 
    Copyright (C) Gerald (Jerry) Carter 2007
+   Copyright (C) Matthew Newton 2015
 
 
@@ -168 +169 @@
 
 /* Fill in a struct passwd* for a domain user based on username */
-wbcErr wbcGetpwnam(const char *name, struct passwd **pwd)
+wbcErr wbcCtxGetpwnam(struct wbcContext *ctx,
+                      const char *name, struct passwd **pwd)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -188 +190 @@
         strncpy(request.data.username, name, sizeof(request.data.username)-1);
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETPWNAM,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETPWNAM,
                                         &request,
                                         &response);
@@ -200 +202 @@
 }
 
+wbcErr wbcGetpwnam(const char *name, struct passwd **pwd)
+{
+        return wbcCtxGetpwnam(NULL, name, pwd);
+}
+
 /* Fill in a struct passwd* for a domain user based on uid */
-wbcErr wbcGetpwuid(uid_t uid, struct passwd **pwd)
+wbcErr wbcCtxGetpwuid(struct wbcContext *ctx, uid_t uid, struct passwd **pwd)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -219 +226 @@
         request.data.uid = uid;
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETPWUID,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETPWUID,
                                         &request,
                                         &response);
@@ -231 +238 @@
 }
 
+wbcErr wbcGetpwuid(uid_t uid, struct passwd **pwd)
+{
+        return wbcCtxGetpwuid(NULL, uid, pwd);
+}
+
 /* Fill in a struct passwd* for a domain user based on sid */
-wbcErr wbcGetpwsid(struct wbcDomainSid *sid, struct passwd **pwd)
+wbcErr wbcCtxGetpwsid(struct wbcContext *ctx,
+                      struct wbcDomainSid *sid, struct passwd **pwd)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -250 +263 @@
         wbcSidToStringBuf(sid, request.data.sid, sizeof(request.data.sid));
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETPWSID,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETPWSID,
                                         &request,
                                         &response);
@@ -262 +275 @@
 }
 
+wbcErr wbcGetpwsid(struct wbcDomainSid *sid, struct passwd **pwd)
+{
+        return wbcCtxGetpwsid(NULL, sid, pwd);
+}
+
 /* Fill in a struct passwd* for a domain user based on username */
-wbcErr wbcGetgrnam(const char *name, struct group **grp)
+wbcErr wbcCtxGetgrnam(struct wbcContext *ctx,
+                      const char *name, struct group **grp)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -283 +302 @@
         strncpy(request.data.groupname, name, sizeof(request.data.groupname)-1);
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETGRNAM,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETGRNAM,
                                         &request,
                                         &response);
@@ -298 +317 @@
 }
 
+wbcErr wbcGetgrnam(const char *name, struct group **grp)
+{
+        return wbcCtxGetgrnam(NULL, name, grp);
+}
+
 /* Fill in a struct passwd* for a domain user based on uid */
-wbcErr wbcGetgrgid(gid_t gid, struct group **grp)
+wbcErr wbcCtxGetgrgid(struct wbcContext *ctx, gid_t gid, struct group **grp)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -317 +341 @@
         request.data.gid = gid;
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETGRGID,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETGRGID,
                                         &request,
                                         &response);
@@ -332 +356 @@
 }
 
-/** @brief Number of cached passwd structs
- *
- */
-static uint32_t pw_cache_size;
-
-/** @brief Position of the pwent context
- *
- */
-static uint32_t pw_cache_idx;
+wbcErr wbcGetgrgid(gid_t gid, struct group **grp)
+{
+        return wbcCtxGetgrgid(NULL, gid, grp);
+}
 
 /** @brief Winbindd response containing the passwd structs
@@ -348 +367 @@
 
 /* Reset the passwd iterator */
+wbcErr wbcCtxSetpwent(struct wbcContext *ctx)
+{
+        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+        if (!ctx) {
+                ctx = wbcGetGlobalCtx();
+        }
+
+        if (ctx->pw_cache_size > 0) {
+                ctx->pw_cache_idx = ctx->pw_cache_size = 0;
+                winbindd_free_response(&pw_response);
+        }
+
+        ZERO_STRUCT(pw_response);
+
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_SETPWENT,
+                                        NULL, NULL);
+        BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+        return wbc_status;
+}
+
 wbcErr wbcSetpwent(void)
 {
-        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
-
-        if (pw_cache_size > 0) {
-                pw_cache_idx = pw_cache_size = 0;
+        return wbcCtxSetpwent(NULL);
+}
+
+/* Close the passwd iterator */
+wbcErr wbcCtxEndpwent(struct wbcContext *ctx)
+{
+        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+        if (!ctx) {
+                ctx = wbcGetGlobalCtx();
+        }
+
+        if (ctx->pw_cache_size > 0) {
+                ctx->pw_cache_idx = ctx->pw_cache_size = 0;
                 winbindd_free_response(&pw_response);
         }
 
-        ZERO_STRUCT(pw_response);
-
-        wbc_status = wbcRequestResponse(WINBINDD_SETPWENT,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_ENDPWENT,
                                         NULL, NULL);
         BAIL_ON_WBC_ERROR(wbc_status);
@@ -367 +417 @@
 }
 
-/* Close the passwd iterator */
 wbcErr wbcEndpwent(void)
 {
-        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
-
-        if (pw_cache_size > 0) {
-                pw_cache_idx = pw_cache_size = 0;
-                winbindd_free_response(&pw_response);
-        }
-
-        wbc_status = wbcRequestResponse(WINBINDD_ENDPWENT,
-                                        NULL, NULL);
-        BAIL_ON_WBC_ERROR(wbc_status);
-
- done:
-        return wbc_status;
+        return wbcCtxEndpwent(NULL);
 }
 
 /* Return the next struct passwd* entry from the pwent iterator */
+wbcErr wbcCtxGetpwent(struct wbcContext *ctx, struct passwd **pwd)
+{
+        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+        struct winbindd_request request;
+        struct winbindd_pw *wb_pw;
+
+        if (!ctx) {
+                ctx = wbcGetGlobalCtx();
+        }
+
+        /* If there's a cached result, return that. */
+        if (ctx->pw_cache_idx < ctx->pw_cache_size) {
+                goto return_result;
+        }
+
+        /* Otherwise, query winbindd for some entries. */
+
+        ctx->pw_cache_idx = 0;
+
+        winbindd_free_response(&pw_response);
+
+        ZERO_STRUCT(request);
+        request.data.num_entries = MAX_GETPWENT_USERS;
+
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETPWENT, &request,
+                                        &pw_response);
+
+        BAIL_ON_WBC_ERROR(wbc_status);
+
+        ctx->pw_cache_size = pw_response.data.num_entries;
+
+return_result:
+
+        wb_pw = (struct winbindd_pw *) pw_response.extra_data.data;
+
+        *pwd = copy_passwd_entry(&wb_pw[ctx->pw_cache_idx]);
+
+        BAIL_ON_PTR_ERROR(*pwd, wbc_status);
+
+        ctx->pw_cache_idx++;
+
+done:
+        return wbc_status;
+}
+
 wbcErr wbcGetpwent(struct passwd **pwd)
 {
-        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
-        struct winbindd_request request;
-        struct winbindd_pw *wb_pw;
-
-        /* If there's a cached result, return that. */
-        if (pw_cache_idx < pw_cache_size) {
-                goto return_result;
-        }
-
-        /* Otherwise, query winbindd for some entries. */
-
-        pw_cache_idx = 0;
-
-        winbindd_free_response(&pw_response);
-
-        ZERO_STRUCT(request);
-        request.data.num_entries = MAX_GETPWENT_USERS;
-
-        wbc_status = wbcRequestResponse(WINBINDD_GETPWENT, &request,
-                                        &pw_response);
-
-        BAIL_ON_WBC_ERROR(wbc_status);
-
-        pw_cache_size = pw_response.data.num_entries;
-
-return_result:
-
-        wb_pw = (struct winbindd_pw *) pw_response.extra_data.data;
-
-        *pwd = copy_passwd_entry(&wb_pw[pw_cache_idx]);
-
-        BAIL_ON_PTR_ERROR(*pwd, wbc_status);
-
-        pw_cache_idx++;
-
-done:
-        return wbc_status;
-}
-
-/** @brief Number of cached group structs
- *
- */
-static uint32_t gr_cache_size;
-
-/** @brief Position of the grent context
- *
- */
-static uint32_t gr_cache_idx;
+        return wbcCtxGetpwent(NULL, pwd);
+}
 
 /** @brief Winbindd response containing the group structs
@@ -443 +479 @@
 
 /* Reset the group iterator */
+wbcErr wbcCtxSetgrent(struct wbcContext *ctx)
+{
+        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+        if (!ctx) {
+                ctx = wbcGetGlobalCtx();
+        }
+
+        if (ctx->gr_cache_size > 0) {
+                ctx->gr_cache_idx = ctx->gr_cache_size = 0;
+                winbindd_free_response(&gr_response);
+        }
+
+        ZERO_STRUCT(gr_response);
+
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_SETGRENT,
+                                        NULL, NULL);
+        BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+        return wbc_status;
+}
+
 wbcErr wbcSetgrent(void)
 {
-        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
-
-        if (gr_cache_size > 0) {
-                gr_cache_idx = gr_cache_size = 0;
+        return wbcCtxSetgrent(NULL);
+}
+
+/* Close the group iterator */
+wbcErr wbcCtxEndgrent(struct wbcContext *ctx)
+{
+        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+        if (!ctx) {
+                ctx = wbcGetGlobalCtx();
+        }
+
+        if (ctx->gr_cache_size > 0) {
+                ctx->gr_cache_idx = ctx->gr_cache_size = 0;
                 winbindd_free_response(&gr_response);
         }
 
-        ZERO_STRUCT(gr_response);
-
-        wbc_status = wbcRequestResponse(WINBINDD_SETGRENT,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_ENDGRENT,
                                         NULL, NULL);
         BAIL_ON_WBC_ERROR(wbc_status);
@@ -462 +529 @@
 }
 
-/* Close the group iterator */
 wbcErr wbcEndgrent(void)
 {
-        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
-
-        if (gr_cache_size > 0) {
-                gr_cache_idx = gr_cache_size = 0;
-                winbindd_free_response(&gr_response);
-        }
-
-        wbc_status = wbcRequestResponse(WINBINDD_ENDGRENT,
-                                        NULL, NULL);
-        BAIL_ON_WBC_ERROR(wbc_status);
-
- done:
-        return wbc_status;
+        return wbcCtxEndgrent(NULL);
 }
 
 /* Return the next struct group* entry from the pwent iterator */
-wbcErr wbcGetgrent(struct group **grp)
+wbcErr wbcCtxGetgrent(struct wbcContext *ctx, struct group **grp)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -488 +542 @@
         uint32_t mem_ofs;
 
+        if (!ctx) {
+                ctx = wbcGetGlobalCtx();
+        }
+
         /* If there's a cached result, return that. */
-        if (gr_cache_idx < gr_cache_size) {
+        if (ctx->gr_cache_idx < ctx->gr_cache_size) {
                 goto return_result;
         }
@@ -495 +553 @@
         /* Otherwise, query winbindd for some entries. */
 
-        gr_cache_idx = 0;
+        ctx->gr_cache_idx = 0;
 
         winbindd_free_response(&gr_response);
@@ -502 +560 @@
         request.data.num_entries = MAX_GETGRENT_GROUPS;
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETGRENT, &request,
-                                        &gr_response);
-
-        BAIL_ON_WBC_ERROR(wbc_status);
-
-        gr_cache_size = gr_response.data.num_entries;
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETGRENT,
+                                        &request, &gr_response);
+
+        BAIL_ON_WBC_ERROR(wbc_status);
+
+        ctx->gr_cache_size = gr_response.data.num_entries;
 
 return_result:
@@ -513 +571 @@
         wb_gr = (struct winbindd_gr *) gr_response.extra_data.data;
 
-        mem_ofs = wb_gr[gr_cache_idx].gr_mem_ofs +
-                  gr_cache_size * sizeof(struct winbindd_gr);
-
-        *grp = copy_group_entry(&wb_gr[gr_cache_idx],
+        mem_ofs = wb_gr[ctx->gr_cache_idx].gr_mem_ofs +
+                  ctx->gr_cache_size * sizeof(struct winbindd_gr);
+
+        *grp = copy_group_entry(&wb_gr[ctx->gr_cache_idx],
                                 ((char *)gr_response.extra_data.data)+mem_ofs);
 
         BAIL_ON_PTR_ERROR(*grp, wbc_status);
 
-        gr_cache_idx++;
+        ctx->gr_cache_idx++;
 
 done:
@@ -527 +585 @@
 }
 
+wbcErr wbcGetgrent(struct group **grp)
+{
+        return wbcCtxGetgrent(NULL, grp);
+}
+
 /* Return the next struct group* entry from the pwent iterator */
-wbcErr wbcGetgrlist(struct group **grp)
+wbcErr wbcCtxGetgrlist(struct wbcContext *ctx, struct group **grp)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -534 +597 @@
         struct winbindd_gr *wb_gr;
 
+        if (!ctx) {
+                ctx = wbcGetGlobalCtx();
+        }
+
         /* If there's a cached result, return that. */
-        if (gr_cache_idx < gr_cache_size) {
+        if (ctx->gr_cache_idx < ctx->gr_cache_size) {
                 goto return_result;
         }
@@ -541 +608 @@
         /* Otherwise, query winbindd for some entries. */
 
-        gr_cache_idx = 0;
+        ctx->gr_cache_idx = 0;
 
         winbindd_free_response(&gr_response);
@@ -549 +616 @@
         request.data.num_entries = MAX_GETGRENT_GROUPS;
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETGRLST, &request,
-                                        &gr_response);
-
-        BAIL_ON_WBC_ERROR(wbc_status);
-
-        gr_cache_size = gr_response.data.num_entries;
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETGRLST,
+                                        &request, &gr_response);
+
+        BAIL_ON_WBC_ERROR(wbc_status);
+
+        ctx->gr_cache_size = gr_response.data.num_entries;
 
 return_result:
@@ -560 +627 @@
         wb_gr = (struct winbindd_gr *) gr_response.extra_data.data;
 
-        *grp = copy_group_entry(&wb_gr[gr_cache_idx], NULL);
+        *grp = copy_group_entry(&wb_gr[ctx->gr_cache_idx], NULL);
 
         BAIL_ON_PTR_ERROR(*grp, wbc_status);
 
-        gr_cache_idx++;
+        ctx->gr_cache_idx++;
 
 done:
@@ -570 +637 @@
 }
 
+wbcErr wbcGetgrlist(struct group **grp)
+{
+        return wbcCtxGetgrlist(NULL, grp);
+}
+
 /* Return the unix group array belonging to the given user */
-wbcErr wbcGetGroups(const char *account,
-                    uint32_t *num_groups,
-                    gid_t **_groups)
+wbcErr wbcCtxGetGroups(struct wbcContext *ctx, const char *account,
+                       uint32_t *num_groups, gid_t **_groups)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -595 +666 @@
         strncpy(request.data.username, account, sizeof(request.data.username)-1);
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETGROUPS,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETGROUPS,
                                         &request,
                                         &response);
@@ -619 +690 @@
         return wbc_status;
 }
+
+wbcErr wbcGetGroups(const char *account, uint32_t *num_groups, gid_t **_groups)
+{
+        return wbcCtxGetGroups(NULL, account, num_groups, _groups);
+}

vendor/current/nsswitch/libwbclient/wbc_sid.c

@@ -33 +33 @@
 int wbcSidToStringBuf(const struct wbcDomainSid *sid, char *buf, int buflen)
 {
-        uint32_t id_auth;
+        uint64_t id_auth;
         int i, ofs;
 
@@ -41 +41 @@
         }
 
-        /*
-         * BIG NOTE: this function only does SIDS where the identauth is not
-         * >= ^32 in a range of 2^48.
-         */
-
-        id_auth = sid->id_auth[5] +
-                (sid->id_auth[4] << 8) +
-                (sid->id_auth[3] << 16) +
-                (sid->id_auth[2] << 24);
-
-        ofs = snprintf(buf, buflen, "S-%u-%lu",
-                       (unsigned int)sid->sid_rev_num, (unsigned long)id_auth);
+        id_auth = (uint64_t)sid->id_auth[5] +
+                ((uint64_t)sid->id_auth[4] << 8) +
+                ((uint64_t)sid->id_auth[3] << 16) +
+                ((uint64_t)sid->id_auth[2] << 24) +
+                ((uint64_t)sid->id_auth[1] << 32) +
+                ((uint64_t)sid->id_auth[0] << 40);
+
+        ofs = snprintf(buf, buflen, "S-%hhu-", (unsigned char)sid->sid_rev_num);
+        if (id_auth >= UINT32_MAX) {
+                ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "0x%llx",
+                                (unsigned long long)id_auth);
+        } else {
+                ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "%llu",
+                                (unsigned long long)id_auth);
+        }
 
         for (i = 0; i < sid->num_auths; i++) {
-                ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "-%lu",
-                                (unsigned long)sid->sub_auths[i]);
+                ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "-%u",
+                                (unsigned int)sid->sub_auths[i]);
         }
         return ofs;
@@ -89 +92 @@
 }
 
+#define AUTHORITY_MASK  (~(0xffffffffffffULL))
+
 /* Convert a character string to a binary SID */
 wbcErr wbcStringToSid(const char *str,
@@ -95 +100 @@
         const char *p;
         char *q;
-        uint32_t x;
+        uint64_t x;
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 
@@ -116 +121 @@
 
         p = str+2;
-        x = (uint32_t)strtol(p, &q, 10);
-        if (x==0 || !q || *q!='-') {
+        x = (uint64_t)strtoul(p, &q, 10);
+        if (x==0 || x > UINT8_MAX || !q || *q!='-') {
                 wbc_status = WBC_ERR_INVALID_SID;
                 BAIL_ON_WBC_ERROR(wbc_status);
@@ -123 +128 @@
         sid->sid_rev_num = (uint8_t)x;
 
-        /* Next the Identifier Authority.  This is stored in big-endian
-           in a 6 byte array. */
-
+        /*
+         * Next the Identifier Authority.  This is stored big-endian in a
+         * 6 byte array. If the authority value is >= UINT_MAX, then it should
+         * be expressed as a hex value, according to MS-DTYP.
+         */
         p = q+1;
-        x = (uint32_t)strtol(p, &q, 10);
-        if (!q || *q!='-') {
+        x = strtoull(p, &q, 0);
+        if (!q || *q!='-' || (x & AUTHORITY_MASK)) {
                 wbc_status = WBC_ERR_INVALID_SID;
                 BAIL_ON_WBC_ERROR(wbc_status);
         }
-        sid->id_auth[5] = (x & 0x000000ff);
-        sid->id_auth[4] = (x & 0x0000ff00) >> 8;
-        sid->id_auth[3] = (x & 0x00ff0000) >> 16;
-        sid->id_auth[2] = (x & 0xff000000) >> 24;
-        sid->id_auth[1] = 0;
-        sid->id_auth[0] = 0;
+        sid->id_auth[5] = (x & 0x0000000000ffULL);
+        sid->id_auth[4] = (x & 0x00000000ff00ULL) >> 8;
+        sid->id_auth[3] = (x & 0x000000ff0000ULL) >> 16;
+        sid->id_auth[2] = (x & 0x0000ff000000ULL) >> 24;
+        sid->id_auth[1] = (x & 0x00ff00000000ULL) >> 32;
+        sid->id_auth[0] = (x & 0xff0000000000ULL) >> 40;
 
         /* now read the the subauthorities */
-
         p = q +1;
         sid->num_auths = 0;
         while (sid->num_auths < WBC_MAXSUBAUTHS) {
-                x=(uint32_t)strtoul(p, &q, 10);
+                x = strtoull(p, &q, 10);
                 if (p == q)
                         break;
-                if (q == NULL) {
+                if (x > UINT32_MAX) {
                         wbc_status = WBC_ERR_INVALID_SID;
                         BAIL_ON_WBC_ERROR(wbc_status);
@@ -175 +181 @@
 
 /* Convert a domain and name to SID */
+wbcErr wbcCtxLookupName(struct wbcContext *ctx,
+                        const char *domain,
+                        const char *name,
+                        struct wbcDomainSid *sid,
+                        enum wbcSidType *name_type)
+{
+        struct winbindd_request request;
+        struct winbindd_response response;
+        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+        if (!sid || !name_type) {
+                wbc_status = WBC_ERR_INVALID_PARAM;
+                BAIL_ON_WBC_ERROR(wbc_status);
+        }
+
+        /* Initialize request */
+
+        ZERO_STRUCT(request);
+        ZERO_STRUCT(response);
+
+        /* dst is already null terminated from the memset above */
+
+        strncpy(request.data.name.dom_name, domain,
+                sizeof(request.data.name.dom_name)-1);
+        strncpy(request.data.name.name, name,
+                sizeof(request.data.name.name)-1);
+
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_LOOKUPNAME,
+                                        &request,
+                                        &response);
+        BAIL_ON_WBC_ERROR(wbc_status);
+
+        wbc_status = wbcStringToSid(response.data.sid.sid, sid);
+        BAIL_ON_WBC_ERROR(wbc_status);
+
+        *name_type = (enum wbcSidType)response.data.sid.type;
+
+        wbc_status = WBC_ERR_SUCCESS;
+
+ done:
+        return wbc_status;
+}
+
 wbcErr wbcLookupName(const char *domain,
                      const char *name,
@@ -180 +229 @@
                      enum wbcSidType *name_type)
 {
-        struct winbindd_request request;
-        struct winbindd_response response;
-        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
-
-        if (!sid || !name_type) {
-                wbc_status = WBC_ERR_INVALID_PARAM;
-                BAIL_ON_WBC_ERROR(wbc_status);
-        }
-
-        /* Initialize request */
-
-        ZERO_STRUCT(request);
-        ZERO_STRUCT(response);
-
-        /* dst is already null terminated from the memset above */
-
-        strncpy(request.data.name.dom_name, domain,
-                sizeof(request.data.name.dom_name)-1);
-        strncpy(request.data.name.name, name,
-                sizeof(request.data.name.name)-1);
-
-        wbc_status = wbcRequestResponse(WINBINDD_LOOKUPNAME,
-                                        &request,
-                                        &response);
-        BAIL_ON_WBC_ERROR(wbc_status);
-
-        wbc_status = wbcStringToSid(response.data.sid.sid, sid);
-        BAIL_ON_WBC_ERROR(wbc_status);
-
-        *name_type = (enum wbcSidType)response.data.sid.type;
-
-        wbc_status = WBC_ERR_SUCCESS;
-
- done:
-        return wbc_status;
+        return wbcCtxLookupName(NULL, domain, name, sid, name_type);
 }
 
 
 /* Convert a SID to a domain and name */
-wbcErr wbcLookupSid(const struct wbcDomainSid *sid,
-                    char **pdomain,
-                    char **pname,
-                    enum wbcSidType *pname_type)
+wbcErr wbcCtxLookupSid(struct wbcContext *ctx,
+                       const struct wbcDomainSid *sid,
+                       char **pdomain,
+                       char **pname,
+                       enum wbcSidType *pname_type)
 {
         struct winbindd_request request;
@@ -242 +258 @@
         /* Make request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_LOOKUPSID, &request,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_LOOKUPSID,
+                                        &request,
                                         &response);
         if (!WBC_ERROR_IS_OK(wbc_status)) {
@@ -280 +297 @@
 }
 
