Changeset 988 for vendor/current/source3/passdb

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source3/passdb

Files:

• ABI (added)
• ABI/pdb-0.1.0.sigs (added)
• ABI/pdb-0.1.1.sigs (added)
• ABI/pdb-0.1.2.sigs (added)
• ABI/pdb-0.sigs (added)
• ABI/samba-passdb-0.2.0.sigs (added)
• ABI/samba-passdb-0.24.1.sigs (added)
• ABI/samba-passdb-0.24.2.sigs (added)
• ABI/samba-passdb-0.25.0.sigs (added)
• account_pol.c (modified) (18 diffs)
• login_cache.c (modified) (2 diffs)
• lookup_sid.c (modified) (40 diffs)
• lookup_sid.h (modified) (3 diffs)
• machine_account_secrets.c (modified) (14 diffs)
• machine_sid.c (modified) (13 diffs)
• machine_sid.h (modified) (1 diff)
• passdb.c (modified) (22 diffs)
• pdb_ads.c (deleted)
• pdb_compat.c (modified) (4 diffs)
• pdb_get_set.c (modified) (14 diffs)
• pdb_interface.c (modified) (57 diffs)
• pdb_ipa.c (modified) (19 diffs)
• pdb_ipa.h (added)
• pdb_ldap.c (modified) (137 diffs)
• pdb_ldap.h (added)
• pdb_ldap_schema.c (added)
• pdb_ldap_schema.h (added)
• pdb_ldap_util.c (added)
• pdb_ldap_util.h (added)
• pdb_nds.c (modified) (6 diffs)
• pdb_nds.h (added)
• pdb_samba_dsdb.c (added)
• pdb_secrets.c (added)
• pdb_secrets.h (added)
• pdb_smbpasswd.c (modified) (25 diffs)
• pdb_smbpasswd.h (added)
• pdb_tdb.c (modified) (64 diffs)
• pdb_tdb.h (added)
• pdb_unixid.c (added)
• pdb_util.c (modified) (5 diffs)
• pdb_wbc_sam.c (modified) (15 diffs)
• pdb_wbc_sam.h (added)
• proto.h (deleted)
• py_passdb.c (added)
• secrets.c (modified) (10 diffs)
• secrets_lsa.c (added)
• wscript_build (modified) (2 diffs)

vendor/current/source3/passdb/account_pol.c

@@ -23 +23 @@
 #include "system/filesys.h"
 #include "passdb.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
 #include "../libcli/security/security.h"
 #include "lib/privileges.h"
@@ -40 +41 @@
         enum pdb_policy_type type;
         const char *string;
-        uint32 default_val;
+        uint32_t default_val;
         const char *description;
         const char *ldap_attr;
@@ -58 +59 @@
                 "sambaLogonToChgPwd" },
 
-        {PDB_POLICY_MAX_PASSWORD_AGE, "maximum password age", (uint32) -1,
+        {PDB_POLICY_MAX_PASSWORD_AGE, "maximum password age", (uint32_t) -1,
                 "Maximum password age, in seconds (default: -1 => never expire passwords)",
                 "sambaMaxPwdAge" },
@@ -78 +79 @@
                 "sambaLockoutThreshold" },
 
-        {PDB_POLICY_TIME_TO_LOGOUT, "disconnect time", (uint32) -1,
+        {PDB_POLICY_TIME_TO_LOGOUT, "disconnect time", (uint32_t) -1,
                 "Disconnect Users outside logon hours (default: -1 => off, 0 => on)",
                 "sambaForceLogoff" },
@@ -89 +90 @@
 };
 
-void account_policy_names_list(const char ***names, int *num_names)
+void account_policy_names_list(TALLOC_CTX *mem_ctx, const char ***names, int *num_names)
 {
         const char **nl;
-        int i, count;
-
-        for (count=0; account_policy_names[count].string; count++) {
-        }
-        nl = SMB_MALLOC_ARRAY(const char *, count);
+        int i, count = ARRAY_SIZE(account_policy_names);
+
+        nl = talloc_array(mem_ctx, const char *, count);
         if (!nl) {
                 *num_names = 0;
                 return;
         }
-        for (i=0; account_policy_names[i].string; i++) {
+        for (i=0; i<count; i++) {
                 nl[i] = account_policy_names[i].string;
         }
-        *num_names = count;
+        /* Do not return the last null entry */
+        *num_names = count-1;
         *names = nl;
         return;
@@ -194 +194 @@
 {
 
-        uint32 value;
+        uint32_t value;
 
         if (!account_policy_get(type, &value) &&
@@ -212 +212 @@
 
         const char *vstring = "INFO/version";
-        uint32 version;
-        int i;
+        uint32_t version = 0;
+        int i;
+        NTSTATUS status;
+        char *db_path;
 
         if (db != NULL) {
@@ -219 +221 @@
         }
 
-        db = db_open(NULL, state_path("account_policy.tdb"), 0, TDB_DEFAULT,
-                     O_RDWR, 0600);
+        db_path = state_path("account_policy.tdb");
+        if (db_path == NULL) {
+                return false;
+        }
+
+        db = db_open(NULL, db_path, 0, TDB_DEFAULT,
+                     O_RDWR, 0600, DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
 
         if (db == NULL) { /* the account policies files does not exist or open
                            * failed, try to create a new one */
-                db = db_open(NULL, state_path("account_policy.tdb"), 0,
-                             TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
+                db = db_open(NULL, db_path, 0,
+                             TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
+                             DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
                 if (db == NULL) {
                         DEBUG(0,("Failed to open account policy database\n"));
+                        TALLOC_FREE(db_path);
                         return False;
                 }
         }
-
-        version = dbwrap_fetch_int32(db, vstring);
+        TALLOC_FREE(db_path);
+
+        status = dbwrap_fetch_uint32_bystring(db, vstring, &version);
+        if (!NT_STATUS_IS_OK(status)) {
+                version = 0;
+        }
+
         if (version == DATABASE_VERSION) {
                 return true;
@@ -239 +253 @@
         /* handle a Samba upgrade */
 
-        if (db->transaction_start(db) != 0) {
+        if (dbwrap_transaction_start(db) != 0) {
                 DEBUG(0, ("transaction_start failed\n"));
                 TALLOC_FREE(db);
@@ -245 +259 @@
         }
 
-        version = dbwrap_fetch_int32(db, vstring);
+        status = dbwrap_fetch_uint32_bystring(db, vstring, &version);
+        if (!NT_STATUS_IS_OK(status)) {
+                version = 0;
+        }
+
         if (version == DATABASE_VERSION) {
                 /*
                  * Race condition
                  */
-                if (db->transaction_cancel(db)) {
+                if (dbwrap_transaction_cancel(db)) {
                         smb_panic("transaction_cancel failed");
                 }
@@ -257 +275 @@
 
         if (version != DATABASE_VERSION) {
-                if (dbwrap_store_uint32(db, vstring, DATABASE_VERSION) != 0) {
-                        DEBUG(0, ("dbwrap_store_uint32 failed\n"));
+                status = dbwrap_store_uint32_bystring(db, vstring,
+                                                      DATABASE_VERSION);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0, ("dbwrap_store_uint32_t failed: %s\n",
+                                  nt_errstr(status)));
                         goto cancel;
                 }
@@ -288 +309 @@
         }
 
-        if (db->transaction_commit(db) != 0) {
+        if (dbwrap_transaction_commit(db) != 0) {
                 DEBUG(0, ("transaction_commit failed\n"));
                 TALLOC_FREE(db);
@@ -297 +318 @@
 
  cancel:
-        if (db->transaction_cancel(db)) {
+        if (dbwrap_transaction_cancel(db)) {
                 smb_panic("transaction_cancel failed");
         }
@@ -312 +333 @@
 {
         const char *name;
-        uint32 regval;
+        uint32_t regval;
+        NTSTATUS status;
 
         if (!init_account_policy()) {
@@ -328 +350 @@
         }
 
-        if (!dbwrap_fetch_uint32(db, name, &regval)) {
-                DEBUG(1, ("account_policy_get: tdb_fetch_uint32 failed for type %d (%s), returning 0\n", type, name));
+        status = dbwrap_fetch_uint32_bystring(db, name, &regval);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(2, ("account_policy_get: tdb_fetch_uint32_t failed for type %d (%s), returning 0\n", type, name));
                 return False;
         }
@@ -361 +384 @@
         }
 
-        status = dbwrap_trans_store_uint32(db, name, value);
+        status = dbwrap_trans_store_uint32_bystring(db, name, value);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("store_uint32 failed for type %d (%s) on value "
+                DEBUG(1, ("store_uint32_t failed for type %d (%s) on value "
                           "%u: %s\n", type, name, value, nt_errstr(status)));
                 return False;
@@ -432 +455 @@
         }
 
-        if (gencache_get(cache_key, &cache_value, NULL)) {
-                uint32 tmp = strtoul(cache_value, NULL, 10);
+        if (gencache_get(cache_key, talloc_tos(), &cache_value, NULL)) {
+                uint32_t tmp = strtoul(cache_value, NULL, 10);
                 *value = tmp;
                 ret = True;
@@ -440 +463 @@
  done:
         SAFE_FREE(cache_key);
-        SAFE_FREE(cache_value);
+        TALLOC_FREE(cache_value);
         return ret;
 }

vendor/current/source3/passdb/login_cache.c

@@ -60 +60 @@
 bool login_cache_shutdown(void)
 {
-        /* tdb_close routine returns -1 on error */
+        /* tdb_close routine returns non-zero on error */
         if (!cache) return False;
         DEBUG(5, ("Closing cache file\n"));
-        return tdb_close(cache) != -1;
+        return tdb_close(cache) == 0;
 }
 
@@ -153 +153 @@
                          entry->bad_password_count,
                          bad_password_time);
-        databuf.dptr = SMB_MALLOC_ARRAY(uint8, databuf.dsize);
+        databuf.dptr = SMB_MALLOC_ARRAY(uint8_t, databuf.dsize);
         if (!databuf.dptr) {
                 SAFE_FREE(keystr);

vendor/current/source3/passdb/lookup_sid.c

@@ -24 +24 @@
 #include "../librpc/gen_ndr/ndr_security.h"
 #include "secrets.h"
-#include "memcache.h"
+#include "../lib/util/memcache.h"
 #include "idmap_cache.h"
 #include "../libcli/security/security.h"
 #include "lib/winbind_util.h"
+#include "../librpc/gen_ndr/idmap.h"
 
 /*****************************************************************
@@ -46 +47 @@
         const char *domain = NULL;
         const char *name = NULL;
-        uint32 rid;
+        uint32_t rid;
         struct dom_sid sid;
         enum lsa_SidType type;
@@ -120 +121 @@
         }
 
-        if (((flags & LOOKUP_NAME_NO_NSS) == 0)
+        if (((flags & (LOOKUP_NAME_NO_NSS|LOOKUP_NAME_GROUP)) == 0)
             && strequal(domain, unix_users_domain_name())) {
                 if (lookup_unix_user_name(name, &sid)) {
@@ -140 +141 @@
         }
 
-        if ((domain[0] == '\0') && (!(flags & LOOKUP_NAME_ISOLATED))) {
+        /*
+         * Finally check for a well known domain name ("NT Authority"),
+         * this is taken care if in lookup_wellknown_name().
+         */
+        if ((domain[0] != '\0') &&
+            (flags & LOOKUP_NAME_WKN) &&
+            lookup_wellknown_name(tmp_ctx, name, &sid, &domain))
+        {
+                type = SID_NAME_WKN_GRP;
+                goto ok;
+        }
+
+        /*
+         * If we're told not to look up 'isolated' names then we're
+         * done.
+         */
+        if (!(flags & LOOKUP_NAME_ISOLATED)) {
+                TALLOC_FREE(tmp_ctx);
+                return false;
+        }
+
+        /*
+         * No domain names beyond this point
+         */
+        if (domain[0] != '\0') {
                 TALLOC_FREE(tmp_ctx);
                 return false;
@@ -151 +176 @@
 
         /* 1. well-known names */
+
+        /*
+         * Check for well known names without a domain name.
+         * e.g. \Creator Owner.
+         */
 
         if ((flags & LOOKUP_NAME_WKN) &&
@@ -293 +323 @@
                Unmapped users and unmapped groups */
 
-        if (((flags & LOOKUP_NAME_NO_NSS) == 0)
+        if (((flags & (LOOKUP_NAME_NO_NSS|LOOKUP_NAME_GROUP)) == 0)
             && lookup_unix_user_name(name, &sid)) {
                 domain = talloc_strdup(tmp_ctx, unix_users_domain_name());
@@ -339 +369 @@
                         return false;
                 }
-                strupper_m(tmp_dom);
+                if (!strupper_m(tmp_dom)) {
+                        TALLOC_FREE(tmp_ctx);
+                        return false;
+                }
                 *ret_domain = tmp_dom;
         }
@@ -390 +423 @@
                                 ret_domain, ret_name,
                                 ret_sid, ret_type);
+        }
+
+        /* Try with winbind default domain name. */
+        if (lp_winbind_use_default_domain()) {
+                bool ok;
+
+                qualified_name = talloc_asprintf(mem_ctx,
+                                                 "%s\\%s",
+                                                 lp_workgroup(),
+                                                 full_name);
+                if (qualified_name == NULL) {
+                        return false;
+                }
+
+                ok = lookup_name(mem_ctx,
+                                 qualified_name,
+                                 flags,
+                                 ret_domain,
+                                 ret_name,
+                                 ret_sid,
+                                 ret_type);
+                if (ok) {
+                        return true;
+                }
         }
 
@@ -423 +480 @@
 static bool wb_lookup_rids(TALLOC_CTX *mem_ctx,
                            const struct dom_sid *domain_sid,
-                           int num_rids, uint32 *rids,
+                           int num_rids, uint32_t *rids,
                            const char **domain_name,
                            const char **names, enum lsa_SidType *types)
@@ -483 +540 @@
 
         if (num_rids) {
-                *names = TALLOC_ZERO_ARRAY(mem_ctx, const char *, num_rids);
-                *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
+                *names = talloc_zero_array(mem_ctx, const char *, num_rids);
+                *types = talloc_array(mem_ctx, enum lsa_SidType, num_rids);
 
                 if ((*names == NULL) || (*types == NULL)) {
@@ -497 +554 @@
         }
 
-        if (sid_check_is_domain(domain_sid)) {
+        if (sid_check_is_our_sam(domain_sid)) {
                 NTSTATUS result;
 
@@ -613 +670 @@
         enum lsa_SidType type;
 
-        if (sid_check_is_domain(sid)) {
+        if (sid_check_is_our_sam(sid)) {
                 *name = talloc_strdup(mem_ctx, get_global_sam_name());
                 return true;
@@ -644 +701 @@
 
         if (IS_DC) {
-                uint32 i, num_domains;
+                uint32_t i, num_domains;
                 struct trustdom_info **domains;
 
@@ -710 +767 @@
         case 4:
         case 6:
-                ret = sid_check_is_domain(sid);
+                ret = sid_check_is_our_sam(sid);
                 break;
         case 5:
@@ -751 +808 @@
 
         if (num_sids) {
-                name_infos = TALLOC_ARRAY(mem_ctx, struct lsa_name_info, num_sids);
+                name_infos = talloc_array(mem_ctx, struct lsa_name_info, num_sids);
                 if (name_infos == NULL) {
                         result = NT_STATUS_NO_MEMORY;
@@ -760 +817 @@
         }
 
-        dom_infos = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_dom_info,
+        dom_infos = talloc_zero_array(mem_ctx, struct lsa_dom_info,
                                       LSA_REF_DOMAIN_LIST_MULTIPLIER);
         if (dom_infos == NULL) {
@@ -896 +953 @@
                 }
 
-                if (dom->num_idxs) {
-                        if (!(rids = TALLOC_ARRAY(tmp_ctx, uint32, dom->num_idxs))) {
-                                result = NT_STATUS_NO_MEMORY;
-                                goto fail;
-                        }
-                } else {
-                        rids = NULL;
+                if (dom->num_idxs == 0) {
+                        /*
+                         * This happens only if the only sid related to
+                         * this domain is the domain sid itself, which
+                         * is mapped to SID_NAME_DOMAIN above.
+                         */
+                        continue;
+                }
+
+                if (!(rids = talloc_array(tmp_ctx, uint32_t, dom->num_idxs))) {
+                        result = NT_STATUS_NO_MEMORY;
+                        goto fail;
                 }
 
@@ -1013 +1075 @@
 *****************************************************************/  
 
-/*****************************************************************
-  Find a SID given a uid.
-*****************************************************************/
-
-static bool fetch_sid_from_uid_cache(struct dom_sid *psid, uid_t uid)
-{
-        DATA_BLOB cache_value;
-
-        if (!memcache_lookup(NULL, UID_SID_CACHE,
-                             data_blob_const(&uid, sizeof(uid)),
-                             &cache_value)) {
-                return false;
-        }
-
-        memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
-        SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
-        SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, 0));
-
-        return true;
-}
-
-/*****************************************************************
-  Find a uid given a SID.
-*****************************************************************/
-
-static bool fetch_uid_from_cache( uid_t *puid, const struct dom_sid *psid )
-{
-        DATA_BLOB cache_value;
-
-        if (!memcache_lookup(NULL, SID_UID_CACHE,
-                             data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
-                             &cache_value)) {
-                return false;
-        }
-
-        SMB_ASSERT(cache_value.length == sizeof(*puid));
-        memcpy(puid, cache_value.data, sizeof(*puid));
-
-        return true;
-}
-
-/*****************************************************************
- Store uid to SID mapping in cache.
-*****************************************************************/
-
-void store_uid_sid_cache(const struct dom_sid *psid, uid_t uid)
-{
-        memcache_add(NULL, SID_UID_CACHE,
-                     data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
-                     data_blob_const(&uid, sizeof(uid)));
-        memcache_add(NULL, UID_SID_CACHE,
-                     data_blob_const(&uid, sizeof(uid)),
-                     data_blob_const(psid, ndr_size_dom_sid(psid, 0)));
-}
-
-/*****************************************************************
-  Find a SID given a gid.
-*****************************************************************/
-
-static bool fetch_sid_from_gid_cache(struct dom_sid *psid, gid_t gid)
-{
-        DATA_BLOB cache_value;
-
-        if (!memcache_lookup(NULL, GID_SID_CACHE,
-                             data_blob_const(&gid, sizeof(gid)),
-                             &cache_value)) {
-                return false;
-        }
-
-        memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
-        SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
-        SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, 0));
-
-        return true;
-}
-
-/*****************************************************************
-  Find a gid given a SID.
-*****************************************************************/
-
-static bool fetch_gid_from_cache(gid_t *pgid, const struct dom_sid *psid)
-{
-        DATA_BLOB cache_value;
-
-        if (!memcache_lookup(NULL, SID_GID_CACHE,
-                             data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
-                             &cache_value)) {
-                return false;
-        }
-
-        SMB_ASSERT(cache_value.length == sizeof(*pgid));
-        memcpy(pgid, cache_value.data, sizeof(*pgid));
-
-        return true;
-}
-
-/*****************************************************************
- Store gid to SID mapping in cache.
-*****************************************************************/
-
-void store_gid_sid_cache(const struct dom_sid *psid, gid_t gid)
-{
-        memcache_add(NULL, SID_GID_CACHE,
-                     data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
-                     data_blob_const(&gid, sizeof(gid)));
-        memcache_add(NULL, GID_SID_CACHE,
-                     data_blob_const(&gid, sizeof(gid)),
-                     data_blob_const(psid, ndr_size_dom_sid(psid, 0)));
-}
 
 /*****************************************************************
@@ -1130 +1083 @@
 {
         bool ret;
+        struct unixid id;
 
         ZERO_STRUCTP(psid);
 
+        id.id = uid;
+        id.type = ID_TYPE_UID;
+
         become_root();
-        ret = pdb_uid_to_sid(uid, psid);
+        ret = pdb_id_to_sid(&id, psid);
         unbecome_root();
 
@@ -1146 +1103 @@
         uid_to_unix_users_sid(uid, psid);
 
+        {
+                struct unixid xid = {
+                        .id = uid, .type = ID_TYPE_UID
+                };
+                idmap_cache_set_sid2unixid(psid, &xid);
+        }
+
  done:
         DEBUG(10,("LEGACY: uid %u -> sid %s\n", (unsigned int)uid,
                   sid_string_dbg(psid)));
 
-        store_uid_sid_cache(psid, uid);
         return;
 }
@@ -1161 +1124 @@
 {
         bool ret;
+        struct unixid id;
 
         ZERO_STRUCTP(psid);
 
+        id.id = gid;
+        id.type = ID_TYPE_GID;
+
         become_root();
-        ret = pdb_gid_to_sid(gid, psid);
+        ret = pdb_id_to_sid(&id, psid);
         unbecome_root();
 
@@ -1177 +1144 @@
         gid_to_unix_groups_sid(gid, psid);
 
+        {
+                struct unixid xid = {
+                        .id = gid, .type = ID_TYPE_GID
+                };
+                idmap_cache_set_sid2unixid(psid, &xid);
+        }
+
  done:
         DEBUG(10,("LEGACY: gid %u -> sid %s\n", (unsigned int)gid,
                   sid_string_dbg(psid)));
 
-        store_gid_sid_cache(psid, gid);
         return;
 }
 
 /*****************************************************************
- *THE LEGACY* convert SID to uid function.
+ *THE LEGACY* convert SID to id function.
 *****************************************************************/  
 
-static bool legacy_sid_to_uid(const struct dom_sid *psid, uid_t *puid)
-{
-        enum lsa_SidType type;
-
-        if (sid_check_is_in_our_domain(psid)) {
-                union unid_t id;
-                bool ret;
-
-                become_root();
-                ret = pdb_sid_to_id(psid, &id, &type);
-                unbecome_root();
-
-                if (ret) {
-                        if (type != SID_NAME_USER) {
-                                DEBUG(5, ("sid %s is a %s, expected a user\n",
-                                          sid_string_dbg(psid),
-                                          sid_type_lookup(type)));
-                                return false;
-                        }
-                        *puid = id.uid;
-                        goto done;
-                }
-
-                /* This was ours, but it was not mapped.  Fail */
-        }
-
-        DEBUG(10,("LEGACY: mapping failed for sid %s\n",
-                  sid_string_dbg(psid)));
-        return false;
-
-done:
-        DEBUG(10,("LEGACY: sid %s -> uid %u\n", sid_string_dbg(psid),
-                  (unsigned int)*puid ));
-
-        store_uid_sid_cache(psid, *puid);
-        return true;
-}
-
-/*****************************************************************
- *THE LEGACY* convert SID to gid function.
- Group mapping is used for gids that maps to Wellknown SIDs
-*****************************************************************/  
-
-static bool legacy_sid_to_gid(const struct dom_sid *psid, gid_t *pgid)
-{
-        GROUP_MAP map;
-        union unid_t id;
-        enum lsa_SidType type;
-
-        if ((sid_check_is_in_builtin(psid) ||
-             sid_check_is_in_wellknown_domain(psid))) {
-                bool ret;
-
-                become_root();
-                ret = pdb_getgrsid(&map, *psid);
-                unbecome_root();
-
-                if (ret) {
-                        *pgid = map.gid;
-                        goto done;
-                }
+static bool legacy_sid_to_unixid(const struct dom_sid *psid, struct unixid *id)
+{
+        bool ret;
+
+        become_root();
+        ret = pdb_sid_to_id(psid, id);
+        unbecome_root();
+
+        if (!ret) {
                 DEBUG(10,("LEGACY: mapping failed for sid %s\n",
                           sid_string_dbg(psid)));
@@ -1255 +1176 @@
         }
 
-        if (sid_check_is_in_our_domain(psid)) {
-                bool ret;
-
-                become_root();
-                ret = pdb_sid_to_id(psid, &id, &type);
-                unbecome_root();
-
-                if (ret) {
-                        if ((type != SID_NAME_DOM_GRP) &&
-                            (type != SID_NAME_ALIAS)) {
-                                DEBUG(5, ("LEGACY: sid %s is a %s, expected "
-                                          "a group\n", sid_string_dbg(psid),
-                                          sid_type_lookup(type)));
-                                return false;
-                        }
-                        *pgid = id.gid;
-                        goto done;
-                }
-
-                /* This was ours, but it was not mapped.  Fail */
-        }
-
-        DEBUG(10,("LEGACY: mapping failed for sid %s\n",
-                  sid_string_dbg(psid)));
+        return true;
+}
+
+static bool legacy_sid_to_gid(const struct dom_sid *psid, gid_t *pgid)
+{
+        struct unixid id;
+        if (!legacy_sid_to_unixid(psid, &id)) {
+                return false;
+        }
+        if (id.type == ID_TYPE_GID || id.type == ID_TYPE_BOTH) {
+                *pgid = id.id;
+                return true;
+        }
         return false;
-
- done:
-        DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_dbg(psid),
-                  (unsigned int)*pgid ));
-
-        store_gid_sid_cache(psid, *pgid);
-
-        return true;
+}
+
+static bool legacy_sid_to_uid(const struct dom_sid *psid, uid_t *puid)
+{
+        struct unixid id;
+        if (!legacy_sid_to_unixid(psid, &id)) {
+                return false;
+        }
+        if (id.type == ID_TYPE_UID || id.type == ID_TYPE_BOTH) {
+                *puid = id.id;
+                return true;
+        }
+        return false;
 }
 
@@ -1299 +1214 @@
         bool ret;
         ZERO_STRUCTP(psid);
-
-        if (fetch_sid_from_uid_cache(psid, uid))
-                return;
 
         /* Check the winbindd cache directly. */
@@ -1339 +1251 @@
                   sid_string_dbg(psid)));
 
-        store_uid_sid_cache(psid, uid);
         return;
 }
@@ -1352 +1263 @@
         bool ret;
         ZERO_STRUCTP(psid);
-
-        if (fetch_sid_from_gid_cache(psid, gid))
-                return;
 
         /* Check the winbindd cache directly. */
@@ -1392 +1300 @@
                   sid_string_dbg(psid)));
 
-        store_gid_sid_cache(psid, gid);
         return;
 }
 
-bool sids_to_unix_ids(const struct dom_sid *sids, uint32_t num_sids,
-                      struct wbcUnixId *ids)
+bool sids_to_unixids(const struct dom_sid *sids, uint32_t num_sids,
+                     struct unixid *ids)
 {
         struct wbcDomainSid *wbc_sids = NULL;
@@ -1405 +1312 @@
         bool ret = false;
 
-        wbc_sids = TALLOC_ARRAY(talloc_tos(), struct wbcDomainSid, num_sids);
+        wbc_sids = talloc_array(talloc_tos(), struct wbcDomainSid, num_sids);
         if (wbc_sids == NULL) {
                 return false;
@@ -1416 +1323 @@
                 uint32_t rid;
 
