Changeset 988 for vendor/current/source3/winbindd

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source3/winbindd

Files:

• idmap.c (modified) (19 diffs)
• idmap_ad.c (modified) (15 diffs)
• idmap_adex (deleted)
• idmap_autorid.c (modified) (15 diffs)
• idmap_autorid_tdb.c (added)
• idmap_hash/idmap_hash.c (modified) (10 diffs)
• idmap_hash/mapfile.c (modified) (3 diffs)
• idmap_ldap.c (modified) (9 diffs)
• idmap_nss.c (modified) (4 diffs)
• idmap_passdb.c (modified) (2 diffs)
• idmap_proto.h (modified) (2 diffs)
• idmap_rfc2307.c (added)
• idmap_rid.c (modified) (7 diffs)
• idmap_script.c (added)
• idmap_tdb.c (modified) (27 diffs)
• idmap_tdb2.c (modified) (23 diffs)
• idmap_tdb_common.c (added)
• idmap_tdb_common.h (added)
• idmap_util.c (modified) (12 diffs)
• nss_info.c (modified) (2 diffs)
• nss_info_template.c (modified) (1 diff)
• wb_dsgetdcname.c (modified) (2 diffs)
• wb_fill_pwent.c (modified) (12 diffs)
• wb_getgrsid.c (modified) (4 diffs)
• wb_getpwsid.c (modified) (6 diffs)
• wb_gettoken.c (modified) (1 diff)
• wb_gid2sid.c (modified) (4 diffs)
• wb_group_members.c (modified) (7 diffs)
• wb_lookupname.c (modified) (1 diff)
• wb_lookupsid.c (modified) (1 diff)
• wb_lookupsids.c (modified) (14 diffs)
• wb_lookupuseraliases.c (modified) (2 diffs)
• wb_lookupusergroups.c (modified) (3 diffs)
• wb_next_grent.c (modified) (7 diffs)
• wb_next_pwent.c (modified) (6 diffs)
• wb_query_group_list.c (added)
• wb_query_user_list.c (modified) (1 diff)
• wb_queryuser.c (modified) (1 diff)
• wb_seqnum.c (modified) (1 diff)
• wb_seqnums.c (modified) (1 diff)
• wb_sid2gid.c (deleted)
• wb_sid2uid.c (deleted)
• wb_sids2xids.c (added)
• wb_uid2sid.c (modified) (4 diffs)
• winbindd.c (modified) (55 diffs)
• winbindd.h (modified) (20 diffs)
• winbindd_ads.c (modified) (39 diffs)
• winbindd_allocate_gid.c (modified) (1 diff)
• winbindd_allocate_uid.c (modified) (1 diff)
• winbindd_cache.c (modified) (101 diffs)
• winbindd_ccache_access.c (modified) (12 diffs)
• winbindd_change_machine_acct.c (modified) (2 diffs)
• winbindd_check_machine_acct.c (modified) (1 diff)
• winbindd_cm.c (modified) (112 diffs)
• winbindd_cred_cache.c (modified) (16 diffs)
• winbindd_creds.c (modified) (1 diff)
• winbindd_dsgetdcname.c (modified) (5 diffs)
• winbindd_dual.c (modified) (36 diffs)
• winbindd_dual_ndr.c (modified) (6 diffs)
• winbindd_dual_srv.c (modified) (22 diffs)
• winbindd_getdcname.c (modified) (1 diff)
• winbindd_getgrgid.c (modified) (1 diff)
• winbindd_getgrnam.c (modified) (4 diffs)
• winbindd_getgroups.c (modified) (3 diffs)
• winbindd_group.c (modified) (1 diff)
• winbindd_irpc.c (added)
• winbindd_list_groups.c (modified) (1 diff)
• winbindd_list_users.c (modified) (1 diff)
• winbindd_lookuprids.c (modified) (1 diff)
• winbindd_misc.c (modified) (9 diffs)
• winbindd_msrpc.c (modified) (27 diffs)
• winbindd_ndr.c (modified) (4 diffs)
• winbindd_pam.c (modified) (50 diffs)
• winbindd_pam_auth_crap.c (modified) (4 diffs)
• winbindd_pam_logoff.c (modified) (2 diffs)
• winbindd_ping_dc.c (modified) (5 diffs)
• winbindd_proto.h (modified) (18 diffs)
• winbindd_reconnect.c (modified) (24 diffs)
• winbindd_reconnect_ads.c (added)
• winbindd_rpc.c (modified) (22 diffs)
• winbindd_samr.c (modified) (13 diffs)
• winbindd_sid_to_gid.c (modified) (2 diffs)
• winbindd_sid_to_uid.c (modified) (2 diffs)
• winbindd_sids_to_xids.c (modified) (10 diffs)
• winbindd_util.c (modified) (34 diffs)
• winbindd_wins.c (deleted)
• winbindd_wins_byip.c (added)
• winbindd_wins_byname.c (added)
• wscript_build (modified) (10 diffs)