+wbcErr wbcLookupSid(const struct wbcDomainSid *sid,
+                    char **pdomain,
+                    char **pname,
+                    enum wbcSidType *pname_type)
+{
+        return wbcCtxLookupSid(NULL, sid, pdomain, pname, pname_type);
+}
+
 static void wbcDomainInfosDestructor(void *ptr)
 {
@@ -296 +321 @@
 
         while (n->name != NULL) {
-                free(n->name);
+                wbcFreeMemory(n->name);
                 n += 1;
         }
 }
 
-wbcErr wbcLookupSids(const struct wbcDomainSid *sids, int num_sids,
-                     struct wbcDomainInfo **pdomains, int *pnum_domains,
-                     struct wbcTranslatedName **pnames)
+wbcErr wbcCtxLookupSids(struct wbcContext *ctx,
+                        const struct wbcDomainSid *sids, int num_sids,
+                        struct wbcDomainInfo **pdomains, int *pnum_domains,
+                        struct wbcTranslatedName **pnames)
 {
         struct winbindd_request request;
@@ -345 +371 @@
         request.extra_len = p - sidlist;
 
-        wbc_status = wbcRequestResponse(WINBINDD_LOOKUPSIDS,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_LOOKUPSIDS,
                                         &request, &response);
         free(sidlist);
@@ -470 +496 @@
 }
 
+wbcErr wbcLookupSids(const struct wbcDomainSid *sids, int num_sids,
+                     struct wbcDomainInfo **pdomains, int *pnum_domains,
+                     struct wbcTranslatedName **pnames)
+{
+        return wbcCtxLookupSids(NULL, sids, num_sids, pdomains,
+                                pnum_domains, pnames);
+}
+
 /* Translate a collection of RIDs within a domain to names */
 
-wbcErr wbcLookupRids(struct wbcDomainSid *dom_sid,
+wbcErr wbcCtxLookupRids(struct wbcContext *ctx, struct wbcDomainSid *dom_sid,
                      int num_rids,
                      uint32_t *rids,
@@ -522 +556 @@
         request.extra_len = len;
 
-        wbc_status = wbcRequestResponse(WINBINDD_LOOKUPRIDS,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_LOOKUPRIDS,
                                         &request,
                                         &response);
@@ -594 +628 @@
 }
 
+wbcErr wbcLookupRids(struct wbcDomainSid *dom_sid,
+                     int num_rids,
+                     uint32_t *rids,
+                     const char **pp_domain_name,
+                     const char ***pnames,
+                     enum wbcSidType **ptypes)
+{
+        return wbcCtxLookupRids(NULL, dom_sid, num_rids, rids,
+                                pp_domain_name, pnames, ptypes);
+}
+
 /* Get the groups a user belongs to */
-wbcErr wbcLookupUserSids(const struct wbcDomainSid *user_sid,
-                         bool domain_groups_only,
-                         uint32_t *num_sids,
-                         struct wbcDomainSid **_sids)
+wbcErr wbcCtxLookupUserSids(struct wbcContext *ctx,
+                            const struct wbcDomainSid *user_sid,
+                            bool domain_groups_only,
+                            uint32_t *num_sids,
+                            struct wbcDomainSid **_sids)
 {
         uint32_t i;
@@ -626 +672 @@
         }
 
-        wbc_status = wbcRequestResponse(cmd,
+        wbc_status = wbcRequestResponse(ctx, cmd,
                                         &request,
                                         &response);
@@ -667 +713 @@
 }
 
+wbcErr wbcLookupUserSids(const struct wbcDomainSid *user_sid,
+                         bool domain_groups_only,
+                         uint32_t *num_sids,
+                         struct wbcDomainSid **_sids)
+{
+        return wbcCtxLookupUserSids(NULL, user_sid, domain_groups_only,
+                                    num_sids, _sids);
+}
+
 static inline
 wbcErr _sid_to_rid(struct wbcDomainSid *sid, uint32_t *rid)
@@ -679 +734 @@
 
 /* Get alias membership for sids */
-wbcErr wbcGetSidAliases(const struct wbcDomainSid *dom_sid,
-                        struct wbcDomainSid *sids,
-                        uint32_t num_sids,
-                        uint32_t **alias_rids,
-                        uint32_t *num_alias_rids)
+wbcErr wbcCtxGetSidAliases(struct wbcContext *ctx,
+                           const struct wbcDomainSid *dom_sid,
+                           struct wbcDomainSid *sids,
+                           uint32_t num_sids,
+                           uint32_t **alias_rids,
+                           uint32_t *num_alias_rids)
 {
         uint32_t i;
@@ -744 +800 @@
         request.extra_len = extra_data_len;
 
-        wbc_status = wbcRequestResponse(WINBINDD_GETSIDALIASES,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_GETSIDALIASES,
                                         &request,
                                         &response);
@@ -784 +840 @@
 }
 
+wbcErr wbcGetSidAliases(const struct wbcDomainSid *dom_sid,
+                        struct wbcDomainSid *sids,
+                        uint32_t num_sids,
+                        uint32_t **alias_rids,
+                        uint32_t *num_alias_rids)
+{
+        return wbcCtxGetSidAliases(NULL, dom_sid, sids, num_sids,
+                                   alias_rids, num_alias_rids);
+}
+
 
 /* Lists Users */
-wbcErr wbcListUsers(const char *domain_name,
-                    uint32_t *_num_users,
-                    const char ***_users)
+wbcErr wbcCtxListUsers(struct wbcContext *ctx,
+                       const char *domain_name,
+                       uint32_t *_num_users,
+                       const char ***_users)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -807 +874 @@
         }
 
-        wbc_status = wbcRequestResponse(WINBINDD_LIST_USERS,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_LIST_USERS,
                                         &request,
                                         &response);
@@ -859 +926 @@
 }
 
+wbcErr wbcListUsers(const char *domain_name,
+                    uint32_t *_num_users,
+                    const char ***_users)
+{
+        return wbcCtxListUsers(NULL, domain_name, _num_users, _users);
+}
+
 /* Lists Groups */
-wbcErr wbcListGroups(const char *domain_name,
-                     uint32_t *_num_groups,
-                     const char ***_groups)
+wbcErr wbcCtxListGroups(struct wbcContext *ctx,
+                        const char *domain_name,
+                        uint32_t *_num_groups,
+                        const char ***_groups)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -881 +956 @@
         }
 
-        wbc_status = wbcRequestResponse(WINBINDD_LIST_GROUPS,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_LIST_GROUPS,
                                         &request,
                                         &response);
@@ -933 +1008 @@
 }
 
-wbcErr wbcGetDisplayName(const struct wbcDomainSid *sid,
-                         char **pdomain,
-                         char **pfullname,
-                         enum wbcSidType *pname_type)
+wbcErr wbcListGroups(const char *domain_name,
+                     uint32_t *_num_groups,
+                     const char ***_groups)
+{
+        return wbcCtxListGroups(NULL, domain_name, _num_groups, _groups);
+}
+
+wbcErr wbcCtxGetDisplayName(struct wbcContext *ctx,
+                            const struct wbcDomainSid *sid,
+                            char **pdomain,
+                            char **pfullname,
+                            enum wbcSidType *pname_type)
 {
         wbcErr wbc_status;
@@ -943 +1026 @@
         enum wbcSidType name_type;
 
-        wbc_status = wbcLookupSid(sid, &domain, &name, &name_type);
+        wbc_status = wbcCtxLookupSid(ctx, sid, &domain, &name, &name_type);
         BAIL_ON_WBC_ERROR(wbc_status);
 
@@ -950 +1033 @@
                 struct passwd *pwd;
 
-                wbc_status = wbcSidToUid(sid, &uid);
-                BAIL_ON_WBC_ERROR(wbc_status);
-
-                wbc_status = wbcGetpwuid(uid, &pwd);
+                wbc_status = wbcCtxSidToUid(ctx, sid, &uid);
+                BAIL_ON_WBC_ERROR(wbc_status);
+
+                wbc_status = wbcCtxGetpwuid(ctx, uid, &pwd);
                 BAIL_ON_WBC_ERROR(wbc_status);
 
@@ -976 +1059 @@
 
         return wbc_status;
+}
+
+wbcErr wbcGetDisplayName(const struct wbcDomainSid *sid,
+                         char **pdomain,
+                         char **pfullname,
+                         enum wbcSidType *pname_type)
+{
+        return wbcCtxGetDisplayName(NULL, sid, pdomain, pfullname, pname_type);
 }
 

vendor/current/nsswitch/libwbclient/wbc_util.c

@@ -29 +29 @@
 /** @brief Ping winbindd to see if the daemon is running
  *
+ * @param *ctx       wbclient Context
+ *
  * @return #wbcErr
  **/
-wbcErr wbcPing(void)
+wbcErr wbcCtxPing(struct wbcContext *ctx)
 {
         struct winbindd_request request;
@@ -41 +43 @@
         ZERO_STRUCT(response);
 
-        return wbcRequestResponse(WINBINDD_PING, &request, &response);
+        return wbcRequestResponse(ctx, WINBINDD_PING, &request, &response);
+}
+
+wbcErr wbcPing(void)
+{
+        return wbcCtxPing(NULL);
 }
 
@@ -61 +68 @@
  */
 
-wbcErr wbcInterfaceDetails(struct wbcInterfaceDetails **_details)
+wbcErr wbcCtxInterfaceDetails(struct wbcContext *ctx,
+                              struct wbcInterfaceDetails **_details)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -80 +88 @@
 
         /* first the interface version */
-        wbc_status = wbcRequestResponse(WINBINDD_INTERFACE_VERSION, NULL, &response);
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_INTERFACE_VERSION,
+                                        NULL, &response);
         BAIL_ON_WBC_ERROR(wbc_status);
         info->interface_version = response.data.interface_version;
 
         /* then the samba version and the winbind separator */
-        wbc_status = wbcRequestResponse(WINBINDD_INFO, NULL, &response);
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_INFO, NULL, &response);
         BAIL_ON_WBC_ERROR(wbc_status);
 
@@ -93 +102 @@
 
         /* then the local netbios name */
-        wbc_status = wbcRequestResponse(WINBINDD_NETBIOS_NAME, NULL, &response);
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_NETBIOS_NAME,
+                                        NULL, &response);
         BAIL_ON_WBC_ERROR(wbc_status);
 
@@ -100 +110 @@
 
         /* then the local workgroup name */
-        wbc_status = wbcRequestResponse(WINBINDD_DOMAIN_NAME, NULL, &response);
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_DOMAIN_NAME,
+                                        NULL, &response);
         BAIL_ON_WBC_ERROR(wbc_status);
 
@@ -106 +117 @@
         BAIL_ON_PTR_ERROR(info->netbios_domain, wbc_status);
 
-        wbc_status = wbcDomainInfo(info->netbios_domain, &domain);
+        wbc_status = wbcCtxDomainInfo(ctx, info->netbios_domain, &domain);
         if (wbc_status == WBC_ERR_DOMAIN_NOT_FOUND) {
                 /* maybe it's a standalone server */
@@ -131 +142 @@
         wbcFreeMemory(info);
         return wbc_status;
+}
+
+wbcErr wbcInterfaceDetails(struct wbcInterfaceDetails **_details)
+{
+        return wbcCtxInterfaceDetails(NULL, _details);
 }
 
@@ -148 +164 @@
  */
 
-wbcErr wbcDomainInfo(const char *domain, struct wbcDomainInfo **dinfo)
+wbcErr wbcCtxDomainInfo(struct wbcContext *ctx,
+                        const char *domain,
+                        struct wbcDomainInfo **dinfo)
 {
         struct winbindd_request request;
@@ -168 +186 @@
                 sizeof(request.domain_name)-1);
 
-        wbc_status = wbcRequestResponse(WINBINDD_DOMAIN_INFO,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_DOMAIN_INFO,
                                         &request,
                                         &response);
@@ -204 +222 @@
 }
 
+wbcErr wbcDomainInfo(const char *domain, struct wbcDomainInfo **dinfo)
+{
+        return wbcCtxDomainInfo(NULL, domain, dinfo);
+}
+
 /* Get the list of current DCs */
-wbcErr wbcDcInfo(const char *domain, size_t *num_dcs,
-                 const char ***dc_names, const char ***dc_ips)
+wbcErr wbcCtxDcInfo(struct wbcContext *ctx,
+                    const char *domain, size_t *num_dcs,
+                    const char ***dc_names, const char ***dc_ips)
 {
         struct winbindd_request request;
@@ -227 +251 @@
         }
 
-        wbc_status = wbcRequestResponse(WINBINDD_DC_INFO,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_DC_INFO,
                                         &request, &response);
         BAIL_ON_WBC_ERROR(wbc_status);
@@ -291 +315 @@
 }
 
+wbcErr wbcDcInfo(const char *domain, size_t *num_dcs,
+                 const char ***dc_names, const char ***dc_ips)
+{
+        return wbcCtxDcInfo(NULL, domain, num_dcs, dc_names, dc_ips);
+}
+
 /* Resolve a NetbiosName via WINS */
-wbcErr wbcResolveWinsByName(const char *name, char **ip)
+wbcErr wbcCtxResolveWinsByName(struct wbcContext *ctx,
+                               const char *name, char **ip)
 {
         struct winbindd_request request;
@@ -307 +338 @@
                 sizeof(request.data.winsreq)-1);
 
-        wbc_status = wbcRequestResponse(WINBINDD_WINS_BYNAME,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_WINS_BYNAME,
                                         &request,
                                         &response);
@@ -324 +355 @@
 }
 
+wbcErr wbcResolveWinsByName(const char *name, char **ip)
+{
+        return wbcCtxResolveWinsByName(NULL, name, ip);
+}
+
 /* Resolve an IP address via WINS into a NetbiosName */
-wbcErr wbcResolveWinsByIP(const char *ip, char **name)
+wbcErr wbcCtxResolveWinsByIP(struct wbcContext *ctx,
+                             const char *ip, char **name)
 {
         struct winbindd_request request;
@@ -340 +377 @@
                 sizeof(request.data.winsreq)-1);
 
-        wbc_status = wbcRequestResponse(WINBINDD_WINS_BYIP,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_WINS_BYIP,
                                         &request,
                                         &response);
@@ -355 +392 @@
  done:
         return wbc_status;
+}
+
+wbcErr wbcResolveWinsByIP(const char *ip, char **name)
+{
+        return wbcCtxResolveWinsByIP(NULL, ip, name);
 }
 
@@ -467 +509 @@
 
         /* Online/Offline status */
-
         r = s;
-        if (r == NULL) {
-                wbc_status = WBC_ERR_INVALID_RESPONSE;
-                BAIL_ON_WBC_ERROR(wbc_status);
-        }
         if ( strcmp(r, "Offline") == 0) {
                 info->domain_flags |= WBC_DOMINFO_DOMAIN_OFFLINE;
@@ -495 +532 @@
 
 /* Enumerate the domain trusts known by Winbind */
-wbcErr wbcListTrusts(struct wbcDomainInfo **domains, size_t *num_domains)
+wbcErr wbcCtxListTrusts(struct wbcContext *ctx,
+                        struct wbcDomainInfo **domains, size_t *num_domains)
 {
         struct winbindd_response response;
@@ -511 +549 @@
         /* Send request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_LIST_TRUSTDOM,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_LIST_TRUSTDOM,
                                         NULL,
                                         &response);
@@ -565 +603 @@
 }
 
+wbcErr wbcListTrusts(struct wbcDomainInfo **domains, size_t *num_domains)
+{
+        return wbcCtxListTrusts(NULL, domains, num_domains);
+}
+
 static void wbcDomainControllerInfoDestructor(void *ptr)
 {
@@ -573 +616 @@
 
 /* Enumerate the domain trusts known by Winbind */
-wbcErr wbcLookupDomainController(const char *domain,
-                                 uint32_t flags,
-                                struct wbcDomainControllerInfo **dc_info)
+wbcErr wbcCtxLookupDomainController(struct wbcContext *ctx,
+                                    const char *domain, uint32_t flags,
+                                    struct wbcDomainControllerInfo **dc_info)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
@@ -604 +647 @@
         /* Send request */
 
-        wbc_status = wbcRequestResponse(WINBINDD_DSGETDCNAME,
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_DSGETDCNAME,
                                         &request,
                                         &response);
@@ -620 +663 @@
 }
 
+wbcErr wbcLookupDomainController(const char *domain, uint32_t flags,
+                                 struct wbcDomainControllerInfo **dc_info)
+{
+        return wbcCtxLookupDomainController(NULL, domain, flags, dc_info);
+}
+
 static void wbcDomainControllerInfoExDestructor(void *ptr)
 {
         struct wbcDomainControllerInfoEx *i =
                 (struct wbcDomainControllerInfoEx *)ptr;
-        free((char *)(i->dc_unc));
-        free((char *)(i->dc_address));
-        free((char *)(i->domain_guid));
-        free((char *)(i->domain_name));
-        free((char *)(i->forest_name));
-        free((char *)(i->dc_site_name));
-        free((char *)(i->client_site_name));
+        free(discard_const_p(char, i->dc_unc));
+        free(discard_const_p(char, i->dc_address));
+        free(discard_const_p(char, i->domain_guid));
+        free(discard_const_p(char, i->domain_name));
+        free(discard_const_p(char, i->forest_name));
+        free(discard_const_p(char, i->dc_site_name));
+        free(discard_const_p(char, i->client_site_name));
 }
 
@@ -694 +743 @@
 
 /* Get extended domain controller information */
+wbcErr wbcCtxLookupDomainControllerEx(struct wbcContext *ctx,
+                                      const char *domain,
+                                      struct wbcGuid *guid,
+                                      const char *site,
+                                      uint32_t flags,
+                                      struct wbcDomainControllerInfoEx **dc_info)
+{
+        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+        struct winbindd_request request;
+        struct winbindd_response response;
+
+        /* validate input params */
+
+        if (!domain || !dc_info) {
+                wbc_status = WBC_ERR_INVALID_PARAM;
+                BAIL_ON_WBC_ERROR(wbc_status);
+        }
+
+        ZERO_STRUCT(request);
+        ZERO_STRUCT(response);
+
+        request.data.dsgetdcname.flags = flags;
+
+        strncpy(request.data.dsgetdcname.domain_name, domain,
+                sizeof(request.data.dsgetdcname.domain_name)-1);
+
+        if (site) {
+                strncpy(request.data.dsgetdcname.site_name, site,
+                        sizeof(request.data.dsgetdcname.site_name)-1);
+        }
+
+        if (guid) {
+                char *str = NULL;
+
+                wbc_status = wbcGuidToString(guid, &str);
+                BAIL_ON_WBC_ERROR(wbc_status);
+
+                strncpy(request.data.dsgetdcname.domain_guid, str,
+                        sizeof(request.data.dsgetdcname.domain_guid)-1);
+
+                wbcFreeMemory(str);
+        }
+
+        /* Send request */
+
+        wbc_status = wbcRequestResponse(ctx, WINBINDD_DSGETDCNAME,
+                                        &request,
+                                        &response);
+        BAIL_ON_WBC_ERROR(wbc_status);
+
+        if (dc_info) {
+                wbc_status = wbc_create_domain_controller_info_ex(&response,
+                                                                  dc_info);
+                BAIL_ON_WBC_ERROR(wbc_status);
+        }
+
+        wbc_status = WBC_ERR_SUCCESS;
+done:
+        return wbc_status;
+}
+
 wbcErr wbcLookupDomainControllerEx(const char *domain,
                                    struct wbcGuid *guid,
@@ -700 +810 @@
                                    struct wbcDomainControllerInfoEx **dc_info)
 {
-        wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
-        struct winbindd_request request;
-        struct winbindd_response response;
-
-        /* validate input params */
-
-        if (!domain || !dc_info) {
-                wbc_status = WBC_ERR_INVALID_PARAM;
-                BAIL_ON_WBC_ERROR(wbc_status);
-        }
-
-        ZERO_STRUCT(request);
-        ZERO_STRUCT(response);
-
-        request.data.dsgetdcname.flags = flags;
-
-        strncpy(request.data.dsgetdcname.domain_name, domain,
-                sizeof(request.data.dsgetdcname.domain_name)-1);
-
-        if (site) {
-                strncpy(request.data.dsgetdcname.site_name, site,
-                        sizeof(request.data.dsgetdcname.site_name)-1);
-        }
-
-        if (guid) {
-                char *str = NULL;
-
-                wbc_status = wbcGuidToString(guid, &str);
-                BAIL_ON_WBC_ERROR(wbc_status);
-
-                strncpy(request.data.dsgetdcname.domain_guid, str,
-                        sizeof(request.data.dsgetdcname.domain_guid)-1);
-
-                wbcFreeMemory(str);
-        }
-
-        /* Send request */
-
-        wbc_status = wbcRequestResponse(WINBINDD_DSGETDCNAME,
-                                        &request,
-                                        &response);
-        BAIL_ON_WBC_ERROR(wbc_status);
-
-        if (dc_info) {
-                wbc_status = wbc_create_domain_controller_info_ex(&response,
-                                                                  dc_info);
-                BAIL_ON_WBC_ERROR(wbc_status);
-        }
-
-        wbc_status = WBC_ERR_SUCCESS;
-done:
-        return wbc_status;
+        return wbcCtxLookupDomainControllerEx(NULL, domain, guid, site,
+                                              flags, dc_info);
 }
 
@@ -759 +819 @@
 
         while (b->name != NULL) {
-                free((char *)(b->name));
+                free(discard_const_p(char, b->name));
                 free(b->blob.data);
                 b += 1;

vendor/current/nsswitch/libwbclient/wbclient.c

@@ -5 +5 @@
 
    Copyright (C) Gerald (Jerry) Carter 2007
+   Copyright (C) Matthew Newton 2015
 
 
@@ -28 +29 @@
 /* From wb_common.c */
 
-NSS_STATUS winbindd_request_response(int req_type,
+struct winbindd_context;
+
+NSS_STATUS winbindd_request_response(struct winbindd_context *wbctx,
+                                     int req_type,
                                      struct winbindd_request *request,
                                      struct winbindd_response *response);
-NSS_STATUS winbindd_priv_request_response(int req_type,
+NSS_STATUS winbindd_priv_request_response(struct winbindd_context *wbctx,
+                                          int req_type,
                                           struct winbindd_request *request,
                                           struct winbindd_response *response);
+struct winbindd_context *winbindd_ctx_create(void);
+void winbindd_ctx_free(struct winbindd_context *ctx);
+
+/* Global context used for non-Ctx functions */
+
+static struct wbcContext wbcGlobalCtx = {
+        .winbindd_ctx = NULL,
+        .pw_cache_size = 0,
+        .pw_cache_idx = 0,
+        .gr_cache_size = 0,
+        .gr_cache_idx = 0
+};
 
 /*
@@ -49 +66 @@
 
 static wbcErr wbcRequestResponseInt(
+        struct winbindd_context *wbctx,
         int cmd,
         struct winbindd_request *request,
         struct winbindd_response *response,
-        NSS_STATUS (*fn)(int req_type,
+        NSS_STATUS (*fn)(struct winbindd_context *wbctx, int req_type,
                          struct winbindd_request *request,
                          struct winbindd_response *response))
@@ -61 +79 @@
         /* for some calls the request and/or response can be NULL */
 