-                if (fetch_uid_from_cache(&ids[i].id.uid, &sids[i])) {
-                        ids[i].type = WBC_ID_TYPE_UID;
-                        continue;
-                }
-                if (fetch_gid_from_cache(&ids[i].id.gid, &sids[i])) {
-                        ids[i].type = WBC_ID_TYPE_GID;
-                        continue;
-                }
                 if (sid_peek_check_rid(&global_sid_Unix_Users,
                                        &sids[i], &rid)) {
-                        ids[i].type = WBC_ID_TYPE_UID;
-                        ids[i].id.uid = rid;
+                        ids[i].type = ID_TYPE_UID;
+                        ids[i].id = rid;
                         continue;
                 }
                 if (sid_peek_check_rid(&global_sid_Unix_Groups,
                                        &sids[i], &rid)) {
-                        ids[i].type = WBC_ID_TYPE_GID;
-                        ids[i].id.gid = rid;
+                        ids[i].type = ID_TYPE_GID;
+                        ids[i].id = rid;
                         continue;
                 }
-                if (idmap_cache_find_sid2uid(&sids[i], &ids[i].id.uid,
-                                             &expired)
-                    && !expired && ids[i].id.uid != (uid_t)-1) {
-                        ids[i].type = WBC_ID_TYPE_UID;
+                if (idmap_cache_find_sid2unixid(&sids[i], &ids[i], &expired)
+                    && !expired)
+                {
                         continue;
                 }
-                if (idmap_cache_find_sid2gid(&sids[i], &ids[i].id.gid,
-                                             &expired)
-                    && !expired && ids[i].id.gid != (gid_t)-1) {
-                        ids[i].type = WBC_ID_TYPE_GID;
-                        continue;
-                }
-                ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
+                ids[i].type = ID_TYPE_NOT_SPECIFIED;
                 memcpy(&wbc_sids[num_not_cached], &sids[i],
                        ndr_size_dom_sid(&sids[i], 0));
@@ -1456 +1348 @@
                 goto done;
         }
-        wbc_ids = TALLOC_ARRAY(talloc_tos(), struct wbcUnixId, num_not_cached);
+        wbc_ids = talloc_array(talloc_tos(), struct wbcUnixId, num_not_cached);
         if (wbc_ids == NULL) {
                 goto fail;
@@ -1472 +1364 @@
 
         for (i=0; i<num_sids; i++) {
-                if (ids[i].type == WBC_ID_TYPE_NOT_SPECIFIED) {
-                        ids[i] = wbc_ids[num_not_cached];
+                if (ids[i].type == ID_TYPE_NOT_SPECIFIED) {
+                        switch (wbc_ids[num_not_cached].type) {
+                        case WBC_ID_TYPE_UID:
+                                ids[i].type = ID_TYPE_UID;
+                                ids[i].id = wbc_ids[num_not_cached].id.uid;
+                                break;
+                        case WBC_ID_TYPE_GID:
+                                ids[i].type = ID_TYPE_GID;
+                                ids[i].id = wbc_ids[num_not_cached].id.gid;
+                                break;
+                        default:
+                                /* The types match, and wbcUnixId -> id is a union anyway */
+                                ids[i].type = (enum id_type)wbc_ids[num_not_cached].type;
+                                ids[i].id = wbc_ids[num_not_cached].id.gid;
+                                break;
+                        }
                         num_not_cached += 1;
                 }
@@ -1479 +1385 @@
 
         for (i=0; i<num_sids; i++) {
-                if (ids[i].type != WBC_ID_TYPE_NOT_SPECIFIED) {
+                if (ids[i].type != ID_TYPE_NOT_SPECIFIED) {
                         continue;
                 }
-                if (legacy_sid_to_gid(&sids[i], &ids[i].id.gid)) {
-                        ids[i].type = WBC_ID_TYPE_GID;
+                if (legacy_sid_to_gid(&sids[i], &ids[i].id)) {
+                        ids[i].type = ID_TYPE_GID;
                         continue;
                 }
-                if (legacy_sid_to_uid(&sids[i], &ids[i].id.uid)) {
-                        ids[i].type = WBC_ID_TYPE_UID;
+                if (legacy_sid_to_uid(&sids[i], &ids[i].id)) {
+                        ids[i].type = ID_TYPE_UID;
                         continue;
                 }
         }
-
 done:
         for (i=0; i<num_sids; i++) {
                 switch(ids[i].type) {
                 case WBC_ID_TYPE_GID:
-                        if (ids[i].id.gid == (gid_t)-1) {
-                                ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
-                        }
-                        break;
                 case WBC_ID_TYPE_UID:
-                        if (ids[i].id.uid == (uid_t)-1) {
-                                ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
+                case WBC_ID_TYPE_BOTH:
+                        if (ids[i].id == -1) {
+                                ids[i].type = ID_TYPE_NOT_SPECIFIED;
                         }
                         break;
@@ -1509 +1411 @@
                 }
         }
+
         ret = true;
 fail:
@@ -1524 +1427 @@
         bool expired = true;
         bool ret;
-        uint32 rid;
-        gid_t gid;
-
-        if (fetch_uid_from_cache(puid, psid))
-                return true;
-
-        if (fetch_gid_from_cache(&gid, psid)) {
-                return false;
-        }
+        uint32_t rid;
 
         /* Optimize for the Unix Users Domain
@@ -1573 +1468 @@
                 (unsigned int)*puid ));
 
-        store_uid_sid_cache(psid, *puid);
         return true;
 }
@@ -1586 +1480 @@
         bool expired = true;
         bool ret;
-        uint32 rid;
-        uid_t uid;
-
-        if (fetch_gid_from_cache(pgid, psid))
-                return true;
-
-        if (fetch_uid_from_cache(&uid, psid))
-                return false;
+        uint32_t rid;
 
         /* Optimize for the Unix Groups Domain
@@ -1635 +1522 @@
                   (unsigned int)*pgid ));
 
-        store_gid_sid_cache(psid, *pgid);
         return true;
 }
@@ -1681 +1567 @@
                 pwd = Get_Pwnam_alloc(mem_ctx, username);
                 if (!pwd) {
-                        DEBUG(0, ("Failed to find a Unix account for %s",
+                        DEBUG(0, ("Failed to find a Unix account for %s\n",
                                   username));
                         TALLOC_FREE(tmp_ctx);
@@ -1717 +1603 @@
                 } else {
                         /* Try group mapping */
+                        struct unixid id;
+
+                        id.id = pwd->pw_gid;
+                        id.type = ID_TYPE_GID;
+
                         ZERO_STRUCTP(group_sid);
-                        if (pdb_gid_to_sid(pwd->pw_gid, group_sid)) {
+                        if (pdb_id_to_sid(&id, group_sid)) {
                                 need_lookup_sid = true;
                         }
@@ -1763 +1654 @@
 }
 
-bool delete_uid_cache(uid_t puid)
-{
-        DATA_BLOB uid = data_blob_const(&puid, sizeof(puid));
-        DATA_BLOB sid;
-
-        if (!memcache_lookup(NULL, UID_SID_CACHE, uid, &sid)) {
-                DEBUG(3, ("UID %d is not memcached!\n", (int)puid));
-                return false;
-        }
-        DEBUG(3, ("Delete mapping UID %d <-> %s from memcache\n", (int)puid,
-                  sid_string_dbg((struct dom_sid*)sid.data)));
-        memcache_delete(NULL, SID_UID_CACHE, sid);
-        memcache_delete(NULL, UID_SID_CACHE, uid);
-        return true;
-}
-
-bool delete_gid_cache(gid_t pgid)
-{
-        DATA_BLOB gid = data_blob_const(&pgid, sizeof(pgid));
-        DATA_BLOB sid;
-        if (!memcache_lookup(NULL, GID_SID_CACHE, gid, &sid)) {
-                DEBUG(3, ("GID %d is not memcached!\n", (int)pgid));
-                return false;
-        }
-        DEBUG(3, ("Delete mapping GID %d <-> %s from memcache\n", (int)pgid,
-                  sid_string_dbg((struct dom_sid*)sid.data)));
-        memcache_delete(NULL, SID_GID_CACHE, sid);
-        memcache_delete(NULL, GID_SID_CACHE, gid);
-        return true;
-}
-
-bool delete_sid_cache(const struct dom_sid* psid)
-{
-        DATA_BLOB sid = data_blob_const(psid, ndr_size_dom_sid(psid, 0));
-        DATA_BLOB id;
-        if (memcache_lookup(NULL, SID_GID_CACHE, sid, &id)) {
-                DEBUG(3, ("Delete mapping %s <-> GID %d from memcache\n",
-                          sid_string_dbg(psid), *(int*)id.data));
-                memcache_delete(NULL, SID_GID_CACHE, sid);
-                memcache_delete(NULL, GID_SID_CACHE, id);
-        } else if (memcache_lookup(NULL, SID_UID_CACHE, sid, &id)) {
-                DEBUG(3, ("Delete mapping %s <-> UID %d from memcache\n",
-                          sid_string_dbg(psid), *(int*)id.data));
-                memcache_delete(NULL, SID_UID_CACHE, sid);
-                memcache_delete(NULL, UID_SID_CACHE, id);
-        } else {
-                DEBUG(3, ("SID %s is not memcached!\n", sid_string_dbg(psid)));
-                return false;
-        }
-        return true;
-}
-
-void flush_gid_cache(void)
-{
-        DEBUG(3, ("Flush GID <-> SID memcache\n"));
-        memcache_flush(NULL, SID_GID_CACHE);
-        memcache_flush(NULL, GID_SID_CACHE);
-}
-
-void flush_uid_cache(void)
-{
-        DEBUG(3, ("Flush UID <-> SID memcache\n"));
-        memcache_flush(NULL, SID_UID_CACHE);
-        memcache_flush(NULL, UID_SID_CACHE);
-}

vendor/current/source3/passdb/lookup_sid.h

@@ -25 +25 @@
 
 #include "../librpc/gen_ndr/lsa.h"
-#include "nsswitch/libwbclient/wbclient.h"
+
+struct passwd;
+struct unixid;
 
 #define LOOKUP_NAME_NONE                0x00000000
 #define LOOKUP_NAME_ISOLATED             0x00000001  /* Look up unqualified names */
 #define LOOKUP_NAME_REMOTE               0x00000002  /* Ask others */
-#define LOOKUP_NAME_GROUP                0x00000004  /* (unused) This is a NASTY hack for
+#define LOOKUP_NAME_GROUP                0x00000004  /* This is a NASTY hack for
                                                         valid users = @foo where foo also
                                                         exists in as user. */
@@ -57 +59 @@
 
 struct lsa_name_info {
-        uint32 rid;
+        uint32_t rid;
         enum lsa_SidType type;
         const char *name;
@@ -80 +82 @@
                 const char **ret_domain, const char **ret_name,
                 enum lsa_SidType *ret_type);
-void store_uid_sid_cache(const struct dom_sid *psid, uid_t uid);
-void store_gid_sid_cache(const struct dom_sid *psid, gid_t gid);
 void uid_to_sid(struct dom_sid *psid, uid_t uid);
 void gid_to_sid(struct dom_sid *psid, gid_t gid);
-bool sids_to_unix_ids(const struct dom_sid *sids, uint32_t num_sids,
-                      struct wbcUnixId *ids);
 bool sid_to_uid(const struct dom_sid *psid, uid_t *puid);
 bool sid_to_gid(const struct dom_sid *psid, gid_t *pgid);
+bool sids_to_unixids(const struct dom_sid *sids, uint32_t num_sids,
+                      struct unixid *ids);
 NTSTATUS get_primary_group_sid(TALLOC_CTX *mem_ctx,
                                 const char *username,
                                 struct passwd **_pwd,
                                 struct dom_sid **_group_sid);
-bool delete_uid_cache(uid_t uid);
-bool delete_gid_cache(gid_t gid);
-bool delete_sid_cache(const struct dom_sid* psid);
-void flush_uid_cache(void);
-void flush_gid_cache(void);
 
 #endif /* _PASSDB_LOOKUP_SID_H_ */

vendor/current/source3/passdb/machine_account_secrets.c

@@ -27 +27 @@
 #include "../libcli/auth/libcli_auth.h"
 #include "secrets.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
 #include "../librpc/ndr/libndr.h"
 #include "util_tdb.h"
+#include "libcli/security/security.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_PASSDB
-
-/* Urrrg. global.... */
-bool global_machine_password_needs_changing;
 
 /**
@@ -54 +52 @@
 }
 
+static const char *protect_ids_keystr(const char *domain)
+{
+        char *keystr;
+
+        keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
+                                            SECRETS_PROTECT_IDS, domain);
+        SMB_ASSERT(keystr != NULL);
+        return keystr;
+}
+
+/* N O T E: never use this outside of passdb modules that store the SID on their own */
+bool secrets_mark_domain_protected(const char *domain)
+{
+        bool ret;
+
+        ret = secrets_store(protect_ids_keystr(domain), "TRUE", 5);
+        if (!ret) {
+                DEBUG(0, ("Failed to protect the Domain IDs\n"));
+        }
+        return ret;
+}
+
+bool secrets_clear_domain_protection(const char *domain)
+{
+        bool ret;
+        void *protection = secrets_fetch(protect_ids_keystr(domain), NULL);
+        
+        if (protection) {
+                SAFE_FREE(protection);
+                ret = secrets_delete(protect_ids_keystr(domain));
+                if (!ret) {
+                        DEBUG(0, ("Failed to remove Domain IDs protection\n"));
+                }
+                return ret;
+        }
+        return true;
+}
+
 bool secrets_store_domain_sid(const char *domain, const struct dom_sid  *sid)
 {
+        char *protect_ids;
         bool ret;
 
+        protect_ids = secrets_fetch(protect_ids_keystr(domain), NULL);
+        if (protect_ids) {
+                if (strncmp(protect_ids, "TRUE", 4)) {
+                        DEBUG(0, ("Refusing to store a Domain SID, "
+                                  "it has been marked as protected!\n"));
+                        SAFE_FREE(protect_ids);
+                        return false;
+                }
+        }
+        SAFE_FREE(protect_ids);
+
         ret = secrets_store(domain_sid_keystr(domain), sid, sizeof(struct dom_sid ));
 
-        /* Force a re-query, in case we modified our domain */
-        if (ret)
-                reset_global_sam_sid();
+        /* Force a re-query, in the case where we modified our domain */
+        if (ret) {
+                if (dom_sid_equal(get_global_sam_sid(), sid) == false) {
+                        reset_global_sam_sid();
+                }
+        }
         return ret;
 }
@@ -88 +139 @@
 bool secrets_store_domain_guid(const char *domain, struct GUID *guid)
 {
+        char *protect_ids;
         fstring key;
 
+        protect_ids = secrets_fetch(protect_ids_keystr(domain), NULL);
+        if (protect_ids) {
+                if (strncmp(protect_ids, "TRUE", 4)) {
+                        DEBUG(0, ("Refusing to store a Domain SID, "
+                                  "it has been marked as protected!\n"));
+                        SAFE_FREE(protect_ids);
+                        return false;
+                }
+        }
+        SAFE_FREE(protect_ids);
+
         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
-        strupper_m(key);
+        if (!strupper_m(key)) {
+                return false;
+        }
         return secrets_store(key, guid, sizeof(struct GUID));
 }
@@ -103 +168 @@
 
         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
-        strupper_m(key);
+        if (!strupper_m(key)) {
+                return false;
+        }
         dyn_guid = (struct GUID *)secrets_fetch(key, &size);
 
@@ -218 +285 @@
 
 /************************************************************************
- Lock the trust password entry.
-************************************************************************/
-
-void *secrets_get_trust_account_lock(TALLOC_CTX *mem_ctx, const char *domain)
-{
-        struct db_context *db_ctx;
-        if (!secrets_init()) {
-                return NULL;
-        }
-
-        db_ctx = secrets_db_ctx();
-
-        return db_ctx->fetch_locked(
-                db_ctx, mem_ctx, string_term_tdb_data(trust_keystr(domain)));
-}
-
-/************************************************************************
  Routine to get the default secure channel type for trust accounts
 ************************************************************************/
@@ -241 +291 @@
 {
         if (lp_server_role() == ROLE_DOMAIN_BDC ||
-            lp_server_role() == ROLE_DOMAIN_PDC) {
+            lp_server_role() == ROLE_DOMAIN_PDC ||
+            lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
                 return SEC_CHAN_BDC;
         } else {
@@ -256 +307 @@
 
 bool secrets_fetch_trust_account_password_legacy(const char *domain,
-                                                 uint8 ret_pwd[16],
+                                                 uint8_t ret_pwd[16],
                                                  time_t *pass_last_set_time,
                                                  enum netr_SchannelType *channel)
@@ -284 +335 @@
         }
 
-        /* Test if machine password has expired and needs to be changed */
-        if (lp_machine_password_timeout()) {
-                if (pass->mod_time > 0 && time(NULL) > (pass->mod_time +
-                                (time_t)lp_machine_password_timeout())) {
-                        global_machine_password_needs_changing = True;
-                }
-        }
-
         SAFE_FREE(pass);
         return True;
@@ -302 +345 @@
 ************************************************************************/
 
-bool secrets_fetch_trust_account_password(const char *domain, uint8 ret_pwd[16],
+bool secrets_fetch_trust_account_password(const char *domain, uint8_t ret_pwd[16],
                                           time_t *pass_last_set_time,
                                           enum netr_SchannelType *channel)
@@ -337 +380 @@
 
 /************************************************************************
- Routine to delete the plaintext machine account password and old
- password if any
-************************************************************************/
-
-bool secrets_delete_machine_password(const char *domain)
-{
-        if (!secrets_delete_prev_machine_password(domain)) {
-                return false;
-        }
-        return secrets_delete(machine_password_keystr(domain));
-}
-
-/************************************************************************
  Routine to delete the plaintext machine account password, old password,
  sec channel type and last change time from secrets database
@@ -406 +436 @@
 {
         bool ret;
-        uint32 last_change_time;
-        uint32 sec_channel_type;
+        uint32_t last_change_time;
+        uint32_t sec_channel_type;
 
         if (!secrets_store_prev_machine_password(domain)) {
@@ -426 +456 @@
 }
 
+/************************************************************************
+ Set the machine trust account password, the old pw and last change
+ time, domain SID and salting principals based on values passed in
+ (added to supprt the secrets_tdb_sync module on secrets.ldb)
+************************************************************************/
+
+bool secrets_store_machine_pw_sync(const char *pass, const char *oldpass, const char *domain,
+                                   const char *realm,
+                                   const char *salting_principal, uint32_t supported_enc_types,
+                                   const struct dom_sid *domain_sid, uint32_t last_change_time,
+                                   uint32_t secure_channel_type,
+                                   bool delete_join)
+{
+        bool ret;
+        uint8_t last_change_time_store[4];
+        TALLOC_CTX *frame = talloc_stackframe();
+        uint8_t sec_channel_bytes[4];
+        void *value;
+
+        if (delete_join) {
+                secrets_delete_machine_password_ex(domain);
+                secrets_delete_domain_sid(domain);
+                TALLOC_FREE(frame);
+                return true;
+        }
+
+        ret = secrets_store(machine_password_keystr(domain), pass, strlen(pass)+1);
+        if (!ret) {
+                TALLOC_FREE(frame);
+                return ret;
+        }
+
+        if (oldpass) {
+                ret = secrets_store(machine_prev_password_keystr(domain), oldpass, strlen(oldpass)+1);
+        } else {
+                value = secrets_fetch_prev_machine_password(domain);
+                if (value) {
+                        SAFE_FREE(value);
+                        ret = secrets_delete_prev_machine_password(domain);
+                }
+        }
+        if (!ret) {
+                TALLOC_FREE(frame);
+                return ret;
+        }
+
+        if (secure_channel_type == 0) {
+                /* We delete this and instead have the read code fall back to
+                 * a default based on server role, as our caller can't specify
+                 * this with any more certainty */
+                value = secrets_fetch(machine_sec_channel_type_keystr(domain), NULL);
+                if (value) {
+                        SAFE_FREE(value);
+                        ret = secrets_delete(machine_sec_channel_type_keystr(domain));
+                        if (!ret) {
+                                TALLOC_FREE(frame);
+                                return ret;
+                        }
+                }
+        } else {
+                SIVAL(&sec_channel_bytes, 0, secure_channel_type);
+                ret = secrets_store(machine_sec_channel_type_keystr(domain), 
+                                    &sec_channel_bytes, sizeof(sec_channel_bytes));
+                if (!ret) {
+                        TALLOC_FREE(frame);
+                        return ret;
+                }
+        }
+
+        SIVAL(&last_change_time_store, 0, last_change_time);
+        ret = secrets_store(machine_last_change_time_keystr(domain),
+                            &last_change_time_store, sizeof(last_change_time));
+
+        if (!ret) {
+                TALLOC_FREE(frame);
+                return ret;
+        }
+
+        ret = secrets_store_domain_sid(domain, domain_sid);
+
+        if (!ret) {
+                TALLOC_FREE(frame);
+                return ret;
+        }
+
+        if (realm && salting_principal) {
+                char *key = talloc_asprintf(frame, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL, realm);
+                if (!key) {
+                        TALLOC_FREE(frame);
+                        return false;
+                }
+                ret = secrets_store(key, salting_principal, strlen(salting_principal)+1 );
+        }
+
+        TALLOC_FREE(frame);
+        return ret;
+}
+
 
 /************************************************************************
@@ -435 +563 @@
 {
         return (char *)secrets_fetch(machine_prev_password_keystr(domain), NULL);
+}
+
+/************************************************************************
+ Routine to fetch the last change time of the machine account password
+  for a realm
+************************************************************************/
+
+time_t secrets_fetch_pass_last_set_time(const char *domain)
+{
+        uint32_t *last_set_time;
+        time_t pass_last_set_time;
+
+        last_set_time = secrets_fetch(machine_last_change_time_keystr(domain),
+                                      NULL);
+        if (last_set_time) {
+                pass_last_set_time = IVAL(last_set_time,0);
+                SAFE_FREE(last_set_time);
+        } else {
+                pass_last_set_time = 0;
+        }
+
+        return pass_last_set_time;
 }
 
@@ -450 +600 @@
 
         if (pass_last_set_time) {
-                size_t size;
-                uint32 *last_set_time;
-                last_set_time = (unsigned int *)secrets_fetch(machine_last_change_time_keystr(domain), &size);
-                if (last_set_time) {
-                        *pass_last_set_time = IVAL(last_set_time,0);
-                        SAFE_FREE(last_set_time);
-                } else {
-                        *pass_last_set_time = 0;
-                }
+                *pass_last_set_time = secrets_fetch_pass_last_set_time(domain);
         }
 
         if (channel) {
                 size_t size;
-                uint32 *channel_type;
+                uint32_t *channel_type;
                 channel_type = (unsigned int *)secrets_fetch(machine_sec_channel_type_keystr(domain), &size);
                 if (channel_type) {

vendor/current/source3/passdb/machine_sid.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
    Password and authentication handling
@@ -22 +22 @@
 
 #include "includes.h"
-#include "passdb.h"
+#include "passdb/machine_sid.h"
 #include "secrets.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
 #include "../libcli/security/security.h"
 
@@ -98 +98 @@
         }
 
-        if (secrets_fetch_domain_sid(global_myname(), sam_sid)) {
+        if (secrets_fetch_domain_sid(lp_netbios_name(), sam_sid)) {
 
                 /* We got our sid. If not a pdc/bdc, we're done. */
@@ -121 +121 @@
 
                         DEBUG(0,("pdb_generate_sam_sid: Mismatched SIDs as a pdc/bdc.\n"));
-                        if (!secrets_store_domain_sid(global_myname(), &domain_sid)) {
+                        if (!secrets_store_domain_sid(lp_netbios_name(), &domain_sid)) {
                                 DEBUG(0,("pdb_generate_sam_sid: Can't re-store domain SID for local sid as PDC/BDC.\n"));
                                 SAFE_FREE(sam_sid);
@@ -140 +140 @@
         if (read_sid_from_file(fname, sam_sid)) {
                 /* remember it for future reference and unlink the old MACHINE.SID */
-                if (!secrets_store_domain_sid(global_myname(), sam_sid)) {
+                if (!secrets_store_domain_sid(lp_netbios_name(), sam_sid)) {
                         DEBUG(0,("pdb_generate_sam_sid: Failed to store SID from file.\n"));
                         SAFE_FREE(fname);
@@ -167 +167 @@
         generate_random_sid(sam_sid);
 
-        if (!secrets_store_domain_sid(global_myname(), sam_sid)) {
+        if (!secrets_store_domain_sid(lp_netbios_name(), sam_sid)) {
                 DEBUG(0,("pdb_generate_sam_sid: Failed to store generated machine SID.\n"));
                 SAFE_FREE(sam_sid);
@@ -181 +181 @@
 
         return sam_sid;
-}   
+}
 
 /* return our global_sam_sid */
@@ -195 +195 @@
          * pdb_generate_sam_sid() as needed
          *
-         * Note: this is garded by a transaction
+         * Note: this is guarded by a transaction
          *       to prevent races on startup which
          *       can happen with some dbwrap backends
@@ -205 +205 @@
         }
 
-        if (db->transaction_start(db) != 0) {
+        if (dbwrap_transaction_start(db) != 0) {
                 smb_panic("could not start transaction on secrets db");
         }
 
         if (!(global_sam_sid = pdb_generate_sam_sid())) {
-                db->transaction_cancel(db);
+                dbwrap_transaction_cancel(db);
                 smb_panic("could not generate a machine SID");
         }
 
-        if (db->transaction_commit(db) != 0) {
+        if (dbwrap_transaction_commit(db) != 0) {
                 smb_panic("could not start commit secrets db");
         }
@@ -221 +221 @@
 }
 
-/** 
- * Force get_global_sam_sid to requery the backends 
+/**
+ * Force get_global_sam_sid to requery the backends
  */
 void reset_global_sam_sid(void) 
@@ -230 +230 @@
 
 /*****************************************************************
- Check if the SID is our domain SID (S-1-5-21-x-y-z).
-*****************************************************************/  
-
-bool sid_check_is_domain(const struct dom_sid *sid)
+ Check if the SID is our sam SID (S-1-5-21-x-y-z).
+*****************************************************************/
+
+bool sid_check_is_our_sam(const struct dom_sid *sid)
 {
         return dom_sid_equal(sid, get_global_sam_sid());
@@ -240 +240 @@
 /*****************************************************************
  Check if the SID is our domain SID (S-1-5-21-x-y-z).
-*****************************************************************/  
-
-bool sid_check_is_in_our_domain(const struct dom_sid *sid)
+*****************************************************************/
+
+bool sid_check_is_in_our_sam(const struct dom_sid *sid)
 {
         struct dom_sid dom_sid;
@@ -248 +248 @@
         sid_copy(&dom_sid, sid);
         sid_split_rid(&dom_sid, NULL);
-        return sid_check_is_domain(&dom_sid);
-}
+        return sid_check_is_our_sam(&dom_sid);
+}

vendor/current/source3/passdb/machine_sid.h

@@ -23 +23 @@
 /* The following definitions come from passdb/machine_sid.c  */
 
+#ifndef _PASSDB_MACHINE_SID_H_
+#define _PASSDB_MACHINE_SID_H_
+
 struct dom_sid  *get_global_sam_sid(void);
 void reset_global_sam_sid(void) ;
-bool sid_check_is_domain(const struct dom_sid  *sid);
-bool sid_check_is_in_our_domain(const struct dom_sid  *sid);
+bool sid_check_is_our_sam(const struct dom_sid  *sid);
+bool sid_check_is_in_our_sam(const struct dom_sid  *sid);
+
+#endif /* _PASSDB_MACHINE_SID_H_ */

vendor/current/source3/passdb/passdb.c

@@ -31 +31 @@
 #include "../lib/util/util_pw.h"
 #include "util_tdb.h"
+#include "auth/credentials/credentials.h"
+#include "lib/param/param.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_PASSDB
-
-/******************************************************************
- Get the default domain/netbios name to be used when
- testing authentication.
-
- LEGACY: this function provides the legacy domain mapping used with
-         the lp_map_untrusted_to_domain() parameter
-******************************************************************/
-
-const char *my_sam_name(void)
-{
-       /* Standalone servers can only use the local netbios name */
-       if ( lp_server_role() == ROLE_STANDALONE )
-               return global_myname();
-
-       /* Default to the DOMAIN name when not specified */
-       return lp_workgroup();
-}
 
 /**********************************************************************
@@ -75 +59 @@
         struct samu *user;
 
-        if ( !(user = TALLOC_ZERO_P( ctx, struct samu )) ) {
+        if ( !(user = talloc_zero( ctx, struct samu )) ) {
                 DEBUG(0,("samuser_new: Talloc failed!\n"));
                 return NULL;
@@ -94 +78 @@
         user->logoff_time           = get_time_t_max();
         user->kickoff_time          = get_time_t_max();
-        user->pass_must_change_time = get_time_t_max();
         user->fields_present        = 0x00ffffff;
         user->logon_divs = 168;         /* hours per week */
@@ -147 +130 @@
 *********************************************************************/
 
-static NTSTATUS samu_set_unix_internal(struct samu *user, const struct passwd *pwd, bool create)
-{
-        const char *guest_account = lp_guestaccount();
-        const char *domain = global_myname();
+static NTSTATUS samu_set_unix_internal(struct pdb_methods *methods,
+                                       struct samu *user, const struct passwd *pwd, bool create)
+{
+        const char *guest_account = lp_guest_account();
+        const char *domain = lp_netbios_name();
         char *fullname;
         uint32_t urid;
@@ -229 +213 @@
 
                 pdb_set_profile_path(user, talloc_sub_specified(user, 
-                        lp_logon_path(), pwd->pw_name, domain, pwd->pw_uid, pwd->pw_gid), 
+                        lp_logon_path(), pwd->pw_name, NULL, domain, pwd->pw_uid, pwd->pw_gid),
                         PDB_DEFAULT);           
                 pdb_set_homedir(user, talloc_sub_specified(user, 
-                        lp_logon_home(), pwd->pw_name, domain, pwd->pw_uid, pwd->pw_gid),
+                        lp_logon_home(), pwd->pw_name, NULL, domain, pwd->pw_uid, pwd->pw_gid),
                         PDB_DEFAULT);
                 pdb_set_dir_drive(user, talloc_sub_specified(user, 
-                        lp_logon_drive(), pwd->pw_name, domain, pwd->pw_uid, pwd->pw_gid),
+                        lp_logon_drive(), pwd->pw_name, NULL, domain, pwd->pw_uid, pwd->pw_gid),
                         PDB_DEFAULT);
                 pdb_set_logon_script(user, talloc_sub_specified(user, 
-                        lp_logon_script(), pwd->pw_name, domain, pwd->pw_uid, pwd->pw_gid), 
+                        lp_logon_script(), pwd->pw_name, NULL, domain, pwd->pw_uid, pwd->pw_gid),
                         PDB_DEFAULT);
         }
@@ -247 +231 @@
            netr_SamInfo3 structure) */
 
-        if ( create && (pdb_capabilities() & PDB_CAP_STORE_RIDS)) {
+        if ( create && (methods->capabilities(methods) & PDB_CAP_STORE_RIDS)) {
                 uint32_t user_rid;
                 struct dom_sid user_sid;
 