-        nss_status = fn(cmd, request, response);
+        nss_status = fn(wbctx, cmd, request, response);
 
         switch (nss_status) {
@@ -84 +102 @@
  * @brief Wrapper around Winbind's send/receive API call
  *
+ * @param ctx       Context
  * @param cmd       Winbind command operation to perform
  * @param request   Send structure
@@ -90 +109 @@
  * @return #wbcErr
  */
-wbcErr wbcRequestResponse(int cmd,
+wbcErr wbcRequestResponse(struct wbcContext *ctx, int cmd,
                           struct winbindd_request *request,
                           struct winbindd_response *response)
 {
-        return wbcRequestResponseInt(cmd, request, response,
+        struct winbindd_context *wbctx = NULL;
+
+        if (ctx) {
+                wbctx = ctx->winbindd_ctx;
+        }
+
+        return wbcRequestResponseInt(wbctx, cmd, request, response,
                                      winbindd_request_response);
 }
 
-wbcErr wbcRequestResponsePriv(int cmd,
+wbcErr wbcRequestResponsePriv(struct wbcContext *ctx, int cmd,
                               struct winbindd_request *request,
                               struct winbindd_response *response)
 {
-        return wbcRequestResponseInt(cmd, request, response,
+        struct winbindd_context *wbctx = NULL;
+
+        if (ctx) {
+                wbctx = ctx->winbindd_ctx;
+        }
+
+        return wbcRequestResponseInt(wbctx, cmd, request, response,
                                      winbindd_priv_request_response);
 }
@@ -258 +289 @@
         return WBC_ERR_SUCCESS;
 }
+
+/* Context handling functions */
+
+static void wbcContextDestructor(void *ptr)
+{
+        struct wbcContext *ctx = (struct wbcContext *)ptr;
+
+        winbindd_ctx_free(ctx->winbindd_ctx);
+}
+
+struct wbcContext *wbcCtxCreate(void)
+{
+        struct wbcContext *ctx;
+        struct winbindd_context *wbctx;
+
+        ctx = (struct wbcContext *)wbcAllocateMemory(
+                1, sizeof(struct wbcContext), wbcContextDestructor);
+
+        if (!ctx) {
+                return NULL;
+        }
+
+        wbctx = winbindd_ctx_create();
+
+        if (!wbctx) {
+                wbcFreeMemory(ctx);
+                return NULL;
+        }
+
+        ctx->winbindd_ctx = wbctx;
+
+        return ctx;
+}
+
+void wbcCtxFree(struct wbcContext *ctx)
+{
+        wbcFreeMemory(ctx);
+}
+
+struct wbcContext *wbcGetGlobalCtx(void)
+{
+        return &wbcGlobalCtx;
+}

vendor/current/nsswitch/libwbclient/wbclient.h

@@ -6 +6 @@
    Copyright (C) Gerald (Jerry) Carter 2007
    Copyright (C) Volker Lendecke 2009
+   Copyright (C) Matthew Newton 2015
 
    This library is free software; you can redistribute it and/or
@@ -69 +70 @@
  *  0.7: Added wbcSidToStringBuf()
  *  0.8: Added wbcSidsToUnixIds() and wbcLookupSids()
+ *  0.9: Added support for WBC_ID_TYPE_BOTH
+ *  0.10: Added wbcPingDc2()
+ *  0.11: Extended wbcAuthenticateUserEx to provide PAC parsing
+ *  0.12: Added wbcCtxCreate and friends
  **/
 #define WBCLIENT_MAJOR_VERSION 0
-#define WBCLIENT_MINOR_VERSION 8
+#define WBCLIENT_MINOR_VERSION 12
 #define WBCLIENT_VENDOR_VERSION "Samba libwbclient"
 struct wbcLibraryDetails {
@@ -91 +96 @@
         char *dns_domain;
 };
+
+/**
+ *  @brief Library context data
+ *
+ **/
+
+struct wbcContext;
 
 /*
@@ -196 +208 @@
 
 /**
+ * @brief Generic Blob
+ **/
+
+struct wbcBlob {
+        uint8_t *data;
+        size_t length;
+};
+
+/**
+ * @brief Named Blob
+ **/
+
+struct wbcNamedBlob {
+        const char *name;
+        uint32_t flags;
+        struct wbcBlob blob;
+};
+
+/**
  * @brief Auth User Parameters
  **/
@@ -211 +242 @@
                 WBC_AUTH_USER_LEVEL_PLAIN = 1,
                 WBC_AUTH_USER_LEVEL_HASH = 2,
-                WBC_AUTH_USER_LEVEL_RESPONSE = 3
+                WBC_AUTH_USER_LEVEL_RESPONSE = 3,
+                WBC_AUTH_USER_LEVEL_PAC = 4
         } level;
         union {
@@ -226 +258 @@
                         uint8_t *lm_data;
                 } response;
+                struct wbcBlob pac;
         } password;
-};
-
-/**
- * @brief Generic Blob
- **/
-
-struct wbcBlob {
-        uint8_t *data;
-        size_t length;
-};
-
-/**
- * @brief Named Blob
- **/
-
-struct wbcNamedBlob {
-        const char *name;
-        uint32_t flags;
-        struct wbcBlob blob;
 };
 
@@ -519 +533 @@
 
 
+/**********************************************************
+ * Context Management
+ **********************************************************/
+
+/**
+ * @brief Create a new wbcContext context
+ *
+ * @return wbcContext
+ **/
+struct wbcContext *wbcCtxCreate(void);
+
+/**
+ * @brief Free a library context
+ *
+ * @param ctx           wbcContext to free
+ *
+ * @return void
+ **/
+void wbcCtxFree(struct wbcContext *ctx);
+
+
+
 /*
  * Utility functions for dealing with SIDs
@@ -596 +632 @@
  * @brief Ping winbindd to see if the daemon is running
  *
+ * @param *ctx        wbclient Context
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxPing(struct wbcContext *ctx);
+
+/**
+ * @brief Ping winbindd to see if the daemon is running
+ *
  * @return #wbcErr
  **/
@@ -602 +647 @@
 wbcErr wbcLibraryDetails(struct wbcLibraryDetails **details);
 
+wbcErr wbcCtxInterfaceDetails(struct wbcContext *ctx,
+                              struct wbcInterfaceDetails **details);
 wbcErr wbcInterfaceDetails(struct wbcInterfaceDetails **details);
 
@@ -611 +658 @@
  * @brief Convert a domain and name to SID
  *
+ * @param *ctx        wbclient Context
  * @param dom_name    Domain name (possibly "")
  * @param name        User or group name
@@ -618 +666 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxLookupName(struct wbcContext *ctx,
+                        const char *dom_name,
+                        const char *name,
+                        struct wbcDomainSid *sid,
+                        enum wbcSidType *name_type);
+
+/**
+ * @brief Convert a domain and name to SID
+ *
+ * @param dom_name    Domain name (possibly "")
+ * @param name        User or group name
+ * @param *sid        Pointer to the resolved domain SID
+ * @param *name_type  Pointer to the SID type
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcLookupName(const char *dom_name,
                      const char *name,
@@ -626 +690 @@
  * @brief Convert a SID to a domain and name
  *
- * @param *sid        Pointer to the domain SID to be resolved
+ * @param *ctx       wbclient Context
+ * @param *sid       Pointer to the domain SID to be resolved
+ * @param domain     Resolved Domain name (possibly "")
+ * @param name       Resolved User or group name
+ * @param *name_type Pointer to the resolved SID type
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxLookupSid(struct wbcContext *ctx,
+                       const struct wbcDomainSid *sid,
+                       char **domain,
+                       char **name,
+                       enum wbcSidType *name_type);
+
+/**
+ * @brief Convert a SID to a domain and name
+ *
+ * @param *sid       Pointer to the domain SID to be resolved
  * @param domain     Resolved Domain name (possibly "")
  * @param name       Resolved User or group name
@@ -644 +725 @@
 };
 
+wbcErr wbcCtxLookupSids(struct wbcContext *ctx,
+                        const struct wbcDomainSid *sids, int num_sids,
+                        struct wbcDomainInfo **domains, int *num_domains,
+                        struct wbcTranslatedName **names);
+
 wbcErr wbcLookupSids(const struct wbcDomainSid *sids, int num_sids,
                      struct wbcDomainInfo **domains, int *num_domains,
                      struct wbcTranslatedName **names);
+
+/**
+ * @brief Translate a collection of RIDs within a domain to names
+ */
+wbcErr wbcCtxLookupRids(struct wbcContext *ctx,
+                        struct wbcDomainSid *dom_sid,
+                        int num_rids,
+                        uint32_t *rids,
+                        const char **domain_name,
+                        const char ***names,
+                        enum wbcSidType **types);
 
 /**
@@ -661 +758 @@
  * @brief Get the groups a user belongs to
  **/
+wbcErr wbcCtxLookupUserSids(struct wbcContext *ctx,
+                            const struct wbcDomainSid *user_sid,
+                            bool domain_groups_only,
+                            uint32_t *num_sids,
+                            struct wbcDomainSid **sids);
+
+/*
+ * @brief Get the groups a user belongs to
+ **/
 wbcErr wbcLookupUserSids(const struct wbcDomainSid *user_sid,
                          bool domain_groups_only,
                          uint32_t *num_sids,
                          struct wbcDomainSid **sids);
+
+/*
+ * @brief Get alias membership for sids
+ **/
+wbcErr wbcCtxGetSidAliases(struct wbcContext *ctx,
+                           const struct wbcDomainSid *dom_sid,
+                           struct wbcDomainSid *sids,
+                           uint32_t num_sids,
+                           uint32_t **alias_rids,
+                           uint32_t *num_alias_rids);
 
 /*
@@ -678 +794 @@
  * @brief Lists Users
  **/
+wbcErr wbcCtxListUsers(struct wbcContext *ctx,
+                       const char *domain_name,
+                       uint32_t *num_users,
+                       const char ***users);
+
+/**
+ * @brief Lists Users
+ **/
 wbcErr wbcListUsers(const char *domain_name,
                     uint32_t *num_users,
@@ -685 +809 @@
  * @brief Lists Groups
  **/
+wbcErr wbcCtxListGroups(struct wbcContext *ctx,
+                        const char *domain_name,
+                        uint32_t *num_groups,
+                        const char ***groups);
+
+/**
+ * @brief Lists Groups
+ **/
 wbcErr wbcListGroups(const char *domain_name,
                      uint32_t *num_groups,
                      const char ***groups);
+
+wbcErr wbcCtxGetDisplayName(struct wbcContext *ctx,
+                            const struct wbcDomainSid *sid,
+                            char **pdomain,
+                            char **pfullname,
+                            enum wbcSidType *pname_type);
 
 wbcErr wbcGetDisplayName(const struct wbcDomainSid *sid,
@@ -701 +839 @@
  * @brief Convert a Windows SID to a Unix uid, allocating an uid if needed
  *
+ * @param *ctx        wbclient Context
  * @param *sid        Pointer to the domain SID to be resolved
  * @param *puid       Pointer to the resolved uid_t value
@@ -707 +846 @@
  *
  **/
+wbcErr wbcCtxSidToUid(struct wbcContext *ctx,
+                      const struct wbcDomainSid *sid,
+                      uid_t *puid);
+
+/**
+ * @brief Convert a Windows SID to a Unix uid, allocating an uid if needed
+ *
+ * @param *sid        Pointer to the domain SID to be resolved
+ * @param *puid       Pointer to the resolved uid_t value
+ *
+ * @return #wbcErr
+ *
+ **/
 wbcErr wbcSidToUid(const struct wbcDomainSid *sid,
                    uid_t *puid);
@@ -725 +877 @@
  * @brief Convert a Unix uid to a Windows SID, allocating a SID if needed
  *
+ * @param *ctx        wbclient Context
  * @param uid         Unix uid to be resolved
  * @param *sid        Pointer to the resolved domain SID
@@ -731 +884 @@
  *
  **/
+wbcErr wbcCtxUidToSid(struct wbcContext *ctx, uid_t uid,
+                      struct wbcDomainSid *sid);
+
+/**
+ * @brief Convert a Unix uid to a Windows SID, allocating a SID if needed
+ *
+ * @param uid         Unix uid to be resolved
+ * @param *sid        Pointer to the resolved domain SID
+ *
+ * @return #wbcErr
+ *
+ **/
 wbcErr wbcUidToSid(uid_t uid,
                    struct wbcDomainSid *sid);
@@ -749 +914 @@
  * @brief Convert a Windows SID to a Unix gid, allocating a gid if needed
  *
+ * @param *ctx        wbclient Context
  * @param *sid        Pointer to the domain SID to be resolved
  * @param *pgid       Pointer to the resolved gid_t value
@@ -755 +921 @@
  *
  **/
+wbcErr wbcCtxSidToGid(struct wbcContext *ctx,
+                      const struct wbcDomainSid *sid,
+                      gid_t *pgid);
+
+/**
+ * @brief Convert a Windows SID to a Unix gid, allocating a gid if needed
+ *
+ * @param *sid        Pointer to the domain SID to be resolved
+ * @param *pgid       Pointer to the resolved gid_t value
+ *
+ * @return #wbcErr
+ *
+ **/
 wbcErr wbcSidToGid(const struct wbcDomainSid *sid,
                    gid_t *pgid);
@@ -769 +948 @@
 wbcErr wbcQuerySidToGid(const struct wbcDomainSid *sid,
                         gid_t *pgid);
+
+/**
+ * @brief Convert a Unix gid to a Windows SID, allocating a SID if needed
+ *
+ * @param *ctx        wbclient Context
+ * @param gid         Unix gid to be resolved
+ * @param *sid        Pointer to the resolved domain SID
+ *
+ * @return #wbcErr
+ *
+ **/
+wbcErr wbcCtxGidToSid(struct wbcContext *ctx, gid_t gid,
+                   struct wbcDomainSid *sid);
 
 /**
@@ -797 +989 @@
         WBC_ID_TYPE_NOT_SPECIFIED,
         WBC_ID_TYPE_UID,
-        WBC_ID_TYPE_GID
+        WBC_ID_TYPE_GID,
+        WBC_ID_TYPE_BOTH
 };
 
@@ -813 +1006 @@
  * @brief Convert a list of sids to unix ids
  *
+ * @param *ctx        wbclient Context
  * @param sids        Pointer to an array of SIDs to convert
  * @param num_sids    Number of SIDs
@@ -820 +1014 @@
  *
  **/
+wbcErr wbcCtxSidsToUnixIds(struct wbcContext *ctx,
+                           const struct wbcDomainSid *sids, uint32_t num_sids,
+                           struct wbcUnixId *ids);
+
+/**
+ * @brief Convert a list of sids to unix ids
+ *
+ * @param sids        Pointer to an array of SIDs to convert
+ * @param num_sids    Number of SIDs
+ * @param ids         Preallocated output array for translated IDs
+ *
+ * @return #wbcErr
+ *
+ **/
 wbcErr wbcSidsToUnixIds(const struct wbcDomainSid *sids, uint32_t num_sids,
                         struct wbcUnixId *ids);
@@ -826 +1034 @@
  * @brief Obtain a new uid from Winbind
  *
- * @param *puid      *pointer to the allocated uid
+ * @param *ctx        wbclient Context
+ * @param *puid       Pointer to the allocated uid
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxAllocateUid(struct wbcContext *ctx, uid_t *puid);
+
+/**
+ * @brief Obtain a new uid from Winbind
+ *
+ * @param *puid       Pointer to the allocated uid
  *
  * @return #wbcErr
@@ -835 +1053 @@
  * @brief Obtain a new gid from Winbind
  *
- * @param *pgid      Pointer to the allocated gid
+ * @param *ctx        wbclient Context
+ * @param *pgid       Pointer to the allocated gid
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxAllocateGid(struct wbcContext *ctx, gid_t *pgid);
+
+/**
+ * @brief Obtain a new gid from Winbind
+ *
+ * @param *pgid       Pointer to the allocated gid
  *
  * @return #wbcErr
@@ -845 +1073 @@
  *
  * @param uid       Uid of the desired mapping.
- * @param *sid      Pointer to the sid of the diresired mapping.
+ * @param *sid      Pointer to the sid of the desired mapping.
  *
  * @return #wbcErr
@@ -858 +1086 @@
  *
  * @param gid       Gid of the desired mapping.
- * @param *sid      Pointer to the sid of the diresired mapping.
+ * @param *sid      Pointer to the sid of the desired mapping.
  *
  * @return #wbcErr
@@ -925 +1153 @@
  *   on username
  *
+ * @param *ctx      wbclient Context
  * @param *name     Username to lookup
  * @param **pwd     Pointer to resulting struct passwd* from the query.
@@ -930 +1159 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxGetpwnam(struct wbcContext *ctx,
+                      const char *name, struct passwd **pwd);
+
+/**
+ * @brief Fill in a struct passwd* for a domain user based
+ *   on username
+ *
+ * @param *name     Username to lookup
+ * @param **pwd     Pointer to resulting struct passwd* from the query.
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcGetpwnam(const char *name, struct passwd **pwd);
 
@@ -936 +1177 @@
  *   on uid
  *
+ * @param *ctx      wbclient Context
  * @param uid       Uid to lookup
  * @param **pwd     Pointer to resulting struct passwd* from the query.
@@ -941 +1183 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxGetpwuid(struct wbcContext *ctx,
+                      uid_t uid, struct passwd **pwd);
+
+/**
+ * @brief Fill in a struct passwd* for a domain user based
+ *   on uid
+ *
+ * @param uid       Uid to lookup
+ * @param **pwd     Pointer to resulting struct passwd* from the query.
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcGetpwuid(uid_t uid, struct passwd **pwd);
 
@@ -947 +1201 @@
  *   on sid
  *
+ * @param *ctx         wbclient Context
  * @param sid       Sid to lookup
  * @param **pwd     Pointer to resulting struct passwd* from the query.
@@ -952 +1207 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxGetpwsid(struct wbcContext *ctx,
+                      struct wbcDomainSid * sid, struct passwd **pwd);
+
+/**
+ * @brief Fill in a struct passwd* for a domain user based
+ *   on sid
+ *
+ * @param sid       Sid to lookup
+ * @param **pwd     Pointer to resulting struct passwd* from the query.
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcGetpwsid(struct wbcDomainSid * sid, struct passwd **pwd);
 
@@ -958 +1225 @@
  *   on username
  *
+ * @param *ctx      wbclient Context
  * @param *name     Username to lookup
  * @param **grp     Pointer to resulting struct group* from the query.
@@ -963 +1231 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxGetgrnam(struct wbcContext *ctx,
+                      const char *name, struct group **grp);
+
+/**
+ * @brief Fill in a struct passwd* for a domain user based
+ *   on username
+ *
+ * @param *name     Username to lookup
+ * @param **grp     Pointer to resulting struct group* from the query.
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcGetgrnam(const char *name, struct group **grp);
 
@@ -969 +1249 @@
  *   on uid
  *
+ * @param *ctx      wbclient Context
  * @param gid       Uid to lookup
  * @param **grp     Pointer to resulting struct group* from the query.
@@ -974 +1255 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxGetgrgid(struct wbcContext *ctx,
+                      gid_t gid, struct group **grp);
+
+/**
+ * @brief Fill in a struct passwd* for a domain user based
+ *   on uid
+ *
+ * @param gid       Uid to lookup
+ * @param **grp     Pointer to resulting struct group* from the query.
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcGetgrgid(gid_t gid, struct group **grp);
 
@@ -979 +1272 @@
  * @brief Reset the passwd iterator
  *
+ * @param *ctx      wbclient Context
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxSetpwent(struct wbcContext *ctx);
+
+/**
+ * @brief Reset the passwd iterator
+ *
  * @return #wbcErr
  **/
@@ -986 +1288 @@
  * @brief Close the passwd iterator
  *
+ * @param *ctx      wbclient Context
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxEndpwent(struct wbcContext *ctx);
+
+/**
+ * @brief Close the passwd iterator
+ *
  * @return #wbcErr
  **/
@@ -993 +1304 @@
  * @brief Return the next struct passwd* entry from the pwent iterator
  *
- * @param **pwd       Pointer to resulting struct passwd* from the query.
+ * @param *ctx      wbclient Context
+ * @param **pwd     Pointer to resulting struct passwd* from the query.
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxGetpwent(struct wbcContext *ctx, struct passwd **pwd);
+
+/**
+ * @brief Return the next struct passwd* entry from the pwent iterator
+ *
+ * @param **pwd     Pointer to resulting struct passwd* from the query.
  *
  * @return #wbcErr
@@ -1002 +1323 @@
  * @brief Reset the group iterator
  *
+ * @param *ctx      wbclient Context
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxSetgrent(struct wbcContext *ctx);
+
+/**
+ * @brief Reset the group iterator
+ *
  * @return #wbcErr
  **/
@@ -1009 +1339 @@
  * @brief Close the group iterator
  *
+ * @param *ctx      wbclient Context
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxEndgrent(struct wbcContext *ctx);
+
+/**
+ * @brief Close the group iterator
+ *
  * @return #wbcErr
  **/
@@ -1016 +1355 @@
  * @brief Return the next struct group* entry from the pwent iterator
  *
- * @param **grp       Pointer to resulting struct group* from the query.
+ * @param *ctx      wbclient Context
+ * @param **grp     Pointer to resulting struct group* from the query.
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxGetgrent(struct wbcContext *ctx, struct group **grp);
+
+/**
+ * @brief Return the next struct group* entry from the pwent iterator
+ *
+ * @param **grp     Pointer to resulting struct group* from the query.
  *
  * @return #wbcErr
@@ -1027 +1376 @@
  * This is similar to #wbcGetgrent, just that the member list is empty
  *
- * @param **grp       Pointer to resulting struct group* from the query.
+ * @param *ctx      wbclient Context
+ * @param **grp     Pointer to resulting struct group* from the query.
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxGetgrlist(struct wbcContext *ctx, struct group **grp);
+
+/**
+ * @brief Return the next struct group* entry from the pwent iterator
+ *
+ * This is similar to #wbcGetgrent, just that the member list is empty
+ *
+ * @param **grp     Pointer to resulting struct group* from the query.
  *
  * @return #wbcErr
@@ -1036 +1397 @@
  * @brief Return the unix group array belonging to the given user
  *
+ * @param *ctx           wbclient Context
  * @param *account       The given user name
  * @param *num_groups    Number of elements returned in the groups array
@@ -1042 +1404 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxGetGroups(struct wbcContext *ctx,
+                       const char *account,
+                       uint32_t *num_groups,
+                       gid_t **_groups);
+
+/**
+ * @brief Return the unix group array belonging to the given user
+ *
+ * @param *account       The given user name
+ * @param *num_groups    Number of elements returned in the groups array
+ * @param **_groups      Pointer to resulting gid_t array.
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcGetGroups(const char *account,
                     uint32_t *num_groups,
@@ -1054 +1430 @@
  * @brief Lookup the current status of a trusted domain
  *
- * @param domain        The domain to query
+ * @param *ctx           wbclient Context
+ * @param domain         The domain to query
+ *
+ * @param dinfo          A pointer to store the returned domain_info struct.
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxDomainInfo(struct wbcContext *ctx,
+                        const char *domain,
+                        struct wbcDomainInfo **dinfo);
+
+/**
+ * @brief Lookup the current status of a trusted domain
+ *
+ * @param domain         The domain to query
  *
  * @param dinfo          A pointer to store the returned domain_info struct.
@@ -1066 +1456 @@
  * @brief Lookup the currently contacted DCs
  *
+ * @param *ctx          wbclient Context
  * @param domain        The domain to query
  *
@@ -1074 +1465 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxDcInfo(struct wbcContext *ctx,
+                    const char *domain, size_t *num_dcs,
+                    const char ***dc_names, const char ***dc_ips);
+
+/**
+ * @brief Lookup the currently contacted DCs
+ *
+ * @param domain        The domain to query
+ *
+ * @param num_dcs       Number of DCs currently known
+ * @param dc_names      Names of the currently known DCs
+ * @param dc_ips        IP addresses of the currently known DCs
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcDcInfo(const char *domain, size_t *num_dcs,
                  const char ***dc_names, const char ***dc_ips);
+
+/**
+ * @brief Enumerate the domain trusts known by Winbind
+ *
+ * @param *ctx          wbclient Context
+ * @param **domains     Pointer to the allocated domain list array
+ * @param *num_domains  Pointer to number of domains returned
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxListTrusts(struct wbcContext *ctx,
+                        struct wbcDomainInfo **domains,
+                        size_t *num_domains);
 
 /**
@@ -1113 +1532 @@
  * @brief Enumerate the domain trusts known by Winbind
  *
+ * @param *ctx          wbclient Context
  * @param domain        Name of the domain to query for a DC
  * @param flags         Bit flags used to control the domain location query
@@ -1119 +1539 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxLookupDomainController(struct wbcContext *ctx,
+                                    const char *domain,
+                                    uint32_t flags,
+                                    struct wbcDomainControllerInfo **dc_info);
+
+/**
+ * @brief Enumerate the domain trusts known by Winbind
+ *
+ * @param domain        Name of the domain to query for a DC
+ * @param flags         Bit flags used to control the domain location query
+ * @param *dc_info      Pointer to the returned domain controller information
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcLookupDomainController(const char *domain,
                                  uint32_t flags,
@@ -1126 +1560 @@
  * @brief Get extended domain controller information
  *
+ * @param *ctx          wbclient Context
  * @param domain        Name of the domain to query for a DC
  * @param guid          Guid of the domain to query for a DC
@@ -1134 +1569 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxLookupDomainControllerEx(struct wbcContext *ctx,
+                                      const char *domain,
+                                      struct wbcGuid *guid,
+                                      const char *site,
+                                      uint32_t flags,
+                                      struct wbcDomainControllerInfoEx **dc_info);
+
+/**
+ * @brief Get extended domain controller information
+ *
+ * @param domain        Name of the domain to query for a DC
+ * @param guid          Guid of the domain to query for a DC
+ * @param site          Site of the domain to query for a DC
+ * @param flags         Bit flags used to control the domain location query
+ * @param *dc_info      Pointer to the returned extended domain controller information
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcLookupDomainControllerEx(const char *domain,
                                    struct wbcGuid *guid,
@@ -1147 +1600 @@
  * @brief Authenticate a username/password pair
  *
+ * @param *ctx         wbclient Context
  * @param username     Name of user to authenticate
  * @param password     Clear text password os user
@@ -1152 +1606 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxAuthenticateUser(struct wbcContext *ctx,
+                              const char *username,
+                              const char *password);
+
+/**
+ * @brief Authenticate a username/password pair
+ *
+ * @param username     Name of user to authenticate
+ * @param password     Clear text password os user
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcAuthenticateUser(const char *username,
                            const char *password);
@@ -1158 +1624 @@
  * @brief Authenticate with more detailed information
  *
+ * @param *ctx         wbclient Context
  * @param params       Input parameters, WBC_AUTH_USER_LEVEL_HASH
  *                     is not supported yet
@@ -1165 +1632 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxAuthenticateUserEx(struct wbcContext *ctx,
+                                const struct wbcAuthUserParams *params,
+                                struct wbcAuthUserInfo **info,
+                                struct wbcAuthErrorInfo **error);
+
+/**
+ * @brief Authenticate with more detailed information
+ *
+ * @param params       Input parameters, WBC_AUTH_USER_LEVEL_HASH
+ *                     is not supported yet
+ * @param info         Output details on WBC_ERR_SUCCESS
+ * @param error        Output details on WBC_ERR_AUTH_ERROR
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
                              struct wbcAuthUserInfo **info,
@@ -1172 +1654 @@
  * @brief Logon a User
  *
+ * @param[in]  *ctx        wbclient Context
  * @param[in]  params      Pointer to a wbcLogonUserParams structure
  * @param[out] info        Pointer to a pointer to a wbcLogonUserInfo structure
@@ -1179 +1662 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxLogonUser(struct wbcContext *ctx,
+                       const struct wbcLogonUserParams *params,
+                       struct wbcLogonUserInfo **info,
+                       struct wbcAuthErrorInfo **error,
+                       struct wbcUserPasswordPolicyInfo **policy);
+
+/**
+ * @brief Logon a User
+ *
+ * @param[in]  params      Pointer to a wbcLogonUserParams structure
+ * @param[out] info        Pointer to a pointer to a wbcLogonUserInfo structure
+ * @param[out] error       Pointer to a pointer to a wbcAuthErrorInfo structure
+ * @param[out] policy      Pointer to a pointer to a wbcUserPasswordPolicyInfo structure
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
                     struct wbcLogonUserInfo **info,
@@ -1187 +1686 @@
  * @brief Trigger a logoff notification to Winbind for a specific user
  *
+ * @param *ctx        wbclient Context
  * @param username    Name of user to remove from Winbind's list of
  *                    logged on users.
@@ -1195 +1695 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxLogoffUser(struct wbcContext *ctx,
+                        const char *username, uid_t uid,
+                        const char *ccfilename);
+
+/**
+ * @brief Trigger a logoff notification to Winbind for a specific user
+ *
+ * @param username    Name of user to remove from Winbind's list of
+ *                    logged on users.
+ * @param uid         Uid assigned to the username
+ * @param ccfilename  Absolute path to the Krb5 credentials cache to
+ *                    be removed
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcLogoffUser(const char *username,
                      uid_t uid,
@@ -1202 +1717 @@
  * @brief Trigger an extended logoff notification to Winbind for a specific user
  *
+ * @param *ctx        wbclient Context
  * @param params      A wbcLogoffUserParams structure
  * @param error       User output details on error
@@ -1207 +1723 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxLogoffUserEx(struct wbcContext *ctx,
+                          const struct wbcLogoffUserParams *params,
+                          struct wbcAuthErrorInfo **error);
+
+/**
+ * @brief Trigger an extended logoff notification to Winbind for a specific user
+ *
+ * @param params      A wbcLogoffUserParams structure
+ * @param error       User output details on error
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
                        struct wbcAuthErrorInfo **error);
@@ -1213 +1741 @@
  * @brief Change a password for a user
  *
+ * @param *ctx          wbclient Context
  * @param username      Name of user to authenticate
  * @param old_password  Old clear text password of user
@@ -1219 +1748 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxChangeUserPassword(struct wbcContext *ctx,
+                                const char *username,
+                                const char *old_password,
+                                const char *new_password);
+
+/**
+ * @brief Change a password for a user
+ *
+ * @param username      Name of user to authenticate
+ * @param old_password  Old clear text password of user
+ * @param new_password  New clear text password of user
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcChangeUserPassword(const char *username,
                              const char *old_password,
@@ -1227 +1770 @@
  *   failure
  *
+ * @param *ctx                  wbclient Context
  * @param params                Input parameters
  * @param error                 User output details on WBC_ERR_PWD_CHANGE_FAILED
@@ -1234 +1778 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxChangeUserPasswordEx(struct wbcContext *ctx,
+                                  const struct wbcChangePasswordParams *params,
+                                  struct wbcAuthErrorInfo **error,
+                                  enum wbcPasswordChangeRejectReason *reject_reason,
+                                  struct wbcUserPasswordPolicyInfo **policy);
+
+/**
+ * @brief Change a password for a user with more detailed information upon
+ *   failure
+ *
+ * @param params                Input parameters
+ * @param error                 User output details on WBC_ERR_PWD_CHANGE_FAILED
+ * @param reject_reason         New password reject reason on WBC_ERR_PWD_CHANGE_FAILED
+ * @param policy                Password policy output details on WBC_ERR_PWD_CHANGE_FAILED
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
                                struct wbcAuthErrorInfo **error,
@@ -1242 +1803 @@
  * @brief Authenticate a user with cached credentials
  *
+ * @param *ctx       wbclient Context
  * @param *params    Pointer to a wbcCredentialCacheParams structure
  * @param **info     Pointer to a pointer to a wbcCredentialCacheInfo structure
@@ -1248 +1810 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxCredentialCache(struct wbcContext *ctx,
+                             struct wbcCredentialCacheParams *params,
+                             struct wbcCredentialCacheInfo **info,
+                             struct wbcAuthErrorInfo **error);
+
+/**
+ * @brief Authenticate a user with cached credentials
+ *
+ * @param *params    Pointer to a wbcCredentialCacheParams structure
+ * @param **info     Pointer to a pointer to a wbcCredentialCacheInfo structure
+ * @param **error    Pointer to a pointer to a wbcAuthErrorInfo structure
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
                           struct wbcCredentialCacheInfo **info,
@@ -1255 +1831 @@
  * @brief Save a password with winbind for doing wbcCredentialCache() later
  *
+ * @param *ctx       wbclient Context
+ * @param *user      Username
+ * @param *password  Password
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxCredentialSave(struct wbcContext *ctx,
+                            const char *user, const char *password);
+
+/**
+ * @brief Save a password with winbind for doing wbcCredentialCache() later
+ *
  * @param *user      Username
  * @param *password  Password
@@ -1269 +1857 @@
  * @brief Resolve a NetbiosName via WINS
  *
+ * @param *ctx         wbclient Context
  * @param name         Name to resolve
  * @param *ip          Pointer to the ip address string
@@ -1274 +1863 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxResolveWinsByName(struct wbcContext *ctx,
+                               const char *name, char **ip);
+
+/**
+ * @brief Resolve a NetbiosName via WINS
+ *
+ * @param name         Name to resolve
+ * @param *ip          Pointer to the ip address string
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcResolveWinsByName(const char *name, char **ip);
 
@@ -1279 +1879 @@
  * @brief Resolve an IP address via WINS into a NetbiosName
  *
- * @param ip          The ip address string
- * @param *name       Pointer to the name
+ * @param *ctx         wbclient Context
+ * @param ip           The ip address string
+ * @param *name        Pointer to the name
+ *
+ * @return #wbcErr
+ *
+ **/
+wbcErr wbcCtxResolveWinsByIP(struct wbcContext *ctx,
+                             const char *ip, char **name);
+
+/**
+ * @brief Resolve an IP address via WINS into a NetbiosName
+ *
+ * @param ip           The ip address string
+ * @param *name        Pointer to the name
  *
  * @return #wbcErr
@@ -1294 +1907 @@
  * @brief Trigger a verification of the trust credentials of a specific domain
  *
+ * @param *ctx         wbclient Context
  * @param *domain      The name of the domain.
  * @param error        Output details on WBC_ERR_AUTH_ERROR
@@ -1299 +1913 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxCheckTrustCredentials(struct wbcContext *ctx, const char *domain,
+                                   struct wbcAuthErrorInfo **error);
+
+/**
+ * @brief Trigger a verification of the trust credentials of a specific domain
+ *
+ * @param *domain      The name of the domain.
+ * @param error        Output details on WBC_ERR_AUTH_ERROR
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcCheckTrustCredentials(const char *domain,
                                 struct wbcAuthErrorInfo **error);
@@ -1305 +1930 @@
  * @brief Trigger a change of the trust credentials for a specific domain
  *
+ * @param *ctx         wbclient Context
  * @param *domain      The name of the domain.
  * @param error        Output details on WBC_ERR_AUTH_ERROR
@@ -1310 +1936 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxChangeTrustCredentials(struct wbcContext *ctx, const char *domain,
+                                    struct wbcAuthErrorInfo **error);
+
+/**
+ * @brief Trigger a change of the trust credentials for a specific domain
+ *
+ * @param *domain      The name of the domain.
+ * @param error        Output details on WBC_ERR_AUTH_ERROR
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcChangeTrustCredentials(const char *domain,
                                  struct wbcAuthErrorInfo **error);
@@ -1317 +1954 @@
  *        version of wbcCheckTrustCredentials
  *
+ * @param *ctx         wbclient Context
  * @param *domain      The name of the domain, only NULL for the default domain is
  *                     supported yet. Other values than NULL will result in
@@ -1324 +1962 @@
  * @return #wbcErr
  **/
+wbcErr wbcCtxPingDc(struct wbcContext *ctx, const char *domain,
+                    struct wbcAuthErrorInfo **error);
+
+/**
+ * @brief Trigger a no-op call through the NETLOGON pipe. Low-cost
+ *        version of wbcCheckTrustCredentials
+ *
+ * @param *domain      The name of the domain, only NULL for the default domain is
+ *                     supported yet. Other values than NULL will result in
+ *                     WBC_ERR_NOT_IMPLEMENTED.
+ * @param error        Output details on WBC_ERR_AUTH_ERROR
+ *
+ * @return #wbcErr
+ **/
 wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error);
+
+/**
+ * @brief Trigger a no-op call through the NETLOGON pipe. Low-cost
+ *        version of wbcCheckTrustCredentials
+ *
+ * @param *ctx         wbclient Context
+ * @param *domain      The name of the domain, only NULL for the default domain is
+ *                     supported yet. Other values than NULL will result in
+ *                     WBC_ERR_NOT_IMPLEMENTED.
+ * @param error        Output details on WBC_ERR_AUTH_ERROR
+ * @param dcname       DC that was attempted to ping
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcCtxPingDc2(struct wbcContext *ctx, const char *domain,
+                     struct wbcAuthErrorInfo **error,
+                     char **dcname);
+
+/**
+ * @brief Trigger a no-op call through the NETLOGON pipe. Low-cost
+ *        version of wbcCheckTrustCredentials
+ *
+ * @param *domain      The name of the domain, only NULL for the default domain is
+ *                     supported yet. Other values than NULL will result in
+ *                     WBC_ERR_NOT_IMPLEMENTED.
+ * @param error        Output details on WBC_ERR_AUTH_ERROR
+ * @param dcname       DC that was attempted to ping
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcPingDc2(const char *domain, struct wbcAuthErrorInfo **error,
+                  char **dcname);
 
 /**********************************************************

vendor/current/nsswitch/libwbclient/wbclient_internal.h

@@ -23 +23 @@
 #define _WBCLIENT_INTERNAL_H
 
+struct wbcContext {
+        struct winbindd_context *winbindd_ctx;
+        uint32_t pw_cache_size; /* Number of cached passwd structs */
+        uint32_t pw_cache_idx;  /* Position of the pwent context */
+        uint32_t gr_cache_size; /* Number of cached group structs */
+        uint32_t gr_cache_idx;  /* Position of the grent context */
+};
+
 /* Private functions */
 
-wbcErr wbcRequestResponse(int cmd,
+wbcErr wbcRequestResponse(struct wbcContext *ctx, int cmd,
                           struct winbindd_request *request,
                           struct winbindd_response *response);
 
-wbcErr wbcRequestResponsePriv(int cmd,
+wbcErr wbcRequestResponsePriv(struct wbcContext *ctx, int cmd,
                               struct winbindd_request *request,
                               struct winbindd_response *response);
@@ -38 +46 @@
 char *wbcStrDup(const char *str);
 const char **wbcAllocateStringArray(int num_strings);
+struct wbcContext *wbcGetGlobalCtx(void);
 
 #endif      /* _WBCLIENT_INTERNAL_H */

vendor/current/nsswitch/nsstest.c

@@ -371 +371 @@
         NSS_STATUS status;
 
-        groups = (gid_t *)malloc(size);
+        groups = (gid_t *)malloc(sizeof(gid_t) * size);
+        if (groups == NULL) {
+                printf("Unable to allocate memory for groups\n");
+                return;
+        }
         groups[0] = gid;
 
@@ -452 +456 @@
         if (pwd || last_error != NSS_STATUS_NOTFOUND) {
                 total_errors++;
-                printf("ERROR Non existant user gave error %d\n", last_error);
+                printf("ERROR Non existent user gave error %d\n", last_error);
         }
 
@@ -458 +462 @@
         if (pwd || last_error != NSS_STATUS_NOTFOUND) {
                 total_errors++;
-                printf("ERROR Non existant uid gave error %d\n", last_error);
+                printf("ERROR Non existent uid gave error %d\n", last_error);
         }
 
@@ -464 +468 @@
         if (grp || last_error != NSS_STATUS_NOTFOUND) {
                 total_errors++;
-                printf("ERROR Non existant group gave error %d\n", last_error);
+                printf("ERROR Non existent group gave error %d\n", last_error);
         }
 
@@ -470 +474 @@
         if (grp || last_error != NSS_STATUS_NOTFOUND) {
                 total_errors++;
-                printf("ERROR Non existant gid gave error %d\n", last_error);
+                printf("ERROR Non existent gid gave error %d\n", last_error);
         }
 }

vendor/current/nsswitch/pam_winbind.c

@@ -12 +12 @@
 
 #include "pam_winbind.h"
-#define CONST_DISCARD(type,ptr) ((type)(void *)ptr)
-
+
+enum pam_winbind_request_type 
+{
+        PAM_WINBIND_AUTHENTICATE,
+        PAM_WINBIND_SETCRED,
+        PAM_WINBIND_ACCT_MGMT,
+        PAM_WINBIND_OPEN_SESSION,
+        PAM_WINBIND_CLOSE_SESSION,
+        PAM_WINBIND_CHAUTHTOK,
+        PAM_WINBIND_CLEANUP
+};
 
 static int wbc_error_to_pam_error(wbcErr status)
@@ -141 +150 @@
         do { \
                 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] LEAVE: " \
-                               function " returning %d (%s)", ctx->pamh, retval, \
+                               function " returning %d (%s)", ctx ? ctx->pamh : NULL, retval, \
                                _pam_error_code_str(retval)); \
                 _pam_log_state(ctx); \
@@ -164 +173 @@
 #endif
 
-
-/*
- * Work around the pam API that has functions with void ** as parameters
- * These lead to strict aliasing warnings with gcc.
- */
-static int _pam_get_item(const pam_handle_t *pamh,
-                         int item_type,
-                         const void *_item)
-{
-        const void **item = (const void **)_item;
-        return pam_get_item(pamh, item_type, item);
-}
-static int _pam_get_data(const pam_handle_t *pamh,
-                         const char *module_data_name,
-                         const void *_data)
-{
-        const void **data = (const void **)_data;
-        return pam_get_data(pamh, module_data_name, data);
-}
 
 /* some syslogging */
@@ -203 +193 @@
         const char *service;
 
-        _pam_get_item(pamh, PAM_SERVICE, &service);
+        pam_get_item(pamh, PAM_SERVICE, (const void **) &service);
 
         format2 = (char *)malloc(strlen(MODULE_NAME)+strlen(format)+strlen(service)+5);
@@ -281 +271 @@
         va_list args;
 
-        if (!_pam_log_is_debug_enabled(r->ctrl)) {
+        if (!r || !_pam_log_is_debug_enabled(r->ctrl)) {
                 return;
         }
@@ -350 +340 @@
         _pam_log_state_datum(ctx, item_type, #item_type, \
                              _LOG_PASSWORD_AS_STRING)
+/*
+ * wrapper to preserve old behaviour of iniparser which ignored
+ * key values that had no value assigned like
+ *    key =
+ * for a key like above newer iniparser will return a zero-length
+ * string, previously iniparser would return NULL
+ *
+ * JRA: For compatibility, tiniparser behaves like iniparser.
+ */
+static const char *tiniparser_getstring_nonempty(struct tiniparser_dictionary *d,
+                        const char *key,
+                        const char *def)
+{
+        const char *ret = tiniparser_getstring(d, key, def);
+        if (ret && strlen(ret) == 0) {
+                ret = NULL;
+        }
+        return ret;
+}
 
 static void _pam_log_state(struct pwb_context *ctx)
 {
-        if (!_pam_log_is_debug_state_enabled(ctx->ctrl)) {
+        if (!ctx || !_pam_log_is_debug_state_enabled(ctx->ctrl)) {
                 return;
         }
@@ -389 +398 @@
                       int argc,
                       const char **argv,
-                      dictionary **result_d)
+                      enum pam_winbind_request_type type,
+                      struct tiniparser_dictionary **result_d)
 {
         int ctrl = 0;
@@ -395 +405 @@
         int i;
         const char **v;
-        dictionary *d = NULL;
+        struct tiniparser_dictionary *d = NULL;
 
         if (flags & PAM_SILENT) {
@@ -413 +423 @@
         }
 
-        d = iniparser_load(CONST_DISCARD(char *, config_file));
+        d = tiniparser_load(config_file);
         if (d == NULL) {
                 goto config_from_pam;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:debug"), false)) {
+        if (tiniparser_getboolean(d, "global:debug", false)) {
                 ctrl |= WINBIND_DEBUG_ARG;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:debug_state"), false)) {
+        if (tiniparser_getboolean(d, "global:debug_state", false)) {
                 ctrl |= WINBIND_DEBUG_STATE;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:cached_login"), false)) {
+        if (tiniparser_getboolean(d, "global:cached_login", false)) {
                 ctrl |= WINBIND_CACHED_LOGIN;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:krb5_auth"), false)) {
+        if (tiniparser_getboolean(d, "global:krb5_auth", false)) {
                 ctrl |= WINBIND_KRB5_AUTH;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:silent"), false)) {
+        if (tiniparser_getboolean(d, "global:silent", false)) {
                 ctrl |= WINBIND_SILENT;
         }
 
-        if (iniparser_getstring(d, CONST_DISCARD(char *, "global:krb5_ccache_type"), NULL) != NULL) {
+        if (tiniparser_getstring_nonempty(d, "global:krb5_ccache_type", NULL) != NULL) {
                 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
         }
 
-        if ((iniparser_getstring(d, CONST_DISCARD(char *, "global:require-membership-of"), NULL)
+        if ((tiniparser_getstring_nonempty(d, "global:require-membership-of", NULL)
              != NULL) ||
-            (iniparser_getstring(d, CONST_DISCARD(char *, "global:require_membership_of"), NULL)
+            (tiniparser_getstring_nonempty(d, "global:require_membership_of", NULL)
              != NULL)) {
                 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:try_first_pass"), false)) {
+        if (tiniparser_getboolean(d, "global:try_first_pass", false)) {
                 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
         }
 