-                if ( !pdb_new_rid( &user_rid ) ) {
+                if ( !methods->new_rid(methods, &user_rid) ) {
                         DEBUG(3, ("Could not allocate a new RID\n"));
                         return NT_STATUS_ACCESS_DENIED;
@@ -283 +267 @@
 NTSTATUS samu_set_unix(struct samu *user, const struct passwd *pwd)
 {
-        return samu_set_unix_internal( user, pwd, False );
-}
-
-NTSTATUS samu_alloc_rid_unix(struct samu *user, const struct passwd *pwd)
-{
-        return samu_set_unix_internal( user, pwd, True );
+        return samu_set_unix_internal( NULL, user, pwd, False );
+}
+
+NTSTATUS samu_alloc_rid_unix(struct pdb_methods *methods,
+                             struct samu *user, const struct passwd *pwd)
+{
+        return samu_set_unix_internal( methods, user, pwd, True );
 }
 
@@ -381 +366 @@
 {
         if (pwd != NULL) {
-                int i;
-                for (i = 0; i < 16; i++)
-                        slprintf(&p[i*2], 3, "%02X", pwd[i]);
+                hex_encode_buf(p, pwd, 16);
         } else {
                 if (acct_ctrl & ACB_PWNOTREQ)
-                        safe_strcpy(p, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX", 32);
+                        strlcpy(p, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX", 33);
                 else
-                        safe_strcpy(p, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 32);
+                        strlcpy(p, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 33);
         }
 }
@@ -432 +415 @@
 {
         if (hours != NULL) {
-                int i;
-                for (i = 0; i < 21; i++) {
-                        slprintf(&p[i*2], 3, "%02X", hours[i]);
-                }
+                hex_encode_buf(p, hours, 21);
         } else {
-                safe_strcpy(p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", 43);
+                strlcpy(p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", 44);
         }
 }
@@ -590 +570 @@
                             enum lsa_SidType *type)
 {
-        GROUP_MAP map;
+        GROUP_MAP *map;
         bool ret;
 
@@ -628 +608 @@
 
                 if (ret) {
-                        if (!sid_check_is_in_our_domain(&user_sid)) {
+                        if (!sid_check_is_in_our_sam(&user_sid)) {
                                 DEBUG(0, ("User %s with invalid SID %s in passdb\n",
                                           name, sid_string_dbg(&user_sid)));
@@ -644 +624 @@
          */
 
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                return false;
+        }
+
         become_root();
-        ret = pdb_getgrnam(&map, name);
+        ret = pdb_getgrnam(map, name);
         unbecome_root();
 
         if (!ret) {
+                TALLOC_FREE(map);
                 return False;
         }
 
         /* BUILTIN groups are looked up elsewhere */
-        if (!sid_check_is_in_our_domain(&map.sid)) {
+        if (!sid_check_is_in_our_sam(&map->sid)) {
                 DEBUG(10, ("Found group %s (%s) not in our domain -- "
-                           "ignoring.", name, sid_string_dbg(&map.sid)));
+                           "ignoring.\n",
+                           name, sid_string_dbg(&map->sid)));
+                TALLOC_FREE(map);
                 return False;
         }
 
         /* yes it's a mapped group */
-        sid_peek_rid(&map.sid, rid);
-        *type = map.sid_name_use;
+        sid_peek_rid(&map->sid, rid);
+        *type = map->sid_name_use;
+        TALLOC_FREE(map);
         return True;
 }
@@ -1019 +1008 @@
         pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
         pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
-        pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
         pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
 
@@ -1210 +1198 @@
         pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
         pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
-        pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
         pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
 
@@ -1401 +1388 @@
         pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
         pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
-        pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
         pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
 
@@ -1637 +1623 @@
         pdb_set_bad_password_time(sampass, convert_uint32_t_to_time_t(bad_password_time), PDB_SET);
         pdb_set_pass_can_change_time(sampass, convert_uint32_t_to_time_t(pass_can_change_time), PDB_SET);
-        pdb_set_pass_must_change_time(sampass, convert_uint32_t_to_time_t(pass_must_change_time), PDB_SET);
         pdb_set_pass_last_set_time(sampass, convert_uint32_t_to_time_t(pass_last_set_time), PDB_SET);
 
@@ -2299 +2284 @@
 *******************************************************************/
 
-bool get_trust_pw_clear(const char *domain, char **ret_pwd,
-                        const char **account_name,
-                        enum netr_SchannelType *channel)
+static bool get_trust_pw_clear2(const char *domain,
+                                const char **account_name,
+                                enum netr_SchannelType *channel,
+                                char **cur_pw,
+                                time_t *_last_set_time,
+                                char **prev_pw)
 {
         char *pwd;
         time_t last_set_time;
+
+        if (cur_pw != NULL) {
+                *cur_pw = NULL;
+        }
+        if (_last_set_time != NULL) {
+                *_last_set_time = 0;
+        }
+        if (prev_pw != NULL) {
+                *prev_pw = NULL;
+        }
 
         /* if we are a DC and this is not our domain, then lookup an account
@@ -2314 +2312 @@
                 }
 
-                if (!pdb_get_trusteddom_pw(domain, ret_pwd, NULL,
+                if (!pdb_get_trusteddom_pw(domain, cur_pw, NULL,
                                            &last_set_time))
                 {
@@ -2329 +2327 @@
                 if (account_name != NULL) {
                         *account_name = lp_workgroup();
+                }
+
+                if (_last_set_time != NULL) {
+                        *_last_set_time = last_set_time;
                 }
 
@@ -2354 +2356 @@
 
         if (pwd != NULL) {
-                *ret_pwd = pwd;
+                struct timeval expire;
+
+                *cur_pw = pwd;
+
                 if (account_name != NULL) {
-                        *account_name = global_myname();
+                        *account_name = lp_netbios_name();
+                }
+
+                if (_last_set_time != NULL) {
+                        *_last_set_time = last_set_time;
+                }
+
+                if (prev_pw == NULL) {
+                        return true;
+                }
+
+                ZERO_STRUCT(expire);
+                expire.tv_sec = lp_machine_password_timeout();
+                expire.tv_sec /= 2;
+                expire.tv_sec += last_set_time;
+                if (timeval_expired(&expire)) {
+                        return true;
+                }
+
+                pwd = secrets_fetch_prev_machine_password(lp_workgroup());
+                if (pwd != NULL) {
+                        *prev_pw = pwd;
                 }
 
@@ -2362 +2388 @@
         }
 
-        DEBUG(5, ("get_trust_pw_clear: could not fetch clear text trust "
+        DEBUG(5, ("get_trust_pw_clear2: could not fetch clear text trust "
                   "account password for domain %s\n", domain));
         return false;
+}
+
+bool get_trust_pw_clear(const char *domain, char **ret_pwd,
+                        const char **account_name,
+                        enum netr_SchannelType *channel)
+{
+        return get_trust_pw_clear2(domain,
+                                   account_name,
+                                   channel,
+                                   ret_pwd,
+                                   NULL,
+                                   NULL);
 }
 
@@ -2372 +2410 @@
 *******************************************************************/
 
+static bool get_trust_pw_hash2(const char *domain,
+                               const char **account_name,
+                               enum netr_SchannelType *channel,
+                               struct samr_Password *current_nt_hash,
+                               time_t *last_set_time,
+                               struct samr_Password **_previous_nt_hash)
+{
+        char *cur_pw = NULL;
+        char *prev_pw = NULL;
+        char **_prev_pw = NULL;
+        bool ok;
+
+        if (_previous_nt_hash != NULL) {
+                *_previous_nt_hash = NULL;
+                _prev_pw = &prev_pw;
+        }
+
+        ok = get_trust_pw_clear2(domain, account_name, channel,
+                                 &cur_pw, last_set_time, _prev_pw);
+        if (ok) {
+                struct samr_Password *previous_nt_hash = NULL;
+
+                E_md4hash(cur_pw, current_nt_hash->hash);
+                SAFE_FREE(cur_pw);
+
+                if (prev_pw == NULL) {
+                        return true;
+                }
+
+                previous_nt_hash = SMB_MALLOC_P(struct samr_Password);
+                if (previous_nt_hash == NULL) {
+                        return false;
+                }
+
+                E_md4hash(prev_pw, previous_nt_hash->hash);
+                SAFE_FREE(prev_pw);
+
+                *_previous_nt_hash = previous_nt_hash;
+                return true;
+        } else if (is_dc_trusted_domain_situation(domain)) {
+                return false;
+        }
+
+        /* as a fallback, try to get the hashed pwd directly from the tdb... */
+
+        if (secrets_fetch_trust_account_password_legacy(domain,
+                                                        current_nt_hash->hash,
+                                                        last_set_time,
+                                                        channel))
+        {
+                if (account_name != NULL) {
+                        *account_name = lp_netbios_name();
+                }
+
+                return true;
+        }
+
+        DEBUG(5, ("get_trust_pw_hash: could not fetch trust account "
+                "password for domain %s\n", domain));
+        return False;
+}
+
 bool get_trust_pw_hash(const char *domain, uint8_t ret_pwd[16],
                        const char **account_name,
                        enum netr_SchannelType *channel)
 {
-        char *pwd = NULL;
+        struct samr_Password current_nt_hash;
+        bool ok;
+
+        ok = get_trust_pw_hash2(domain, account_name, channel,
+                                &current_nt_hash, NULL, NULL);
+        if (!ok) {
+                return false;
+        }
+
+        memcpy(ret_pwd, current_nt_hash.hash, sizeof(current_nt_hash.hash));
+        return true;
+}
+
+NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
+                                   const char *dns_domain, /* optional */
+                                   TALLOC_CTX *mem_ctx,
+                                   struct cli_credentials **_creds)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
+        struct loadparm_context *lp_ctx;
+        enum netr_SchannelType channel;
         time_t last_set_time;
-
-        if (get_trust_pw_clear(domain, &pwd, account_name, channel)) {
-                E_md4hash(pwd, ret_pwd);
-                SAFE_FREE(pwd);
-                return true;
-        } else if (is_dc_trusted_domain_situation(domain)) {
-                return false;
-        }
-
-        /* as a fallback, try to get the hashed pwd directly from the tdb... */
-
-        if (secrets_fetch_trust_account_password_legacy(domain, ret_pwd,
-                                                        &last_set_time,
-                                                        channel))
-        {
-                if (account_name != NULL) {
-                        *account_name = global_myname();
-                }
-
-                return true;
-        }
-
-        DEBUG(5, ("get_trust_pw_hash: could not fetch trust account "
-                "password for domain %s\n", domain));
-        return False;
-}
+        const char *_account_name;
+        const char *account_name;
+        char *cur_pw = NULL;
+        char *prev_pw = NULL;
+        struct samr_Password cur_nt_hash;
+        struct cli_credentials *creds = NULL;
+        bool ok;
+
+        /*
+         * If this is our primary trust relationship, use the common
+         * code to read the secrets.ldb or secrets.tdb file.
+         */
+        if (strequal(netbios_domain, lp_workgroup())) {
+                struct db_context *db_ctx = secrets_db_ctx();
+                if (db_ctx == NULL) {
+                        DEBUG(1, ("failed to open secrets.tdb to obtain our trust credentials for %s\n",
+                                  netbios_domain));
+                        status = NT_STATUS_INTERNAL_ERROR;
+                        goto fail;
+                }
+
+                lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
+                if (lp_ctx == NULL) {
+                        DEBUG(1, ("loadparm_init_s3 failed\n"));
+                        status = NT_STATUS_INTERNAL_ERROR;
+                        goto fail;
+                }
+
+                creds = cli_credentials_init(mem_ctx);
+                if (creds == NULL) {
+                        status = NT_STATUS_NO_MEMORY;
+                        goto fail;
+                }
+
+                cli_credentials_set_conf(creds, lp_ctx);
+
+                ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
+                if (!ok) {
+                        status = NT_STATUS_NO_MEMORY;
+                        goto fail;
+                }
+
+                status = cli_credentials_set_machine_account_db_ctx(creds,
+                                                                    lp_ctx,
+                                                                    db_ctx);
+                if (!NT_STATUS_IS_OK(status)) {
+                        goto fail;
+                }
+                goto done;
+        } else if (!IS_DC) {
+                DEBUG(1, ("Refusing to get trust account info for %s, "
+                          "which is not our primary domain %s, "
+                          "as we are not a DC\n",
+                          netbios_domain, lp_workgroup()));
+                status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+                goto fail;
+        }
+
+        status = pdb_get_trusteddom_creds(netbios_domain, mem_ctx, &creds);
+        if (NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+        if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                goto fail;
+        }
+
+        ok = get_trust_pw_clear2(netbios_domain,
+                                 &_account_name,
+                                 &channel,
+                                 &cur_pw,
+                                 &last_set_time,
+                                 &prev_pw);
+        if (!ok) {
+                ok = get_trust_pw_hash2(netbios_domain,
+                                        &_account_name,
+                                        &channel,
+                                        &cur_nt_hash,
+                                        &last_set_time,
+                                        NULL);
+                if (!ok) {
+                        DEBUG(1, ("get_trust_pw_*2 failed for domain[%s]\n",
+                                  netbios_domain));
+                        status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+                        goto fail;
+                }
+        }
+
+        account_name = talloc_asprintf(frame, "%s$", _account_name);
+        if (account_name == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
+        if (lp_ctx == NULL) {
+                DEBUG(1, ("loadparm_init_s3 failed\n"));
+                status = NT_STATUS_INTERNAL_ERROR;
+                goto fail;
+        }
+
+        creds = cli_credentials_init(mem_ctx);
+        if (creds == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        cli_credentials_set_conf(creds, lp_ctx);
+
+        cli_credentials_set_secure_channel_type(creds, channel);
+        cli_credentials_set_password_last_changed_time(creds, last_set_time);
+
+        ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
+        if (!ok) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        if (dns_domain != NULL) {
+                ok = cli_credentials_set_realm(creds, dns_domain, CRED_SPECIFIED);
+                if (!ok) {
+                        status = NT_STATUS_NO_MEMORY;
+                        goto fail;
+                }
+        }
+
+        ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED);
+        if (!ok) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        if (cur_pw == NULL) {
+                ok = cli_credentials_set_nt_hash(creds, &cur_nt_hash, CRED_SPECIFIED);
+                if (!ok) {
+                        status = NT_STATUS_NO_MEMORY;
+                        goto fail;
+                }
+                goto done;
+        }
+
+        ok = cli_credentials_set_password(creds, cur_pw, CRED_SPECIFIED);
+        if (!ok) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        if (prev_pw != NULL) {
+                ok = cli_credentials_set_old_password(creds, prev_pw, CRED_SPECIFIED);
+                if (!ok) {
+                        status = NT_STATUS_NO_MEMORY;
+                        goto fail;
+                }
+        }
+
+ done:
+        *_creds = creds;
+        creds = NULL;
+        status = NT_STATUS_OK;
+ fail:
+        TALLOC_FREE(creds);
+        SAFE_FREE(cur_pw);
+        SAFE_FREE(prev_pw);
+        TALLOC_FREE(frame);
+        return status;
+}

vendor/current/source3/passdb/pdb_compat.c

@@ -29 +29 @@
 #define DBGC_CLASS DBGC_PASSDB
 
-uint32 pdb_get_user_rid (const struct samu *sampass)
+uint32_t pdb_get_user_rid (const struct samu *sampass)
 {
-        uint32 u_rid;
+        uint32_t u_rid;
 
         if (sampass)
@@ -40 +40 @@
 }
 
-uint32 pdb_get_group_rid (struct samu *sampass)
+uint32_t pdb_get_group_rid (struct samu *sampass)
 {
-        uint32 g_rid;
+        uint32_t g_rid;
 
         if (sampass)
@@ -50 +50 @@
 }
 
-bool pdb_set_user_sid_from_rid (struct samu *sampass, uint32 rid, enum pdb_value_state flag)
+bool pdb_set_user_sid_from_rid (struct samu *sampass, uint32_t rid, enum pdb_value_state flag)
 {
         struct dom_sid u_sid;
@@ -76 +76 @@
 }
 
-bool pdb_set_group_sid_from_rid (struct samu *sampass, uint32 grid, enum pdb_value_state flag)
+bool pdb_set_group_sid_from_rid (struct samu *sampass, uint32_t grid, enum pdb_value_state flag)
 {
         struct dom_sid g_sid;

vendor/current/source3/passdb/pdb_get_set.c

@@ -65 +65 @@
  ********************************************************************/
 
-time_t pdb_password_change_time_max(void)
+static time_t pdb_password_change_time_max(void)
 {
         return 0x7FFFFFFF;
@@ -170 +170 @@
 }
 
-const uint8 *pdb_get_hours(const struct samu *sampass)
+const uint8_t *pdb_get_hours(const struct samu *sampass)
 {
         return (sampass->hours);
 }
 
-const uint8 *pdb_get_nt_passwd(const struct samu *sampass)
+const uint8_t *pdb_get_nt_passwd(const struct samu *sampass)
 {
         SMB_ASSERT((!sampass->nt_pw.data) 
                    || sampass->nt_pw.length == NT_HASH_LEN);
-        return (uint8 *)sampass->nt_pw.data;
-}
-
-const uint8 *pdb_get_lanman_passwd(const struct samu *sampass)
+        return (uint8_t *)sampass->nt_pw.data;
+}
+
+const uint8_t *pdb_get_lanman_passwd(const struct samu *sampass)
 {
         SMB_ASSERT((!sampass->lm_pw.data) 
                    || sampass->lm_pw.length == LM_HASH_LEN);
-        return (uint8 *)sampass->lm_pw.data;
-}
-
-const uint8 *pdb_get_pw_history(const struct samu *sampass, uint32_t *current_hist_len)
+        return (uint8_t *)sampass->lm_pw.data;
+}
+
+const uint8_t *pdb_get_pw_history(const struct samu *sampass, uint32_t *current_hist_len)
 {
         SMB_ASSERT((!sampass->nt_pw_his.data) 
            || ((sampass->nt_pw_his.length % PW_HISTORY_ENTRY_LEN) == 0));
         *current_hist_len = sampass->nt_pw_his.length / PW_HISTORY_ENTRY_LEN;
-        return (uint8 *)sampass->nt_pw_his.data;
+        return (uint8_t *)sampass->nt_pw_his.data;
 }
 
@@ -399 +399 @@
         sampass->pass_can_change_time = mytime;
         return pdb_set_init_flags(sampass, PDB_CANCHANGETIME, flag);
-}
-
-bool pdb_set_pass_must_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
-{
-        sampass->pass_must_change_time = mytime;
-        return pdb_set_init_flags(sampass, PDB_MUSTCHANGETIME, flag);
 }
 
@@ -504 +498 @@
 }
 
-bool pdb_set_user_sid_from_string(struct samu *sampass, fstring u_sid, enum pdb_value_state flag)
+bool pdb_set_user_sid_from_string(struct samu *sampass, const char *u_sid, enum pdb_value_state flag)
 {
         struct dom_sid new_sid;
@@ -543 +537 @@
                 return False;
 
-        if ( !(sampass->group_sid = TALLOC_P( sampass, struct dom_sid )) ) {
+        if ( !(sampass->group_sid = talloc( sampass, struct dom_sid )) ) {
                 return False;
         }
@@ -837 +831 @@
  ********************************************************************/
 
-bool pdb_set_nt_passwd(struct samu *sampass, const uint8 pwd[NT_HASH_LEN], enum pdb_value_state flag)
+bool pdb_set_nt_passwd(struct samu *sampass, const uint8_t pwd[NT_HASH_LEN], enum pdb_value_state flag)
 {
         data_blob_clear_free(&sampass->nt_pw);
@@ -855 +849 @@
  ********************************************************************/
 
-bool pdb_set_lanman_passwd(struct samu *sampass, const uint8 pwd[LM_HASH_LEN], enum pdb_value_state flag)
+bool pdb_set_lanman_passwd(struct samu *sampass, const uint8_t pwd[LM_HASH_LEN], enum pdb_value_state flag)
 {
         data_blob_clear_free(&sampass->lm_pw);
@@ -873 +867 @@
  Set the user's password history hash. historyLen is the number of 
  PW_HISTORY_SALT_LEN+SALTED_MD5_HASH_LEN length
- entries to store in the history - this must match the size of the uint8 array
+ entries to store in the history - this must match the size of the uint8_t array
  in pwd.
 ********************************************************************/
 
-bool pdb_set_pw_history(struct samu *sampass, const uint8 *pwd, uint32_t historyLen, enum pdb_value_state flag)
-{
+bool pdb_set_pw_history(struct samu *sampass, const uint8_t *pwd, uint32_t historyLen, enum pdb_value_state flag)
+{
+        DATA_BLOB new_nt_pw_his = {};
+
         if (historyLen && pwd){
-                data_blob_free(&(sampass->nt_pw_his));
-                sampass->nt_pw_his = data_blob_talloc(sampass,
-                                                pwd, historyLen*PW_HISTORY_ENTRY_LEN);
-                if (!sampass->nt_pw_his.length) {
+                new_nt_pw_his = data_blob_talloc(sampass,
+                                                 pwd, historyLen*PW_HISTORY_ENTRY_LEN);
+                if (new_nt_pw_his.length == 0) {
                         DEBUG(0, ("pdb_set_pw_history: data_blob_talloc() failed!\n"));
                         return False;
                 }
-        } else {
-                sampass->nt_pw_his = data_blob_talloc(sampass, NULL, 0);
-        }
+        }
+
+        data_blob_free(&sampass->nt_pw_his);
+        sampass->nt_pw_his = new_nt_pw_his;
 
         return pdb_set_init_flags(sampass, PDB_PWHISTORY, flag);
@@ -950 +946 @@
 }
 
-bool pdb_set_hours(struct samu *sampass, const uint8 *hours, int hours_len,
+bool pdb_set_hours(struct samu *sampass, const uint8_t *hours, int hours_len,
                    enum pdb_value_state flag)
 {
@@ -1004 +1000 @@
         uchar new_lanman_p16[LM_HASH_LEN];
         uchar new_nt_p16[NT_HASH_LEN];
-        uchar *pwhistory;
-        uint32_t pwHistLen;
-        uint32_t current_history_len;
 
         if (!plaintext)
@@ -1035 +1028 @@
         if (!pdb_set_pass_last_set_time (sampass, time(NULL), PDB_CHANGED))
                 return False;
+
+        
+        return pdb_update_history(sampass, new_nt_p16);
+}
+
+/*********************************************************************
+ Update password history after change 
+ ********************************************************************/
+
+bool pdb_update_history(struct samu *sampass, const uint8_t new_nt[NT_HASH_LEN])
+{
+        uchar *pwhistory;
+        uint32_t pwHistLen;
+        uint32_t current_history_len;
+        const uint8_t *current_history;
 
         if ((pdb_get_acct_ctrl(sampass) & ACB_NORMAL) == 0) {
@@ -1057 +1065 @@
          * and now.... JRA.
          */
-        pwhistory = (uchar *)pdb_get_pw_history(sampass, &current_history_len);
-
-        if ((current_history_len != 0) && (pwhistory == NULL)) {
-                DEBUG(1, ("pdb_set_plaintext_passwd: pwhistory == NULL!\n"));
+        current_history = pdb_get_pw_history(sampass, &current_history_len);
+        if ((current_history_len != 0) && (current_history == NULL)) {
+                DEBUG(1, ("pdb_update_history: pwhistory == NULL!\n"));
                 return false;
         }
 
-        if (current_history_len < pwHistLen) {
-                /*
-                 * Ensure we have space for the needed history. This
-                 * also takes care of an account which did not have
-                 * any history at all so far, i.e. pwhistory==NULL
-                 */
-                uchar *new_history = talloc_zero_array(
+        /*
+         * Ensure we have space for the needed history. This
+         * also takes care of an account which did not have
+         * any history at all so far, i.e. pwhistory==NULL
+         */
+        pwhistory = talloc_zero_array(
                         sampass, uchar,
                         pwHistLen*PW_HISTORY_ENTRY_LEN);
-
-                if (!new_history) {
-                        return False;
-                }
-
-                memcpy(new_history, pwhistory,
-                       current_history_len*PW_HISTORY_ENTRY_LEN);
-
-                pwhistory = new_history;
-        }
+        if (!pwhistory) {
+                return false;
+        }
+
+        memcpy(pwhistory, current_history,
+               current_history_len*PW_HISTORY_ENTRY_LEN);
 
         /*
@@ -1106 +1108 @@
          * the salt+newpw.
          */
-        memcpy(&pwhistory[PW_HISTORY_SALT_LEN], new_nt_p16, SALTED_MD5_HASH_LEN);
+        memcpy(&pwhistory[PW_HISTORY_SALT_LEN], new_nt, SALTED_MD5_HASH_LEN);
 
         pdb_set_pw_history(sampass, pwhistory, pwHistLen, PDB_CHANGED);
 
         return True;
+
 }
 
@@ -1119 +1122 @@
         return 0x00ffffff;
 }
+
+/**********************************************************************
+ Helper function to determine for update_sam_account whether
+ we need LDAP modification.
+*********************************************************************/
+
+bool pdb_element_is_changed(const struct samu *sampass,
+                            enum pdb_elements element)
+{
+        return IS_SAM_CHANGED(sampass, element);
+}
+
+/**********************************************************************
+ Helper function to determine for update_sam_account whether
+ we need LDAP modification.
+ *********************************************************************/
+
+bool pdb_element_is_set_or_changed(const struct samu *sampass,
+                                   enum pdb_elements element)
+{
+        return (IS_SAM_SET(sampass, element) ||
+                IS_SAM_CHANGED(sampass, element));
+}

vendor/current/source3/passdb/pdb_interface.c

@@ -25 +25 @@
 #include "passdb.h"
 #include "secrets.h"
+#include "messages.h"
 #include "../librpc/gen_ndr/samr.h"
-#include "memcache.h"
+#include "../librpc/gen_ndr/drsblobs.h"
+#include "../librpc/gen_ndr/ndr_drsblobs.h"
+#include "../librpc/gen_ndr/idmap.h"
+#include "../lib/util/memcache.h"
 #include "nsswitch/winbind_client.h"
 #include "../libcli/security/security.h"
 #include "../lib/util/util_pw.h"
+#include "passdb/pdb_secrets.h"
+#include "lib/util_sid_passdb.h"
+#include "idmap_cache.h"
 
 #undef DBGC_CLASS
@@ -48 +55 @@
 }
 
-static bool lookup_global_sam_rid(TALLOC_CTX *mem_ctx, uint32 rid,
+static bool lookup_global_sam_rid(TALLOC_CTX *mem_ctx, uint32_t rid,
                                   const char **name,
                                   enum lsa_SidType *psid_name_use,
-                                  union unid_t *unix_id);
+                                  uid_t *uid, gid_t *gid);
 
 NTSTATUS smb_register_passdb(int version, const char *name, pdb_init_function init) 
@@ -97 +104 @@
         return NULL;
 }
+
+const struct pdb_init_function_entry *pdb_get_backends(void)
+{
+        return backends;
+}
+
 
 /*
@@ -108 +121 @@
  */
 
-static struct event_context *pdb_event_ctx;
-
-struct event_context *pdb_get_event_context(void)
-{
-        return pdb_event_ctx;
+static struct tevent_context *pdb_tevent_ctx;
+
+struct tevent_context *pdb_get_tevent_context(void)
+{
+        return pdb_tevent_ctx;
 }
 
@@ -189 +202 @@
                 }
                 if ( !NT_STATUS_IS_OK( make_pdb_method_name( &pdb, lp_passdb_backend() ) ) ) {
-                        char *msg = NULL;
-                        if (asprintf(&msg, "pdb_get_methods_reload: "
-                                        "failed to get pdb methods for backend %s\n",
-                                        lp_passdb_backend()) > 0) {
-                                smb_panic(msg);
-                        } else {
-                                smb_panic("pdb_get_methods_reload");
-                        }
+                        return NULL;
                 }
         }
@@ -202 +208 @@
         if ( !pdb ) {
                 if ( !NT_STATUS_IS_OK( make_pdb_method_name( &pdb, lp_passdb_backend() ) ) ) {
-                        char *msg = NULL;
-                        if (asprintf(&msg, "pdb_get_methods_reload: "
-                                        "failed to get pdb methods for backend %s\n",
-                                        lp_passdb_backend()) > 0) {
-                                smb_panic(msg);
-                        } else {
-                                smb_panic("pdb_get_methods_reload");
-                        }
+                        return NULL;
                 }
         }
@@ -218 +217 @@
 static struct pdb_methods *pdb_get_methods(void)
 {
-        return pdb_get_methods_reload(False);
+        struct pdb_methods *pdb;
+
+        pdb = pdb_get_methods_reload(false);
+        if (!pdb) {
+                char *msg = NULL;
+                if (asprintf(&msg, "pdb_get_methods: "
+                             "failed to get pdb methods for backend %s\n",
+                             lp_passdb_backend()) > 0) {
+                        smb_panic(msg);
+                } else {
+                        smb_panic("pdb_get_methods");
+                }
+        }
+
+        return pdb;
 }
 
@@ -356 +369 @@
         struct passwd *pwd;
         NTSTATUS result;
-        const char *guestname = lp_guestaccount();
+        const char *guestname = lp_guest_account();
 
         pwd = Get_Pwnam_alloc(talloc_tos(), guestname);
@@ -448 +461 @@
 
                 if ((acb_info & ACB_NORMAL) && name[strlen(name)-1] != '$') {
-                        add_script = talloc_strdup(tmp_ctx,
-                                        lp_adduser_script());
+                        add_script = lp_add_user_script(tmp_ctx);
                 } else {
-                        add_script = talloc_strdup(tmp_ctx,
-                                        lp_addmachine_script());
+                        add_script = lp_add_machine_script(tmp_ctx);
                 }
 