-        if (iniparser_getint(d, CONST_DISCARD(char *, "global:warn_pwd_expire"), 0)) {
+        if (tiniparser_getint(d, "global:warn_pwd_expire", 0)) {
                 ctrl |= WINBIND_WARN_PWD_EXPIRE;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:mkhomedir"), false)) {
+        if (tiniparser_getboolean(d, "global:mkhomedir", false)) {
                 ctrl |= WINBIND_MKHOMEDIR;
         }
@@ -480 +490 @@
                 else if (!strcasecmp(*v, "unknown_ok"))
                         ctrl |= WINBIND_UNKNOWN_OK_ARG;
-                else if (!strncasecmp(*v, "require_membership_of",
-                                      strlen("require_membership_of")))
+                else if ((type == PAM_WINBIND_AUTHENTICATE
+                          || type == PAM_WINBIND_SETCRED) 
+                         && !strncasecmp(*v, "require_membership_of",
+                                         strlen("require_membership_of")))
                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
-                else if (!strncasecmp(*v, "require-membership-of",
-                                      strlen("require-membership-of")))
+                else if ((type == PAM_WINBIND_AUTHENTICATE 
+                          || type == PAM_WINBIND_SETCRED) 
+                         && !strncasecmp(*v, "require-membership-of",
+                                         strlen("require-membership-of")))
                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
                 else if (!strcasecmp(*v, "krb5_auth"))
@@ -495 +509 @@
                 else if (!strcasecmp(*v, "mkhomedir"))
                         ctrl |= WINBIND_MKHOMEDIR;
-                else {
+                else if (!strncasecmp(*v, "warn_pwd_expire",
+                        strlen("warn_pwd_expire")))
+                        ctrl |= WINBIND_WARN_PWD_EXPIRE;
+                else if (type != PAM_WINBIND_CLEANUP) {
                         __pam_log(pamh, ctrl, LOG_ERR,
                                  "pam_parse: unknown option: %s", *v);
@@ -507 +524 @@
         } else {
                 if (d) {
-                        iniparser_freedict(d);
+                        tiniparser_freedict(d);
                 }
         }
@@ -521 +538 @@
 
         if (ctx->dict) {
-                iniparser_freedict(ctx->dict);
+                tiniparser_freedict(ctx->dict);
         }
 
@@ -531 +548 @@
                                      int argc,
                                      const char **argv,
+                                     enum pam_winbind_request_type type,
                                      struct pwb_context **ctx_p)
 {
@@ -539 +557 @@
 #endif
 
-        r = TALLOC_ZERO_P(NULL, struct pwb_context);
+        r = talloc_zero(NULL, struct pwb_context);
         if (!r) {
                 return PAM_BUF_ERR;
@@ -550 +568 @@
         r->argc = argc;
         r->argv = argv;
-        r->ctrl = _pam_parse(pamh, flags, argc, argv, &r->dict);
+        r->ctrl = _pam_parse(pamh, flags, argc, argv, type, &r->dict);
         if (r->ctrl == -1) {
                 TALLOC_FREE(r);
@@ -565 +583 @@
                                       int error_status)
 {
-        int ctrl = _pam_parse(pamh, 0, 0, NULL, NULL);
+        int ctrl = _pam_parse(pamh, 0, 0, NULL, PAM_WINBIND_CLEANUP, NULL);
         if (_pam_log_is_debug_state_enabled(ctrl)) {
                 __pam_log_debug(pamh, ctrl, LOG_DEBUG,
@@ -646 +664 @@
         struct pam_conv *conv;
 
-        retval = _pam_get_item(pamh, PAM_CONV, &conv);
+        retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv);
         if (retval == PAM_SUCCESS) {
                 retval = conv->conv(nargs,
-                                    (const struct pam_message **)message,
+                                    discard_const_p(const struct pam_message *, message),
                                     response, conv->appdata_ptr);
         }
@@ -813 +831 @@
         struct pam_message msg, *pmsg;
         struct pam_response *resp = NULL;
-        const char *prompt;
         int ret;
         bool retval = false;
-        prompt = _("Do you want to change your password now?");
         pmsg = &msg;
         msg.msg_style = PAM_RADIO_TYPE;
-        msg.msg = prompt;
+        msg.msg = _("Do you want to change your password now?");
         ret = converse(ctx->pamh, 1, &pmsg, &resp);
         if (resp == NULL) {
@@ -1050 +1066 @@
                                int dest_buffer_size)
 {
-        int dest_length = strlen(dest);
-        int src_length = strlen(src);
-
-        if (dest_length + src_length + 1 > dest_buffer_size) {
-                return false;
-        }
-
-        memcpy(dest + dest_length, src, src_length + 1);
-        return true;
+        size_t len;
+        len = strlcat(dest, src, dest_buffer_size);
+        return (len < dest_buffer_size);
 }
 
@@ -1221 +1231 @@
                                 struct wbcLogonUserInfo *info)
 {
-        char var[PATH_MAX];
+        char *var = NULL;
         int ret;
         uint32_t i;
@@ -1248 +1258 @@
                        "request returned KRB5CCNAME: %s", krb5ccname);
 
-        if (snprintf(var, sizeof(var), "KRB5CCNAME=%s", krb5ccname) == -1) {
+        if (asprintf(&var, "KRB5CCNAME=%s", krb5ccname) == -1) {
                 return;
         }
 
         ret = pam_putenv(ctx->pamh, var);
-        if (ret) {
+        if (ret != PAM_SUCCESS) {
                 _pam_log(ctx, LOG_ERR,
                          "failed to set KRB5CCNAME to %s: %s",
                          var, pam_strerror(ctx->pamh, ret));
         }
+        free(var);
 }
 
@@ -1318 +1329 @@
         ret = pam_set_data(ctx->pamh, data_name, talloc_strdup(NULL, value),
                            _pam_winbind_cleanup_func);
-        if (ret) {
+        if (ret != PAM_SUCCESS) {
                 _pam_log_debug(ctx, LOG_DEBUG,
                                "Could not set data %s: %s\n",
@@ -1646 +1657 @@
 
                 ret = _pam_create_homedir(ctx, create_dir, mode);
-                if (ret) {
+                if (ret != PAM_SUCCESS) {
                         return ret;
                 }
@@ -1771 +1782 @@
                                              "krb5_cc_type",
                                              0,
-                                             (uint8_t *)cctype,
+                                             discard_const_p(uint8_t, cctype),
                                              strlen(cctype)+1);
                 if (!WBC_ERROR_IS_OK(wbc_status)) {
@@ -1952 +1963 @@
 
         params.account_name             = user;
-        params.level                    = WBC_AUTH_USER_LEVEL_PLAIN;
+        params.level                    = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
         params.old_password.plaintext   = oldpass;
         params.new_password.plaintext   = newpass;
@@ -1991 +2002 @@
 
                 /* FIXME: avoid to send multiple PAM messages after another */
-                switch (reject_reason) {
+                switch ((int)reject_reason) {
                         case -1:
                                 break;
@@ -2129 +2140 @@
         if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) ||
             on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
-                retval = _pam_get_item(ctx->pamh, authtok_flag, &item);
+                retval = pam_get_item(ctx->pamh,
+                                      authtok_flag,
+                                      (const void **) &item);
                 if (retval != PAM_SUCCESS) {
                         /* very strange. */
@@ -2237 +2250 @@
         _pam_delete(token);     /* clean it up */
         if (retval != PAM_SUCCESS ||
-            (retval = _pam_get_item(ctx->pamh, authtok_flag, &item)) != PAM_SUCCESS) {
+            (retval = pam_get_item(ctx->pamh, authtok_flag, (const void **) &item)) != PAM_SUCCESS) {
 
                 _pam_log(ctx, LOG_CRIT, "error manipulating password");
@@ -2287 +2300 @@
                 }
 
-                parm_opt = iniparser_getstring(ctx->dict, key, NULL);
+                parm_opt = tiniparser_getstring_nonempty(ctx->dict, key, NULL);
                 TALLOC_FREE(key);
 
@@ -2335 +2348 @@
                 }
 
-                parm_opt = iniparser_getint(ctx->dict, key, -1);
+                parm_opt = tiniparser_getint(ctx->dict, key, -1);
                 TALLOC_FREE(key);
 
@@ -2357 +2370 @@
         ret = get_conf_item_string(ctx, "require_membership_of",
                                    WINBIND_REQUIRED_MEMBERSHIP);
-        if (ret) {
+        if (ret != NULL) {
                 return ret;
         }
@@ -2370 +2383 @@
                                   WINBIND_WARN_PWD_EXPIRE);
         /* no or broken setting */
-        if (ret <= 0) {
+        if (ret < 0) {
                 return DEFAULT_DAYS_TO_WARN_BEFORE_PWD_EXPIRES;
         }
@@ -2409 +2422 @@
  *
  * @param ctx PAM winbind context.
- * @param upn  USer UPN to be trabslated.
+ * @param upn  User UPN to be translated.
  *
  * @return converted name. NULL pointer on failure. Caller needs to free.
@@ -2424 +2437 @@
         char *name;
         char *p;
+        char *result;
 
         /* This cannot work when the winbind separator = @ */
@@ -2455 +2469 @@
         }
 
-        return talloc_asprintf(ctx, "%s%c%s", domain, sep, name);
+        result = talloc_asprintf(ctx, "%s%c%s", domain, sep, name);
+        wbcFreeMemory(domain);
+        wbcFreeMemory(name);
+        return result;
 }
 
 static int _pam_delete_cred(pam_handle_t *pamh, int flags,
-                         int argc, const char **argv)
+                            int argc, enum pam_winbind_request_type type, 
+                            const char **argv)
 {
         int retval = PAM_SUCCESS;
@@ -2470 +2488 @@
         ZERO_STRUCT(logoff);
 
-        retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (retval) {
-                goto out;
+        retval = _pam_winbind_init_context(pamh, flags, argc, argv, type, &ctx);
+        if (retval != PAM_SUCCESS) {
+                return retval;
         }
 
@@ -2486 +2504 @@
 
                 retval = pam_get_user(pamh, &user, _("Username: "));
-                if (retval) {
+                if (retval != PAM_SUCCESS) {
                         _pam_log(ctx, LOG_ERR,
                                  "could not identify user");
@@ -2524 +2542 @@
                                                      "ccfilename",
                                                      0,
-                                                     (uint8_t *)ccname,
+                                                     discard_const_p(uint8_t, ccname),
                                                      strlen(ccname)+1);
                         if (!WBC_ERROR_IS_OK(wbc_status)) {
@@ -2605 +2623 @@
         struct pwb_context *ctx = NULL;
 
-        retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (retval) {
-                goto out;
+        retval = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                           PAM_WINBIND_AUTHENTICATE, &ctx);
+        if (retval != PAM_SUCCESS) {
+                return retval;
         }
 
@@ -2742 +2761 @@
         }
 
-        if (ctx != NULL) {
-                _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
-                TALLOC_FREE(ctx);
-        }
+        _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
+
+        TALLOC_FREE(ctx);
 
         return retval;
@@ -2757 +2775 @@
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_SETCRED, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
@@ -2767 +2786 @@
 
                 case PAM_DELETE_CRED:
-                        ret = _pam_delete_cred(pamh, flags, argc, argv);
+                        ret = _pam_delete_cred(pamh, flags, argc,
+                                               PAM_WINBIND_SETCRED, argv);
                         break;
                 case PAM_REFRESH_CRED:
@@ -2789 +2809 @@
         }
 
- out:
-
         _PAM_LOG_FUNCTION_LEAVE("pam_sm_setcred", ctx, ret);
 
@@ -2808 +2826 @@
         const char *username;
         int ret = PAM_USER_UNKNOWN;
-        void *tmp = NULL;
+        const char *tmp = NULL;
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_ACCT_MGMT, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
@@ -2849 +2868 @@
                              (const void **)&tmp);
                 if (tmp != NULL) {
-                        ret = atoi((const char *)tmp);
+                        ret = atoi(tmp);
                         switch (ret) {
                         case PAM_AUTHTOK_EXPIRED:
@@ -2906 +2925 @@
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_OPEN_SESSION, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
@@ -2917 +2937 @@
                 ret = _pam_mkhomedir(ctx);
         }
- out:
+
         _PAM_LOG_FUNCTION_LEAVE("pam_sm_open_session", ctx, ret);
 
@@ -2932 +2952 @@
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_CLOSE_SESSION, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
         _PAM_LOG_FUNCTION_ENTER("pam_sm_close_session", ctx);
 
-out:
         _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx, ret);
 
@@ -2975 +2995 @@
         struct passwd *pwd = NULL;
 
-        _pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
-                      &new_authtok_reqd_during_auth);
+        pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
+                      (const void **) &new_authtok_reqd_during_auth);
         pam_set_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
                      NULL, NULL);
@@ -3007 +3027 @@
         /* <DO NOT free() THESE> */
         const char *user;
-        char *pass_old, *pass_new;
+        const char *pass_old;
+        const char *pass_new;
         /* </DO NOT free() THESE> */
 
@@ -3017 +3038 @@
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_CHAUTHTOK, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
@@ -3033 +3055 @@
          */
         ret = pam_get_user(pamh, &user, _("Username: "));
-        if (ret) {
+        if (ret != PAM_SUCCESS) {
                 _pam_log(ctx, LOG_ERR,
                          "password - could not identify user");
@@ -3130 +3152 @@
                  */
 
-                ret = _pam_get_item(pamh, PAM_OLDAUTHTOK, &pass_old);
+                ret = pam_get_item(pamh, PAM_OLDAUTHTOK, (const void **) &pass_old);
 
                 if (ret != PAM_SUCCESS) {
@@ -3180 +3202 @@
                  * rebuild the password database file.
                  */
-                _pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
-                              &pwdlastset_update);
+                pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
+                             (const void **) &pwdlastset_update);
 
                 /*
@@ -3194 +3216 @@
                 ret = winbind_chauthtok_request(ctx, user, pass_old,
                                                 pass_new, pwdlastset_update);
-                if (ret) {
+                if (ret != PAM_SUCCESS) {
                         pass_old = pass_new = NULL;
                         goto out;

vendor/current/nsswitch/pam_winbind.h

@@ -56 +56 @@
 #include <talloc.h>
 #include "libwbclient/wbclient.h"
+#include "lib/util/tiniparser.h"
 
 #define MODULE_NAME "pam_winbind"
@@ -66 +67 @@
 #define PAM_WINBIND_CONFIG_FILE "/etc/security/pam_winbind.conf"
 #endif
-
-#include <iniparser.h>
 
 #ifdef HAVE_LIBINTL_H
@@ -94 +93 @@
 #endif
 
-#endif /* defined(SUNOS5) || defined(SUNOS4) || defined(HPUX) || defined(FREEBSD) || defined(AIX) */
+#endif /* (!)LINUX */
 
 #if defined(HAVE_SECURITY_PAM_MODULES_H)
@@ -213 +212 @@
         int argc;
         const char **argv;
-        dictionary *dict;
+        struct tiniparser_dictionary *dict;
         uint32_t ctrl;
 };

vendor/current/nsswitch/tests/test_wbinfo.sh

@@ -15 +15 @@
 
 failed=0
-samba4bindir="$BUILDDIR/bin"
-wbinfo="$VALGRIND $samba4bindir/wbinfo$EXEEXT"
+samba4bindir="$BINDIR"
+wbinfo="$VALGRIND $samba4bindir/wbinfo"
 
 . `dirname $0`/../../testprogs/blackbox/subunit.sh
@@ -58 +58 @@
 # Convert netbios name to IP
 # Does not work yet
-knownfail "wbinfo -N against $TARGET" $wbinfo -N $NETBIOSNAME || failed=`expr $failed + 1`
+testit "wbinfo -N against $TARGET" $wbinfo -N $NETBIOSNAME || failed=`expr $failed + 1`
 # Convert IP to netbios name
 # Does not work yet
-knownfail "wbinfo -I against $TARGET" $wbinfo -I $SERVER_IP || failed=`expr $failed + 1`
+testit "wbinfo -I against $TARGET" $wbinfo -I $SERVER_IP || failed=`expr $failed + 1`
 
 # Convert name to SID
@@ -152 +152 @@
 
 #didn't really work anyway
-knownfail "wbinfo  --trusted-domains against $TARGET" $wbinfo --trusted-domains || failed=`expr $failed + 1`
-knownfail "wbinfo --all-domains against $TARGET" $wbinfo --all-domains || failed=`expr $failed + 1`
+testit "wbinfo  --trusted-domains against $TARGET" $wbinfo --trusted-domains || failed=`expr $failed + 1`
+testit "wbinfo --all-domains against $TARGET" $wbinfo --all-domains || failed=`expr $failed + 1`
 
 testit "wbinfo --own-domain against $TARGET" $wbinfo --own-domain || failed=`expr $failed + 1`
@@ -175 +175 @@
 testit "wbinfo -i against $TARGET" $wbinfo -i "$DOMAIN/$USERNAME" || failed=`expr $failed + 1`
 
-testit "wbinfo --uid-info against $TARGET" $wbinfo --uid-info $admin_uid || failed=`expr $failed + 1`
-
 echo "test: wbinfo --group-info against $TARGET"
-rawgid=`$wbinfo --group-info "Domain admins" | sed 's/.*:\([0-9][0-9]*\):/\1/'`
+gid=`$wbinfo --group-info "$DOMAIN/Domain users" | cut -d: -f3`
 if test x$? = x0; then
         echo "success: wbinfo --group-info against $TARGET"
@@ -186 +184 @@
 fi
 
-gid=`echo $rawgid | sed 's/.*:\([0-9][0-9]*\):/\1/'`
+test_name="wbinfo -i against $TARGET"
+subunit_start_test "$test_name"
+passwd_line=`$wbinfo -i "$DOMAIN/$USERNAME"`
+if test x$? = x0; then
+        subunit_pass_test "$test_name"
+else
+        subunit_fail_test "$test_name"
+        failed=`expr $failed + 1`
+fi
+
+test_name="confirm output of wbinfo -i against $TARGET"
+subunit_start_test "$test_name"
+
+# The full name (GECOS) is based on name (the RDN, in this case CN)
+# and displayName in winbindd_ads, and is based only on displayName in
+# winbindd_msrpc and winbindd_rpc.  Allow both versions.
+expected_line="$DOMAIN/administrator:*:$admin_uid:$gid:Administrator:/home/$DOMAIN/administrator:/bin/false"
+expected2_line="$DOMAIN/administrator:*:$admin_uid:$gid::/home/$DOMAIN/administrator:/bin/false"
+
+if test x$passwd_line = x"$expected_line" -o x$passwd_line = x"$expected2_line"; then
+        subunit_pass_test "$test_name"
+else
+        echo "expected '$expected_line' or '$expected2_line' got '$passwd_line'" | subunit_fail_test "$test_name"
+        failed=`expr $failed + 1`
+fi
+
+test_name="wbinfo --uid-info against $TARGET"
+subunit_start_test "$test_name"
+passwd_line=`$wbinfo --uid-info=$admin_uid`
+if test x$? = x0; then
+        subunit_pass_test "$test_name"
+else
+        subunit_fail_test "$test_name"
+        failed=`expr $failed + 1`
+fi
+
+test_name="confirm output of wbinfo --uid-info against $TARGET"
+subunit_start_test "$test_name"
+if test x$passwd_line = x"$expected_line" -o x$passwd_line = x"$expected2_line"; then
+        subunit_pass_test "$test_name"
+else
+        echo "expected '$expected_line' or '$expected2_line' got '$passwd_line'" | subunit_fail_test "$test_name"
+        failed=`expr $failed + 1`
+fi
+
+testfail "wbinfo --group-info against $TARGET with $USERNAME" $wbinfo --group-info $USERNAME && failed=`expr $failed + 1`
+
 testit "wbinfo --gid-info against $TARGET" $wbinfo --gid-info $gid || failed=`expr $failed + 1`
 

vendor/current/nsswitch/wb_common.c

@@ -7 +7 @@
    Copyright (C) Andrew Tridgell 2000
    Copyright (C) Andrew Bartlett 2002
+   Copyright (C) Matthew Newton 2015
 
 
@@ -27 +28 @@
 #include "winbind_client.h"
 
-/* Global variables.  These are effectively the client state information */
-
-int winbindd_fd = -1;           /* fd for winbindd socket */
-static int is_privileged = 0;
+/* Global context */
+
+struct winbindd_context {
+        int winbindd_fd;        /* winbind file descriptor */
+        bool is_privileged;     /* using the privileged socket? */
+        pid_t our_pid;          /* calling process pid */
+};
+
+static struct winbindd_context wb_global_ctx = {
+        .winbindd_fd = -1,
+        .is_privileged = 0,
+        .our_pid = 0
+};
 
 /* Free a response structure */
@@ -65 +75 @@
 /* Close established socket */
 
-#if HAVE_FUNCTION_ATTRIBUTE_DESTRUCTOR
+static void winbind_close_sock(struct winbindd_context *ctx)
+{
+        if (!ctx) {
+                return;
+        }
+
+        if (ctx->winbindd_fd != -1) {
+                close(ctx->winbindd_fd);
+                ctx->winbindd_fd = -1;
+        }
+}
+
+/* Destructor for global context to ensure fd is closed */
+
+#if HAVE_DESTRUCTOR_ATTRIBUTE
 __attribute__((destructor))
 #endif
-static void winbind_close_sock(void)
-{
-        if (winbindd_fd != -1) {
-                close(winbindd_fd);
-                winbindd_fd = -1;
-        }
+static void winbind_destructor(void)
+{
+        winbind_close_sock(&wb_global_ctx);
 }
 
@@ -169 +190 @@
 }
 
+/**
+ * @internal
+ *
+ * @brief Check if we talk to the priviliged pipe which should be owned by root.
+ *
+ * This checks if we have uid_wrapper running and if this is the case it will
+ * allow one to connect to the winbind privileged pipe even it is not owned by root.
+ *
+ * @param[in]  uid      The uid to check if we can safely talk to the pipe.
+ *
+ * @return              If we have access it returns true, else false.
+ */
+static bool winbind_privileged_pipe_is_root(uid_t uid)
+{
+        if (uid == 0) {
+                return true;
+        }
+
+        if (uid_wrapper_enabled()) {
+                return true;
+        }
+
+        return false;
+}
+
 /* Connect to winbindd socket */
 
@@ -175 +221 @@
         struct sockaddr_un sunaddr;
         struct stat st;
-        char *path = NULL;
         int fd;
         int wait_time;
         int slept;
+        int ret;
 
         /* Check permissions on unix socket directory */
@@ -187 +233 @@
         }
 
+        /*
+         * This tells us that the pipe is owned by a privileged
+         * process, as we will be sending passwords to it.
+         */
         if (!S_ISDIR(st.st_mode) ||
-            (st.st_uid != 0 && st.st_uid != geteuid())) {
+            !winbind_privileged_pipe_is_root(st.st_uid)) {
                 errno = ENOENT;
                 return -1;
@@ -195 +245 @@
         /* Connect to socket */
 
-        if (asprintf(&path, "%s/%s", dir, WINBINDD_SOCKET_NAME) < 0) {
-                return -1;
-        }
-
-        ZERO_STRUCT(sunaddr);
-        sunaddr.sun_family = AF_UNIX;
-        strncpy(sunaddr.sun_path, path, sizeof(sunaddr.sun_path) - 1);
+        sunaddr = (struct sockaddr_un) { .sun_family = AF_UNIX };
+
+        ret = snprintf(sunaddr.sun_path, sizeof(sunaddr.sun_path),
+                       "%s/%s", dir, WINBINDD_SOCKET_NAME);
+        if ((ret == -1) || (ret >= sizeof(sunaddr.sun_path))) {
+                errno = ENAMETOOLONG;
+                return -1;
+        }
 
         /* If socket file doesn't exist, don't bother trying to connect
@@ -207 +258 @@
            the winbindd daemon is not running. */
 
-        if (lstat(path, &st) == -1) {
+        if (lstat(sunaddr.sun_path, &st) == -1) {
                 errno = ENOENT;
-                SAFE_FREE(path);
-                return -1;
-        }
-
-        SAFE_FREE(path);
+                return -1;
+        }
+
         /* Check permissions on unix socket file */
 
+        /*
+         * This tells us that the pipe is owned by a privileged
+         * process, as we will be sending passwords to it.
+         */
         if (!S_ISSOCK(st.st_mode) ||
-            (st.st_uid != 0 && st.st_uid != geteuid())) {
+            !winbind_privileged_pipe_is_root(st.st_uid)) {
                 errno = ENOENT;
                 return -1;
@@ -237 +290 @@
                         wait_time += slept) {
                 struct pollfd pfd;
-                int ret;
                 int connect_errno = 0;
                 socklen_t errnosize;
@@ -287 +339 @@
 static const char *winbindd_socket_dir(void)
 {
-#ifdef SOCKET_WRAPPER
-        const char *env_dir;
-
-        env_dir = getenv(WINBINDD_SOCKET_DIR_ENVVAR);
-        if (env_dir) {
-                return env_dir;
-        }
-#endif
+        if (nss_wrapper_enabled()) {
+                const char *env_dir;
+
+                env_dir = getenv("SELFTEST_WINBINDD_SOCKET_DIR");
+                if (env_dir != NULL) {
+                        return env_dir;
+                }
+        }
 
         return WINBINDD_SOCKET_DIR;
@@ -301 +353 @@
 /* Connect to winbindd socket */
 
-static int winbind_open_pipe_sock(int recursing, int need_priv)
+static int winbind_open_pipe_sock(struct winbindd_context *ctx,
+                                  int recursing, int need_priv)
 {
 #ifdef HAVE_UNIXSOCKET
-        static pid_t our_pid;
         struct winbindd_request request;
         struct winbindd_response response;
+
         ZERO_STRUCT(request);
         ZERO_STRUCT(response);
 
-        if (our_pid != getpid()) {
-                winbind_close_sock();
-                our_pid = getpid();
-        }
-
-        if ((need_priv != 0) && (is_privileged == 0)) {
-                winbind_close_sock();
-        }
-
-        if (winbindd_fd != -1) {
-                return winbindd_fd;
+        if (!ctx) {
+                return -1;
+        }
+
+        if (ctx->our_pid != getpid()) {
+                winbind_close_sock(ctx);
+                ctx->our_pid = getpid();
+        }
+
+        if ((need_priv != 0) && (ctx->is_privileged == 0)) {
+                winbind_close_sock(ctx);
+        }
+
+        if (ctx->winbindd_fd != -1) {
+                return ctx->winbindd_fd;
         }
 
@@ -327 +384 @@
         }
 
-        if ((winbindd_fd = winbind_named_pipe_sock(winbindd_socket_dir())) == -1) {
-                return -1;
-        }
-
-        is_privileged = 0;
+        ctx->winbindd_fd = winbind_named_pipe_sock(winbindd_socket_dir());
+
+        if (ctx->winbindd_fd == -1) {
+                return -1;
+        }
+
+        ctx->is_privileged = 0;
 
         /* version-check the socket */
 
         request.wb_flags = WBFLAG_RECURSE;
-        if ((winbindd_request_response(WINBINDD_INTERFACE_VERSION, &request, &response) != NSS_STATUS_SUCCESS) || (response.data.interface_version != WINBIND_INTERFACE_VERSION)) {
-                winbind_close_sock();
+        if ((winbindd_request_response(ctx, WINBINDD_INTERFACE_VERSION, &request,
+                                       &response) != NSS_STATUS_SUCCESS) ||
+            (response.data.interface_version != WINBIND_INTERFACE_VERSION)) {
+                winbind_close_sock(ctx);
                 return -1;
         }
@@ -344 +405 @@
 
         request.wb_flags = WBFLAG_RECURSE;
-        if (winbindd_request_response(WINBINDD_PRIV_PIPE_DIR, &request, &response) == NSS_STATUS_SUCCESS) {
+
+        /* Note that response needs to be initialized to avoid
+         * crashing on clean up after WINBINDD_PRIV_PIPE_DIR call failed
+         * as interface version (from the first request) returned as a fstring,
+         * thus response.extra_data.data will not be NULL even though
+         * winbindd response did not write over it due to a failure */
+        ZERO_STRUCT(response);
+        if (winbindd_request_response(ctx, WINBINDD_PRIV_PIPE_DIR, &request,
+                                      &response) == NSS_STATUS_SUCCESS) {
                 int fd;
-                if ((fd = winbind_named_pipe_sock((char *)response.extra_data.data)) != -1) {
-                        close(winbindd_fd);
-                        winbindd_fd = fd;
-                        is_privileged = 1;
-                }
-        }
-
-        if ((need_priv != 0) && (is_privileged == 0)) {
+                fd = winbind_named_pipe_sock((char *)response.extra_data.data);
+                if (fd != -1) {
+                        close(ctx->winbindd_fd);
+                        ctx->winbindd_fd = fd;
+                        ctx->is_privileged = 1;
+                }
+        }
+
+        if ((need_priv != 0) && (ctx->is_privileged == 0)) {
                 return -1;
         }
@@ -359 +429 @@
         SAFE_FREE(response.extra_data.data);
 
-        return winbindd_fd;
+        return ctx->winbindd_fd;
 #else
         return -1;
@@ -367 +437 @@
 /* Write data to winbindd socket */
 
-static int winbind_write_sock(void *buffer, int count, int recursing,
-                              int need_priv)
-{
-        int result, nwritten;
+static int winbind_write_sock(struct winbindd_context *ctx, void *buffer,
+                              int count, int recursing, int need_priv)
+{
+        int fd, result, nwritten;
 
         /* Open connection to winbind daemon */
@@ -376 +446 @@
  restart:
 
-        if (winbind_open_pipe_sock(recursing, need_priv) == -1) {
+        fd = winbind_open_pipe_sock(ctx, recursing, need_priv);
+        if (fd == -1) {
                 errno = ENOENT;
                 return -1;
@@ -392 +463 @@
                    call would not block by calling poll(). */
 
-                pfd.fd = winbindd_fd;
+                pfd.fd = fd;
                 pfd.events = POLLIN|POLLOUT|POLLHUP;
 
                 ret = poll(&pfd, 1, -1);
                 if (ret == -1) {
-                        winbind_close_sock();
+                        winbind_close_sock(ctx);
                         return -1;                   /* poll error */
                 }
@@ -407 +478 @@
                         /* Pipe has closed on remote end */
 
-                        winbind_close_sock();
+                        winbind_close_sock(ctx);
                         goto restart;
                 }
@@ -413 +484 @@
                 /* Do the write */
 
-                result = write(winbindd_fd,
-                               (char *)buffer + nwritten,
+                result = write(fd, (char *)buffer + nwritten,
                                count - nwritten);
 
@@ -421 +491 @@
                         /* Write failed */
 
-                        winbind_close_sock();
+                        winbind_close_sock(ctx);
                         return -1;
                 }
@@ -433 +503 @@
 /* Read data from winbindd socket */
 
-static int winbind_read_sock(void *buffer, int count)
-{
+static int winbind_read_sock(struct winbindd_context *ctx,
+                             void *buffer, int count)
+{
+        int fd;
         int nread = 0;
         int total_time = 0;
 
-        if (winbindd_fd == -1) {
+        fd = winbind_open_pipe_sock(ctx, false, false);
+        if (fd == -1) {
                 return -1;
         }
@@ -450 +523 @@
                    call would not block by calling poll(). */
 
-                pfd.fd = winbindd_fd;
+                pfd.fd = fd;
                 pfd.events = POLLIN|POLLHUP;
 
@@ -457 +530 @@
                 ret = poll(&pfd, 1, 5000);
                 if (ret == -1) {
-                        winbind_close_sock();
+                        winbind_close_sock(ctx);
                         return -1;                   /* poll error */
                 }
@@ -463 +536 @@
                 if (ret == 0) {
                         /* Not ready for read yet... */
-                        if (total_time >= 30) {
+                        if (total_time >= 300) {
                                 /* Timeout */
-                                winbind_close_sock();
+                                winbind_close_sock(ctx);
                                 return -1;
                         }
@@ -476 +549 @@
                         /* Do the Read */
 
-                        int result = read(winbindd_fd, (char *)buffer + nread,
+                        int result = read(fd, (char *)buffer + nread,
                               count - nread);
 
@@ -485 +558 @@
                                    transaction has failed half way through. */
 
-                                winbind_close_sock();
+                                winbind_close_sock(ctx);
                                 return -1;
                         }
@@ -499 +572 @@
 /* Read reply */
 
-static int winbindd_read_reply(struct winbindd_response *response)
+static int winbindd_read_reply(struct winbindd_context *ctx,
+                               struct winbindd_response *response)
 {
         int result1, result2 = 0;
@@ -509 +583 @@
         /* Read fixed length response */
 
-        result1 = winbind_read_sock(response,
+        result1 = winbind_read_sock(ctx, response,
                                     sizeof(struct winbindd_response));
-        if (result1 == -1) {
-                return -1;
-        }
-
-        if (response->length < sizeof(struct winbindd_response)) {
-                return -1;
-        }
 
         /* We actually send the pointer value of the extra_data field from
@@ -525 +592 @@
         response->extra_data.data = NULL;
 
+        if (result1 == -1) {
+                return -1;
+        }
+
+        if (response->length < sizeof(struct winbindd_response)) {
+                return -1;
+        }
+
         /* Read variable length response */
 
@@ -537 +612 @@
                 }
 
-                result2 = winbind_read_sock(response->extra_data.data,
+                result2 = winbind_read_sock(ctx, response->extra_data.data,
                                             extra_data_len);
                 if (result2 == -1) {
@@ -554 +629 @@
  */
 
-NSS_STATUS winbindd_send_request(int req_type, int need_priv,
+NSS_STATUS winbindd_send_request(struct winbindd_context *ctx,
+                                 int req_type, int need_priv,
                                  struct winbindd_request *request)
 {
@@ -574 +650 @@
         winbindd_init_request(request, req_type);
 
-        if (winbind_write_sock(request, sizeof(*request),
+        if (winbind_write_sock(ctx, request, sizeof(*request),
                                request->wb_flags & WBFLAG_RECURSE,
                                need_priv) == -1)
@@ -585 +661 @@
 
         if ((request->extra_len != 0) &&
-            (winbind_write_sock(request->extra_data.data,
+            (winbind_write_sock(ctx, request->extra_data.data,
                                 request->extra_len,
                                 request->wb_flags & WBFLAG_RECURSE,
@@ -603 +679 @@
  */
 
-NSS_STATUS winbindd_get_response(struct winbindd_response *response)
+NSS_STATUS winbindd_get_response(struct winbindd_context *ctx,
+                                 struct winbindd_response *response)
 {
         struct winbindd_response lresponse;
@@ -615 +692 @@
 
         /* Wait for reply */
-        if (winbindd_read_reply(response) == -1) {
+        if (winbindd_read_reply(ctx, response) == -1) {
                 /* Set ENOENT for consistency.  Required by some apps */
                 errno = ENOENT;
@@ -637 +714 @@
 /* Handle simple types of requests */
 
-NSS_STATUS winbindd_request_response(int req_type,
-                            struct winbindd_request *request,
-                            struct winbindd_response *response)
+NSS_STATUS winbindd_request_response(struct winbindd_context *ctx,
+                                     int req_type,
+                                     struct winbindd_request *request,
+                                     struct winbindd_response *response)
 {
         NSS_STATUS status = NSS_STATUS_UNAVAIL;
-        int count = 0;
-
-        while ((status == NSS_STATUS_UNAVAIL) && (count < 10)) {
-                status = winbindd_send_request(req_type, 0, request);
-                if (status != NSS_STATUS_SUCCESS)
-                        return(status);
-                status = winbindd_get_response(response);
-                count += 1;
-        }
+        struct winbindd_context *wb_ctx = ctx;
+
+        if (ctx == NULL) {
+                wb_ctx = &wb_global_ctx;
+        }
+
+        status = winbindd_send_request(wb_ctx, req_type, 0, request);
+        if (status != NSS_STATUS_SUCCESS)
+                return (status);
+        status = winbindd_get_response(wb_ctx, response);
 
         return status;
 }
 
-NSS_STATUS winbindd_priv_request_response(int req_type,
+NSS_STATUS winbindd_priv_request_response(struct winbindd_context *ctx,
+                                          int req_type,
                                           struct winbindd_request *request,
                                           struct winbindd_response *response)
 {
         NSS_STATUS status = NSS_STATUS_UNAVAIL;
-        int count = 0;
-
-        while ((status == NSS_STATUS_UNAVAIL) && (count < 10)) {
-                status = winbindd_send_request(req_type, 1, request);
-                if (status != NSS_STATUS_SUCCESS)
-                        return(status);
-                status = winbindd_get_response(response);
-                count += 1;
-        }
+        struct winbindd_context *wb_ctx = ctx;
+
+        if (ctx == NULL) {
+                wb_ctx = &wb_global_ctx;
+        }
+
+        status = winbindd_send_request(wb_ctx, req_type, 1, request);
+        if (status != NSS_STATUS_SUCCESS)
+                return (status);
+        status = winbindd_get_response(wb_ctx, response);
 
         return status;
 }
+
+/* Create and free winbindd context */
+
+struct winbindd_context *winbindd_ctx_create(void)
+{
+        struct winbindd_context *ctx;
+
+        ctx = calloc(1, sizeof(struct winbindd_context));
+
+        if (!ctx) {
+                return NULL;
+        }
+
+        ctx->winbindd_fd = -1;
+
+        return ctx;
+}
+
+void winbindd_ctx_free(struct winbindd_context *ctx)
+{
+        winbind_close_sock(ctx);
+        free(ctx);
+}

vendor/current/nsswitch/wbinfo.c

@@ -23 +23 @@
 
 #include "includes.h"
-#include "popt_common.h"
 #include "winbind_client.h"
 #include "libwbclient/wbclient.h"
-#include "lib/popt/popt.h"
 #include "../libcli/auth/libcli_auth.h"
-#if (_SAMBA_BUILD_) >= 4
 #include "lib/cmdline/popt_common.h"
-#endif
+#include "lib/afs/afs_settoken.h"
 
 #ifdef DBGC_CLASS
@@ -121 +118 @@
         if (!p) {
                 /* Maybe it was a UPN? */
-                if ((p = strchr(domuser, '@')) != NULL) {
+                p = strchr(domuser, '@');
+                if (p != NULL) {
                         fstrcpy(domain, "");
                         fstrcpy(user, domuser);
@@ -135 +133 @@
         fstrcpy(domain, domuser);
         domain[PTR_DIFF(p, domuser)] = 0;
-        strupper_m(domain);
 
         return true;
@@ -243 +240 @@
                  pwd->pw_shell);
 
+        wbcFreeMemory(pwd);
+
         return true;
 }
@@ -520 +519 @@
 
         if (print_all) {
-                d_printf("%-16s%-24s%-12s%-12s%-5s%-5s\n",
+                d_printf("%-16s%-65s%-12s%-12s%-5s%-5s\n",
                          "Domain Name", "DNS Domain", "Trust Type",
                          "Transitive", "In", "Out");
@@ -534 +533 @@
                 }
 
-                d_printf("%-24s", domain_list[i].dns_name);
+                d_printf("%-65s", domain_list[i].dns_name);
 
                 switch(domain_list[i].trust_type) {
@@ -690 +689 @@
         /* Send request */
 
-        if (winbindd_request_response(WINBINDD_GETDCNAME, &request,
+        if (winbindd_request_response(NULL, WINBINDD_GETDCNAME, &request,
                                       &response) != NSS_STATUS_SUCCESS) {
                 d_fprintf(stderr, "Could not get dc name for %s\n",domain_name);
@@ -754 +753 @@
 
         if (wbc_status == WBC_ERR_AUTH_ERROR) {
-                d_fprintf(stderr, "error code was %s (0x%x)\n",
-                          error->nt_string, error->nt_status);
+                d_fprintf(stderr, "wbcCheckTrustCredentials(%s): error code was %s (0x%x)\n",
+                          domain_name, error->nt_string, error->nt_status);
                 wbcFreeMemory(error);
         }
@@ -813 +812 @@
 
         if (wbc_status == WBC_ERR_AUTH_ERROR) {
-                d_fprintf(stderr, "error code was %s (0x%x)\n",
-                          error->nt_string, error->nt_status);
+                d_fprintf(stderr, "wbcChangeTrustCredentials(%s): error code was %s (0x%x)\n",
+                          domain_name, error->nt_string, error->nt_status);
                 wbcFreeMemory(error);
         }
@@ -828 +827 @@
 /* Check DC connection */
 
-static bool wbinfo_ping_dc(void)
+static bool wbinfo_ping_dc(const char *domain)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
         struct wbcAuthErrorInfo *error = NULL;
-
-        wbc_status = wbcPingDc(NULL, &error);
-
-        d_printf("checking the NETLOGON dc connection %s\n",
+        char *dcname = NULL;
+
+        const char *domain_name;
+
+        if (domain) {
+                domain_name = domain;
+        } else {
+                domain_name = get_winbind_domain();
+        }
+
+        wbc_status = wbcPingDc2(domain_name, &error, &dcname);
+
+        d_printf("checking the NETLOGON for domain[%s] dc connection to \"%s\" %s\n",
+                 domain_name ? domain_name : "",
+                 dcname ? dcname : "",
                  WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
 
+        wbcFreeMemory(dcname);
         if (wbc_status == WBC_ERR_AUTH_ERROR) {
-                d_fprintf(stderr, "error code was %s (0x%x)\n",
-                          error->nt_string, error->nt_status);
+                d_fprintf(stderr, "wbcPingDc2(%s): error code was %s (0x%x)\n",
+                          domain_name, error->nt_string, error->nt_status);
                 wbcFreeMemory(error);
+                return false;
         }
         if (!WBC_ERROR_IS_OK(wbc_status)) {
@@ -1020 +1032 @@
                         d_printf("%s -> gid %d\n", sidstr, unix_ids[i].id.gid);
                         break;
+                case WBC_ID_TYPE_BOTH:
+                        d_printf("%s -> uid/gid %d\n", sidstr, unix_ids[i].id.uid);
+                        break;
                 default:
                         d_printf("%s -> unmapped\n", sidstr);
@@ -1218 +1233 @@
         /* Display response */
 
-        d_printf("%s%c%s %d\n",
-                 domain, winbind_separator(), name, type);
+        if (type == WBC_SID_NAME_DOMAIN) {
+                d_printf("%s %d\n", domain, type);
+        } else {
+                d_printf("%s%c%s %d\n",
+                         domain, winbind_separator(), name, type);
+        }
+
+        wbcFreeMemory(domain);
+        wbcFreeMemory(name);
 
         return true;
@@ -1254 +1276 @@
         d_printf("%s%c%s %d\n",
                  domain, winbind_separator(), name, type);
+
+        wbcFreeMemory(domain);
+        wbcFreeMemory(name);
 
         return true;
@@ -1314 +1339 @@
 
         wbc_status = wbcLookupRids(&dinfo->sid, num_rids, rids,
-                                   (const char **)&domain_name, &names, &types);
+                                   &p, &names, &types);
         if (!WBC_ERROR_IS_OK(wbc_status)) {
                 d_printf("winbind_lookup_rids failed: %s\n",
@@ -1321 +1346 @@
         }
 
+        domain_name = discard_const_p(char, p);
         d_printf("Domain: %s\n", domain_name);
 
@@ -1395 +1421 @@
                 if (names[i].type == WBC_SID_NAME_DOMAIN) {
                         d_printf("%s -> %s %d\n", sidstr,
-                                domain,
-                                names[i].type);
+                                 domain,
+                                 names[i].type);
                 } else {
                         d_printf("%s -> %s%c%s %d\n", sidstr,
-                                domain,
-                                winbind_separator(),
-                                names[i].name, names[i].type);
-                }
-        }
+                                 domain,
+                                 winbind_separator(),
+                                 names[i].name, names[i].type);
+                }
+        }
+        wbcFreeMemory(names);
+        wbcFreeMemory(domains);
         return true;
 }
@@ -1445 +1473 @@
 {
         char *prompt;
-        const char *ret = NULL;
+        char buf[1024] = {0};
+        int rc;
 
         prompt = talloc_asprintf(mem_ctx, "Enter %s's ", username);
@@ -1462 +1491 @@
         }
 
-        ret = getpass(prompt);
+        rc = samba_getpass(prompt, buf, sizeof(buf), false, false);
         TALLOC_FREE(prompt);
-
-        return talloc_strdup(mem_ctx, ret);
+        if (rc < 0) {
+                return NULL;
+        }
+
+        return talloc_strdup(mem_ctx, buf);
 }
 
@@ -1553 +1585 @@
         if (error) {
                 d_fprintf(stderr,
-                         "error code was %s (0x%x)\nerror message was: %s\n",
-                         error->nt_string,
+                         "wbcLogonUser(%s): error code was %s (0x%x)\n"
+                         "error message was: %s\n",
+                         params.username, error->nt_string,
                          error->nt_status,
                          error->display_string);
@@ -1725 +1758 @@
         if (wbc_status == WBC_ERR_AUTH_ERROR) {
                 d_fprintf(stderr,
-                         "error code was %s (0x%x)\nerror message was: %s\n",
+                         "wbcAuthenticateUserEx(%s%c%s): error code was %s (0x%x)\n"
+                         "error message was: %s\n",
+                         name_domain,
+                         winbind_separator(),
+                         name_user,
                          err->nt_string,
                          err->nt_status,
@@ -1742 +1779 @@
 /* Authenticate a user with a plaintext password */
 
-static bool wbinfo_pam_logon(char *username)
+static bool wbinfo_pam_logon(char *username, bool verbose)
 {
         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
         struct wbcLogonUserParams params;
+        struct wbcLogonUserInfo *info = NULL;
         struct wbcAuthErrorInfo *error = NULL;
         char *s = NULL;
@@ -1790 +1828 @@
         }
 
-        wbc_status = wbcLogonUser(&params, NULL, &error, NULL);
+        wbc_status = wbcLogonUser(&params, &info, &error, NULL);
+
+        if (verbose && (info != NULL)) {
+                struct wbcAuthUserInfo *i = info->info;
+                uint32_t j;
+
+                if (i->account_name != NULL) {
+                        d_printf("account_name: %s\n", i->account_name);
+                }
+                if (i->user_principal != NULL) {
+                        d_printf("user_principal: %s\n", i->user_principal);
+                }
+                if (i->full_name != NULL) {
+                        d_printf("full_name: %s\n", i->full_name);
+                }
+                if (i->domain_name != NULL) {
+                        d_printf("domain_name: %s\n", i->domain_name);
+                }
+                if (i->dns_domain_name != NULL) {
+                        d_printf("dns_domain_name: %s\n", i->dns_domain_name);
+                }
+                if (i->logon_server != NULL) {
+                        d_printf("logon_server: %s\n", i->logon_server);
+                }
+                if (i->logon_script != NULL) {
+                        d_printf("logon_script: %s\n", i->logon_script);
+                }
+                if (i->profile_path != NULL) {
+                        d_printf("profile_path: %s\n", i->profile_path);
+                }
+                if (i->home_directory != NULL) {
+                        d_printf("home_directory: %s\n", i->home_directory);
+                }
+                if (i->home_drive != NULL) {
+                        d_printf("home_drive: %s\n", i->home_drive);
+                }
+
+                d_printf("sids:");
+
+                for (j=0; j<i->num_sids; j++) {
+                        char buf[WBC_SID_STRING_BUFLEN];
+                        wbcSidToStringBuf(&i->sids[j].sid, buf, sizeof(buf));
+                        d_printf(" %s", buf);
+                }
+                d_printf("\n");
+
+                wbcFreeMemory(info);
+                info = NULL;
+        }
 
         wbcFreeMemory(params.blobs);
@@ -1799 +1885 @@
         if (!WBC_ERROR_IS_OK(wbc_status) && (error != NULL)) {
                 d_fprintf(stderr,
-                          "error code was %s (0x%x)\nerror message was: %s\n",
+                          "wbcLogonUser(%s): error code was %s (0x%x)\n"
+                          "error message was: %s\n",
+                          params.username,
                           error->nt_string,
                           (int)error->nt_status,
@@ -1869 +1957 @@
         } else {
                 fstrcpy(request.data.auth.user, username);
-                fstrcpy(request.data.auth.pass, getpass("Password: "));
+                (void) samba_getpass("Password: ",
+                                     request.data.auth.pass,
+                                     sizeof(request.data.auth.pass),
+                                     false, false);
         }
 
         request.flags |= WBFLAG_PAM_AFS_TOKEN;
 