@@ -464 +475 @@
                    compatibility with previous Samba releases */
                 fstrcpy( name2, name );
-                strlower_m( name2 );
+                if (!strlower_m( name2 )) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
                 add_script = talloc_all_string_sub(tmp_ctx,
                                         add_script,
@@ -491 +504 @@
         /* we have a valid SID coming out of this call */
 
-        status = samu_alloc_rid_unix( sam_pass, pwd );
+        status = samu_alloc_rid_unix(methods, sam_pass, pwd);
 
         TALLOC_FREE( pwd );
@@ -516 +529 @@
         pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED);
 
-        status = pdb_add_sam_account(sam_pass);
+        status = methods->add_sam_account(methods, sam_pass);
 
         TALLOC_FREE(sam_pass);
@@ -546 +559 @@
         }
 
-        del_script = talloc_strdup(talloc_tos(), lp_deluser_script());
+        del_script = lp_delete_user_script(talloc_tos());
         if (!del_script || !*del_script) {
                 return -1;
@@ -574 +587 @@
         fstring username;
 
-        status = pdb_delete_sam_account(sam_acct);
+        status = methods->delete_sam_account(methods, sam_acct);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -590 +603 @@
 
         fstrcpy( username, pdb_get_username(sam_acct) );
-        strlower_m( username );
+        if (!strlower_m( username )) {
+                return status;
+        }
 
         smb_delete_user( username );
@@ -601 +616 @@
         struct pdb_methods *pdb = pdb_get_methods();
         uid_t uid = -1;
+        NTSTATUS status;
+        const struct dom_sid *user_sid;
+        char *msg_data;
+
+        user_sid = pdb_get_user_sid(sam_acct);
 
         /* sanity check to make sure we don't delete root */
 
-        if ( !sid_to_uid( pdb_get_user_sid(sam_acct), &uid ) ) {
+        if ( !sid_to_uid(user_sid, &uid ) ) {
                 return NT_STATUS_NO_SUCH_USER;
         }
@@ -612 +632 @@
         }
 
-        return pdb->delete_user(pdb, mem_ctx, sam_acct);
+        memcache_delete(NULL,
+                        PDB_GETPWSID_CACHE,
+                        data_blob_const(user_sid, sizeof(*user_sid)));
+
+        status = pdb->delete_user(pdb, mem_ctx, sam_acct);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        msg_data = talloc_asprintf(mem_ctx, "USER %s",
+                                   pdb_get_username(sam_acct));
+        if (!msg_data) {
+                /* not fatal, and too late to rollback,
+                 * just return */
+                return status;
+        }
+        message_send_all(server_messaging_context(),
+                         ID_CACHE_DELETE,
+                         msg_data,
+                         strlen(msg_data) + 1,
+                         NULL);
+
+        TALLOC_FREE(msg_data);
+        return status;
 }
 
@@ -633 +676 @@
 {
         struct pdb_methods *pdb = pdb_get_methods();
-
-        memcache_flush(NULL, PDB_GETPWSID_CACHE);
+        const struct dom_sid *user_sid = pdb_get_user_sid(sam_acct);
+
+        memcache_delete(NULL,
+                        PDB_GETPWSID_CACHE,
+                        data_blob_const(user_sid, sizeof(*user_sid)));
 
         return pdb->delete_sam_account(pdb, sam_acct);
@@ -740 +786 @@
 {
         struct dom_sid group_sid;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         NTSTATUS status;
         struct group *grp;
         const char *grp_name;
 
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
         /* coverity */
-        map.gid = (gid_t) -1;
+        map->gid = (gid_t) -1;
 
         sid_compose(&group_sid, get_global_sam_sid(), rid);
 
-        if (!get_domain_group_from_sid(group_sid, &map)) {
+        if (!get_domain_group_from_sid(group_sid, map)) {
                 DEBUG(10, ("Could not find group for rid %d\n", rid));
                 return NT_STATUS_NO_SUCH_GROUP;
@@ -757 +808 @@
         /* We need the group name for the smb_delete_group later on */
 
-        if (map.gid == (gid_t)-1) {
+        if (map->gid == (gid_t)-1) {
                 return NT_STATUS_NO_SUCH_GROUP;
         }
 
-        grp = getgrgid(map.gid);
+        grp = getgrgid(map->gid);
         if (grp == NULL) {
                 return NT_STATUS_NO_SUCH_GROUP;
         }
+
+        TALLOC_FREE(map);
 
         /* Copy the name, no idea what pdb_delete_group_mapping_entry does.. */
@@ -810 +863 @@
 }
 
-bool pdb_enum_group_mapping(const struct dom_sid *sid, enum lsa_SidType sid_name_use, GROUP_MAP **pp_rmap,
-                            size_t *p_num_entries, bool unix_only)
+bool pdb_enum_group_mapping(const struct dom_sid *sid,
+                            enum lsa_SidType sid_name_use,
+                            GROUP_MAP ***pp_rmap,
+                            size_t *p_num_entries,
+                            bool unix_only)
 {
         struct pdb_methods *pdb = pdb_get_methods();
@@ -917 +973 @@
         struct dom_sid group_sid, member_sid;
         struct samu *account = NULL;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         struct group *grp;
         struct passwd *pwd;
@@ -923 +979 @@
         uid_t uid;
 
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
         /* coverity */
-        map.gid = (gid_t) -1;
+        map->gid = (gid_t) -1;
 
         sid_compose(&group_sid, get_global_sam_sid(), group_rid);
         sid_compose(&member_sid, get_global_sam_sid(), member_rid);
 
-        if (!get_domain_group_from_sid(group_sid, &map) ||
-            (map.gid == (gid_t)-1) ||
-            ((grp = getgrgid(map.gid)) == NULL)) {
+        if (!get_domain_group_from_sid(group_sid, map) ||
+            (map->gid == (gid_t)-1) ||
+            ((grp = getgrgid(map->gid)) == NULL)) {
                 return NT_STATUS_NO_SUCH_GROUP;
         }
+
+        TALLOC_FREE(map);
 
         group_name = talloc_strdup(mem_ctx, grp->gr_name);
@@ -982 +1045 @@
         struct dom_sid group_sid, member_sid;
         struct samu *account = NULL;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         struct group *grp;
         struct passwd *pwd;
@@ -988 +1051 @@
         uid_t uid;
 
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
         sid_compose(&group_sid, get_global_sam_sid(), group_rid);
         sid_compose(&member_sid, get_global_sam_sid(), member_rid);
 
-        if (!get_domain_group_from_sid(group_sid, &map) ||
-            (map.gid == (gid_t)-1) ||
-            ((grp = getgrgid(map.gid)) == NULL)) {
+        if (!get_domain_group_from_sid(group_sid, map) ||
+            (map->gid == (gid_t)-1) ||
+            ((grp = getgrgid(map->gid)) == NULL)) {
                 return NT_STATUS_NO_SUCH_GROUP;
         }
+
+        TALLOC_FREE(map);
 
         group_name = talloc_strdup(mem_ctx, grp->gr_name);
@@ -1105 +1175 @@
 }
 
-/* 
- * NOTE: pdb_lookup_names is currently (2007-01-12) not used anywhere 
- *       in the samba code.
- *       Unlike _lsa_lookup_sids and _samr_lookup_rids, which eventually 
- *       also ask pdb_lookup_rids, thus looking up a bunch of rids at a time, 
- *       the pdb_ calls _lsa_lookup_names and _samr_lookup_names come
- *       down to are pdb_getsampwnam and pdb_getgrnam instead of
- *       pdb_lookup_names.
- *       But in principle, it the call belongs to the API and might get
- *       used in this context some day. 
- */
-#if 0
-NTSTATUS pdb_lookup_names(const struct dom_sid *domain_sid,
-                          int num_names,
-                          const char **names,
-                          uint32_t *rids,
-                          enum lsa_SidType *attrs)
-{
-        struct pdb_methods *pdb = pdb_get_methods();
-        return pdb->lookup_names(pdb, domain_sid, num_names, names, rids, attrs);
-}
-#endif
-
 bool pdb_get_account_policy(enum pdb_policy_type type, uint32_t *value)
 {
@@ -1158 +1205 @@
 }
 
-bool pdb_uid_to_sid(uid_t uid, struct dom_sid *sid)
-{
-        struct pdb_methods *pdb = pdb_get_methods();
-        return pdb->uid_to_sid(pdb, uid, sid);
-}
-
-bool pdb_gid_to_sid(gid_t gid, struct dom_sid *sid)
-{
-        struct pdb_methods *pdb = pdb_get_methods();
-        return pdb->gid_to_sid(pdb, gid, sid);
-}
-
-bool pdb_sid_to_id(const struct dom_sid *sid, union unid_t *id,
-                   enum lsa_SidType *type)
-{
-        struct pdb_methods *pdb = pdb_get_methods();
-        return pdb->sid_to_id(pdb, sid, id, type);
+/* 
+ * Instead of passing down a gid or uid, this function sends down a pointer
+ * to a unixid. 
+ *
+ * This acts as an in-out variable so that the idmap functions can correctly
+ * receive ID_TYPE_BOTH, filling in cache details correctly rather than forcing
+ * the cache to store ID_TYPE_UID or ID_TYPE_GID. 
+ */
+bool pdb_id_to_sid(struct unixid *id, struct dom_sid *sid)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        bool ret;
+
+        ret = pdb->id_to_sid(pdb, id, sid);
+
+        if (ret == true) {
+                idmap_cache_set_sid2unixid(sid, id);
+        }
+
+        return ret;
+}
+
+bool pdb_sid_to_id(const struct dom_sid *sid, struct unixid *id)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        bool ret;
+
+        /* only ask the backend if it is responsible */
+        if (!sid_check_object_is_for_passdb(sid)) {
+                return false;
+        }
+
+        ret = pdb->sid_to_id(pdb, sid, id);
+
+        if (ret == true) {
+                idmap_cache_set_sid2unixid(sid, id);
+        }
+
+        return ret;
 }
 
@@ -1231 +1300 @@
                 /* validate that the RID is not in use */
 
-                if ( lookup_global_sam_rid( ctx, allocated_rid, &name, &type, NULL ) ) {
+                if (lookup_global_sam_rid(ctx, allocated_rid, &name, &type, NULL, NULL)) {
                         allocated_rid = 0;
                 }
@@ -1254 +1323 @@
  ***************************************************************/
 
-bool initialize_password_db(bool reload, struct event_context *event_ctx)
-{
-        pdb_event_ctx = event_ctx;
+bool initialize_password_db(bool reload, struct tevent_context *tevent_ctx)
+{
+        if (tevent_ctx) {
+                pdb_tevent_ctx = tevent_ctx;
+        }
         return (pdb_get_methods_reload(reload) != NULL);
 }
-
 
 /***************************************************************************
@@ -1325 +1395 @@
         bool ret;
 
-        unix_pw = sys_getpwuid( uid );
+        unix_pw = getpwuid( uid );
 
         if ( !unix_pw ) {
@@ -1360 +1430 @@
                                    struct dom_sid *sid)
 {
-        GROUP_MAP map;
-
-        if (!NT_STATUS_IS_OK(methods->getgrgid(methods, &map, gid))) {
-                return False;
-        }
-
-        sid_copy(sid, &map.sid);
-        return True;
+        GROUP_MAP *map;
+
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                return false;
+        }
+
+        if (!NT_STATUS_IS_OK(methods->getgrgid(methods, map, gid))) {
+                TALLOC_FREE(map);
+                return false;
+        }
+
+        sid_copy(sid, &map->sid);
+        TALLOC_FREE(map);
+        return true;
+}
+
+static bool pdb_default_id_to_sid(struct pdb_methods *methods, struct unixid *id,
+                                   struct dom_sid *sid)
+{
+        switch (id->type) {
+        case ID_TYPE_UID:
+                return pdb_default_uid_to_sid(methods, id->id, sid);
+
+        case ID_TYPE_GID:
+                return pdb_default_gid_to_sid(methods, id->id, sid);
+
+        default:
+                return false;
+        }
+}
+/**
+ * The "Unix User" and "Unix Group" domains have a special
+ * id mapping that is a rid-algorithm with range starting at 0.
+ */
+bool pdb_sid_to_id_unix_users_and_groups(const struct dom_sid *sid,
+                                         struct unixid *id)
+{
+        uint32_t rid;
+
+        id->id = -1;
+
+        if (sid_peek_check_rid(&global_sid_Unix_Users, sid, &rid)) {
+                id->id = rid;
+                id->type = ID_TYPE_UID;
+                return true;
+        }
+
+        if (sid_peek_check_rid(&global_sid_Unix_Groups, sid, &rid)) {
+                id->id = rid;
+                id->type = ID_TYPE_GID;
+                return true;
+        }
+
+        return false;
 }
 
 static bool pdb_default_sid_to_id(struct pdb_methods *methods,
                                   const struct dom_sid *sid,
-                                  union unid_t *id, enum lsa_SidType *type)
+                                  struct unixid *id)
 {
         TALLOC_CTX *mem_ctx;
         bool ret = False;
-        const char *name;
         uint32_t rid;
+        id->id = -1;
 
         mem_ctx = talloc_new(NULL);
@@ -1387 +1504 @@
 
         if (sid_peek_check_rid(get_global_sam_sid(), sid, &rid)) {
+                const char *name;
+                enum lsa_SidType type;
+                uid_t uid = (uid_t)-1;
+                gid_t gid = (gid_t)-1;
                 /* Here we might have users as well as groups and aliases */
-                ret = lookup_global_sam_rid(mem_ctx, rid, &name, type, id);
+                ret = lookup_global_sam_rid(mem_ctx, rid, &name, &type, &uid, &gid);
+                if (ret) {
+                        switch (type) {
+                        case SID_NAME_DOM_GRP:
+                        case SID_NAME_ALIAS:
+                                id->type = ID_TYPE_GID;
+                                id->id = gid;
+                                break;
+                        case SID_NAME_USER:
+                                id->type = ID_TYPE_UID;
+                                id->id = uid;
+                                break;
+                        default:
+                                DEBUG(5, ("SID %s belongs to our domain, and "
+                                          "an object exists in the database, "
+                                           "but it is neither a user nor a "
+                                           "group (got type %d).\n",
+                                          sid_string_dbg(sid), type));
+                                ret = false;
+                        }
+                } else {
+                        DEBUG(5, ("SID %s belongs to our domain, but there is "
+                                  "no corresponding object in the database.\n",
+                                  sid_string_dbg(sid)));
+                }
                 goto done;
         }
 
-        /* check for "Unix User" */
-
-        if ( sid_peek_check_rid(&global_sid_Unix_Users, sid, &rid) ) {
-                id->uid = rid;
-                *type = SID_NAME_USER;
-                ret = True;             
-                goto done;              
-        }
-
-        /* check for "Unix Group" */
-
-        if ( sid_peek_check_rid(&global_sid_Unix_Groups, sid, &rid) ) {
-                id->gid = rid;
-                *type = SID_NAME_ALIAS;
-                ret = True;             
-                goto done;              
+        /*
+         * "Unix User" and "Unix Group"
+         */
+        ret = pdb_sid_to_id_unix_users_and_groups(sid, id);
+        if (ret == true) {
+                goto done;
         }
 
@@ -1415 +1550 @@
             sid_check_is_in_wellknown_domain(sid)) {
                 /* Here we only have aliases */
-                GROUP_MAP map;
-                if (!NT_STATUS_IS_OK(methods->getgrsid(methods, &map, *sid))) {
+                GROUP_MAP *map;
+
+                map = talloc_zero(mem_ctx, GROUP_MAP);
+                if (!map) {
+                        ret = false;
+                        goto done;
+                }
+
+                if (!NT_STATUS_IS_OK(methods->getgrsid(methods, map, *sid))) {
                         DEBUG(10, ("Could not find map for sid %s\n",
                                    sid_string_dbg(sid)));
                         goto done;
                 }
-                if ((map.sid_name_use != SID_NAME_ALIAS) &&
-                    (map.sid_name_use != SID_NAME_WKN_GRP)) {
+                if ((map->sid_name_use != SID_NAME_ALIAS) &&
+                    (map->sid_name_use != SID_NAME_WKN_GRP)) {
                         DEBUG(10, ("Map for sid %s is a %s, expected an "
                                    "alias\n", sid_string_dbg(sid),
-                                   sid_type_lookup(map.sid_name_use)));
+                                   sid_type_lookup(map->sid_name_use)));
                         goto done;
                 }
 
-                id->gid = map.gid;
-                *type = SID_NAME_ALIAS;
+                id->id = map->gid;
+                id->type = ID_TYPE_GID;
                 ret = True;
                 goto done;
@@ -1521 +1663 @@
                 return NT_STATUS_OK;
 
-        *pp_member_rids = TALLOC_ZERO_ARRAY(mem_ctx, uint32_t, num_uids);
+        *pp_member_rids = talloc_zero_array(mem_ctx, uint32_t, num_uids);
 
         for (i=0; i<num_uids; i++) {
@@ -1528 +1670 @@
                 uid_to_sid(&sid, uids[i]);
 
-                if (!sid_check_is_in_our_domain(&sid)) {
+                if (!sid_check_is_in_our_sam(&sid)) {
                         DEBUG(5, ("Inconsistent SAM -- group member uid not "
                                   "in our domain\n"));
@@ -1573 +1715 @@
         }
 
-        *pp_sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, *p_num_groups);
+        *pp_sids = talloc_array(mem_ctx, struct dom_sid, *p_num_groups);
 
         if (*pp_sids == NULL) {
@@ -1594 +1736 @@
                                   const char **name,
                                   enum lsa_SidType *psid_name_use,
-                                  union unid_t *unix_id)
+                                  uid_t *uid, gid_t *gid)
 {
         struct samu *sam_account = NULL;
-        GROUP_MAP map;
+        GROUP_MAP *map = NULL;
         bool ret;
         struct dom_sid sid;
@@ -1614 +1756 @@
         }
 
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (!map) {
+                return false;
+        }
+
         /* BEING ROOT BLOCK */
         become_root();
-        if (pdb_getsampwsid(sam_account, &sid)) {
+        ret = pdb_getsampwsid(sam_account, &sid);
+        if (!ret) {
+                TALLOC_FREE(sam_account);
+                ret = pdb_getgrsid(map, sid);
+        }
+        unbecome_root();
+        /* END BECOME_ROOT BLOCK */
+
+        if (sam_account || !ret) {
+                TALLOC_FREE(map);
+        }
+
+        if (sam_account) {
                 struct passwd *pw;
 
-                unbecome_root();                /* -----> EXIT BECOME_ROOT() */
                 *name = talloc_strdup(mem_ctx, pdb_get_username(sam_account));
                 if (!*name) {
@@ -1630 +1788 @@
                 TALLOC_FREE(sam_account);
 
-                if (unix_id == NULL) {
+                if (uid == NULL) {
                         return True;
                 }
@@ -1638 +1796 @@
                         return False;
                 }
-                unix_id->uid = pw->pw_uid;
+                *uid = pw->pw_uid;
                 TALLOC_FREE(pw);
                 return True;
-        }
-        TALLOC_FREE(sam_account);
-
-        ret = pdb_getgrsid(&map, sid);
-        unbecome_root();
-        /* END BECOME_ROOT BLOCK */
-
-        /* do not resolve SIDs to a name unless there is a valid 
-           gid associated with it */
-
-        if ( ret && (map.gid != (gid_t)-1) ) {
-                *name = talloc_strdup(mem_ctx, map.nt_name);
-                *psid_name_use = map.sid_name_use;
-
-                if ( unix_id ) {
-                        unix_id->gid = map.gid;
-                }
-
+
+        } else if (map && (map->gid != (gid_t)-1)) {
+
+                /* do not resolve SIDs to a name unless there is a valid
+                   gid associated with it */
+
+                *name = talloc_steal(mem_ctx, map->nt_name);
+                *psid_name_use = map->sid_name_use;
+
+                if (gid) {
+                        *gid = map->gid;
+                }
+
+                TALLOC_FREE(map);
                 return True;
         }
+
+        TALLOC_FREE(map);
 
         /* Windows will always map RID 513 to something.  On a non-domain 
            controller, this gets mapped to SERVER\None. */
 
-        if ( unix_id ) {
+        if (uid || gid) {
                 DEBUG(5, ("Can't find a unix id for an unmapped group\n"));
                 return False;
@@ -1712 +1868 @@
 
         /* Should not happen, but better check once too many */
-        if (!sid_check_is_domain(domain_sid)) {
+        if (!sid_check_is_our_sam(domain_sid)) {
                 return NT_STATUS_INVALID_HANDLE;
         }
@@ -1720 +1876 @@
 
                 if (lookup_global_sam_rid(names, rids[i], &name, &attrs[i],
-                                          NULL)) {
+                                          NULL, NULL)) {
                         if (name == NULL) {
                                 return NT_STATUS_NO_MEMORY;
@@ -1743 +1899 @@
 }
 
-#if 0
-static NTSTATUS pdb_default_lookup_names(struct pdb_methods *methods,
-                                         const struct dom_sid *domain_sid,
-                                         int num_names,
-                                         const char **names,
-                                         uint32_t *rids,
-                                         enum lsa_SidType *attrs)
-{
-        int i;
-        NTSTATUS result;
-        bool have_mapped = False;
-        bool have_unmapped = False;
-
-        if (sid_check_is_builtin(domain_sid)) {
-
-                for (i=0; i<num_names; i++) {
-                        uint32_t rid;
-
-                        if (lookup_builtin_name(names[i], &rid)) {
-                                attrs[i] = SID_NAME_ALIAS;
-                                rids[i] = rid;
-                                DEBUG(5,("lookup_rids: %s:%d\n",
-                                         names[i], attrs[i]));
-                                have_mapped = True;
-                        } else {
-                                have_unmapped = True;
-                                attrs[i] = SID_NAME_UNKNOWN;
-                        }
-                }
-                goto done;
-        }
-
-        /* Should not happen, but better check once too many */
-        if (!sid_check_is_domain(domain_sid)) {
-                return NT_STATUS_INVALID_HANDLE;
-        }
-
-        for (i = 0; i < num_names; i++) {
-                if (lookup_global_sam_name(names[i], 0, &rids[i], &attrs[i])) {
-                        DEBUG(5,("lookup_names: %s-> %d:%d\n", names[i],
-                                 rids[i], attrs[i]));
-                        have_mapped = True;
-                } else {
-                        have_unmapped = True;
-                        attrs[i] = SID_NAME_UNKNOWN;
-                }
-        }
-
- done:
-
-        result = NT_STATUS_NONE_MAPPED;
-
-        if (have_mapped)
-                result = have_unmapped ? STATUS_SOME_UNMAPPED : NT_STATUS_OK;
-
-        return result;
-}
-#endif
-
 static int pdb_search_destructor(struct pdb_search *search)
 {
@@ -1864 +1961 @@
 
 struct group_search {
-        GROUP_MAP *groups;
+        GROUP_MAP **groups;
         size_t num_groups, current_group;
 };
@@ -1873 +1970 @@
         struct group_search *state = (struct group_search *)s->private_data;
         uint32_t rid;
-        GROUP_MAP *map = &state->groups[state->current_group];
+        GROUP_MAP *map;
 
         if (state->current_group == state->num_groups)
                 return False;
 
+        map = state->groups[state->current_group];
+
         sid_peek_rid(&map->sid, &rid);
 
@@ -1890 +1989 @@
         struct group_search *state =
                 (struct group_search *)search->private_data;
-        SAFE_FREE(state->groups);
-}
-
-static bool pdb_search_grouptype(struct pdb_search *search,
+        TALLOC_FREE(state->groups);
+}
+
+static bool pdb_search_grouptype(struct pdb_methods *methods,
+                                 struct pdb_search *search,
                                  const struct dom_sid *sid, enum lsa_SidType type)
 {
         struct group_search *state;
 
-        state = talloc(search, struct group_search);
+        state = talloc_zero(search, struct group_search);
         if (state == NULL) {
                 DEBUG(0, ("talloc failed\n"));
@@ -1904 +2004 @@
         }
 
-        if (!pdb_enum_group_mapping(sid, type, &state->groups, &state->num_groups,
-                                    True)) {
+        if (!NT_STATUS_IS_OK(methods->enum_group_mapping(methods, sid, type, 
+                                                         &state->groups, &state->num_groups,
+                                                         True))) {
                 DEBUG(0, ("Could not enum groups\n"));
                 return False;
@@ -1920 +2021 @@
                                       struct pdb_search *search)
 {
-        return pdb_search_grouptype(search, get_global_sam_sid(), SID_NAME_DOM_GRP);
+        return pdb_search_grouptype(methods, search, get_global_sam_sid(), SID_NAME_DOM_GRP);
 }
 
@@ -1928 +2029 @@
 {
 
-        return pdb_search_grouptype(search, sid, SID_NAME_ALIAS);
+        return pdb_search_grouptype(methods, search, sid, SID_NAME_ALIAS);
 }
 
@@ -2043 +2144 @@
         return pdb->get_trusteddom_pw(pdb, domain, pwd, sid, 
                         pass_last_set_time);
+}
+
+NTSTATUS pdb_get_trusteddom_creds(const char *domain, TALLOC_CTX *mem_ctx,
+                                  struct cli_credentials **creds)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->get_trusteddom_creds(pdb, domain, mem_ctx, creds);
 }
 
@@ -2082 +2190 @@
 }
 
+static NTSTATUS pdb_default_get_trusteddom_creds(struct pdb_methods *methods,
+                                                 const char *domain,
+                                                 TALLOC_CTX *mem_ctx,
+                                                 struct cli_credentials **creds)
+{
+        *creds = NULL;
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
+
 static bool pdb_default_set_trusteddom_pw(struct pdb_methods *methods, 
                                           const char* domain, 
@@ -2147 +2264 @@
                                                struct pdb_trusted_domain **td)
 {
-        return NT_STATUS_NOT_IMPLEMENTED;
+        struct trustAuthInOutBlob taiob;
+        struct AuthenticationInformation aia;
+        struct pdb_trusted_domain *tdom;
+        enum ndr_err_code ndr_err;
+        time_t last_set_time;
+        char *pwd;
+        bool ok;
+
+        tdom = talloc(mem_ctx, struct pdb_trusted_domain);
+        if (!tdom) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        tdom->domain_name = talloc_strdup(tdom, domain);
+        tdom->netbios_name = talloc_strdup(tdom, domain);
+        if (!tdom->domain_name || !tdom->netbios_name) {
+                talloc_free(tdom);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        tdom->trust_auth_incoming = data_blob_null;
+
+        ok = pdb_get_trusteddom_pw(domain, &pwd, &tdom->security_identifier,
+                                   &last_set_time);
+        if (!ok) {
+                talloc_free(tdom);
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        ZERO_STRUCT(taiob);
+        ZERO_STRUCT(aia);
+        taiob.count = 1;
+        taiob.current.count = 1;
+        taiob.current.array = &aia;
+        unix_to_nt_time(&aia.LastUpdateTime, last_set_time);
+
+        aia.AuthType = TRUST_AUTH_TYPE_CLEAR;
+        aia.AuthInfo.clear.size = strlen(pwd);
+        aia.AuthInfo.clear.password = (uint8_t *)talloc_memdup(tdom, pwd,
+                                                               aia.AuthInfo.clear.size);
+        SAFE_FREE(pwd);
+        if (aia.AuthInfo.clear.password == NULL) {
+                talloc_free(tdom);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        taiob.previous.count = 0;
+        taiob.previous.array = NULL;
+
+        ndr_err = ndr_push_struct_blob(&tdom->trust_auth_outgoing,
+                                        tdom, &taiob,
+                        (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                talloc_free(tdom);
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        tdom->trust_direction = LSA_TRUST_DIRECTION_OUTBOUND;
+        tdom->trust_type = LSA_TRUST_TYPE_DOWNLEVEL;
+        tdom->trust_attributes = 0;
+        tdom->trust_forest_trust_info = data_blob_null;
+
+        *td = tdom;
+        return NT_STATUS_OK;
 }
 
@@ -2158 +2338 @@
 }
 
+#define IS_NULL_DATA_BLOB(d) ((d).data == NULL && (d).length == 0)
+
 static NTSTATUS pdb_default_set_trusted_domain(struct pdb_methods *methods,
                                                const char* domain,
                                                const struct pdb_trusted_domain *td)
 {
-        return NT_STATUS_NOT_IMPLEMENTED;
+        struct trustAuthInOutBlob taiob;
+        struct AuthenticationInformation *aia;
+        enum ndr_err_code ndr_err;
+        char *pwd;
+        bool ok;
+
+        if (td->trust_attributes != 0 ||
+            td->trust_type != LSA_TRUST_TYPE_DOWNLEVEL ||
+            td->trust_direction != LSA_TRUST_DIRECTION_OUTBOUND ||
+            !IS_NULL_DATA_BLOB(td->trust_auth_incoming) ||
+            !IS_NULL_DATA_BLOB(td->trust_forest_trust_info)) {
+            return NT_STATUS_NOT_IMPLEMENTED;
+        }
+
+        ZERO_STRUCT(taiob);
+        ndr_err = ndr_pull_struct_blob(&td->trust_auth_outgoing, talloc_tos(),
+                              &taiob,
+                              (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        aia = (struct AuthenticationInformation *) taiob.current.array;
+
+        if (taiob.count != 1 || taiob.current.count != 1 ||
+            taiob.previous.count != 0 ||
+            aia->AuthType != TRUST_AUTH_TYPE_CLEAR) {
+            return NT_STATUS_NOT_IMPLEMENTED;
+        }
+
+        pwd = talloc_strndup(talloc_tos(), (char *) aia->AuthInfo.clear.password,
+                             aia->AuthInfo.clear.size);
+        if (!pwd) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ok = pdb_set_trusteddom_pw(domain, pwd, &td->security_identifier);
+        if (!ok) {
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        return NT_STATUS_OK;
 }
 
@@ -2183 +2406 @@
 {
         return NULL;
+}
+
+/*****************************************************************
+ UPN suffixes
+ *****************************************************************/
+static NTSTATUS pdb_default_enum_upn_suffixes(struct pdb_methods *pdb,
+                                              TALLOC_CTX *mem_ctx,
+                                              uint32_t *num_suffixes,
+                                              char ***suffixes)
+{
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS pdb_default_set_upn_suffixes(struct pdb_methods *pdb,
+                                             uint32_t num_suffixes,
+                                             const char **suffixes)
+{
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS pdb_enum_upn_suffixes(TALLOC_CTX *mem_ctx,
+                               uint32_t *num_suffixes,
+                               char ***suffixes)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->enum_upn_suffixes(pdb, mem_ctx, num_suffixes, suffixes);
+}
+
+NTSTATUS pdb_set_upn_suffixes(uint32_t num_suffixes,
+                              const char **suffixes)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->set_upn_suffixes(pdb, num_suffixes, suffixes);
+}
+
+/*******************************************************************
+ idmap control methods
+ *******************************************************************/
+static bool pdb_default_is_responsible_for_our_sam(
+                                        struct pdb_methods *methods)
+{
+        return true;
+}
+
+static bool pdb_default_is_responsible_for_builtin(
+                                        struct pdb_methods *methods)
+{
+        return true;
+}
+
+static bool pdb_default_is_responsible_for_wellknown(
+                                        struct pdb_methods *methods)
+{
+        return false;
+}
+
+static bool pdb_default_is_responsible_for_unix_users(
+                                        struct pdb_methods *methods)
+{
+        return true;
+}
+
+static bool pdb_default_is_responsible_for_unix_groups(
+                                        struct pdb_methods *methods)
+{
+        return true;
+}
+
+static bool pdb_default_is_responsible_for_everything_else(
+                                        struct pdb_methods *methods)
+{
+        return false;
+}
+
+bool pdb_is_responsible_for_our_sam(void)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->is_responsible_for_our_sam(pdb);
+}
+
+bool pdb_is_responsible_for_builtin(void)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->is_responsible_for_builtin(pdb);
+}
+
+bool pdb_is_responsible_for_wellknown(void)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->is_responsible_for_wellknown(pdb);
+}
+
+bool pdb_is_responsible_for_unix_users(void)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->is_responsible_for_unix_users(pdb);
+}
+
+bool pdb_is_responsible_for_unix_groups(void)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->is_responsible_for_unix_groups(pdb);
+}
+
+bool pdb_is_responsible_for_everything_else(void)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->is_responsible_for_everything_else(pdb);
+}
+
+/*******************************************************************
+ secret methods
+ *******************************************************************/
+
+NTSTATUS pdb_get_secret(TALLOC_CTX *mem_ctx,
+                        const char *secret_name,
+                        DATA_BLOB *secret_current,
+                        NTTIME *secret_current_lastchange,
+                        DATA_BLOB *secret_old,
+                        NTTIME *secret_old_lastchange,
+                        struct security_descriptor **sd)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->get_secret(pdb, mem_ctx, secret_name,
+                               secret_current, secret_current_lastchange,
+                               secret_old, secret_old_lastchange,
+                               sd);
+}
+
+NTSTATUS pdb_set_secret(const char *secret_name,
+                        DATA_BLOB *secret_current,
+                        DATA_BLOB *secret_old,
+                        struct security_descriptor *sd)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->set_secret(pdb, secret_name,
+                               secret_current,
+                               secret_old,
+                               sd);
+}
+
+NTSTATUS pdb_delete_secret(const char *secret_name)
+{
+        struct pdb_methods *pdb = pdb_get_methods();
+        return pdb->delete_secret(pdb, secret_name);
+}
+
+static NTSTATUS pdb_default_get_secret(struct pdb_methods *methods,
+                                       TALLOC_CTX *mem_ctx,
+                                       const char *secret_name,
+                                       DATA_BLOB *secret_current,
+                                       NTTIME *secret_current_lastchange,
+                                       DATA_BLOB *secret_old,
+                                       NTTIME *secret_old_lastchange,
+                                       struct security_descriptor **sd)
+{
+        return lsa_secret_get(mem_ctx, secret_name,
+                              secret_current,
+                              secret_current_lastchange,
+                              secret_old,
+                              secret_old_lastchange,
+                              sd);
+}
+
+static NTSTATUS pdb_default_set_secret(struct pdb_methods *methods,
+                                       const char *secret_name,
+                                       DATA_BLOB *secret_current,
+                                       DATA_BLOB *secret_old,
+                                       struct security_descriptor *sd)
+{
+        return lsa_secret_set(secret_name,
+                              secret_current,
+                              secret_old,
+                              sd);
+}
+
+static NTSTATUS pdb_default_delete_secret(struct pdb_methods *methods,
+                                          const char *secret_name)
+{
+        return lsa_secret_delete(secret_name);
 }
 
@@ -2238 +2641 @@
         (*methods)->set_account_policy = pdb_default_set_account_policy;
         (*methods)->get_seq_num = pdb_default_get_seq_num;
-        (*methods)->uid_to_sid = pdb_default_uid_to_sid;
-        (*methods)->gid_to_sid = pdb_default_gid_to_sid;
+        (*methods)->id_to_sid = pdb_default_id_to_sid;
         (*methods)->sid_to_id = pdb_default_sid_to_id;
 
@@ -2246 +2648 @@
 
         (*methods)->get_trusteddom_pw = pdb_default_get_trusteddom_pw;
+        (*methods)->get_trusteddom_creds = pdb_default_get_trusteddom_creds;
         (*methods)->set_trusteddom_pw = pdb_default_set_trusteddom_pw;
         (*methods)->del_trusteddom_pw = pdb_default_del_trusteddom_pw;
@@ -2256 +2659 @@
         (*methods)->enum_trusted_domains = pdb_default_enum_trusted_domains;
 
+        (*methods)->get_secret = pdb_default_get_secret;
+        (*methods)->set_secret = pdb_default_set_secret;
+        (*methods)->delete_secret = pdb_default_delete_secret;
+
+        (*methods)->enum_upn_suffixes = pdb_default_enum_upn_suffixes;
+        (*methods)->set_upn_suffixes  = pdb_default_set_upn_suffixes;
+
+        (*methods)->is_responsible_for_our_sam =
+                                pdb_default_is_responsible_for_our_sam;
+        (*methods)->is_responsible_for_builtin =
+                                pdb_default_is_responsible_for_builtin;
+        (*methods)->is_responsible_for_wellknown =
+                                pdb_default_is_responsible_for_wellknown;
+        (*methods)->is_responsible_for_unix_users =
+                                pdb_default_is_responsible_for_unix_users;
+        (*methods)->is_responsible_for_unix_groups =
+                                pdb_default_is_responsible_for_unix_groups;
+        (*methods)->is_responsible_for_everything_else =
+                                pdb_default_is_responsible_for_everything_else;
+
         return NT_STATUS_OK;
 }

vendor/current/source3/passdb/pdb_ipa.c

@@ -24 +24 @@
 #include "../librpc/ndr/libndr.h"
 #include "librpc/gen_ndr/samr.h"
+#include "secrets.h"
 
 #include "smbldap.h"
+#include "passdb/pdb_ldap.h"
+#include "passdb/pdb_ipa.h"
+#include "passdb/pdb_ldap_schema.h"
 
 #define IPA_KEYTAB_SET_OID "2.16.840.1.113730.3.8.3.1"
@@ -35 +39 @@
 #define LDAP_ATTRIBUTE_TRUST_ATTRIBUTES "sambaTrustAttributes"
 #define LDAP_ATTRIBUTE_TRUST_DIRECTION "sambaTrustDirection"
+#define LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET "sambaTrustPosixOffset"
+#define LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE "sambaSupportedEncryptionTypes"
 #define LDAP_ATTRIBUTE_TRUST_PARTNER "sambaTrustPartner"
 #define LDAP_ATTRIBUTE_FLAT_NAME "sambaFlatName"
@@ -116 +122 @@
         if (name[strlen(name)-1] == '$') {
                 dn = talloc_asprintf(talloc_tos(), "uid=%s,%s", escape_name,
-                                     lp_ldap_machine_suffix());
+                                     lp_ldap_machine_suffix(talloc_tos()));
         } else {
                 dn = talloc_asprintf(talloc_tos(), "uid=%s,%s", escape_name,
-                                     lp_ldap_user_suffix());
+                                     lp_ldap_user_suffix(talloc_tos()));
         }
 
@@ -160 +166 @@
 
         if (result != NULL) {
-                talloc_autofree_ldapmsg(mem_ctx, result);
+                smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
         }
 
@@ -364 +370 @@
         }
 
+        td->trust_posix_offset = talloc(td, uint32_t);
+        if (td->trust_posix_offset == NULL) {
+                return false;
+        }
+        res = get_uint32_t_from_ldap_msg(ldap_state, entry,
+                                         LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET,
+                                         td->trust_posix_offset);
+        if (!res) {
+                return false;
+        }
+
+        td->supported_enc_type = talloc(td, uint32_t);
+        if (td->supported_enc_type == NULL) {
+                return false;
+        }
+        res = get_uint32_t_from_ldap_msg(ldap_state, entry,
+                                         LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE,
+                                         td->supported_enc_type);
+        if (!res) {
+                return false;
+        }
+
+
         get_data_blob_from_ldap_msg(td, ldap_state, entry,
                                     LDAP_ATTRIBUTE_TRUST_FOREST_TRUST_INFO,
@@ -520 +549 @@
         }
 
+        if (td->trust_posix_offset != NULL) {
+                res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
+                                                &mods,
+                                                LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET,
+                                                *td->trust_posix_offset);
+                if (!res) {
+                        return NT_STATUS_UNSUCCESSFUL;
+                }
+        }
+
+        if (td->supported_enc_type != NULL) {
+                res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
+                                                &mods,
+                                                LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE,
+                                                *td->supported_enc_type);
+                if (!res) {
+                        return NT_STATUS_UNSUCCESSFUL;
+                }
+        }
+
         if (td->trust_auth_outgoing.data != NULL) {
                 smbldap_make_mod_blob(priv2ld(ldap_state), entry, &mods,
@@ -538 +587 @@
         }
 
-        talloc_autofree_ldapmod(talloc_tos(), mods);
+        smbldap_talloc_autofree_ldapmod(talloc_tos(), mods);
 
         trusted_dn = trusted_domain_dn(ldap_state, domain);
@@ -623 +672 @@
 
         if (result != NULL) {
-                talloc_autofree_ldapmsg(mem_ctx, result);
+                smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
         }
 
@@ -637 +686 @@
 
         *num_domains = 0;
-        if (!(*domains = TALLOC_ARRAY(mem_ctx, struct pdb_trusted_domain *, 1))) {
+        if (!(*domains = talloc_array(mem_ctx, struct pdb_trusted_domain *, 1))) {
                 DEBUG(1, ("talloc failed\n"));
                 return NT_STATUS_NO_MEMORY;
@@ -685 +734 @@
         }
 
-        if (!(*domains = TALLOC_ARRAY(mem_ctx, struct trustdom_info *,
+        if (!(*domains = talloc_array(mem_ctx, struct trustdom_info *,
                                       *num_domains))) {
                 DEBUG(1, ("talloc failed\n"));
@@ -694 +743 @@
                 struct trustdom_info *dom_info;
 
-                dom_info = TALLOC_P(*domains, struct trustdom_info);
+                dom_info = talloc(*domains, struct trustdom_info);
                 if (dom_info == NULL) {
                         DEBUG(1, ("talloc failed\n"));
@@ -718 +767 @@
 {
         struct pdb_domain_info *info;
-        NTSTATUS status;
         struct ldapsam_privates *ldap_state =
                         (struct ldapsam_privates *)pdb_methods->private_data;
+        uint8_t sid_buf[24];
+        DATA_BLOB sid_blob;
+        NTSTATUS status;
 
         info = talloc(mem_ctx, struct pdb_domain_info);
@@ -737 +788 @@
                 goto fail;
         }
-        strlower_m(info->dns_domain);
+        if (!strlower_m(info->dns_domain)) {
+                goto fail;
+        }
         info->dns_forest = talloc_strdup(info, info->dns_domain);
+
+        /* we expect a domain SID to have 4 sub IDs */
+        if (ldap_state->domain_sid.num_auths != 4) {
+                goto fail;
+        }
+
         sid_copy(&info->sid, &ldap_state->domain_sid);
 
-        status = GUID_from_string("testguid", &info->guid);
+        if (!sid_linearize(sid_buf, sizeof(sid_buf), &info->sid)) {
+                goto fail;
+        }
+
+        /* the first 8 bytes of the linearized SID are not random,
+         * so we skip them */
+        sid_blob.data = (uint8_t *) sid_buf + 8 ;
+        sid_blob.length = 16;
+
+        status = GUID_from_ndr_blob(&sid_blob, &info->guid);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto fail;
+        }
 
         return info;
@@ -1233 +1304 @@
         NTSTATUS status;
         struct ldapsam_privates *ldap_state;
-        int ldap_op = LDAP_MOD_REPLACE;
-        char *dn;
+        char *dn = NULL;
         uint32_t has_objectclass = 0;
 
@@ -1244 +1314 @@
 
         status = find_group(ldap_state, name, &dn, &has_objectclass);
-        if (NT_STATUS_IS_OK(status)) {
-                ldap_op = LDAP_MOD_REPLACE;
-        } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
-                ldap_op = LDAP_MOD_ADD;
-        } else {
+        if (!NT_STATUS_IS_OK(status) &&
+                        !NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
                 return status;
         }
@@ -1300 +1367 @@
                         dn = talloc_asprintf(tmp_ctx, "uid=%s,%s",
                                              escape_username,
-                                             lp_ldap_machine_suffix());
+                                             lp_ldap_machine_suffix(talloc_tos()));
                 } else {
                         dn = talloc_asprintf(tmp_ctx, "uid=%s,%s",
                                              escape_username,
-                                             lp_ldap_user_suffix());
+                                             lp_ldap_user_suffix(talloc_tos()));
                 }
                 SAFE_FREE(escape_username);
@@ -1339 +1406 @@
 }
 
+static NTSTATUS pdb_ipa_init_secrets(struct pdb_methods *m)
+{
+        struct pdb_domain_info *dom_info;
+        bool ret;
+
+        dom_info = pdb_ipasam_get_domain_info(m, m);
+        if (!dom_info) {
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        PDB_secrets_clear_domain_protection(dom_info->name);
+        ret = PDB_secrets_store_domain_sid(dom_info->name,
+                                       &dom_info->sid);
+        if (!ret) {
+                goto done;
+        }
+        ret = PDB_secrets_store_domain_guid(dom_info->name,
+                                        &dom_info->guid);
+        if (!ret) {
+                goto done;
+        }
+        ret = PDB_secrets_mark_domain_protected(dom_info->name);
+        if (!ret) {
+                goto done;
+        }
+
+done:
+        TALLOC_FREE(dom_info);
+        if (!ret) {
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+        return NT_STATUS_OK;
+}
+
 static NTSTATUS pdb_init_IPA_ldapsam(struct pdb_methods **pdb_method, const char *location)
 {
@@ -1344 +1445 @@
         NTSTATUS status;
 
-        status = pdb_init_ldapsam(pdb_method, location);
+        status = pdb_ldapsam_init_common(pdb_method, location);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -1390 +1491 @@
         (*pdb_method)->enum_trusted_domains = ipasam_enum_trusted_domains;
 
+        status = pdb_ipa_init_secrets(*pdb_method);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("pdb_ipa_init_secrets failed!\n"));
+                return status;
+        }
+
         return NT_STATUS_OK;
 }

vendor/current/source3/passdb/pdb_ldap.c

@@ -52 +52 @@
 #include "../lib/util/util_pw.h"
 #include "lib/winbind_util.h"
+#include "librpc/gen_ndr/idmap.h"
+#include "lib/param/loadparm.h"
+#include "lib/util_sid_passdb.h"
 
 #undef DBGC_CLASS
@@ -61 +64 @@
 
 #include "smbldap.h"
+#include "passdb/pdb_ldap.h"
+#include "passdb/pdb_nds.h"
+#include "passdb/pdb_ipa.h"
+#include "passdb/pdb_ldap_util.h"
+#include "passdb/pdb_ldap_schema.h"
 
 /**********************************************************************
@@ -78 +86 @@
 {
         switch ( schema_ver ) {
-                case SCHEMAVER_SAMBAACCOUNT:
-                        return get_attr_key2string( attrib_map_v22, key );
-
                 case SCHEMAVER_SAMBASAMACCOUNT:
                         return get_attr_key2string( attrib_map_v30, key );
@@ -98 +103 @@
 {
         switch ( schema_ver ) {
-                case SCHEMAVER_SAMBAACCOUNT:
-                        return get_attr_list( mem_ctx, attrib_map_v22 );
-
                 case SCHEMAVER_SAMBASAMACCOUNT:
                         return get_attr_list( mem_ctx, attrib_map_v30 );
@@ -119 +121 @@
 {
         switch ( schema_ver ) {
-                case SCHEMAVER_SAMBAACCOUNT:
-                        return get_attr_list( mem_ctx,
-                                              attrib_map_to_delete_v22 );
-
                 case SCHEMAVER_SAMBASAMACCOUNT:
                         return get_attr_list( mem_ctx,
@@ -146 +144 @@
 
         switch( schema_ver ) {
-                case SCHEMAVER_SAMBAACCOUNT:
-                        fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
-                        break;
                 case SCHEMAVER_SAMBASAMACCOUNT:
                         fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
@@ -198 +193 @@
         }
 
-        if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix())) {
+        if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix(talloc_tos()))) {
                 DEBUG(3,("ldapsam_get_seq_num: DIT not configured to hold %s "
-                         "as top-level namingContext\n", lp_ldap_suffix()));
+                         "as top-level namingContext\n", lp_ldap_suffix(talloc_tos())));
                 return ntstatus;
         }
@@ -209 +204 @@
                 return NT_STATUS_NO_MEMORY;
 
-        if ((attrs = TALLOC_ARRAY(mem_ctx, const char *, 2)) == NULL) {
+        if ((attrs = talloc_array(mem_ctx, const char *, 2)) == NULL) {
                 ntstatus = NT_STATUS_NO_MEMORY;
                 goto done;
@@ -223 +218 @@
                 attrs[1] = NULL;
                 suffix = talloc_asprintf(mem_ctx,
-                                "cn=syncrepl%d,%s", rid, lp_ldap_suffix());
+                                "cn=syncrepl%d,%s", rid, lp_ldap_suffix(talloc_tos()));
                 if (!suffix) {
                         ntstatus = NT_STATUS_NO_MEMORY;
@@ -235 +230 @@
                 attrs[1] = NULL;
                 suffix = talloc_asprintf(mem_ctx,
-                                "cn=ldapsync,%s", lp_ldap_suffix());
+                                "cn=ldapsync,%s", lp_ldap_suffix(talloc_tos()));
 
                 if (!suffix) {
@@ -354 +349 @@
 
 /*******************************************************************
- Run the search by rid.
-******************************************************************/
-
-static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
-                                         uint32_t rid, LDAPMessage ** result,
-                                         const char **attr)
-{
-        char *filter = NULL;
-        int rc;
-
-        filter = talloc_asprintf(talloc_tos(), "(&(rid=%i)%s)", rid,
-                get_objclass_filter(ldap_state->schema_ver));
-        if (!filter) {
-                return LDAP_NO_MEMORY;
-        }
-
-        rc = smbldap_search_suffix(ldap_state->smbldap_state,
-                        filter, attr, result);
-        TALLOC_FREE(filter);
-        return rc;
-}
-
-/*******************************************************************
  Run the search by SID.
 ******************************************************************/
@@ -455 +427 @@
 
         smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
-        talloc_autofree_ldapmod(mem_ctx, mods);
+        smbldap_talloc_autofree_ldapmod(mem_ctx, mods);
 
         return smbldap_modify(priv->smbldap_state, dn, mods);
@@ -497 +469 @@
                         pass_last_set_time,
                         pass_can_change_time,
-                        pass_must_change_time,
                         ldap_entry_time,
                         bad_password_time;
@@ -512 +483 @@
                         *munged_dial = NULL;
         uint32_t                user_rid;
-        uint8           smblmpwd[LM_HASH_LEN],
+        uint8_t         smblmpwd[LM_HASH_LEN],
                         smbntpwd[NT_HASH_LEN];
         bool            use_samba_attrs = True;
@@ -520 +491 @@
                         logon_count = 0;
         uint32_t hours_len;
-        uint8           hours[MAX_HOURS_LEN];
+        uint8_t         hours[MAX_HOURS_LEN];
         char *temp = NULL;
         struct login_cache cache_entry;
@@ -656 +627 @@
                 pdb_set_pass_can_change_time(sampass,
                                 pass_can_change_time, PDB_SET);
-        }
-
-        temp = smbldap_talloc_single_attribute(
-                        ldap_state->smbldap_state->ldap_struct,
-                        entry,
-                        get_userattr_key2string(ldap_state->schema_ver,
-                                LDAP_ATTR_PWD_MUST_CHANGE),
-                        ctx);
-        if (temp) {
-                pass_must_change_time = (time_t) atol(temp);
-                pdb_set_pass_must_change_time(sampass,
-                                pass_must_change_time, PDB_SET);
         }
 
@@ -886 +845 @@
         pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
         if (pwHistLen > 0){
-                uint8 *pwhist = NULL;
+                uint8_t *pwhist = NULL;
                 int i;
-                char *history_string = TALLOC_ARRAY(ctx, char,
+                char *history_string = talloc_array(ctx, char,
                                                 MAX_PW_HISTORY_LEN*64);
 
@@ -897 +856 @@
                 pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
 
-                pwhist = TALLOC_ARRAY(ctx, uint8,
-                                      pwHistLen * PW_HISTORY_ENTRY_LEN);
+                pwhist = talloc_zero_array(ctx, uint8_t,
+                                           pwHistLen * PW_HISTORY_ENTRY_LEN);
                 if (pwhist == NULL) {
                         DEBUG(0, ("init_sam_from_ldap: talloc failed!\n"));
                         goto fn_exit;
                 }
-                memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
 
                 if (smbldap_get_single_attribute(
@@ -1016 +974 @@
                 struct dom_sid mapped_gsid;
                 const struct dom_sid *primary_gsid;
+                struct unixid id;
 
                 ZERO_STRUCT(unix_pw);
@@ -1079 +1038 @@
                 }
 
-                store_uid_sid_cache(pdb_get_user_sid(sampass),
-                                    sampass->unix_pw->pw_uid);
-                idmap_cache_set_sid2uid(pdb_get_user_sid(sampass),
-                                        sampass->unix_pw->pw_uid);
+                id.id = sampass->unix_pw->pw_uid;
+                id.type = ID_TYPE_UID;
+
+                idmap_cache_set_sid2unixid(pdb_get_user_sid(sampass), &id);
 
                 gid_to_sid(&mapped_gsid, sampass->unix_pw->pw_gid);
                 primary_gsid = pdb_get_group_sid(sampass);
                 if (primary_gsid && dom_sid_equal(primary_gsid, &mapped_gsid)) {
-                        store_gid_sid_cache(primary_gsid,
-                                            sampass->unix_pw->pw_gid);
-                        idmap_cache_set_sid2gid(primary_gsid,
-                                                sampass->unix_pw->pw_gid);
+                        id.id = sampass->unix_pw->pw_gid;
+                        id.type = ID_TYPE_GID;
+
+                        idmap_cache_set_sid2unixid(primary_gsid, &id);
                 }
         }
@@ -1154 +1113 @@
 {
         char *temp = NULL;
-        uint32_t rid;
 
         if (mods == NULL || sampass == NULL) {
@@ -1186 +1144 @@
 
                 switch ( ldap_state->schema_ver ) {
-                        case SCHEMAVER_SAMBAACCOUNT:
-                                if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
-                                        DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n", 
-                                                  sid_string_dbg(user_sid),
-                                                  sid_string_dbg(
-                                                          &ldap_state->domain_sid)));
-                                        return False;
-                                }
-                                if (asprintf(&temp, "%i", rid) < 0) {
-                                        return false;
-                                }
-                                smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
-                                        get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), 
-                                        temp);
-                                SAFE_FREE(temp);
-                                break;
-
                         case SCHEMAVER_SAMBASAMACCOUNT:
                                 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
@@ -1223 +1164 @@
 
                 switch ( ldap_state->schema_ver ) {
-                        case SCHEMAVER_SAMBAACCOUNT:
-                                if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
-                                        DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
-                                                  sid_string_dbg(group_sid),
-                                                  sid_string_dbg(
-                                                          &ldap_state->domain_sid)));
-                                        return False;
-                                }
-
-                                if (asprintf(&temp, "%i", rid) < 0) {
-                                        return false;
-                                }
-                                smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
-                                        get_userattr_key2string(ldap_state->schema_ver, 
-                                        LDAP_ATTR_PRIMARY_GROUP_RID), temp);
-                                SAFE_FREE(temp);
-                                break;
-
                         case SCHEMAVER_SAMBASAMACCOUNT:
                                 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
@@ -1332 +1255 @@
                 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
                         get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
-        SAFE_FREE(temp);
-
-        if (asprintf(&temp, "%li", (long int)pdb_get_pass_must_change_time(sampass)) < 0) {
-                return false;
-        }
-        if (need_update(sampass, PDB_MUSTCHANGETIME))
-                smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
-                        get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
         SAFE_FREE(temp);
 
@@ -1392 +1307 @@
                                 int i;
                                 uint32_t currHistLen = 0;
-                                const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
+                                const uint8_t *pwhist = pdb_get_pw_history(sampass, &currHistLen);
                                 if (pwhist != NULL) {
                                         /* We can only store (1024-1/64 password history entries. */
@@ -1425 +1340 @@
 
         if (need_update(sampass, PDB_HOURS)) {
-                const uint8 *hours = pdb_get_hours(sampass);
+                const uint8_t *hours = pdb_get_hours(sampass);
                 if (hours) {
                         char hourstr[44];
@@ -1533 +1448 @@
         }
 
-        (*attr_list) = TALLOC_REALLOC_ARRAY(mem_ctx, (*attr_list),
+        (*attr_list) = talloc_realloc(mem_ctx, (*attr_list),
                                             const char *,  i+2);
         SMB_ASSERT((*attr_list) != NULL);
@@ -1597 +1512 @@
                 pdb_set_backend_private_data(user, result, NULL,
                                              my_methods, PDB_CHANGED);
-                talloc_autofree_ldapmsg(user, result);
+                smbldap_talloc_autofree_ldapmsg(user, result);
                 ret = NT_STATUS_OK;
         } else {
@@ -1610 +1525 @@
         int rc = -1;
         const char ** attr_list;
-        uint32_t rid;
 
         switch ( ldap_state->schema_ver ) {
@@ -1635 +1549 @@
                 }
 
-                case SCHEMAVER_SAMBAACCOUNT:
-                        if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
-                                return rc;
-                        }
-
-                        attr_list = get_userattr_list(NULL,
-                                                      ldap_state->schema_ver);
-                        rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
-                        TALLOC_FREE( attr_list );
-
-                        if ( rc != LDAP_SUCCESS ) 
-                                return rc;
+                default:
+                        DEBUG(0,("Invalid schema version specified\n"));
                         break;
         }
@@ -1698 +1602 @@
         pdb_set_backend_private_data(user, result, NULL,
                                      my_methods, PDB_CHANGED);
-        talloc_autofree_ldapmsg(user, result);
+        smbldap_talloc_autofree_ldapmsg(user, result);
         return NT_STATUS_OK;
 }       
@@ -1931 +1835 @@
                 priv, mem_ctx, entry,
                 priv->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ?
-                LDAP_OBJ_SAMBASAMACCOUNT : LDAP_OBJ_SAMBAACCOUNT,
+                LDAP_OBJ_SAMBASAMACCOUNT : 0,
                 attr_list);
 
@@ -1940 +1844 @@
         TALLOC_FREE(mem_ctx);
         return result;
-}
-
-/**********************************************************************
- Helper function to determine for update_sam_account whether
- we need LDAP modification.
-*********************************************************************/
-
-static bool element_is_changed(const struct samu *sampass,
-                               enum pdb_elements element)
-{
-        return IS_SAM_CHANGED(sampass, element);
 }
 