-        result = winbindd_request_response(WINBINDD_PAM_AUTH, &request,
+        result = winbindd_request_response(NULL, WINBINDD_PAM_AUTH, &request,
                                            &response);
 
@@ -1924 +2015 @@
         /* Send request to winbind daemon */
 
-        /* '.' is the special sign for our own domain */
-        if (domain && strcmp(domain, ".") == 0) {
+        if (domain == NULL) {
                 domain = get_winbind_domain();
+        } else {
+                /* '.' is the special sign for our own domain */
+                if ((domain[0] == '\0') || strcmp(domain, ".") == 0) {
+                        domain = get_winbind_domain();
+                /* '*' is the special sign for all domains */
+                } else if (strcmp(domain, "*") == 0) {
+                        domain = NULL;
+                }
         }
 
@@ -1954 +2052 @@
         /* Send request to winbind daemon */
 
-        /* '.' is the special sign for our own domain */
-        if (domain && strcmp(domain, ".") == 0) {
+        if (domain == NULL) {
                 domain = get_winbind_domain();
+        } else {
+                /* '.' is the special sign for our own domain */
+                if ((domain[0] == '\0') || strcmp(domain, ".") == 0) {
+                        domain = get_winbind_domain();
+                /* '*' is the special sign for all domains */
+                } else if (strcmp(domain, "*") == 0) {
+                        domain = NULL;
+                }
         }
 
@@ -2062 +2167 @@
         OPT_LOGOFF_USER,
         OPT_LOGOFF_UID,
-        OPT_LANMAN
+        OPT_LANMAN,
+        OPT_KRB5CCNAME
 };
 
-int main(int argc, char **argv, char **envp)
+int main(int argc, const char **argv, char **envp)
 {
         int opt;
@@ -2081 +2187 @@
         char *logoff_user = getenv("USER");
         int logoff_uid = geteuid();
+        const char *opt_krb5ccname = "FILE";
 
         struct poptOption long_options[] = {
@@ -2162 +2269 @@
                         /* destroys wbinfo --help output */
                         /* "user%password,DOM\\user%password,user@EXAMPLE.COM,EXAMPLE.COM\\user%password" }, */
+                { "krb5ccname", 0, POPT_ARG_STRING, &opt_krb5ccname, OPT_KRB5CCNAME, "authenticate user using Kerberos and specific credential cache type", "krb5ccname" },
 #endif
                 { "separator", 0, POPT_ARG_NONE, 0, OPT_SEPARATOR, "Get the active winbind separator", NULL },
@@ -2173 +2281 @@
 
         /* Samba client initialisation */
-        load_case_tables();
+        smb_init_locale();
 
 
         /* Parse options */
 
-        pc = poptGetContext("wbinfo", argc, (const char **)argv,
+        pc = poptGetContext("wbinfo", argc, argv,
                             long_options, 0);
 
@@ -2382 +2490 @@
                         break;
                 case 'P':
-                        if (!wbinfo_ping_dc()) {
-                                d_fprintf(stderr, "Could not ping our DC\n");
+                        if (!wbinfo_ping_dc(opt_domain_name)) {
                                 goto done;
                         }
@@ -2509 +2616 @@
                         }
                 case OPT_PAM_LOGON:
-                        if (!wbinfo_pam_logon(string_arg)) {
+                        if (!wbinfo_pam_logon(string_arg, verbose)) {
                                 d_fprintf(stderr, "pam_logon failed for %s\n",
                                           string_arg);
@@ -2532 +2639 @@
                                                  WBFLAG_PAM_CONTACT_TRUSTDOM;
 
-                                if (!wbinfo_auth_krb5(string_arg, "FILE",
+                                if (!wbinfo_auth_krb5(string_arg, opt_krb5ccname,
                                                       flags)) {
                                         d_fprintf(stderr,
@@ -2538 +2645 @@
                                                 "[%s] with Kerberos "
                                                 "(ccache: %s)\n", string_arg,
-                                                "FILE");
+                                                opt_krb5ccname);
                                         goto done;
                                 }
@@ -2618 +2725 @@
                 case OPT_LOGOFF_USER:
                 case OPT_LOGOFF_UID:
+                case OPT_KRB5CCNAME:
                         break;
                 default:

vendor/current/nsswitch/winbind_client.h

@@ -7 +7 @@
    Copyright (C) Andrew Tridgell 2000
    Copyright (C) Andrew Bartlett 2002
+   Copyright (C) Matthew Newton 2015
 
 
@@ -29 +30 @@
 #include "winbind_struct_protocol.h"
 
+struct winbindd_context;
+
+struct winbindd_context *winbindd_ctx_create(void);
+void winbindd_ctx_free(struct winbindd_context *ctx);
+
 void winbindd_free_response(struct winbindd_response *response);
-NSS_STATUS winbindd_send_request(int req_type, int need_priv,
+NSS_STATUS winbindd_send_request(struct winbindd_context *ctx,
+                                 int req_type, int need_priv,
                                  struct winbindd_request *request);
-NSS_STATUS winbindd_get_response(struct winbindd_response *response);
-NSS_STATUS winbindd_request_response(int req_type,
-                            struct winbindd_request *request,
-                            struct winbindd_response *response);
-NSS_STATUS winbindd_priv_request_response(int req_type,
+NSS_STATUS winbindd_get_response(struct winbindd_context *ctx,
+                                 struct winbindd_response *response);
+NSS_STATUS winbindd_request_response(struct winbindd_context *ctx,
+                                     int req_type,
+                                     struct winbindd_request *request,
+                                     struct winbindd_response *response);
+NSS_STATUS winbindd_priv_request_response(struct winbindd_context *ctx,
+                                          int req_type,
                                           struct winbindd_request *request,
                                           struct winbindd_response *response);
+
 #define winbind_env_set() \
         (strcmp(getenv(WINBINDD_DONT_ENV)?getenv(WINBINDD_DONT_ENV):"0","1") == 0)

vendor/current/nsswitch/winbind_krb5_locator.c

@@ -143 +143 @@
                 case AF_UNSPEC:
                 case AF_INET:
-                        break;
 #if defined(HAVE_IPV6)
                 case AF_INET6:
-                        break;
-#endif
+#endif
+                        break;
                 default:
                         return EINVAL;

vendor/current/nsswitch/winbind_nss_aix.c

@@ -280 +280 @@
         request.data.gid = gid;
 
-        ret = winbindd_request_response(WINBINDD_GETGRGID, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_GETGRGID,
+                                        &request, &response);
 
         logit("getgrgid ret=%d\n", ret);
@@ -312 +313 @@
         STRCPY_RETNULL(request.data.groupname, name);
 
-        ret = winbindd_request_response(WINBINDD_GETGRNAM, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_GETGRNAM,
+                                        &request, &response);
 
         HANDLE_ERRORS(ret);
@@ -371 +373 @@
         }
 
-        ret = winbindd_request_response(WINBINDD_GETGROUPS, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_GETGROUPS,
+                                        &request, &response);
 
         HANDLE_ERRORS(ret);
@@ -410 +413 @@
         request.data.uid = uid;
 
-        ret = winbindd_request_response(WINBINDD_GETPWUID, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_GETPWUID,
+                                        &request, &response);
 
         HANDLE_ERRORS(ret);
@@ -443 +447 @@
         STRCPY_RETNULL(request.data.username, name);
 
-        ret = winbindd_request_response(WINBINDD_GETPWNAM, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_GETPWNAM,
+                                        &request, &response);
 
         HANDLE_ERRORS(ret);
@@ -476 +481 @@
         ZERO_STRUCT(response);
 
-        ret = winbindd_request_response(WINBINDD_LIST_USERS, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_LIST_USERS,
+                                        &request, &response);
         if (ret != 0) {
                 errno = EINVAL;
@@ -524 +530 @@
         ZERO_STRUCT(response);
 
-        ret = winbindd_request_response(WINBINDD_LIST_GROUPS, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_LIST_GROUPS,
+                                        &request, &response);
         if (ret != 0) {
                 errno = EINVAL;
@@ -603 +610 @@
         request.data.uid = pwd->pw_uid;
 
-        if (winbindd_request_response(WINBINDD_UID_TO_SID, &request, &response) !=
+        if (winbindd_request_response(NULL, WINBINDD_UID_TO_SID,
+                                      &request, &response) !=
             NSS_STATUS_SUCCESS) {
                 r.attr_flag = ENOENT;
@@ -889 +897 @@
         }
 
-        result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
+        result = winbindd_request_response(NULL, WINBINDD_PAM_AUTH,
+                                           &request, &response);
 
         winbindd_free_response(&response);
@@ -938 +947 @@
         }
 
-        result = winbindd_request_response(WINBINDD_PAM_CHAUTHTOK, &request, &response);
+        result = winbindd_request_response(NULL, WINBINDD_PAM_CHAUTHTOK,
+                                           &request, &response);
 
         winbindd_free_response(&response);

vendor/current/nsswitch/winbind_nss_config.h

@@ -28 +28 @@
 #endif
 
-/*
- * we don't need socket wrapper
- * nor nss wrapper here and we don't
- * want to depend on swrap_close()
- * so we better disable both
- */
-#define SOCKET_WRAPPER_NOT_REPLACE
-#define NSS_WRAPPER_NOT_REPLACE
-
 /* Include header files from data in config.h file */
 
@@ -55 +46 @@
 #define FSTRING_LEN 256
 typedef char fstring[FSTRING_LEN];
-#define fstrcpy(d,s) safe_strcpy((d),(s),sizeof(fstring)-1)
+#ifndef fstrcpy
+#define fstrcpy(d,s) \
+do { \
+        const char *_fstrcpy_src = (const char *)(s); \
+        strlcpy((d),_fstrcpy_src ? _fstrcpy_src : "",sizeof(fstring)); \
+} while (0)
+#endif
 #endif
 

vendor/current/nsswitch/winbind_nss_freebsd.c

@@ -6 +6 @@
 
    Copyright (C) Aaron Collins 2003
+   Copyright (C) Timur I. Bakeyev 2013
 
    This library is free software; you can redistribute it and/or
@@ -24 +25 @@
 
 /* Make sure that the module gets registered needed by freebsd 5.1 */
-
 extern enum nss_status _nss_winbind_getgrent_r(struct group *, char *, size_t,
     int *);
@@ -33 +33 @@
 extern enum nss_status _nss_winbind_setgrent(void);
 extern enum nss_status _nss_winbind_endgrent(void);
+extern enum nss_status _nss_winbind_initgroups_dyn(char *, gid_t, long int *,
+    long int *, gid_t **, long int , int *);
 
 extern enum nss_status _nss_winbind_getpwent_r(struct passwd *, char *, size_t,
@@ -42 +44 @@
 extern enum nss_status _nss_winbind_setpwent(void);
 extern enum nss_status _nss_winbind_endpwent(void);
+ns_mtab *nss_module_register(const char *, unsigned int *, nss_module_unregister_fn *);
 
 NSS_METHOD_PROTOTYPE(__nss_compat_getgrnam_r);
@@ -54 +57 @@
 NSS_METHOD_PROTOTYPE(__nss_compat_setpwent);
 NSS_METHOD_PROTOTYPE(__nss_compat_endpwent);
+NSS_METHOD_PROTOTYPE(__nss_compat_endpwent);
+
+NSS_METHOD_PROTOTYPE(__freebsd_getgroupmembership);
 
 static ns_mtab methods[] = {
@@ -61 +67 @@
 { NSDB_GROUP, "setgrent",   __nss_compat_setgrent,   _nss_winbind_setgrent },
 { NSDB_GROUP, "endgrent",   __nss_compat_endgrent,   _nss_winbind_endgrent },
+{ NSDB_GROUP, "getgroupmembership", __freebsd_getgroupmembership, NULL },
 
 { NSDB_PASSWD, "getpwnam_r", __nss_compat_getpwnam_r, _nss_winbind_getpwnam_r },
@@ -70 +77 @@
 };
 
+/* Taken from libc */
+static int
+gr_addgid(gid_t gid, gid_t *groups, int maxgrp, int *grpcnt)
+{
+        int     ret, dupc;
+
+        /* skip duplicates */
+        for (dupc = 0; dupc < MIN(maxgrp, *grpcnt); dupc++) {
+                if (groups[dupc] == gid)
+                        return 1;
+        }
+
+        ret = 1;
+        if (*grpcnt < maxgrp)                   /* add this gid */
+                groups[*grpcnt] = gid;
+        else
+                ret = 0;
+
+        (*grpcnt)++;
+
+        return ret;
+}
+
+/*
+    rv = _nsdispatch(NULL, dtab, NSDB_GROUP, "getgroupmembership",
+                    defaultsrc, uname, agroup, groups, maxgrp, grpcnt);
+*/
+
+int
+__freebsd_getgroupmembership(void *retval, void *mdata, va_list ap)
+{
+        const char      *uname  = va_arg(ap, const char *);
+        gid_t            group  = va_arg(ap, gid_t);
+        gid_t           *groups = va_arg(ap, gid_t *);
+        int              maxgrp = va_arg(ap, int);
+        int             *groupc = va_arg(ap, int *);
+
+        NSS_STATUS ret;
+        long int lcount, lsize;
+        int i, errnop;
+        gid_t *tmpgroups;
+
+        /* Can be realloc() inside _nss_winbind_initgroups_dyn() */
+        if ((tmpgroups=calloc(maxgrp, sizeof(gid_t))) == NULL) {
+                errno = ENOMEM;
+                return NS_TRYAGAIN;
+        }
+
+        lcount = 0;
+        lsize = maxgrp;
+        /* insert primary membership(possibly already there) */
+        gr_addgid(group, groups, maxgrp, groupc);
+        /* Don't limit number of groups, we want to know total size */
+        ret = _nss_winbind_initgroups_dyn(uname, group, &lcount, &lsize,
+                &tmpgroups, 0, &errnop);
+        if (ret == NSS_STATUS_SUCCESS) {
+                /* lcount potentially can be bigger than maxgrp, so would groupc */
+                for (i = 0; i < lcount; i++)
+                         gr_addgid(tmpgroups[i], groups, maxgrp, groupc);
+        }
+        free(tmpgroups);
+        /* Let following nsswitch backend(s) add more groups(?) */
+        return NSS_STATUS_NOTFOUND;
+}
+
 ns_mtab *
 nss_module_register(const char *source, unsigned int *mtabsize,

vendor/current/nsswitch/winbind_nss_linux.c

@@ -288 +288 @@
 
 static NSS_STATUS fill_grent(struct group *result, struct winbindd_gr *gr,
-                      char *gr_mem, char **buffer, size_t *buflen)
+                      const char *gr_mem, char **buffer, size_t *buflen)
 {
         char *name;
@@ -323 +323 @@
         /* Group membership */
 
-        if ((gr->num_gr_mem < 0) || !gr_mem) {
+        if (!gr_mem) {
                 gr->num_gr_mem = 0;
         }
@@ -402 +402 @@
         }
 
-        ret = winbindd_request_response(WINBINDD_SETPWENT, NULL, NULL);
+        ret = winbindd_request_response(NULL, WINBINDD_SETPWENT, NULL, NULL);
 #ifdef DEBUG_NSS
         fprintf(stderr, "[%5d]: setpwent returns %s (%d)\n", getpid(),
@@ -433 +433 @@
         }
 
-        ret = winbindd_request_response(WINBINDD_ENDPWENT, NULL, NULL);
+        ret = winbindd_request_response(NULL, WINBINDD_ENDPWENT, NULL, NULL);
 #ifdef DEBUG_NSS
         fprintf(stderr, "[%5d]: endpwent returns %s (%d)\n", getpid(),
@@ -482 +482 @@
         request.data.num_entries = MAX_GETPWENT_USERS;
 
-        ret = winbindd_request_response(WINBINDD_GETPWENT, &request,
+        ret = winbindd_request_response(NULL, WINBINDD_GETPWENT, &request,
                                &getpwent_response);
 
@@ -570 +570 @@
                 request.data.uid = uid;
 
-                ret = winbindd_request_response(WINBINDD_GETPWUID, &request, &response);
+                ret = winbindd_request_response(NULL, WINBINDD_GETPWUID, &request, &response);
 
                 if (ret == NSS_STATUS_SUCCESS) {
@@ -646 +646 @@
                         [sizeof(request.data.username) - 1] = '\0';
 
-                ret = winbindd_request_response(WINBINDD_GETPWNAM, &request, &response);
+                ret = winbindd_request_response(NULL, WINBINDD_GETPWNAM, &request, &response);
 
                 if (ret == NSS_STATUS_SUCCESS) {
@@ -717 +717 @@
         }
 
-        ret = winbindd_request_response(WINBINDD_SETGRENT, NULL, NULL);
+        ret = winbindd_request_response(NULL, WINBINDD_SETGRENT, NULL, NULL);
 #ifdef DEBUG_NSS
         fprintf(stderr, "[%5d]: setgrent returns %s (%d)\n", getpid(),
@@ -749 +749 @@
         }
 
-        ret = winbindd_request_response(WINBINDD_ENDGRENT, NULL, NULL);
+        ret = winbindd_request_response(NULL, WINBINDD_ENDGRENT, NULL, NULL);
 #ifdef DEBUG_NSS
         fprintf(stderr, "[%5d]: endgrent returns %s (%d)\n", getpid(),
@@ -800 +800 @@
         request.data.num_entries = MAX_GETGRENT_USERS;
 
-        ret = winbindd_request_response(cmd, &request,
+        ret = winbindd_request_response(NULL, cmd, &request,
                                &getgrent_response);
 
@@ -919 +919 @@
                         [sizeof(request.data.groupname) - 1] = '\0';
 
-                ret = winbindd_request_response(WINBINDD_GETGRNAM, &request, &response);
+                ret = winbindd_request_response(NULL, WINBINDD_GETGRNAM,
+                                                &request, &response);
 
                 if (ret == NSS_STATUS_SUCCESS) {
@@ -997 +998 @@
                 request.data.gid = gid;
 
-                ret = winbindd_request_response(WINBINDD_GETGRGID, &request, &response);
+                ret = winbindd_request_response(NULL, WINBINDD_GETGRGID,
+                                                &request, &response);
 
                 if (ret == NSS_STATUS_SUCCESS) {
@@ -1070 +1072 @@
                 sizeof(request.data.username) - 1);
 
-        ret = winbindd_request_response(WINBINDD_GETGROUPS, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_GETGROUPS,
+                                        &request, &response);
 
         if (ret == NSS_STATUS_SUCCESS) {
@@ -1099 +1102 @@
 
                         if (gid_list[i] == group) {
+                                continue;
+                        }
+
+                        /* Skip groups without a mapping */
+                        if (gid_list[i] == (uid_t)-1) {
                                 continue;
                         }
@@ -1177 +1185 @@
         request.data.sid[sizeof(request.data.sid) - 1] = '\0';
 
-        ret = winbindd_request_response(WINBINDD_GETUSERSIDS, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_GETUSERSIDS,
+                                        &request, &response);
 
         if (ret != NSS_STATUS_SUCCESS) {
@@ -1229 +1238 @@
         request.data.name.name[sizeof(request.data.name.name) - 1] = '\0';
 
-        ret = winbindd_request_response(WINBINDD_LOOKUPNAME, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_LOOKUPNAME,
+                                        &request, &response);
         if (ret != NSS_STATUS_SUCCESS) {
                 *errnop = errno = EINVAL;
@@ -1279 +1289 @@
         /* we need to fetch the separator first time through */
         if (!sep_char) {
-                ret = winbindd_request_response(WINBINDD_INFO, &request, &response);
+                ret = winbindd_request_response(NULL, WINBINDD_INFO,
+                                                &request, &response);
                 if (ret != NSS_STATUS_SUCCESS) {
                         *errnop = errno = EINVAL;
@@ -1294 +1305 @@
         request.data.sid[sizeof(request.data.sid) - 1] = '\0';
 
-        ret = winbindd_request_response(WINBINDD_LOOKUPSID, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_LOOKUPSID,
+                                        &request, &response);
         if (ret != NSS_STATUS_SUCCESS) {
                 *errnop = errno = EINVAL;
@@ -1350 +1362 @@
         request.data.sid[sizeof(request.data.sid) - 1] = '\0';
 
-        ret = winbindd_request_response(WINBINDD_SID_TO_UID, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_SID_TO_UID,
+                                        &request, &response);
         if (ret != NSS_STATUS_SUCCESS) {
                 *errnop = errno = EINVAL;
@@ -1389 +1402 @@
         request.data.sid[sizeof(request.data.sid) - 1] = '\0';
 
-        ret = winbindd_request_response(WINBINDD_SID_TO_GID, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_SID_TO_GID,
+                                        &request, &response);
         if (ret != NSS_STATUS_SUCCESS) {
                 *errnop = errno = EINVAL;
@@ -1428 +1442 @@
         request.data.uid = uid;
 
-        ret = winbindd_request_response(WINBINDD_UID_TO_SID, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_UID_TO_SID,
+                                        &request, &response);
         if (ret != NSS_STATUS_SUCCESS) {
                 *errnop = errno = EINVAL;
@@ -1476 +1491 @@
         request.data.gid = gid;
 
-        ret = winbindd_request_response(WINBINDD_GID_TO_SID, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_GID_TO_SID,
+                                        &request, &response);
         if (ret != NSS_STATUS_SUCCESS) {
                 *errnop = errno = EINVAL;

vendor/current/nsswitch/winbind_nss_netbsd.c

@@ -229 +229 @@
         strncpy(request.data.username, uname,
                                 sizeof(request.data.username) - 1);
-        i = winbindd_request_response(WINBINDD_GETGROUPS, &request, &response);
+        i = winbindd_request_response(NULL, WINBINDD_GETGROUPS,
+                                      &request, &response);
         if (i != NSS_STATUS_SUCCESS)
                 return NS_NOTFOUND;

vendor/current/nsswitch/winbind_nss_solaris.c

@@ -26 +26 @@
 
 #undef DEVELOPER
+
 
 #include "winbind_client.h"
@@ -33 +34 @@
 #include <string.h>
 #include <pwd.h>
-#include "includes.h"
 #include <syslog.h>
+
 #if !defined(HPUX)
 #include <sys/syslog.h>
@@ -47 +48 @@
 #else
 #define NSS_DEBUG(str) ;
+#endif
+
+#if !defined(SMB_MALLOC_P)
+#define SMB_MALLOC_P(type) (type *)malloc(sizeof(type))
 #endif
 