@@ -1981 +1874 @@
                 pdb_set_backend_private_data(newpwd, result, NULL,
                                              my_methods, PDB_CHANGED);
-                talloc_autofree_ldapmsg(newpwd, result);
+                smbldap_talloc_autofree_ldapmsg(newpwd, result);
         }
 
@@ -1998 +1891 @@
 
         if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
-                                element_is_changed)) {
+                                pdb_element_is_changed)) {
                 DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
                 TALLOC_FREE(dn);
@@ -2014 +1907 @@
         }
 
-        ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
+        ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, pdb_element_is_changed);
 
         if (mods != NULL) {
@@ -2082 +1975 @@
 
         /* rename the posix user */
-        rename_script = SMB_STRDUP(lp_renameuser_script());
+        rename_script = lp_rename_user_script(talloc_tos());
         if (rename_script == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -2088 +1981 @@
 
         if (!(*rename_script)) {
-                SAFE_FREE(rename_script);
+                TALLOC_FREE(rename_script);
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -2100 +1993 @@
 
         fstrcpy( oldname_lower, oldname );
-        strlower_m( oldname_lower );
+        if (!strlower_m( oldname_lower )) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
         fstrcpy( newname_lower, newname );
-        strlower_m( newname_lower );
+        if (!strlower_m( newname_lower )) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
         rename_script = realloc_string_sub2(rename_script,
                                         "%unew",
@@ -2121 +2019 @@
                           rename_script, rc));
 
-        SAFE_FREE(rename_script);
+        TALLOC_FREE(rename_script);
 
         if (rc == 0) {
@@ -2131 +2029 @@
 
         return NT_STATUS_OK;
-}
-
-/**********************************************************************
- Helper function to determine for update_sam_account whether
- we need LDAP modification.
- *********************************************************************/
-
-static bool element_is_set_or_changed(const struct samu *sampass,
-                                      enum pdb_elements element)
-{
-        return (IS_SAM_SET(sampass, element) ||
-                IS_SAM_CHANGED(sampass, element));
 }
 
@@ -2195 +2081 @@
         result = NULL;
 
-        if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
+        if (pdb_element_is_set_or_changed(newpwd, PDB_USERSID)) {
                 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
                                                   sid, &result);
@@ -2315 +2201 @@
                                         "uid=%s,%s",
                                         escape_username,
-                                        lp_ldap_machine_suffix());
+                                        lp_ldap_machine_suffix(talloc_tos()));
                 } else {
                         dn = talloc_asprintf(ctx,
                                         "uid=%s,%s",
                                         escape_username,
-                                        lp_ldap_user_suffix());
+                                        lp_ldap_user_suffix(talloc_tos()));
                 }
 
@@ -2331 +2217 @@
 
         if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
-                                element_is_set_or_changed)) {
+                                pdb_element_is_set_or_changed)) {
                 DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
                 if (mods != NULL) {
@@ -2344 +2230 @@
         }
         switch ( ldap_state->schema_ver ) {
-                case SCHEMAVER_SAMBAACCOUNT:
-                        smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
-                        break;
                 case SCHEMAVER_SAMBASAMACCOUNT:
                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
@@ -2355 +2238 @@
         }
 
-        ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
+        ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, pdb_element_is_set_or_changed);
         if (!NT_STATUS_IS_OK(ret)) {
                 DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
@@ -2390 +2273 @@
         attr_list = get_attr_list(NULL, groupmap_attr_list);
         rc = smbldap_search(ldap_state->smbldap_state,
-                            lp_ldap_suffix (), scope,
+                            lp_ldap_suffix (talloc_tos()), scope,
                             filter, attr_list, 0, result);
         TALLOC_FREE(attr_list);
@@ -2492 +2375 @@
                 }
         }
-        fstrcpy(map->nt_name, temp);
+        map->nt_name = talloc_strdup(map, temp);
+        if (!map->nt_name) {
+                TALLOC_FREE(ctx);
+                return false;
+        }
 
         TALLOC_FREE(temp);
@@ -2508 +2395 @@
                 }
         }
-        fstrcpy(map->comment, temp);
+        map->comment = talloc_strdup(map, temp);
+        if (!map->comment) {
+                TALLOC_FREE(ctx);
+                return false;
+        }
 
         if (lp_parm_bool(-1, "ldapsam", "trusted", false)) {
-                store_gid_sid_cache(&map->sid, map->gid);
-                idmap_cache_set_sid2gid(&map->sid, map->gid);
+                struct unixid id;
+                id.id = map->gid;
+                id.type = ID_TYPE_GID;
+
+                idmap_cache_set_sid2unixid(&map->sid, &id);
         }
 
@@ -2711 +2605 @@
         }
 
-        rc = smbldap_search(conn, lp_ldap_suffix(),
+        rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
                             LDAP_SCOPE_SUBTREE, filter, id_attrs, 0,
                             &result);
@@ -2718 +2612 @@
                 goto done;
 
-        talloc_autofree_ldapmsg(mem_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
         count = ldap_count_entries(conn->ldap_struct, result);
@@ -2779 +2673 @@
                 }
 
-                rc = smbldap_search(conn, lp_ldap_suffix(),
+                rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
                                     LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
                                     &result);
@@ -2789 +2683 @@
                 DEBUG(10,("ldapsam_enum_group_members: found %d accounts\n", count));
 
-                talloc_autofree_ldapmsg(mem_ctx, result);
+                smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
                 for (entry = ldap_first_entry(conn->ldap_struct, result);
@@ -2812 +2706 @@
                                 goto done;
 
-                        if (!sid_check_is_in_our_domain(&sid)) {
+                        if (!sid_check_is_in_our_sam(&sid)) {
                                 DEBUG(0, ("Inconsistent SAM -- group member uid not "
                                           "in our domain\n"));
@@ -2835 +2729 @@
                                  gidstr);
 
-        rc = smbldap_search(conn, lp_ldap_suffix(),
+        rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
                             LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
                             &result);
@@ -2842 +2736 @@
                 goto done;
 
-        talloc_autofree_ldapmsg(mem_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
         for (entry = ldap_first_entry(conn->ldap_struct, result);
@@ -2922 +2816 @@
                 }
 
-                rc = smbldap_search(conn, lp_ldap_suffix(),
+                rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
                                     LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
 
@@ -2928 +2822 @@
                         goto done;
 
-                talloc_autofree_ldapmsg(mem_ctx, result);
+                smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
                 count = ldap_count_entries(priv2ld(ldap_state), result);
@@ -2963 +2857 @@
         }
 
-        rc = smbldap_search(conn, lp_ldap_suffix(),
+        rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
                             LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
 
@@ -2969 +2863 @@
                 goto done;
 
-        talloc_autofree_ldapmsg(mem_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
         num_gids = 0;
@@ -3075 +2969 @@
                                    get_attr_list(mem_ctx, groupmap_attr_list),
                                    &msg);
-        talloc_autofree_ldapmsg(mem_ctx, msg);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, msg);
 
         if ((rc != LDAP_SUCCESS) ||
@@ -3099 +2993 @@
         smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
                          map->comment);
-        talloc_autofree_ldapmod(mem_ctx, mods);
+        smbldap_talloc_autofree_ldapmod(mem_ctx, mods);
 
         rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
@@ -3124 +3018 @@
 
         struct dom_sid sid;
+        struct unixid id;
 
         int rc;
@@ -3140 +3035 @@
         }
 
-        rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
+        rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(talloc_tos()),
                             LDAP_SCOPE_SUBTREE, filter, attrs, True, &msg);
-        talloc_autofree_ldapmsg(mem_ctx, msg);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, msg);
 
         if ((rc == LDAP_SUCCESS) &&
@@ -3163 +3058 @@
 
         case SID_NAME_ALIAS:
-                if (!sid_check_is_in_our_domain(&map->sid) 
+                if (!sid_check_is_in_our_sam(&map->sid) 
                         && !sid_check_is_in_builtin(&map->sid) ) 
                 {
@@ -3189 +3084 @@
         }
 
-        if (pdb_gid_to_sid(map->gid, &sid)) {
+        id.id = map->gid;
+        id.type = ID_TYPE_GID;
+
+        if (pdb_id_to_sid(&id, &sid)) {
                 DEBUG(3, ("Gid %u is already mapped to SID %s, refusing to "
                           "add\n", (unsigned int)map->gid, sid_string_dbg(&sid)));
@@ -3201 +3099 @@
         dn = talloc_asprintf(mem_ctx, "sambaSid=%s,%s",
                              sid_string_talloc(mem_ctx, &map->sid),
-                             lp_ldap_group_suffix());
+                             lp_ldap_group_suffix(talloc_tos()));
         if (dn == NULL) {
                 result = NT_STATUS_NO_MEMORY;
@@ -3223 +3121 @@
         smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "gidNumber",
                          talloc_asprintf(mem_ctx, "%u", (unsigned int)map->gid));
-        talloc_autofree_ldapmod(mem_ctx, mods);
+        smbldap_talloc_autofree_ldapmod(mem_ctx, mods);
 
         rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
@@ -3277 +3175 @@
                                    get_attr_list(mem_ctx, groupmap_attr_list),
                                    &msg);
-        talloc_autofree_ldapmsg(mem_ctx, msg);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, msg);
 
         if ((rc != LDAP_SUCCESS) ||
@@ -3298 +3196 @@
         smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
                          map->comment);
-        talloc_autofree_ldapmod(mem_ctx, mods);
+        smbldap_talloc_autofree_ldapmod(mem_ctx, mods);
 
         if (mods == NULL) {
@@ -3354 +3252 @@
                                    get_attr_list(mem_ctx, groupmap_attr_list),
                                    &msg);
-        talloc_autofree_ldapmsg(mem_ctx, msg);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, msg);
 
         if ((rc != LDAP_SUCCESS) ||
@@ -3422 +3320 @@
         }
         attr_list = get_attr_list( NULL, groupmap_attr_list );
-        rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
+        rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(talloc_tos()),
                             LDAP_SCOPE_SUBTREE, filter,
                             attr_list, 0, &ldap_state->result);
@@ -3431 +3329 @@
                           ldap_err2string(rc)));
                 DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n",
-                          lp_ldap_suffix(), filter));
+                          lp_ldap_suffix(talloc_tos()), filter));
                 ldap_msgfree(ldap_state->result);
                 ldap_state->result = NULL;
@@ -3492 +3390 @@
 static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
                                            const struct dom_sid *domsid, enum lsa_SidType sid_name_use,
-                                           GROUP_MAP **pp_rmap,
+                                           GROUP_MAP ***pp_rmap,
                                            size_t *p_num_entries,
                                            bool unix_only)
 {
-        GROUP_MAP map = { 0, };
+        GROUP_MAP *map = NULL;
         size_t entries = 0;
 
@@ -3508 +3406 @@
         }
 
-        while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
+        while (true) {
+
+                map = talloc_zero(NULL, GROUP_MAP);
+                if (!map) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                if (!NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, map))) {
+                        TALLOC_FREE(map);
+                        break;
+                }
+
                 if (sid_name_use != SID_NAME_UNKNOWN &&
-                    sid_name_use != map.sid_name_use) {
+                    sid_name_use != map->sid_name_use) {
                         DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
-                                  "not of the requested type\n", map.nt_name));
+                                  "not of the requested type\n",
+                                  map->nt_name));
                         continue;
                 }
-                if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
+                if (unix_only == ENUM_ONLY_MAPPED && map->gid == -1) {
                         DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
-                                  "non mapped\n", map.nt_name));
+                                  "non mapped\n", map->nt_name));
                         continue;
                 }
 
-                (*pp_rmap)=SMB_REALLOC_ARRAY((*pp_rmap), GROUP_MAP, entries+1);
+                *pp_rmap = talloc_realloc(NULL, *pp_rmap,
+                                                GROUP_MAP *, entries + 1);
                 if (!(*pp_rmap)) {
                         DEBUG(0,("ldapsam_enum_group_mapping: Unable to "
@@ -3528 +3439 @@
                 }
 
-                (*pp_rmap)[entries] = map;
+                (*pp_rmap)[entries] = talloc_move((*pp_rmap), &map);
 
                 entries += 1;
-
-        }
+        }
+
         ldapsam_endsamgrent(methods);
 
@@ -3562 +3473 @@
         }
 
-        if (sid_check_is_in_our_domain(alias)) {
+        if (sid_check_is_in_our_sam(alias)) {
                 type = SID_NAME_ALIAS;
         }
@@ -3685 +3596 @@
         }
 
-        if (sid_check_is_in_our_domain(alias)) {
+        if (sid_check_is_in_our_sam(alias)) {
                 type = SID_NAME_ALIAS;
         }
@@ -3802 +3713 @@
         }
 
-        if (sid_check_is_domain(domain_sid)) {
+        if (sid_check_is_our_sam(domain_sid)) {
                 type = SID_NAME_ALIAS;
         }
@@ -3839 +3750 @@
                 ldap_state->search_cache.result = NULL;
         } else {
-                rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
+                rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(talloc_tos()),
                                     LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
                 if (rc != LDAP_SUCCESS) {
                         return NT_STATUS_UNSUCCESSFUL;
                 }
-                talloc_autofree_ldapmsg(filter, result);
+                smbldap_talloc_autofree_ldapmsg(filter, result);
         }
 
@@ -3881 +3792 @@
                 /*
                  * Note: result is a talloc child of filter because of the
-                 * talloc_autofree_ldapmsg() usage
+                 * smbldap_talloc_autofree_ldapmsg() usage
                  */
                 ldap_state->search_cache.filter = talloc_move(ldap_state, &filter);
@@ -4107 +4018 @@
 
         if (!sid_check_is_builtin(domain_sid) &&
-            !sid_check_is_domain(domain_sid)) {
+            !sid_check_is_our_sam(domain_sid)) {
                 result = NT_STATUS_INVALID_PARAMETER;
                 goto done;
@@ -4151 +4062 @@
 
                 rc = smbldap_search(ldap_state->smbldap_state,
-                                    lp_ldap_user_suffix(),
+                                    lp_ldap_user_suffix(talloc_tos()),
                                     LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
                                     &msg);
-                talloc_autofree_ldapmsg(mem_ctx, msg);
+                smbldap_talloc_autofree_ldapmsg(mem_ctx, msg);
         }
 
@@ -4219 +4130 @@
 
                 rc = smbldap_search(ldap_state->smbldap_state,
-                                    lp_ldap_suffix(),
+                                    lp_ldap_suffix(talloc_tos()),
                                     LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
                                     &msg);
-                talloc_autofree_ldapmsg(mem_ctx, msg);
+                smbldap_talloc_autofree_ldapmsg(mem_ctx, msg);
         }
 
@@ -4342 +4253 @@
         va_end(ap);
 
-        if ((result = TALLOC_ARRAY(mem_ctx, const char *, num+1)) == NULL) {
+        if ((result = talloc_array(mem_ctx, const char *, num+1)) == NULL) {
                 return NULL;
         }
@@ -4545 +4456 @@
         vals = ldap_get_values(ld, entry, "sambaAcctFlags");
         if ((vals == NULL) || (vals[0] == NULL)) {
-                DEBUG(5, ("\"sambaAcctFlags\" not found\n"));
-                return False;
-        }
-        acct_flags = pdb_decode_acct_ctrl(vals[0]);
-        ldap_value_free(vals);
+                acct_flags = ACB_NORMAL;
+        } else {
+                acct_flags = pdb_decode_acct_ctrl(vals[0]);
+                ldap_value_free(vals);
+        }
 
         if ((state->acct_flags != 0) &&
@@ -4566 +4477 @@
         }
         if (!pull_utf8_talloc(mem_ctx,
-                              CONST_DISCARD(char **, &result->account_name),
+                              discard_const_p(char *, &result->account_name),
                               vals[0], &converted_size))
         {
@@ -4579 +4490 @@
                 DEBUG(8, ("\"displayName\" not found\n"));
         else if (!pull_utf8_talloc(mem_ctx,
-                                   CONST_DISCARD(char **, &result->fullname),
+                                   discard_const_p(char *, &result->fullname),
                                    vals[0], &converted_size))
         {
@@ -4592 +4503 @@
                 DEBUG(8, ("\"description\" not found\n"));
         else if (!pull_utf8_talloc(mem_ctx,
-                                   CONST_DISCARD(char **, &result->description),
+                                   discard_const_p(char *, &result->description),
                                    vals[0], &converted_size))
         {
@@ -4648 +4559 @@
 
         if ((acct_flags != 0) && ((acct_flags & ACB_NORMAL) != 0))
-                state->base = lp_ldap_user_suffix();
+                state->base = lp_ldap_user_suffix(talloc_tos());
         else if ((acct_flags != 0) &&
                  ((acct_flags & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) != 0))
-                state->base = lp_ldap_machine_suffix();
+                state->base = lp_ldap_machine_suffix(talloc_tos());
         else
-                state->base = lp_ldap_suffix();
+                state->base = lp_ldap_suffix(talloc_tos());
 
         state->acct_flags = acct_flags;
@@ -4726 +4637 @@
                 }
                 if (!pull_utf8_talloc(mem_ctx,
-                                      CONST_DISCARD(char **,
+                                      discard_const_p(char *,
                                                     &result->account_name),
                                       vals[0], &converted_size))
@@ -4735 +4646 @@
         }
         else if (!pull_utf8_talloc(mem_ctx,
-                                   CONST_DISCARD(char **,
+                                   discard_const_p(char *,
                                                  &result->account_name),
                                    vals[0], &converted_size))
@@ -4749 +4660 @@
                 DEBUG(8, ("\"description\" not found\n"));
         else if (!pull_utf8_talloc(mem_ctx,
-                                   CONST_DISCARD(char **, &result->description),
+                                   discard_const_p(char *, &result->description),
                                    vals[0], &converted_size))
         {
@@ -4821 +4732 @@
         state->connection = ldap_state->smbldap_state;
 
-        state->base = talloc_strdup(search, lp_ldap_suffix());
+        state->base = lp_ldap_suffix(search);
         state->connection = ldap_state->smbldap_state;
         state->scope = LDAP_SCOPE_SUBTREE;
@@ -4897 +4808 @@
         }
 
-        talloc_autofree_ldapmsg(mem_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
         entry = ldap_first_entry(priv2ld(priv), result);
@@ -4941 +4852 @@
         smbldap_make_mod(priv2ld(priv), entry, &mods, "sambaNextRid",
                          talloc_asprintf(mem_ctx, "%d", nextRid));
-        talloc_autofree_ldapmod(mem_ctx, mods);
+        smbldap_talloc_autofree_ldapmod(mem_ctx, mods);
 
         if ((dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)) == NULL) {
@@ -4994 +4905 @@
 static bool ldapsam_sid_to_id(struct pdb_methods *methods,
                               const struct dom_sid *sid,
-                              union unid_t *id, enum lsa_SidType *type)
+                              struct unixid *id)
 {
         struct ldapsam_privates *priv =
@@ -5009 +4920 @@
         TALLOC_CTX *mem_ctx;
 
+        ret = pdb_sid_to_id_unix_users_and_groups(sid, id);
+        if (ret == true) {
+                return true;
+        }
+
         mem_ctx = talloc_new(NULL);
         if (mem_ctx == NULL) {
@@ -5030 +4946 @@
                 goto done;
         }
-        talloc_autofree_ldapmsg(mem_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
         if (ldap_count_entries(priv2ld(priv), result) != 1) {
@@ -5056 +4972 @@
                 }
 
-                id->gid = strtoul(gid_str, NULL, 10);
-                *type = (enum lsa_SidType)strtoul(value, NULL, 10);
-                store_gid_sid_cache(sid, id->gid);
-                idmap_cache_set_sid2gid(sid, id->gid);
+                id->id = strtoul(gid_str, NULL, 10);
+                id->type = ID_TYPE_GID;
                 ret = True;
                 goto done;
@@ -5074 +4988 @@
         }
 
-        id->uid = strtoul(value, NULL, 10);
-        *type = SID_NAME_USER;
-        store_uid_sid_cache(sid, id->uid);
-        idmap_cache_set_sid2uid(sid, id->uid);
+        id->id = strtoul(value, NULL, 10);
+        id->type = ID_TYPE_UID;
 
         ret = True;
@@ -5120 +5032 @@
                 goto done;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         if (ldap_count_entries(priv2ld(priv), result) != 1) {
@@ -5146 +5058 @@
 
         sid_copy(sid, &user_sid);
-
-        store_uid_sid_cache(sid, uid);
-        idmap_cache_set_sid2uid(sid, uid);
 
         ret = true;
@@ -5190 +5099 @@
                 goto done;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         if (ldap_count_entries(priv2ld(priv), result) != 1) {
@@ -5217 +5126 @@
         sid_copy(sid, &group_sid);
 
-        store_gid_sid_cache(sid, gid);
-        idmap_cache_set_sid2gid(sid, gid);
-
         ret = true;
 
@@ -5225 +5131 @@
         TALLOC_FREE(tmp_ctx);
         return ret;
+}
+
+static bool ldapsam_id_to_sid(struct pdb_methods *methods, struct unixid *id,
+                                   struct dom_sid *sid)
+{
+        switch (id->type) {
+        case ID_TYPE_UID:
+                return ldapsam_uid_to_sid(methods, id->id, sid);
+
+        case ID_TYPE_GID:
+                return ldapsam_gid_to_sid(methods, id->id, sid);
+
+        default:
+                return false;
+        }
 }
 
@@ -5252 +5173 @@
         bool is_machine = False;
         bool add_posix = False;
+        bool init_okay = False;
         LDAPMod **mods = NULL;
         struct samu *user;
@@ -5285 +5207 @@
                 return NT_STATUS_ACCESS_DENIED;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         num_result = ldap_count_entries(priv2ld(ldap_state), result);
@@ -5369 +5291 @@
         }
 
-        if (!init_ldap_from_sam(ldap_state, entry, &mods, user, element_is_set_or_changed)) {
+        init_okay = init_ldap_from_sam(ldap_state, entry, &mods, user, pdb_element_is_set_or_changed);
+        smbldap_talloc_autofree_ldapmod(tmp_ctx, mods);
+
+        if (!init_okay) {
                 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
                 return NT_STATUS_UNSUCCESSFUL;
@@ -5400 +5325 @@
                 if (is_machine) {
                         /* TODO: choose a more appropriate default for machines */
-                        homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), "SMB_workstations_home", ldap_state->domain_name, uid, gid);
+                        homedir = talloc_sub_specified(tmp_ctx,
+                                                       lp_template_homedir(),
+                                                       "SMB_workstations_home",
+                                                       NULL,
+                                                       ldap_state->domain_name,
+                                                       uid,
+                                                       gid);
                         shell = talloc_strdup(tmp_ctx, "/bin/false");
                 } else {
-                        homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), name, ldap_state->domain_name, uid, gid);
-                        shell = talloc_sub_specified(tmp_ctx, lp_template_shell(), name, ldap_state->domain_name, uid, gid);
+                        homedir = talloc_sub_specified(tmp_ctx,
+                                                       lp_template_homedir(),
+                                                       name,
+                                                       NULL,
+                                                       ldap_state->domain_name,
+                                                       uid,
+                                                       gid);
+                        shell = talloc_sub_specified(tmp_ctx,
+                                                     lp_template_shell(),
+                                                     name,
+                                                     NULL,
+                                                     ldap_state->domain_name,
+                                                     uid,
+                                                     gid);
                 }
                 uidstr = talloc_asprintf(tmp_ctx, "%u", (unsigned int)uid);
@@ -5416 +5359 @@
 
                 if (is_machine) {
-                        dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_machine_suffix ());
+                        dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_machine_suffix (talloc_tos()));
                 } else {
-                        dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_user_suffix ());
+                        dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_user_suffix (talloc_tos()));
                 }
 
@@ -5437 +5380 @@
         }
 
-        talloc_autofree_ldapmod(tmp_ctx, mods);
-
-        if (add_posix) {        
+        if (add_posix) {
                 rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
         } else {
@@ -5485 +5426 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         num_result = ldap_count_entries(priv2ld(ldap_state), result);
@@ -5595 +5536 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         num_result = ldap_count_entries(priv2ld(ldap_state), result);
@@ -5681 +5622 @@
                 }
 
-                dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", escape_name, lp_ldap_group_suffix());
+                dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", escape_name, lp_ldap_group_suffix(talloc_tos()));
 
                 SAFE_FREE(escape_name);
@@ -5695 +5636 @@
         }
 
-        talloc_autofree_ldapmod(tmp_ctx, mods);
+        smbldap_talloc_autofree_ldapmod(tmp_ctx, mods);
 
         if (is_new_entry) {     
@@ -5752 +5693 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         num_result = ldap_count_entries(priv2ld(ldap_state), result);
@@ -5798 +5739 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         num_result = ldap_count_entries(priv2ld(ldap_state), result);
@@ -5867 +5808 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         num_result = ldap_count_entries(priv2ld(ldap_state), result);
@@ -5931 +5872 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        talloc_autofree_ldapmsg(tmp_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);
 
         num_result = ldap_count_entries(priv2ld(ldap_state), result);
@@ -5959 +5900 @@
         smbldap_set_mod(&mods, modop, "memberUid", uidstr);
 
-        talloc_autofree_ldapmod(tmp_ctx, mods);
+        smbldap_talloc_autofree_ldapmod(tmp_ctx, mods);
 
         rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
@@ -6045 +5986 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        talloc_autofree_ldapmsg(mem_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
         num_result = ldap_count_entries(priv2ld(ldap_state), result);
@@ -6128 +6069 @@
 
         if (result != NULL) {
-                talloc_autofree_ldapmsg(mem_ctx, result);
+                smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
         }
 
@@ -6269 +6210 @@
         }
 
-        talloc_autofree_ldapmod(talloc_tos(), mods);
+        smbldap_talloc_autofree_ldapmod(talloc_tos(), mods);
 
         trusted_dn = trusteddom_dn(ldap_state, domain);
@@ -6350 +6291 @@
 
         if (result != NULL) {
-                talloc_autofree_ldapmsg(mem_ctx, result);
+                smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
         }
 
@@ -6358 +6299 @@
 
         *num_domains = 0;
-        if (!(*domains = TALLOC_ARRAY(mem_ctx, struct trustdom_info *, 1))) {
+        if (!(*domains = talloc_array(mem_ctx, struct trustdom_info *, 1))) {
                 DEBUG(1, ("talloc failed\n"));
                 return NT_STATUS_NO_MEMORY;
@@ -6370 +6311 @@
                 struct trustdom_info *dom_info;
 
-                dom_info = TALLOC_P(*domains, struct trustdom_info);
+                dom_info = talloc(*domains, struct trustdom_info);
                 if (dom_info == NULL) {
                         DEBUG(1, ("talloc failed\n"));
@@ -6445 +6386 @@
         NTSTATUS nt_status;
         struct ldapsam_privates *ldap_state;
+        char *bind_dn = NULL;
+        char *bind_secret = NULL;
 
         if (!NT_STATUS_IS_OK(nt_status = make_pdb_method( pdb_method ))) {
@@ -6482 +6425 @@
         /* TODO: Setup private data and free */
 
-        if ( !(ldap_state = TALLOC_ZERO_P(*pdb_method, struct ldapsam_privates)) ) {
+        if ( !(ldap_state = talloc_zero(*pdb_method, struct ldapsam_privates)) ) {
                 DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
                 return NT_STATUS_NO_MEMORY;
         }
 
-        nt_status = smbldap_init(*pdb_method, pdb_get_event_context(),
-                                 location, &ldap_state->smbldap_state);
-
+        if (!fetch_ldap_pw(&bind_dn, &bind_secret)) {
+                DEBUG(0, ("pdb_init_ldapsam_common: Failed to retrieve LDAP password from secrets.tdb\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        nt_status = smbldap_init(*pdb_method, pdb_get_tevent_context(),
+                                 location, false, bind_dn, bind_secret,
+                                 &ldap_state->smbldap_state);
+        memset(bind_secret, '\0', strlen(bind_secret));
+        SAFE_FREE(bind_secret);
+        SAFE_FREE(bind_dn);
         if ( !NT_STATUS_IS_OK(nt_status) ) {
                 return nt_status;
@@ -6505 +6456 @@
 }
 
-/**********************************************************************
- Initialise the 'compat' mode for pdb_ldap
- *********************************************************************/
-
-NTSTATUS pdb_init_ldapsam_compat(struct pdb_methods **pdb_method, const char *location)
-{
-        NTSTATUS nt_status;
-        struct ldapsam_privates *ldap_state;
-        char *uri = talloc_strdup( NULL, location );
-
-        trim_char( uri, '\"', '\"' );
-        nt_status = pdb_init_ldapsam_common( pdb_method, uri );
-        if ( uri )
-                TALLOC_FREE( uri );
-
-        if ( !NT_STATUS_IS_OK(nt_status) ) {
-                return nt_status;
-        }
-
-        (*pdb_method)->name = "ldapsam_compat";
-
-        ldap_state = (struct ldapsam_privates *)((*pdb_method)->private_data);
-        ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
-
-        sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
-
-        return NT_STATUS_OK;
+static bool ldapsam_is_responsible_for_wellknown(struct pdb_methods *m)
+{
+        return true;
 }
 
@@ -6538 +6465 @@
  *********************************************************************/
 
-NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
+NTSTATUS pdb_ldapsam_init_common(struct pdb_methods **pdb_method,
+                                 const char *location)
 {
         NTSTATUS nt_status;
@@ -6570 +6498 @@
         (*pdb_method)->search_groups = ldapsam_search_groups;
         (*pdb_method)->search_aliases = ldapsam_search_aliases;
+        (*pdb_method)->is_responsible_for_wellknown =
+                                        ldapsam_is_responsible_for_wellknown;
 
         if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
@@ -6577 +6507 @@
                 (*pdb_method)->lookup_rids = ldapsam_lookup_rids;
                 (*pdb_method)->sid_to_id = ldapsam_sid_to_id;
-                (*pdb_method)->uid_to_sid = ldapsam_uid_to_sid;
-                (*pdb_method)->gid_to_sid = ldapsam_gid_to_sid;
+                (*pdb_method)->id_to_sid = ldapsam_id_to_sid;
 
                 if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
@@ -6601 +6530 @@
 
         if ( !NT_STATUS_IS_OK(nt_status) ) {
-                DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
-                          "info, nor add one to the domain\n"));
-                DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, "
-                             "will be unable to allocate new users/groups, "
-                             "and will risk BDCs having inconsistent SIDs\n"));
-                sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
-                return NT_STATUS_OK;
+                DEBUG(0, ("pdb_init_ldapsam: WARNING: Could not get domain "
+                          "info, nor add one to the domain. "
+                          "We cannot work reliably without it.\n"));
+                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
         }
 
@@ -6647 +6573 @@
                         return NT_STATUS_INVALID_PARAMETER;
                 }
-                found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
+                found_sid = PDB_secrets_fetch_domain_sid(ldap_state->domain_name,
                                                      &secrets_domain_sid);
                 if (!found_sid || !dom_sid_equal(&secrets_domain_sid,
@@ -6658 +6584 @@
 
                         /* reset secrets.tdb sid */
-                        secrets_store_domain_sid(ldap_state->domain_name,
+                        PDB_secrets_store_domain_sid(ldap_state->domain_name,
                                                  &ldap_domain_sid);
                         DEBUG(1, ("New global sam SID: %s\n",
@@ -6690 +6616 @@
 }
 
-NTSTATUS pdb_ldap_init(void)
+NTSTATUS pdb_ldapsam_init(void)
 {
         NTSTATUS nt_status;
-        if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
+
+        nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION,
+                                        "ldapsam",
+                                        pdb_ldapsam_init_common);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
-
-        if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
-                return nt_status;
+        }
 
         /* Let pdb_nds register backends */

vendor/current/source3/passdb/pdb_nds.c

@@ -24 +24 @@
 #include <lber.h>
 #include <ldap.h>
-#include <wchar.h>
 
 #include "smbldap.h"
+#include "passdb/pdb_ldap.h"
+#include "passdb/pdb_nds.h"
 
 #define NMASLDAP_GET_LOGIN_CONFIG_REQUEST       "2.16.840.1.113719.1.39.42.100.3"
@@ -781 +782 @@
                         pdb_set_backend_private_data(sam_acct, result, NULL,
                                                      methods, PDB_CHANGED);
-                        talloc_autofree_ldapmsg(sam_acct, result);
+                        smbldap_talloc_autofree_ldapmsg(sam_acct, result);
                 }
 
@@ -811 +812 @@
                 if((success != True) || (got_clear_text_pw == True)) {
                         
-                        rc = smb_ldap_setup_full_conn(&ld, ldap_state->location);
+                        rc = smbldap_setup_full_conn(&ld, ldap_state->location);
                         if (rc) {
                                 TALLOC_FREE(dn);
@@ -872 +873 @@
 }
 
-
-/**********************************************************************
- Initialise the 'nds compat' mode for pdb_ldap
- *********************************************************************/
-
-static NTSTATUS pdb_init_NDS_ldapsam_compat(struct pdb_methods **pdb_method, const char *location)
-{
-        NTSTATUS nt_status = pdb_init_ldapsam_compat(pdb_method, location);
-
-        (*pdb_method)->name = "NDS_ldapsam_compat";
-
-        pdb_init_NDS_ldapsam_common(pdb_method, location);
-
-        return nt_status;
-}
-
-
 /**********************************************************************
  Initialise the 'nds' normal mode for pdb_ldap
@@ -895 +879 @@
 static NTSTATUS pdb_init_NDS_ldapsam(struct pdb_methods **pdb_method, const char *location)
 {
-        NTSTATUS nt_status = pdb_init_ldapsam(pdb_method, location);
+        NTSTATUS nt_status = pdb_ldapsam_init_common(pdb_method, location);
 
         (*pdb_method)->name = "NDS_ldapsam";
@@ -910 +894 @@
                 return nt_status;
 
-        if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "NDS_ldapsam_compat", pdb_init_NDS_ldapsam_compat)))
-                return nt_status;
-
         return NT_STATUS_OK;
 }

vendor/current/source3/passdb/pdb_smbpasswd.c

@@ -27 +27 @@
 #include "../librpc/gen_ndr/samr.h"
 #include "../libcli/security/security.h"
+#include "passdb/pdb_smbpasswd.h"
 
 #undef DBGC_CLASS
@@ -39 +40 @@
 struct smb_passwd
 {
-        uint32 smb_userid;        /* this is actually the unix uid_t */
+        uint32_t smb_userid;      /* this is actually the unix uid_t */
         const char *smb_name;     /* username string */
 
@@ -87 +88 @@
 static bool do_file_lock(int fd, int waitsecs, int type)
 {
-        SMB_STRUCT_FLOCK lock;
+        struct flock lock;
         int             ret;
         void (*oldsig_handler)(int);
@@ -102 +103 @@
         alarm(waitsecs);
         /* Note we must *NOT* use sys_fcntl here ! JRA */
-        ret = fcntl(fd, SMB_F_SETLKW, &lock);
+        ret = fcntl(fd, F_SETLKW, &lock);
         alarm(0);
         CatchSignal(SIGALRM, oldsig_handler);
@@ -214 +215 @@
 
                                 for(i = 0; i < 5; i++) {
-                                        if((fd = sys_open(pfile, O_CREAT|O_TRUNC|O_EXCL|O_RDWR, 0600))!=-1) {
+                                        if((fd = open(pfile, O_CREAT|O_TRUNC|O_EXCL|O_RDWR, 0600))!=-1) {
                                                 break;
                                         }
-                                        sys_usleep(200); /* Spin, spin... */
+                                        usleep(200); /* Spin, spin... */
                                 }
                                 if(fd == -1) {
@@ -237 +238 @@
                 DEBUG(10, ("startsmbfilepwent_internal: opening file %s\n", pfile));
 
-                if((fp = sys_fopen(pfile, open_mode)) == NULL) {
+                if((fp = fopen(pfile, open_mode)) == NULL) {
 
                         /*
@@ -244 +245 @@
                          */
                         if (errno == ENOENT) {
-                                if ((fp = sys_fopen(pfile, "a+")) != NULL) {
+                                if ((fp = fopen(pfile, "a+")) != NULL) {
                                         DEBUG(0, ("startsmbfilepwent_internal: file %s did not \
 exist. File successfully created.\n", pfile));
@@ -550 +551 @@
                         if(*p == ':') {
                                 p++;
-                                if(*p && (StrnCaseCmp((char *)p, "LCT-", 4)==0)) {
+                                if(*p && (strncasecmp_m((char *)p, "LCT-", 4)==0)) {
                                         int i;
                                         p += 4;
@@ -642 +643 @@
         size_t new_entry_length;
         char *new_entry;
-        SMB_OFF_T offpos;
+        off_t offpos;
  
         /* Open the smbpassword file - for update. */
@@ -678 +679 @@
         fd = fileno(fp);
 
-        if((offpos = sys_lseek(fd, 0, SEEK_END)) == -1) {
+        if((offpos = lseek(fd, 0, SEEK_END)) == -1) {
                 NTSTATUS result = map_nt_error_from_unix(errno);
-                DEBUG(0, ("add_smbfilepwd_entry(sys_lseek): Failed to add entry for user %s to file %s. \
+                DEBUG(0, ("add_smbfilepwd_entry(lseek): Failed to add entry for user %s to file %s. \
 Error was %s\n", newpwd->smb_name, pfile, strerror(errno)));
                 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
@@ -706 +707 @@
 
                 /* Remove the entry we just wrote. */
-                if(sys_ftruncate(fd, offpos) == -1) {
+                if(ftruncate(fd, offpos) == -1) {
                         DEBUG(0, ("add_smbfilepwd_entry: ERROR failed to ftruncate file %s. \
 Error was %s. Password file may be corrupt ! Please examine by hand !\n", 
@@ -751 +752 @@
         bool got_pass_last_set_time = False;
 
-        SMB_OFF_T pwd_seekpos = 0;
+        off_t pwd_seekpos = 0;
 
         int i;
@@ -763 +764 @@
         DEBUG(10, ("mod_smbfilepwd_entry: opening file %s\n", pfile));
 
-        fp = sys_fopen(pfile, "r+");
+        fp = fopen(pfile, "r+");
 
         if (fp == NULL) {
@@ -789 +790 @@
         status = linebuf;
         while (status && !feof(fp)) {
-                pwd_seekpos = sys_ftell(fp);
+                pwd_seekpos = ftell(fp);
 
                 linebuf[0] = '\0';
@@ -977 +978 @@
 
                         /* We should be pointing at the LCT entry. */
-                        if((linebuf_len > (PTR_DIFF(p, linebuf) + 13)) && (StrnCaseCmp((char *)p, "LCT-", 4) == 0)) {
+                        if((linebuf_len > (PTR_DIFF(p, linebuf) + 13)) && (strncasecmp_m((char *)p, "LCT-", 4) == 0)) {
                                 p += 4;
                                 for(i = 0; i < 8; i++) {
@@ -992 +993 @@
                                         got_pass_last_set_time = True;
                                 } /* i == 8 */
-                        } /* *p && StrnCaseCmp() */
+                        } /* *p && strncasecmp_m() */
                 } /* p == ':' */
         } /* p == '[' */
@@ -1019 +1020 @@
 #ifdef DEBUG_PASSWORD
         DEBUG(100,("mod_smbfilepwd_entry: "));
-        dump_data(100, (uint8 *)ascii_p16, wr_len);
+        dump_data(100, (uint8_t *)ascii_p16, wr_len);
 #endif
 
@@ -1040 +1041 @@
         fd = fileno(fp);
 
-        if (sys_lseek(fd, pwd_seekpos - 1, SEEK_SET) != pwd_seekpos - 1) {
+        if (lseek(fd, pwd_seekpos - 1, SEEK_SET) != pwd_seekpos - 1) {
                 DEBUG(0, ("mod_smbfilepwd_entry: seek fail on file %s.\n", pfile));
                 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
@@ -1062 +1063 @@
         }
  
-        if (sys_lseek(fd, pwd_seekpos, SEEK_SET) != pwd_seekpos) {
+        if (lseek(fd, pwd_seekpos, SEEK_SET) != pwd_seekpos) {
                 DEBUG(0, ("mod_smbfilepwd_entry: seek fail on file %s.\n", pfile));
                 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
@@ -1096 +1097 @@
         pfile2 = talloc_asprintf(talloc_tos(),
                         "%s.%u",
-                        pfile, (unsigned)sys_getpid());
+                        pfile, (unsigned)getpid());
         if (!pfile2) {
                 return false;
@@ -1206 +1207 @@
                 /* If the user specified a RID, make sure its able to be both stored and retreived */
                 if (rid == DOMAIN_RID_GUEST) {
-                        struct passwd *passwd = Get_Pwnam_alloc(NULL, lp_guestaccount());
+                        struct passwd *passwd = Get_Pwnam_alloc(NULL, lp_guest_account());
                         if (!passwd) {
-                                DEBUG(0, ("Could not find guest account via Get_Pwnam_alloc()! (%s)\n", lp_guestaccount()));
+                                DEBUG(0, ("Could not find guest account via Get_Pwnam_alloc()! (%s)\n", lp_guest_account()));
                                 return False;
                         }
@@ -1343 +1344 @@
         /* More special case 'guest account' hacks... */
         if (rid == DOMAIN_RID_GUEST) {
-                const char *guest_account = lp_guestaccount();
+                const char *guest_account = lp_guest_account();
                 if (!(guest_account && *guest_account)) {
                         DEBUG(1, ("Guest account not specfied!\n"));
@@ -1449 +1450 @@
         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 
-        if (!*(lp_renameuser_script()))
+        if (!*(lp_rename_user_script(talloc_tos())))
                 goto done;
 
@@ -1469 +1470 @@
 
         /* rename the posix user */
-        rename_script = talloc_strdup(ctx,
-                                lp_renameuser_script());
+        rename_script = lp_rename_user_script(ctx);
         if (!rename_script) {
                 ret = NT_STATUS_NO_MEMORY;
@@ -1696 +1696 @@
         /* Setup private data and free function */
 
-        if ( !(privates = TALLOC_ZERO_P( *pdb_method, struct smbpasswd_privates )) ) {
+        if ( !(privates = talloc_zero( *pdb_method, struct smbpasswd_privates )) ) {
                 DEBUG(0, ("talloc() failed for smbpasswd private_data!\n"));
                 return NT_STATUS_NO_MEMORY;

vendor/current/source3/passdb/pdb_tdb.c

@@ -26 +26 @@
 #include "system/filesys.h"
 #include "passdb.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
 #include "../libcli/security/security.h"
 #include "util_tdb.h"
+#include "passdb/pdb_tdb.h"
 
 #if 0 /* when made a module use this */
@@ -58 +60 @@
 static struct db_context *db_sam;
 static char *tdbsam_filename;
+static bool map_builtin;
 
 struct tdbsam_convert_state {
@@ -72 +75 @@
         NTSTATUS status;
         bool ret;
-
-        if (rec->key.dsize < USERPREFIX_LEN) {
+        TDB_DATA key;
+        TDB_DATA value;
+
+        key = dbwrap_record_get_key(rec);
+
+        if (key.dsize < USERPREFIX_LEN) {
                 return 0;
         }
-        if (strncmp((char *)rec->key.dptr, USERPREFIX, USERPREFIX_LEN) != 0) {
+        if (strncmp((char *)key.dptr, USERPREFIX, USERPREFIX_LEN) != 0) {
                 return 0;
         }
@@ -88 +95 @@
 
         DEBUG(10,("tdbsam_convert: Try unpacking a record with (key:%s) "
-                  "(version:%d)\n", rec->key.dptr, state->from));
+                  "(version:%d)\n", (char *)key.dptr, state->from));
+
+        value = dbwrap_record_get_value(rec);
 
         switch (state->from) {
         case 0:
                 ret = init_samu_from_buffer(user, SAMU_BUFFER_V0,
-                                            (uint8 *)rec->value.dptr,
-                                            rec->value.dsize);
+                                            (uint8_t *)value.dptr,
+                                            value.dsize);
                 break;
         case 1:
                 ret = init_samu_from_buffer(user, SAMU_BUFFER_V1,
-                                            (uint8 *)rec->value.dptr,
-                                            rec->value.dsize);
+                                            (uint8_t *)value.dptr,
+                                            value.dsize);
                 break;
         case 2:
                 ret = init_samu_from_buffer(user, SAMU_BUFFER_V2,
-                                            (uint8 *)rec->value.dptr,
-                                            rec->value.dsize);
+                                            (uint8_t *)value.dptr,
+                                            value.dsize);
                 break;
         case 3:
                 ret = init_samu_from_buffer(user, SAMU_BUFFER_V3,
-                                            (uint8 *)rec->value.dptr,
-                                            rec->value.dsize);
+                                            (uint8_t *)value.dptr,
+                                            value.dsize);
                 break;
         case 4:
                 ret = init_samu_from_buffer(user, SAMU_BUFFER_V4,
-                                            (uint8 *)rec->value.dptr,
-                                            rec->value.dsize);
+                                            (uint8_t *)value.dptr,
+                                            value.dsize);
                 break;
         default:
@@ -122 +131 @@
         if (!ret) {
                 DEBUG(0,("tdbsam_convert: Bad struct samu entry returned "
-                         "from TDB (key:%s) (version:%d)\n", rec->key.dptr,
+                         "from TDB (key:%s) (version:%d)\n", (char *)key.dptr,
                          state->from));
                 TALLOC_FREE(user);
@@ -139 +148 @@
         }
 
-        status = rec->store(rec, data, TDB_MODIFY);
+        status = dbwrap_record_store(rec, data, TDB_MODIFY);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0, ("Could not store the new record: %s\n",
@@ -164 +173 @@
         struct db_record *new_rec;
         NTSTATUS status;
-
-        new_rec = bs->new_db->fetch_locked(bs->new_db, talloc_tos(), orig_rec->key);
+        TDB_DATA key;
+        TDB_DATA value;
+
+        key = dbwrap_record_get_key(orig_rec);
+
+        new_rec = dbwrap_fetch_locked(bs->new_db, talloc_tos(), key);
         if (new_rec == NULL) {
                 bs->success = false;
@@ -171 +184 @@
         }
 
-        status = new_rec->store(new_rec, orig_rec->value, TDB_INSERT);
+        value = dbwrap_record_get_value(orig_rec);
+
+        status = dbwrap_record_store(new_rec, value, TDB_INSERT);
 
         TALLOC_FREE(new_rec);
@@ -197 +212 @@
         struct db_context *orig_db = *pp_db;
         struct tdbsam_backup_state bs;
-        int ret;
+        NTSTATUS status;
 
         tmp_fname = talloc_asprintf(frame, "%s.tmp", dbname);
@@ -211 +226 @@
 
         tmp_db = db_open(NULL, tmp_fname, 0,
-                                TDB_DEFAULT, O_CREAT|O_RDWR, 0600);
+                         TDB_DEFAULT, O_CREAT|O_RDWR, 0600,
+                         DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         if (tmp_db == NULL) {
                 DEBUG(0, ("tdbsam_convert_backup: Failed to create backup TDB passwd "
@@ -219 +235 @@
         }
 
-        if (orig_db->transaction_start(orig_db) != 0) {
+        if (dbwrap_transaction_start(orig_db) != 0) {
                 DEBUG(0, ("tdbsam_convert_backup: Could not start transaction (1)\n"));
                 unlink(tmp_fname);
@@ -226 +242 @@
                 return false;
         }
-        if (tmp_db->transaction_start(tmp_db) != 0) {
+        if (dbwrap_transaction_start(tmp_db) != 0) {
                 DEBUG(0, ("tdbsam_convert_backup: Could not start transaction (2)\n"));
-                orig_db->transaction_cancel(orig_db);
+                dbwrap_transaction_cancel(orig_db);
                 unlink(tmp_fname);
                 TALLOC_FREE(tmp_db);
@@ -238 +254 @@
         bs.success = true;
 
-        ret = orig_db->traverse(orig_db, backup_copy_fn, (void *)&bs);
-        if (ret < 0) {
+        status = dbwrap_traverse(orig_db, backup_copy_fn, (void *)&bs, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0, ("tdbsam_convert_backup: traverse failed\n"));
                 goto cancel;
@@ -249 +265 @@
         }
 
-        if (orig_db->transaction_commit(orig_db) != 0) {
+        if (dbwrap_transaction_commit(orig_db) != 0) {
                 smb_panic("tdbsam_convert_backup: orig commit failed\n");
         }
-        if (tmp_db->transaction_commit(tmp_db) != 0) {
+        if (dbwrap_transaction_commit(tmp_db) != 0) {
                 smb_panic("tdbsam_convert_backup: orig commit failed\n");
         }
@@ -277 +293 @@
 
         orig_db = db_open(NULL, dbname, 0,
-                          TDB_DEFAULT, O_CREAT|O_RDWR, 0600);
+                          TDB_DEFAULT, O_CREAT|O_RDWR, 0600,
+                          DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         if (orig_db == NULL) {
                 DEBUG(0, ("tdbsam_convert_backup: Failed to re-open "
@@ -293 +310 @@
   cancel:
 
-        if (orig_db->transaction_cancel(orig_db) != 0) {
+        if (dbwrap_transaction_cancel(orig_db) != 0) {
                 smb_panic("tdbsam_convert: transaction_cancel failed");
         }
 
-        if (tmp_db->transaction_cancel(tmp_db) != 0) {
+        if (dbwrap_transaction_cancel(tmp_db) != 0) {
                 smb_panic("tdbsam_convert: transaction_cancel failed");
         }
@@ -310 +327 @@
 {
         TDB_CONTEXT *tdb;
-        uint32 rid;
+        uint32_t rid;
         bool ok = false;
-
-        ok = dbwrap_fetch_uint32(db, NEXT_RID_STRING, &rid);
-        if (ok) {
+        NTSTATUS status;
+        char *db_path;
+
+        status = dbwrap_fetch_uint32_bystring(db, NEXT_RID_STRING, &rid);
+        if (NT_STATUS_IS_OK(status)) {
                 return true;
         }
 
-        tdb = tdb_open_log(state_path("winbindd_idmap.tdb"), 0,
+        db_path = state_path("winbindd_idmap.tdb");
+        if (db_path == NULL) {
+                return false;
+        }
+
+        tdb = tdb_open_log(db_path, 0,
                            TDB_DEFAULT, O_RDONLY, 0644);
-
+        TALLOC_FREE(db_path);
         if (tdb) {
                 ok = tdb_fetch_uint32(tdb, "RID_COUNTER", &rid);
@@ -331 +355 @@
         }
 
-        if (dbwrap_store_uint32(db, NEXT_RID_STRING, rid) != 0) {
+        status = dbwrap_store_uint32_bystring(db, NEXT_RID_STRING, rid);
+        if (!NT_STATUS_IS_OK(status)) {
                 return false;
         }
@@ -338 +363 @@
 }
 
-static bool tdbsam_convert(struct db_context **pp_db, const char *name, int32 from)
+static bool tdbsam_convert(struct db_context **pp_db, const char *name, int32_t from)
 {
         struct tdbsam_convert_state state;
         struct db_context *db = NULL;
-        int ret;
+        NTSTATUS status;
 
         /* We only need the update backup for local db's. */
@@ -354 +379 @@
         state.success = true;
 
-        if (db->transaction_start(db) != 0) {
+        if (dbwrap_transaction_start(db) != 0) {
                 DEBUG(0, ("tdbsam_convert: Could not start transaction\n"));
                 return false;
@@ -364 +389 @@
         }
 
-        ret = db->traverse(db, tdbsam_convert_one, &state);
-        if (ret < 0) {
+        status = dbwrap_traverse(db, tdbsam_convert_one, &state, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0, ("tdbsam_convert: traverse failed\n"));
                 goto cancel;
@@ -375 +400 @@
         }
 
-        if (dbwrap_store_int32(db, TDBSAM_VERSION_STRING,
-                               TDBSAM_VERSION) != 0) {
-                DEBUG(0, ("tdbsam_convert: Could not store tdbsam version\n"));
-                goto cancel;
-        }
-
-        if (dbwrap_store_int32(db, TDBSAM_MINOR_VERSION_STRING,
-                               TDBSAM_MINOR_VERSION) != 0) {
-                DEBUG(0, ("tdbsam_convert: Could not store tdbsam minor version\n"));
-                goto cancel;
-        }
-
-        if (db->transaction_commit(db) != 0) {
+        status = dbwrap_store_int32_bystring(db, TDBSAM_VERSION_STRING,
+                                             TDBSAM_VERSION);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("tdbsam_convert: Could not store tdbsam version: "
+                          "%s\n", nt_errstr(status)));
+                goto cancel;
+        }
+
+        status = dbwrap_store_int32_bystring(db, TDBSAM_MINOR_VERSION_STRING,
+                                             TDBSAM_MINOR_VERSION);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("tdbsam_convert: Could not store tdbsam minor "
+                          "version: %s\n", nt_errstr(status)));
+                goto cancel;
+        }
+
+        if (dbwrap_transaction_commit(db) != 0) {
                 DEBUG(0, ("tdbsam_convert: Could not commit transaction\n"));
                 return false;
@@ -395 +424 @@
 
  cancel:
-        if (db->transaction_cancel(db) != 0) {
+        if (dbwrap_transaction_cancel(db) != 0) {
                 smb_panic("tdbsam_convert: transaction_cancel failed");
         }
@@ -409 +438 @@
 static bool tdbsam_open( const char *name )
 {
-        int32   version;
-        int32   minor_version;
+        int32_t version;
+        int32_t minor_version;
+        NTSTATUS status;
 
         /* check if we are already open */
@@ -420 +450 @@
         /* Try to open tdb passwd.  Create a new one if necessary */
 
-        db_sam = db_open(NULL, name, 0, TDB_DEFAULT, O_CREAT|O_RDWR, 0600);
+        db_sam = db_open(NULL, name, 0, TDB_DEFAULT, O_CREAT|O_RDWR, 0600,
+                         DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         if (db_sam == NULL) {
                 DEBUG(0, ("tdbsam_open: Failed to open/create TDB passwd "
@@ -428 +459 @@
 
         /* Check the version */
-        version = dbwrap_fetch_int32(db_sam, TDBSAM_VERSION_STRING);
-        if (version == -1) {
+        status = dbwrap_fetch_int32_bystring(db_sam, TDBSAM_VERSION_STRING,
+                                             &version);
+        if (!NT_STATUS_IS_OK(status)) {
                 version = 0;    /* Version not found, assume version 0 */
         }
 
         /* Get the minor version */
-        minor_version = dbwrap_fetch_int32(db_sam, TDBSAM_MINOR_VERSION_STRING);
-        if (minor_version == -1) {
+        status = dbwrap_fetch_int32_bystring(
+                db_sam, TDBSAM_MINOR_VERSION_STRING, &minor_version);
+        if (!NT_STATUS_IS_OK(status)) {
                 minor_version = 0; /* Minor version not found, assume 0 */
         }
@@ -469 +502 @@
 
                 /* Re-check the version */
-                version = dbwrap_fetch_int32(db_sam, TDBSAM_VERSION_STRING);
-                if (version == -1) {
+                status = dbwrap_fetch_int32_bystring(
+                        db_sam, TDBSAM_VERSION_STRING, &version);
+                if (!NT_STATUS_IS_OK(status)) {
                         version = 0;    /* Version not found, assume version 0 */
                 }
 
                 /* Re-check the minor version */
-                minor_version = dbwrap_fetch_int32(db_sam, TDBSAM_MINOR_VERSION_STRING);
-                if (minor_version == -1) {
+                status = dbwrap_fetch_int32_bystring(
+                        db_sam, TDBSAM_MINOR_VERSION_STRING, &minor_version);
+                if (!NT_STATUS_IS_OK(status)) {
                         minor_version = 0; /* Minor version not found, assume 0 */
                 }
@@ -536 +571 @@
         fstring         keystr;
         fstring         name;
+        NTSTATUS status;
 
         if ( !user ) {
@@ -544 +580 @@
         /* Data is stored in all lower-case */
         fstrcpy(name, sname);
-        strlower_m(name);
+        if (!strlower_m(name)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         /* set search key */
-        slprintf(keystr, sizeof(keystr)-1, "%s%s", USERPREFIX, name);
+        fstr_sprintf(keystr, "%s%s", USERPREFIX, name);
 
         /* open the database */
@@ -558 +596 @@
         /* get the record */
 
-        data = dbwrap_fetch_bystring(db_sam, talloc_tos(), keystr);
-        if (!data.dptr) {
+        status = dbwrap_fetch_bystring(db_sam, talloc_tos(), keystr, &data);
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(5,("pdb_getsampwnam (TDB): error fetching database.\n"));
                 DEBUGADD(5, (" Key: %s\n", keystr));
@@ -565 +603 @@
         }
 
+        if (data.dsize == 0) {
+                DEBUG(5, ("%s: Got 0-sized record for key %s\n", __func__,
+                          keystr));
+                return NT_STATUS_NO_SUCH_USER;
+        }
+
         /* unpack the buffer */
 
         if (!init_samu_from_buffer(user, SAMU_BUFFER_LATEST, data.dptr, data.dsize)) {
                 DEBUG(0,("pdb_getsampwent: Bad struct samu entry returned from TDB!\n"));
-                SAFE_FREE(data.dptr);
+                TALLOC_FREE(data.dptr);
                 return NT_STATUS_NO_MEMORY;
         }
@@ -585 +629 @@
 
 static NTSTATUS tdbsam_getsampwrid (struct pdb_methods *my_methods,
-                                    struct samu *user, uint32 rid)
+                                    struct samu *user, uint32_t rid)
 {
         NTSTATUS                nt_status = NT_STATUS_UNSUCCESSFUL;
@@ -599 +643 @@
         /* set search key */
 
-        slprintf(keystr, sizeof(keystr)-1, "%s%.8x", RIDPREFIX, rid);
+        fstr_sprintf(keystr, "%s%.8x", RIDPREFIX, rid);
 
         /* open the database */
@@ -610 +654 @@
         /* get the record */
 
-        data = dbwrap_fetch_bystring(db_sam, talloc_tos(), keystr);
-        if (!data.dptr) {
+        nt_status = dbwrap_fetch_bystring(db_sam, talloc_tos(), keystr, &data);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUG(5,("pdb_getsampwrid (TDB): error looking up RID %d by key %s.\n", rid, keystr));
-                return NT_STATUS_UNSUCCESSFUL;
+                return nt_status;
         }
 
@@ -625 +669 @@
                                    struct samu * user, const struct dom_sid *sid)
 {
-        uint32 rid;
+        uint32_t rid;
 
         if ( !sid_peek_check_rid(get_global_sam_sid(), sid, &rid) )
@@ -640 +684 @@
 
         fstrcpy(name, pdb_get_username(sam_pass));
-        strlower_m(name);
+        if (!strlower_m(name)) {
+                return false;
+        }
 
         /* set the search key */
 
-        slprintf(keystr, sizeof(keystr)-1, "%s%s", USERPREFIX, name);
+        fstr_sprintf(keystr, "%s%s", USERPREFIX, name);
 
         /* it's outaa here!  8^) */
@@ -672 +718 @@
         NTSTATUS        nt_status = NT_STATUS_UNSUCCESSFUL;
         fstring         keystr;
-        uint32          rid;
+        uint32_t        rid;
         fstring         name;
 
@@ -684 +730 @@
 
         fstrcpy(name, pdb_get_username(sam_pass));
-        strlower_m(name);
+        if (!strlower_m(name)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         /* set the search key */
 
-        slprintf(keystr, sizeof(keystr)-1, "%s%s", USERPREFIX, name);
+        fstr_sprintf(keystr, "%s%s", USERPREFIX, name);
 
         rid = pdb_get_user_rid(sam_pass);
@@ -694 +742 @@
         /* it's outaa here!  8^) */
 
-        if (db_sam->transaction_start(db_sam) != 0) {
+        if (dbwrap_transaction_start(db_sam) != 0) {
                 DEBUG(0, ("Could not start transaction\n"));
                 return NT_STATUS_UNSUCCESSFUL;
@@ -708 +756 @@
         /* set the search key */
 
-        slprintf(keystr, sizeof(keystr)-1, "%s%.8x", RIDPREFIX, rid);
+        fstr_sprintf(keystr, "%s%.8x", RIDPREFIX, rid);
 
         /* it's outaa here!  8^) */
@@ -719 +767 @@
         }
 
-        if (db_sam->transaction_commit(db_sam) != 0) {
+        if (dbwrap_transaction_commit(db_sam) != 0) {
                 DEBUG(0, ("Could not commit transaction\n"));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -727 +775 @@
 
  cancel:
-        if (db_sam->transaction_cancel(db_sam) != 0) {
+        if (dbwrap_transaction_cancel(db_sam) != 0) {
                 smb_panic("transaction_cancel failed");
         }
@@ -742 +790 @@
 {
         TDB_DATA        data;
-        uint8           *buf = NULL;
+        uint8_t         *buf = NULL;
         fstring         keystr;
         fstring         name;
@@ -757 +805 @@
 
         fstrcpy(name, pdb_get_username(newpwd));
-        strlower_m(name);
+        if (!strlower_m(name)) {
+                goto done;
+        }
 
         DEBUG(5, ("Storing %saccount %s with RID %d\n",
@@ -764 +814 @@
 
         /* setup the USER index key */
-        slprintf(keystr, sizeof(keystr)-1, "%s%s", USERPREFIX, name);
+        fstr_sprintf(keystr, "%s%s", USERPREFIX, name);
 
         /* add the account */
@@ -795 +845 @@
 
         fstrcpy(name, pdb_get_username(newpwd));
-        strlower_m(name);
+        if (!strlower_m(name)) {
+                return false;
+        }
 
         /* setup RID data */
@@ -801 +853 @@
 
         /* setup the RID index key */
-        slprintf(keystr, sizeof(keystr)-1, "%s%.8x", RIDPREFIX,
-                 pdb_get_user_rid(newpwd));
+        fstr_sprintf(keystr, "%s%.8x", RIDPREFIX, pdb_get_user_rid(newpwd));
 
         /* add the reference */
@@ -841 +892 @@
         }
 
-        if (db_sam->transaction_start(db_sam) != 0) {
+        if (dbwrap_transaction_start(db_sam) != 0) {
                 DEBUG(0, ("Could not start transaction\n"));
                 return false;
@@ -882 +933 @@
                 /* Delete old RID key */
                 DEBUG(10, ("tdb_update_sam: Deleting key for RID %u\n", oldrid));
-                slprintf(keystr, sizeof(keystr) - 1, "%s%.8x", RIDPREFIX, oldrid);
+                fstr_sprintf(keystr, "%s%.8x", RIDPREFIX, oldrid);
                 if (!NT_STATUS_IS_OK(dbwrap_delete_bystring(db_sam, keystr))) {
                         DEBUG(0, ("tdb_update_sam: Can't delete %s\n", keystr));
@@ -900 +951 @@
         }
 
-        if (db_sam->transaction_commit(db_sam) != 0) {
+        if (dbwrap_transaction_commit(db_sam) != 0) {
                 DEBUG(0, ("Could not commit transaction\n"));
                 return false;
@@ -908 +959 @@
 
  cancel:
-        if (db_sam->transaction_cancel(db_sam) != 0) {
+        if (dbwrap_transaction_cancel(db_sam) != 0) {
                 smb_panic("transaction_cancel failed");
         }
@@ -963 +1014 @@
         }
 
-        rename_script = talloc_strdup(new_acct, lp_renameuser_script());
+        rename_script = lp_rename_user_script(new_acct);
         if (!rename_script) {
                 TALLOC_FREE(new_acct);
@@ -988 +1039 @@
         }
 
-        if (db_sam->transaction_start(db_sam) != 0) {
+        if (dbwrap_transaction_start(db_sam) != 0) {
                 DEBUG(0, ("Could not start transaction\n"));
                 TALLOC_FREE(new_acct);
@@ -1004 +1055 @@
 
         fstrcpy( oldname_lower, pdb_get_username(old_acct) );
-        strlower_m( oldname_lower );
+        if (!strlower_m( oldname_lower )) {
+                goto cancel;
+        }
 
         fstrcpy( newname_lower, newname );
-        strlower_m( newname_lower );
+        if (!strlower_m( newname_lower )) {
+                goto cancel;
+        }
 
         rename_script = talloc_string_sub2(new_acct,
@@ -1048 +1103 @@
         tdb_delete_samacct_only( old_acct );
 
-        if (db_sam->transaction_commit(db_sam) != 0) {
+        if (dbwrap_transaction_commit(db_sam) != 0) {
                 /*
                  * Ok, we're screwed. We've changed the posix account, but
@@ -1063 +1118 @@
 
  cancel:
-        if (db_sam->transaction_cancel(db_sam) != 0) {
+        if (dbwrap_transaction_cancel(db_sam) != 0) {
                 smb_panic("transaction_cancel failed");
         }
@@ -1077 +1132 @@
 }
 
-static bool tdbsam_new_rid(struct pdb_methods *methods, uint32 *prid)
-{
-        uint32 rid;
+static bool tdbsam_new_rid(struct pdb_methods *methods, uint32_t *prid)
+{
+        uint32_t rid;
         NTSTATUS status;
 
@@ -1090 +1145 @@
         }
 
-        status = dbwrap_trans_change_uint32_atomic(db_sam, NEXT_RID_STRING,
-                                                   &rid, 1);
+        status = dbwrap_trans_change_uint32_atomic_bystring(
+                db_sam, NEXT_RID_STRING, &rid, 1);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(3, ("tdbsam_new_rid: Failed to increase %s: %s\n",
@@ -1118 +1173 @@
                 private_data, struct tdbsam_search_state);
         size_t prefixlen = strlen(RIDPREFIX);
-        uint32 rid;
-
-        if ((rec->key.dsize < prefixlen)
-            || (strncmp((char *)rec->key.dptr, RIDPREFIX, prefixlen))) {
+        uint32_t rid;
+        TDB_DATA key;
+
+        key = dbwrap_record_get_key(rec);
+
+        if ((key.dsize < prefixlen)
+            || (strncmp((char *)key.dptr, RIDPREFIX, prefixlen))) {
                 return 0;
         }
 
-        rid = strtoul((char *)rec->key.dptr+prefixlen, NULL, 16);
-
-        ADD_TO_LARGE_ARRAY(state, uint32, rid, &state->rids, &state->num_rids,
+        rid = strtoul((char *)key.dptr+prefixlen, NULL, 16);
+
+        ADD_TO_LARGE_ARRAY(state, uint32_t, rid, &state->rids, &state->num_rids,
                            &state->array_size);
 
@@ -1158 +1216 @@
 
         if (state->current == state->num_rids) {
+                TALLOC_FREE(user);
                 return false;
         }
@@ -1203 +1262 @@
 static bool tdbsam_search_users(struct pdb_methods *methods,
                                 struct pdb_search *search,
-                                uint32 acct_flags)
+                                uint32_t acct_flags)
 {
         struct tdbsam_search_state *state;
@@ -1221 +1280 @@
         state->methods = methods;
 
-        db_sam->traverse_read(db_sam, tdbsam_collect_rids, state);
+        dbwrap_traverse_read(db_sam, tdbsam_collect_rids, state, NULL);
 
         search->private_data = state;
@@ -1228 +1287 @@
 
         return true;
+}
+
+static bool tdbsam_is_responsible_for_builtin(struct pdb_methods *m)
+{
+        return map_builtin;
 }
 
@@ -1258 +1322 @@
         (*pdb_method)->new_rid = tdbsam_new_rid;
 
+        (*pdb_method)->is_responsible_for_builtin =
+                                        tdbsam_is_responsible_for_builtin;
+        map_builtin = lp_parm_bool(-1, "tdbsam", "map builtin", true);
+
         /* save the path for later */
 

vendor/current/source3/passdb/pdb_util.c

@@ -27 +27 @@
 #include "passdb.h"
 #include "lib/winbind_util.h"
+#include "../librpc/gen_ndr/idmap.h"
 
 /**
@@ -68 +69 @@
  * @return Normal NTSTATUS return.
  */
-static NTSTATUS create_builtin(uint32 rid)
+NTSTATUS pdb_create_builtin(uint32_t rid)
 {
         NTSTATUS status = NT_STATUS_OK;
         struct dom_sid sid;
         gid_t gid;
+        bool mapresult;
 
         if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
@@ -78 +80 @@
         }
 
-        if (!sid_to_gid(&sid, &gid)) {
-                if (!lp_winbind_nested_groups() || !winbind_ping()) {
-                        return NT_STATUS_PROTOCOL_UNREACHABLE;
+        if (!pdb_is_responsible_for_builtin()) {
+                /*
+                 * if this backend is not responsible for BUILTIN
+                 *
+                 * Use the gid from the mapping request for entry.
+                 * If the mapping fails, bail out
+                 */
+                mapresult = sid_to_gid(&sid, &gid);
+                if (!mapresult) {
+                        status = NT_STATUS_NO_SUCH_GROUP;
+                } else {
+                        status = pdb_create_builtin_alias(rid, gid);
                 }
-                status = pdb_create_builtin_alias(rid);
+        } else {
+                /*
+                 * this backend is responsible for BUILTIN
+                 *
+                 * a failed mapping result means that the entry
+                 * does not exist yet, so create it
+                 *
+                 * we use pdb_sid_to_id intentionally here to
+                 * directly query the passdb backend (sid_to_gid
+                 * would finally do the same)
+                 */
+                struct unixid id;
+                mapresult = pdb_sid_to_id(&sid, &id);
+                if (!mapresult) {
+                        if (!lp_winbind_nested_groups() || !winbind_ping()) {
+                                return NT_STATUS_PROTOCOL_UNREACHABLE;
+                        }
+                        status = pdb_create_builtin_alias(rid, 0);
+                }
         }
         return status;
@@ -95 +124 @@
         struct dom_sid dom_users;
 
-        status = create_builtin(BUILTIN_RID_USERS);
+        status = pdb_create_builtin(BUILTIN_RID_USERS);
         if ( !NT_STATUS_IS_OK(status) ) {
                 DEBUG(5,("create_builtin_users: Failed to create Users\n"));
@@ -124 +153 @@
         bool ret;
 
-        status = create_builtin(BUILTIN_RID_ADMINISTRATORS);
+        status = pdb_create_builtin(BUILTIN_RID_ADMINISTRATORS);
         if ( !NT_STATUS_IS_OK(status) ) {
                 DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));

vendor/current/source3/passdb/pdb_wbc_sam.c

@@ -40 +40 @@
 #include "passdb.h"
 #include "lib/winbind_util.h"
+#include "passdb/pdb_wbc_sam.h"
+#include "idmap.h"
 
 /***************************************************************************
@@ -72 +74 @@
 }
 
-static bool pdb_wbc_sam_uid_to_sid(struct pdb_methods *methods, uid_t uid,
-                                   struct dom_sid *sid)
-{
-        return winbind_uid_to_sid(sid, uid);
-}
-
-static bool pdb_wbc_sam_gid_to_sid(struct pdb_methods *methods, gid_t gid,
-                                   struct dom_sid *sid)
-{
-        return winbind_gid_to_sid(sid, gid);
+static bool pdb_wbc_sam_id_to_sid(struct pdb_methods *methods, struct unixid *id,
+                                  struct dom_sid *sid)
+{
+        switch (id->type) {
+        case ID_TYPE_UID:
+                return winbind_uid_to_sid(sid, id->id);
+
+        case ID_TYPE_GID:
+                return winbind_gid_to_sid(sid, id->id);
+
+        default:
+                return false;
+        }
 }
 
@@ -87 +92 @@
                                                TALLOC_CTX *mem_ctx,
                                                const struct dom_sid *group,
-                                               uint32 **pp_member_rids,
+                                               uint32_t **pp_member_rids,
                                                size_t *p_num_members)
 {
@@ -113 +118 @@
         }
 
-        *pp_sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, *p_num_groups);
+        *pp_sids = talloc_array(mem_ctx, struct dom_sid, *p_num_groups);
 
         if (*pp_sids == NULL) {
@@ -130 +135 @@
                                         const struct dom_sid *domain_sid,
                                         int num_rids,
-                                        uint32 *rids,
+                                        uint32_t *rids,
                                         const char **names,
                                         enum lsa_SidType *attrs)
 {
         NTSTATUS result = NT_STATUS_OK;
+        const char *p = NULL;
+        const char **pp = NULL;
         char *domain = NULL;
         char **account_names = NULL;
@@ -141 +148 @@
 
         if (!winbind_lookup_rids(talloc_tos(), domain_sid, num_rids, rids,
-                                 (const char **)&domain,
-                                 (const char ***)&account_names, &attr_list))
+                                 &p, &pp, &attr_list))
         {
                 result = NT_STATUS_NONE_MAPPED;
                 goto done;
         }
+        domain = discard_const_p(char, p);
+        account_names = discard_const_p(char *, pp);
 
         memcpy(attrs, attr_list, num_rids * sizeof(enum lsa_SidType));
@@ -220 +228 @@
 static NTSTATUS pdb_wbc_sam_enum_trusteddoms(struct pdb_methods *methods,
                                              TALLOC_CTX *mem_ctx,
-                                             uint32 *num_domains,
+                                             uint32_t *num_domains,
                                              struct trustdom_info ***domains)
 {
@@ -228 +236 @@
 static bool _make_group_map(struct pdb_methods *methods, const char *domain, const char *name, enum lsa_SidType name_type, gid_t gid, struct dom_sid *sid, GROUP_MAP *map)
 {
-        snprintf(map->nt_name, sizeof(map->nt_name), "%s%c%s",
+        map->nt_name = talloc_asprintf(map, "%s%c%s",
                 domain, *lp_winbind_separator(), name);
+        if (!map->nt_name) {
+                return false;
+        }
         map->sid_name_use = name_type;
         map->sid = *sid;
@@ -240 +251 @@
 {
         NTSTATUS result = NT_STATUS_OK;
+        const char *p1 = NULL, *p2 = NULL;
         char *name = NULL;
         char *domain = NULL;
@@ -245 +257 @@
         gid_t gid;
 
-        if (!winbind_lookup_sid(talloc_tos(), &sid, (const char **)&domain,
-                                (const char **) &name, &name_type)) {
-                result = NT_STATUS_NO_SUCH_GROUP;
-                goto done;
-        }
+        if (!winbind_lookup_sid(talloc_tos(), &sid, &p1, &p2, &name_type)) {
+                result = NT_STATUS_NO_SUCH_GROUP;
+                goto done;
+        }
+        domain = discard_const_p(char, p1);
+        name = discard_const_p(char, p2);
 
         if ((name_type != SID_NAME_DOM_GRP) &&
@@ -279 +292 @@
 {
         NTSTATUS result = NT_STATUS_OK;
+        const char *p1 = NULL, *p2 = NULL;
         char *name = NULL;
         char *domain = NULL;
@@ -289 +303 @@
         }
 
-        if (!winbind_lookup_sid(talloc_tos(), &sid, (const char **)&domain,
-                                (const char **)&name, &name_type)) {
-                result = NT_STATUS_NO_SUCH_GROUP;
-                goto done;
-        }
+        if (!winbind_lookup_sid(talloc_tos(), &sid, &p1, &p2, &name_type)) {
+                result = NT_STATUS_NO_SUCH_GROUP;
+                goto done;
+        }
+        domain = discard_const_p(char, p1);
+        name = discard_const_p(char, p2);
 
         if ((name_type != SID_NAME_DOM_GRP) &&
@@ -354 +369 @@
 static NTSTATUS pdb_wbc_sam_enum_group_mapping(struct pdb_methods *methods,
                                            const struct dom_sid *sid, enum lsa_SidType sid_name_use,
-                                           GROUP_MAP **pp_rmap, size_t *p_num_entries,
+                                           GROUP_MAP ***pp_rmap, size_t *p_num_entries,
                                            bool unix_only)
 {
@@ -381 +396 @@
                                        const struct dom_sid *members,
                                        size_t num_members,
-                                       uint32 **pp_alias_rids,
+                                       uint32_t **pp_alias_rids,
                                        size_t *p_num_alias_rids)
 {
@@ -416 +431 @@
         (*pdb_method)->get_account_policy = pdb_wbc_sam_get_account_policy;
         (*pdb_method)->set_account_policy = pdb_wbc_sam_set_account_policy;
-        (*pdb_method)->uid_to_sid = pdb_wbc_sam_uid_to_sid;
-        (*pdb_method)->gid_to_sid = pdb_wbc_sam_gid_to_sid;
+        (*pdb_method)->id_to_sid = pdb_wbc_sam_id_to_sid;
 
         (*pdb_method)->search_groups = pdb_wbc_sam_search_groups;

vendor/current/source3/passdb/secrets.c

@@ -25 +25 @@
 #include "includes.h"
 #include "system/filesys.h"
-#include "passdb.h"
 #include "../libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/ndr_secrets.h"
 #include "secrets.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
 #include "../libcli/security/security.h"
 #include "util_tdb.h"
@@ -38 +38 @@
 static struct db_context *db_ctx;
 
-/**
- * Use a TDB to store an incrementing random seed.
- *
- * Initialised to the current pid, the very first time Samba starts,
- * and incremented by one each time it is needed.
- *
- * @note Not called by systems with a working /dev/urandom.
- */
-static void get_rand_seed(void *userdata, int *new_seed)
-{
-        *new_seed = sys_getpid();
-        if (db_ctx) {
-                dbwrap_trans_change_int32_atomic(db_ctx, "INFO/random_seed",
-                                                 new_seed, 1);
-        }
+/* open up the secrets database with specified private_dir path */
+bool secrets_init_path(const char *private_dir)
+{
+        char *fname = NULL;
+        TALLOC_CTX *frame;
+
+        if (db_ctx != NULL) {
+                return True;
+        }
+
+        if (private_dir == NULL) {
+                return False;
+        }
+
+        frame = talloc_stackframe();
+        fname = talloc_asprintf(frame, "%s/secrets.tdb", private_dir);
+        if (fname == NULL) {
+                TALLOC_FREE(frame);
+                return False;
+        }
+
+        db_ctx = db_open(NULL, fname, 0,
+                         TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
+                         DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
+
+        if (db_ctx == NULL) {
+                DEBUG(0,("Failed to open %s\n", fname));
+                TALLOC_FREE(frame);
+                return False;
+        }
+
+        TALLOC_FREE(frame);
+        return True;
 }
 
@@ -58 +76 @@
 bool secrets_init(void)
 {
-        char *fname = NULL;
-        unsigned char dummy;
-
-        if (db_ctx != NULL)
-                return True;
-
-        fname = talloc_asprintf(talloc_tos(), "%s/secrets.tdb",
-                                lp_private_dir());
-        if (fname == NULL) {
-                return false;
-        }
-
-        db_ctx = db_open(NULL, fname, 0,
-                         TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
-
-        if (db_ctx == NULL) {
-                DEBUG(0,("Failed to open %s\n", fname));
-                TALLOC_FREE(fname);
-                return False;
-        }
-
-        TALLOC_FREE(fname);
-
-        /**
-         * Set a reseed function for the crypto random generator
-         *
-         * This avoids a problem where systems without /dev/urandom
-         * could send the same challenge to multiple clients
-         */
-        set_rand_reseed_callback(get_rand_seed, NULL);
-
-        /* Ensure that the reseed is done now, while we are root, etc */
-        generate_random_buffer(&dummy, sizeof(dummy));
-
-        return True;
+        return secrets_init_path(lp_private_dir());
 }
 
@@ -119 +103 @@
         TDB_DATA dbuf;
         void *result;
+        NTSTATUS status;
 
         if (!secrets_init()) {
@@ -124 +109 @@
         }
 
-        if (db_ctx->fetch(db_ctx, talloc_tos(), string_tdb_data(key),
-                          &dbuf) != 0) {
-                return NULL;
-        }
-
-        result = memdup(dbuf.dptr, dbuf.dsize);
+        status = dbwrap_fetch(db_ctx, talloc_tos(), string_tdb_data(key),
+                              &dbuf);
+        if (!NT_STATUS_IS_OK(status)) {
+                return NULL;
+        }
+
+        result = smb_memdup(dbuf.dptr, dbuf.dsize);
         if (result == NULL) {
                 return NULL;
@@ -153 +139 @@
 
         status = dbwrap_trans_store(db_ctx, string_tdb_data(key),
-                                    make_tdb_data((const uint8 *)data, size),
+                                    make_tdb_data((const uint8_t *)data, size),
                                     TDB_REPLACE);
         return NT_STATUS_IS_OK(status);
@@ -320 +306 @@
         size_t size = 0;
 
-        *dn = smb_xstrdup(lp_ldap_admin_dn());
+        *dn = smb_xstrdup(lp_ldap_admin_dn(talloc_tos()));
 
         if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) {
@@ -379 +365 @@
 }
 
-/**
- * Get trusted domains info from secrets.tdb.
- **/
-
-struct list_trusted_domains_state {
-        uint32 num_domains;
-        struct trustdom_info **domains;
-};
-
-static int list_trusted_domain(struct db_record *rec, void *private_data)
-{
-        const size_t prefix_len = strlen(SECRETS_DOMTRUST_ACCT_PASS);
-        struct TRUSTED_DOM_PASS pass;
-        enum ndr_err_code ndr_err;
-        DATA_BLOB blob;
-        struct trustdom_info *dom_info;
-
-        struct list_trusted_domains_state *state =
-                (struct list_trusted_domains_state *)private_data;
-
-        if ((rec->key.dsize < prefix_len)
-            || (strncmp((char *)rec->key.dptr, SECRETS_DOMTRUST_ACCT_PASS,
-                        prefix_len) != 0)) {
-                return 0;
-        }
-
-        blob = data_blob_const(rec->value.dptr, rec->value.dsize);
-
-        ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &pass,
-                        (ndr_pull_flags_fn_t)ndr_pull_TRUSTED_DOM_PASS);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                return false;
-        }
-
-        if (pass.domain_sid.num_auths != 4) {
-                DEBUG(0, ("SID %s is not a domain sid, has %d "
-                          "auths instead of 4\n",
-                          sid_string_dbg(&pass.domain_sid),
-                          pass.domain_sid.num_auths));
-                return 0;
-        }
-
-        if (!(dom_info = TALLOC_P(state->domains, struct trustdom_info))) {
-                DEBUG(0, ("talloc failed\n"));
-                return 0;
-        }
-
-        dom_info->name = talloc_strdup(dom_info, pass.uni_name);
-        if (!dom_info->name) {
-                TALLOC_FREE(dom_info);
-                return 0;
-        }
-
-        sid_copy(&dom_info->sid, &pass.domain_sid);
-
-        ADD_TO_ARRAY(state->domains, struct trustdom_info *, dom_info,
-                     &state->domains, &state->num_domains);
-
-        if (state->domains == NULL) {
-                state->num_domains = 0;
-                return -1;
-        }
-        return 0;
-}
-
-NTSTATUS secrets_trusted_domains(TALLOC_CTX *mem_ctx, uint32 *num_domains,
-                                 struct trustdom_info ***domains)
-{
-        struct list_trusted_domains_state state;
-
-        if (!secrets_init()) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        state.num_domains = 0;
-
-        /*
-         * Make sure that a talloc context for the trustdom_info structs
-         * exists
-         */
-
-        if (!(state.domains = TALLOC_ARRAY(
-                      mem_ctx, struct trustdom_info *, 1))) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        db_ctx->traverse_read(db_ctx, list_trusted_domain, (void *)&state);
-
-        *num_domains = state.num_domains;
-        *domains = state.domains;
-        return NT_STATUS_OK;
-}
-
 /*******************************************************************************
  Store a complete AFS keyfile into secrets.tdb.
@@ -498 +391 @@
         struct afs_keyfile *keyfile;
         size_t size = 0;
-        uint32 i;
+        uint32_t i;
 
         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell);
@@ -580 +473 @@
 }
 
-bool secrets_delete_generic(const char *owner, const char *key)
-{
-        char *tdbkey = NULL;
-        bool ret;
-
-        if (asprintf(&tdbkey, "SECRETS/GENERIC/%s/%s", owner, key) < 0) {
-                DEBUG(0, ("asprintf failed!\n"));
-                return False;
-        }
-
-        ret = secrets_delete(tdbkey);
-
-        SAFE_FREE(tdbkey);
-        return ret;
-}
-
 /*******************************************************************
  Find the ldap password.

vendor/current/source3/passdb/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
-
-PDB_TDBSAM_SRC =    'pdb_tdb.c'
-PDB_LDAP_SRC =      'pdb_ldap.c pdb_nds.c pdb_ipa.c'
-PDB_ADS_SRC =       'pdb_ads.c'
-PDB_SMBPASSWD_SRC = 'pdb_smbpasswd.c'
-PDB_WBC_SAM_SRC =   'pdb_wbc_sam.c'
-
-bld.SAMBA3_SUBSYSTEM('pdb',
-                    source='pdb_interface.c',
-                    deps='',
-                    vars=locals())
 
 bld.SAMBA3_MODULE('pdb_tdbsam',
                  subsystem='pdb',
-                 source=PDB_TDBSAM_SRC,
+                 source='pdb_tdb.c',
+                 deps='samba-util dbwrap tdb-wrap3',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_tdbsam'),
                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('pdb_tdbsam'))
 
-bld.SAMBA3_MODULE('pdb_ldap',
+bld.SAMBA3_MODULE('pdb_ldapsam',
                  subsystem='pdb',
-                 source=PDB_LDAP_SRC,
+                 deps='smbldap smbldaphelper',
+                 source='pdb_ldap.c pdb_nds.c pdb_ipa.c',
                  init_function='',
-                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_ldap'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('pdb_ldap') and bld.env.HAVE_LDAP)
-
-bld.SAMBA3_MODULE('pdb_ads',
-                 subsystem='pdb',
-                 source=PDB_ADS_SRC,
-                 deps='LIBCLI_LDAP_NDR TLDAP',
-                 init_function='',
-                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_ads'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('pdb_ads'))
+                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_ldapsam'),
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('pdb_ldapsam') and bld.CONFIG_SET('HAVE_LDAP'))
 
 bld.SAMBA3_MODULE('pdb_smbpasswd',
                  subsystem='pdb',
-                 source=PDB_SMBPASSWD_SRC,
+                 source='pdb_smbpasswd.c',
+                 deps='samba-util',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_smbpasswd'),
@@ -43 +27 @@
 bld.SAMBA3_MODULE('pdb_wbc_sam',
                  subsystem='pdb',
-                 source=PDB_WBC_SAM_SRC,
+                 source='pdb_wbc_sam.c',
+                 deps='samba-util wbclient',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_wbc_sam'),
                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('pdb_wbc_sam'))
+
+bld.SAMBA3_MODULE('pdb_samba_dsdb',
+                  subsystem='pdb',
+                  source='pdb_samba_dsdb.c',
+                  init_function='',
+                  deps='IDMAP samdb',
+                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_samba_dsdb') and bld.AD_DC_BUILD_IS_ENABLED(),
+                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('pdb_samba_dsdb') and bld.AD_DC_BUILD_IS_ENABLED())
+
+bld.SAMBA3_PYTHON('pypassdb',
+                  source='py_passdb.c',
+                  deps='pdb',
+                  public_deps='samba-util tdb talloc pyrpc_util pytalloc-util',
+                  realname='samba/samba3/passdb.so'
+                  )