@@ -255 +260 @@
                 NSS_ARGS(args)->returnval = (void*) result;
 
+        if (NSS_ARGS(args)->erange == ERANGE && ret == NSS_STATUS_TRYAGAIN)
+                return NSS_STATUS_UNAVAIL;
+
         return ret;
 }
@@ -273 +281 @@
         if(ret == NSS_STATUS_SUCCESS)
                 NSS_ARGS(args)->returnval = (void*) result;
+
+        if (NSS_ARGS(args)->erange == ERANGE && ret == NSS_STATUS_TRYAGAIN)
+                return NSS_STATUS_UNAVAIL;
 
         return ret;
@@ -511 +522 @@
         request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
 
-        if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
+        if( (ret = winbindd_request_response(NULL, WINBINDD_WINS_BYNAME,
+                                             &request, &response))
                 == NSS_STATUS_SUCCESS ) {
           ret = parse_response(af, argp, &response);
@@ -534 +546 @@
         request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
 
-        if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
+        if( (ret = winbindd_request_response(NULL, WINBINDD_WINS_BYNAME,
+                                             &request, &response))
                 == NSS_STATUS_SUCCESS ) {
           ret = parse_response(AF_INET, argp, &response);
@@ -573 +586 @@
 #endif
 
-        ret = winbindd_request_response(WINBINDD_WINS_BYIP, &request, &response);
+        ret = winbindd_request_response(NULL, WINBINDD_WINS_BYIP,
+                                        &request, &response);
 
         if( ret == NSS_STATUS_SUCCESS) {

vendor/current/nsswitch/winbind_nss_solaris.h

@@ -26 +26 @@
 #include <nss_dbdefs.h>
 #include <nsswitch.h>
+#include "system/passwd.h"
 
 typedef nss_status_t NSS_STATUS;

vendor/current/nsswitch/winbind_struct_protocol.h

@@ -26 +26 @@
 #define WINBINDD_SOCKET_NAME "pipe"            /* Name of PF_UNIX socket */
 
-/* Let the build environment override the public winbindd socket location. This
- * is needed for launchd support -- jpeach.
+/* We let the build environment set the public winbindd socket
+ * location. Therefore we no longer set
+ *
+ * #define WINBINDD_SOCKET_DIR "/tmp/.winbindd"
+ *
+ * A number of different distributions set different paths, and so it
+ * needs to come from configure in Samba.  External users of this header will
+ * need to know where the path is on their system by some other
+ * mechanism.
  */
-#ifndef WINBINDD_SOCKET_DIR
-#define WINBINDD_SOCKET_DIR  "/tmp/.winbindd"  /* Name of PF_UNIX dir */
-#endif
-
-/*
- * when compiled with socket_wrapper support
- * the location of the WINBINDD_SOCKET_DIR
- * can be overwritten via an environment variable
- */
-#define WINBINDD_SOCKET_DIR_ENVVAR "WINBINDD_SOCKET_DIR"
-
-#define WINBINDD_PRIV_SOCKET_SUBDIR "winbindd_privileged" /* name of subdirectory of lp_lockdir() to hold the 'privileged' pipe */
+
+#define WINBINDD_PRIV_SOCKET_SUBDIR "winbindd_privileged" /* name of subdirectory of lp_lock_directory() to hold the 'privileged' pipe */
 #define WINBINDD_DOMAIN_ENV  "WINBINDD_DOMAIN" /* Environment variables */
 #define WINBINDD_DONT_ENV    "_NO_WINBINDD"
@@ -206 +203 @@
 } WINBINDD_GR;
 
-/* PAM specific request flags */
+/* Request flags */
 #define WBFLAG_PAM_INFO3_NDR            0x00000001
 #define WBFLAG_PAM_INFO3_TEXT           0x00000002
@@ -212 +209 @@
 #define WBFLAG_PAM_LMKEY                0x00000008
 #define WBFLAG_PAM_CONTACT_TRUSTDOM     0x00000010
+#define WBFLAG_QUERY_ONLY               0x00000020      /* not used */
+#define WBFLAG_PAM_AUTH_PAC             0x00000040
 #define WBFLAG_PAM_UNIX_NAME            0x00000080
 #define WBFLAG_PAM_AFS_TOKEN            0x00000100
 #define WBFLAG_PAM_NT_STATUS_SQUASH     0x00000200
+/* This is a flag that can only be sent from parent to child */
+#define WBFLAG_IS_PRIVILEGED            0x00000400      /* not used */
+/* Flag to say this is a winbindd internal send - don't recurse. */
+#define WBFLAG_RECURSE                  0x00000800
 #define WBFLAG_PAM_KRB5                 0x00001000
 #define WBFLAG_PAM_FALLBACK_AFTER_KRB5  0x00002000
 #define WBFLAG_PAM_CACHED_LOGIN         0x00004000
 #define WBFLAG_PAM_GET_PWD_POLICY       0x00008000
-
-/* generic request flags */
-#define WBFLAG_QUERY_ONLY               0x00000020      /* not used */
-/* This is a flag that can only be sent from parent to child */
-#define WBFLAG_IS_PRIVILEGED            0x00000400      /* not used */
-/* Flag to say this is a winbindd internal send - don't recurse. */
-#define WBFLAG_RECURSE                  0x00000800
 /* Flag to tell winbind the NTLMv2 blob is too big for the struct and is in the
  * extra_data field */
@@ -491 +487 @@
                         uint8_t session_key[16];
                         uint32_t auth_blob_len; /* blob in extra_data */
+                        uint8_t new_spnego;
                 } ccache_ntlm_auth;
                 struct {

vendor/current/nsswitch/wins.c

@@ -21 +21 @@
 #include "includes.h"
 #include "nsswitch/winbind_nss.h"
+#include "nsswitch/libwbclient/wbclient.h"
 
 #ifdef HAVE_NS_API_H
@@ -38 +39 @@
 #define INADDRSZ 4
 #endif
-
-static int initialised;
 
 NSS_STATUS _nss_wins_gethostbyname_r(const char *hostname, struct hostent *he,
@@ -46 +45 @@
                            char *buffer, size_t buflen, int *h_errnop);
 
-static void nss_wins_init(void)
-{
-        initialised = 1;
-        load_case_tables_library();
-        lp_set_cmdline("log level", "0");
-
-        TimeInit();
-        setup_logging("nss_wins",False);
-        lp_load(get_dyn_CONFIGFILE(),True,False,False,True);
-        load_interfaces();
-}
-
-static struct in_addr *lookup_byname_backend(const char *name, int *count)
-{
-        struct ip_service *address = NULL;
-        struct in_addr *ret = NULL;
-        int j;
-
-        if (!initialised) {
-                nss_wins_init();
-        }
-
-        *count = 0;
-
-        /* always try with wins first */
-        if (NT_STATUS_IS_OK(resolve_wins(name,0x00,&address,count))) {
-                if ( (ret = SMB_MALLOC_P(struct in_addr)) == NULL ) {
-                        free( address );
-                        return NULL;
-                }
-                if (address[0].ss.ss_family != AF_INET) {
-                        free(address);
-                        free(ret);
-                        return NULL;
-                }
-                *ret = ((struct sockaddr_in *)(void *)&address[0].ss)
-                        ->sin_addr;
-                free( address );
-                return ret;
-        }
-
-        /* uggh, we have to broadcast to each interface in turn */
-        for (j=iface_count() - 1;j >= 0;j--) {
-                const struct in_addr *bcast = iface_n_bcast_v4(j);
-                struct sockaddr_storage ss;
-                struct sockaddr_storage *pss;
-                NTSTATUS status;
-
-                if (!bcast) {
-                        continue;
-                }
-                in_addr_to_sockaddr_storage(&ss, *bcast);
-                status = name_query(name, 0x00, True, True, &ss,
-                                    NULL, &pss, count, NULL);
-                if (NT_STATUS_IS_OK(status) && (*count > 0)) {
-                        if ((ret = SMB_MALLOC_P(struct in_addr)) == NULL) {
-                                return NULL;
-                        }
-                        *ret = ((struct sockaddr_in *)pss)->sin_addr;
-                        TALLOC_FREE(pss);
-                        break;
-                }
-        }
-
-        return ret;
+static char *lookup_byname_backend(const char *name)
+{
+        const char *p;
+        char *ip, *ipp;
+        size_t nbt_len;
+        wbcErr result;
+
+        nbt_len = strlen(name);
+        if (nbt_len > MAX_NETBIOSNAME_LEN - 1) {
+                return NULL;
+        }
+        p = strchr(name, '.');
+        if (p != NULL) {
+                return NULL;
+        }
+
+        result = wbcResolveWinsByName(name, &ip);
+        if (result != WBC_ERR_SUCCESS) {
+                return NULL;
+        }
+
+        ipp = strchr(ip, '\t');
+        if (ipp != NULL) {
+                *ipp = '\0';
+        }
+
+        return ip;
 }
 
 #ifdef HAVE_NS_API_H
 
-static struct node_status *lookup_byaddr_backend(char *addr, int *count)
-{
-        struct sockaddr_storage ss;
-        struct nmb_name nname;
-        struct node_status *result;
-        NTSTATUS status;
-
-        if (!initialised) {
-                nss_wins_init();
-        }
-
-        make_nmb_name(&nname, "*", 0);
-        if (!interpret_string_addr(&ss, addr, AI_NUMERICHOST)) {
-                return NULL;
-        }
-        status = node_status_query(NULL, &nname, &ss, &result, count, NULL);
-        if (!NT_STATUS_IS_OK(status)) {
-                return NULL;
-        }
-
-        return result;
+static char *lookup_byaddr_backend(const char *ip)
+{
+        wbcErr result;
+        char *name = NULL;
+
+        result = wbcResolveWinsByIP(ip, &name);
+        if (result != WBC_ERR_SUCCESS) {
+                return NULL;
+        }
+
+        return name;
 }
 
@@ -142 +93 @@
 int init(void)
 {
+        bool ok;
+
         nsd_logprintf(NSD_LOG_MIN, "entering init (wins)\n");
-        nss_wins_init();
+
+        ok = nss_wins_init();
+        if (!ok) {
+                return NSD_ERROR;
+        }
+
         return NSD_OK;
 }
@@ -152 +110 @@
         char *key;
         char *addr;
-        struct in_addr *ip_list;
-        struct node_status *status;
         int i, count, len, size;
         char response[1024];
@@ -181 +137 @@
          * ip_address[ ip_address]*\tname[ alias]*
          */
-        if (StrCaseCmp(map,"hosts.byaddr") == 0) {
-                if ( status = lookup_byaddr_backend(key, &count)) {
-                    size = strlen(key) + 1;
-                    if (size > len) {
-                        talloc_free(status);
-                        return NSD_ERROR;
-                    }
-                    len -= size;
-                    strncat(response,key,size);
-                    strncat(response,"\t",1);
-                    for (i = 0; i < count; i++) {
-                        /* ignore group names */
-                        if (status[i].flags & 0x80) continue;
-                        if (status[i].type == 0x20) {
-                                size = sizeof(status[i].name) + 1;
-                                if (size > len) {
-                                    talloc_free(status);
-                                    return NSD_ERROR;
-                                }
-                                len -= size;
-                                strncat(response, status[i].name, size);
-                                strncat(response, " ", 1);
-                                found = True;
+        if (strcasecmp_m(map,"hosts.byaddr") == 0) {
+                char *name;
+
+                name = lookup_byaddr_backend(key);
+                if (name != NULL) {
+                        size = strlen(key) + 1;
+                        if (size > len) {
+                                return NSD_ERROR;
                         }
-                    }
-                    response[strlen(response)-1] = '\n';
-                    talloc_free(status);
+                        len -= size;
+                        strncat(response,key,size);
+                        strncat(response,"\t",1);
+
+                        size = strlen(name) + 1;
+                        if (size > len) {
+                                return NSD_ERROR;
+                        }
+                        len -= size;
+                        strncat(response, name, size);
+                        strncat(response, " ", 1);
+                        found = True;
                 }
-        } else if (StrCaseCmp(map,"hosts.byname") == 0) {
-            if (ip_list = lookup_byname_backend(key, &count)) {
-                for (i = count; i ; i--) {
-                    addr = inet_ntoa(ip_list[i-1]);
-                    size = strlen(addr) + 1;
-                    if (size > len) {
-                        free(ip_list);
-                        return NSD_ERROR;
-                    }
-                    len -= size;
-                    if (i != 0)
-                        response[strlen(response)-1] = ' ';
-                    strncat(response,addr,size);
-                    strncat(response,"\t",1);
+                response[strlen(response)-1] = '\n';
+        } else if (strcasecmp_m(map,"hosts.byname") == 0) {
+                char *ip;
+
+                ip = lookup_byname_backend(key);
+                if (ip != NULL) {
+                        size = strlen(ip) + 1;
+                        if (size > len) {
+                                wbcFreeMemory(ip);
+                                return NSD_ERROR;
+                        }
+                        len -= size;
+                        strncat(response,ip,size);
+                        strncat(response,"\t",1);
+                        size = strlen(key) + 1;
+                        wbcFreeMemory(ip);
+                        if (size > len) {
+                                return NSD_ERROR;
+                        }
+                        strncat(response,key,size);
+                        strncat(response,"\n",1);
+
+                        found = True;
                 }
-                size = strlen(key) + 1;
-                if (size > len) {
-                    free(ip_list);
-                    return NSD_ERROR;
-                }
-                strncat(response,key,size);
-                strncat(response,"\n",1);
-                found = True;
-                free(ip_list);
-            }
         }
 
@@ -252 +201 @@
    functions. */
 
-static char *get_static(char **buffer, size_t *buflen, int len)
+static char *get_static(char **buffer, size_t *buflen, size_t len)
 {
         char *result;
@@ -281 +230 @@
 {
         NSS_STATUS nss_status = NSS_STATUS_SUCCESS;
-        struct in_addr *ip_list;
-        int i, count;
+        char *ip;
+        struct in_addr in;
+        int i;
         fstring name;
         size_t namelen;
-        TALLOC_CTX *frame;
+        int rc;
 
 #if HAVE_PTHREAD
@@ -291 +241 @@
 #endif
 
-        frame = talloc_stackframe();
-
         memset(he, '\0', sizeof(*he));
         fstrcpy(name, hostname);
@@ -298 +246 @@
         /* Do lookup */
 
-        ip_list = lookup_byname_backend(name, &count);
-
-        if (!ip_list) {
+        ip = lookup_byname_backend(name);
+        if (ip == NULL) {
                 nss_status = NSS_STATUS_NOTFOUND;
                 goto out;
         }
 
+        rc = inet_pton(AF_INET, ip, &in);
+        wbcFreeMemory(ip);
+        if (rc == 0) {
+                nss_status = NSS_STATUS_TRYAGAIN;
+                goto out;
+        }
+
         /* Copy h_name */
 
@@ -310 +264 @@
 
         if ((he->h_name = get_static(&buffer, &buflen, namelen)) == NULL) {
-                free(ip_list);
                 nss_status = NSS_STATUS_TRYAGAIN;
                 goto out;
@@ -323 +276 @@
 
         if (get_static(&buffer, &buflen, i) == NULL) {
-                free(ip_list);
                 nss_status = NSS_STATUS_TRYAGAIN;
                 goto out;
@@ -329 +281 @@
 
         if ((he->h_addr_list = (char **)get_static(
-                     &buffer, &buflen, (count + 1) * sizeof(char *))) == NULL) {
-                free(ip_list);
-                nss_status = NSS_STATUS_TRYAGAIN;
-                goto out;
-        }
-
-        for (i = 0; i < count; i++) {
-                if ((he->h_addr_list[i] = get_static(&buffer, &buflen,
-                                                     INADDRSZ)) == NULL) {
-                        free(ip_list);
-                        nss_status = NSS_STATUS_TRYAGAIN;
-                        goto out;
-                }
-                memcpy(he->h_addr_list[i], &ip_list[i], INADDRSZ);
-        }
-
-        he->h_addr_list[count] = NULL;
-
-        free(ip_list);
+                     &buffer, &buflen, 2 * sizeof(char *))) == NULL) {
+                nss_status = NSS_STATUS_TRYAGAIN;
+                goto out;
+        }
+
+        if ((he->h_addr_list[0] = get_static(&buffer, &buflen,
+                                             INADDRSZ)) == NULL) {
+                nss_status = NSS_STATUS_TRYAGAIN;
+                goto out;
+        }
+
+        memcpy(he->h_addr_list[0], &in, INADDRSZ);
+
+        he->h_addr_list[1] = NULL;
 
         /* Set h_addr_type and h_length */
@@ -375 +322 @@
 
   out:
-
-        TALLOC_FREE(frame);
 
 #if HAVE_PTHREAD

vendor/current/nsswitch/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
+import Utils
+import sys
+host_os = sys.platform
 
 bld.SAMBA_LIBRARY('winbind-client',
         source='wb_common.c',
         deps='replace',
-        cflags='-DSOCKET_WRAPPER_DISABLE=1 -DWINBINDD_SOCKET_DIR=\"%s\"' % bld.env.WINBINDD_SOCKET_DIR,
+        cflags='-DWINBINDD_SOCKET_DIR=\"%s\"' % bld.env.WINBINDD_SOCKET_DIR,
         private_library=True
         )
@@ -10 +13 @@
 
 bld.SAMBA_BINARY('nsstest',
-        source='nsstest.c',
-        deps='replace dl'
-        )
+                 source='nsstest.c',
+                 deps='replace dl',
+                 install=False
+                 )
 
+# The nss_wrapper code relies strictly on the linux implementation and
+# name, so compile but do not install a copy under this name.
+bld.SAMBA_LIBRARY('nss_wrapper_winbind',
+                  source='winbind_nss_linux.c',
+                  deps='winbind-client',
+                  realname='libnss_wrapper_winbind.so.2',
+                  install=False,
+                  vnum='2')
 
-bld.SAMBA_LIBRARY('nss_winbind',
-        source='winbind_nss_linux.c',
-        deps='winbind-client',
-        realname='libnss_winbind.so.2',
-        vnum='2')
+# FIXME: original was *linux* | gnu* | k*bsd*-gnu | kopensolaris*-gnu)
+# the search for .rfind('gnu') covers gnu* and *-gnu is that too broad?
 
+if (Utils.unversioned_sys_platform() == 'linux' or (host_os.rfind('gnu') > -1)):
+    bld.SAMBA_LIBRARY('nss_winbind',
+              keep_underscore=True,
+              source='winbind_nss_linux.c',
+              deps='winbind-client',
+              public_headers=[],
+              public_headers_install=False,
+              pc_files=[],
+              vnum='2')
 
-if bld.CONFIG_SET('WITH_PAM_MODULES') or bld.CONFIG_SET('HAVE_PAM_START'):
+    bld.SAMBA3_LIBRARY('nss_wins',
+                       keep_underscore=True,
+                       source='wins.c',
+                       deps='''wbclient''',
+                       public_headers=[],
+                       public_headers_install=False,
+                       pc_files=[],
+                       vnum='2')
+elif (host_os.rfind('freebsd') > -1):
+        # FreeBSD winbind client is implemented as a wrapper around
+        # the Linux version.
+        bld.SAMBA_LIBRARY('nss_winbind',
+                          source='winbind_nss_linux.c winbind_nss_freebsd.c',
+                          deps='winbind-client',
+                          realname='nss_winbind.so.1',
+                          vnum='1')
+
+        bld.SAMBA3_LIBRARY('nss_wins',
+                          source='wins.c wins_freebsd.c',
+                          deps='''wbclient''',
+                          realname='nss_wins.so.1',
+                          vnum='1')
+
+elif (host_os.rfind('netbsd') > -1):
+        # NetBSD winbind client is implemented as a wrapper
+        # around the Linux version. It needs getpwent_r() to
+        # indicate libc's use of the correct nsdispatch API.
+
+        if bld.CONFIG_SET("HAVE_GETPWENT_R"):
+                bld.SAMBA_LIBRARY('nss_winbind',
+                                  source='winbind_nss_linux.c winbind_nss_netbsd.c',
+                                  deps='winbind-client', 
+                                  realname='libnss_winbind.so')
+elif (host_os.rfind('irix') > -1):
+        bld.SAMBA_LIBRARY('ns_winbind',
+                          source='winbind_nss_irix.c',
+                          deps='winbind-client', 
+                          realname='libns_winbind.so')
+
+elif Utils.unversioned_sys_platform() == 'sunos':
+        bld.SAMBA_LIBRARY('nss_winbind',
+                          source='winbind_nss_solaris.c winbind_nss_linux.c',
+                          deps='winbind-client',
+                          realname='nss_winbind.so.1',
+                          vnum='1')
+elif (host_os.rfind('hpux') > -1):
+        bld.SAMBA_LIBRARY('nss_winbind',
+                          source='winbind_nss_linux.c',
+                          deps='winbind-client', 
+                          realname='libnss_winbind.so')
+elif (host_os.rfind('aix') > -1):
+        bld.SAMBA_LIBRARY('nss_winbind',
+                          source='winbind_nss_aix.c',
+                          deps='winbind-client', 
+                          realname='WINBIND')
+
+if bld.CONFIG_SET('WITH_PAM_MODULES') and bld.CONFIG_SET('HAVE_PAM_START'):
         bld.SAMBA_LIBRARY('pamwinbind',
                 source='pam_winbind.c',
-                deps='intl talloc wbclient winbind-client LIBINIPARSER pam',
+                deps='talloc wbclient winbind-client tiniparser pam samba_intl',
                 cflags='-DLOCALEDIR=\"%s/locale\"' % bld.env.DATADIR,
                 realname='pam_winbind.so',
+                install_path='${PAMMODULESDIR}'
                 )
 
@@ -33 +108 @@
         bld.SAMBA_LIBRARY('winbind_krb5_locator',
                 source='winbind_krb5_locator.c',
-                deps='wbclient krb5',
+                deps='wbclient krb5 com_err',
                 realname='winbind_krb5_locator.so')
 
@@ -40 +115 @@
         deps='talloc tevent LIBASYNC_REQ'
         )
+
+bld.SAMBA_BINARY('wbinfo',
+        source='wbinfo.c',
+        deps='samba-util LIBCLI_AUTH popt POPT_SAMBA wbclient LIBAFS_SETTOKEN'
+        )

vendor/current/nsswitch/wscript_configure

@@ -5 +5 @@
 conf.CHECK_HEADERS('security/pam_appl.h security/pam_modules.h pam/pam_modules.h', together=True)
 conf.CHECK_FUNCS_IN('pam_start', 'pam', checklibc=True, headers='security/pam_appl.h')
+
+# Solaris 10 does have new member in nss_XbyY_key
+conf.CHECK_STRUCTURE_MEMBER('union nss_XbyY_key', 'ipnode.af_family', 
+                            define='HAVE_NSS_XBYY_KEY_IPNODE',
+                            headers='nss_dbdefs.h')
+
+# Solaris has some extra fields in struct passwd that need to be
+# initialised otherwise nscd crashes.
+
+conf.CHECK_STRUCTURE_MEMBER('struct passwd', 'pw_comment',
+                            define='HAVE_PASSWD_PW_COMMENT',
+                            headers='pwd.h')
+
+conf.CHECK_STRUCTURE_MEMBER('struct passwd', 'pw_age',
+                            define='HAVE_PASSWD_PW_AGE',
+                            headers='pwd.h')