vendor/current/source3/winbindd/idmap.c

@@ -25 +25 @@
 #include "winbindd.h"
 #include "idmap.h"
-#include "passdb/machine_sid.h"
+#include "lib/util_sid_passdb.h"
+#include "passdb.h"
 
 #undef DBGC_CLASS
@@ -31 +32 @@
 
 static_decl_idmap;
-
-static void idmap_init(void)
-{
-        static bool initialized;
-
-        if (initialized) {
-                return;
-        }
-
-        DEBUG(10, ("idmap_init(): calling static_init_idmap\n"));
-
-        static_init_idmap;
-
-        initialized = true;
-}
 
 /**
@@ -78 +64 @@
 static struct idmap_domain **idmap_domains = NULL;
 static int num_domains = 0;
+
+static struct idmap_domain *idmap_init_named_domain(TALLOC_CTX *mem_ctx,
+                                                    const char *domname);
+static struct idmap_domain *idmap_init_domain(TALLOC_CTX *mem_ctx,
+                                              const char *domainname,
+                                              const char *modulename,
+                                              bool check_range);
+static bool idmap_found_domain_backend(
+        const char *string, regmatch_t matches[], void *private_data);
+
+static bool idmap_init(void)
+{
+        static bool initialized;
+        int ret;
+
+        if (initialized) {
+                return true;
+        }
+
+        DEBUG(10, ("idmap_init(): calling static_init_idmap\n"));
+
+        static_init_idmap;
+
+        initialized = true;
+
+        if (!pdb_is_responsible_for_everything_else()) {
+                default_idmap_domain = idmap_init_named_domain(NULL, "*");
+                if (default_idmap_domain == NULL) {
+                        return false;
+                }
+        }
+
+        passdb_idmap_domain = idmap_init_domain(
+                NULL, get_global_sam_name(), "passdb", false);
+        if (passdb_idmap_domain == NULL) {
+                TALLOC_FREE(default_idmap_domain);
+                return false;
+        }
+
+        idmap_domains = talloc_array(NULL, struct idmap_domain *, 0);
+        if (idmap_domains == NULL) {
+                TALLOC_FREE(passdb_idmap_domain);
+                TALLOC_FREE(default_idmap_domain);
+                return false;
+        }
+
+        ret = lp_wi_scan_global_parametrics(
+                "idmapconfig\\(.*\\):backend", 2,
+                idmap_found_domain_backend, NULL);
+        if (ret != 0) {
+                DBG_WARNING("wi_scan_global_parametrics returned %d\n", ret);
+                return false;
+        }
+
+        return true;
+}
+
+bool domain_has_idmap_config(const char *domname)
+{
+        int i;
+        char *config_option;
+        const char *range = NULL;
+        const char *backend = NULL;
+        bool ok;
+
+        ok = idmap_init();
+        if (!ok) {
+                return false;
+        }
+
+        for (i=0; i<num_domains; i++) {
+                if (strequal(idmap_domains[i]->name, domname)) {
+                        return true;
+                }
+        }
+
+        /* fallback: also check loadparm */
+
+        config_option = talloc_asprintf(talloc_tos(), "idmap config %s",
+                                        domname);
+        if (config_option == NULL) {
+                DEBUG(0, ("out of memory\n"));
+                return false;
+        }
+
+        range = lp_parm_const_string(-1, config_option, "range", NULL);
+        backend = lp_parm_const_string(-1, config_option, "backend", NULL);
+        if (range != NULL && backend != NULL) {
+                DEBUG(5, ("idmap configuration specified for domain '%s'\n",
+                        domname));
+                TALLOC_FREE(config_option);
+                return true;
+        }
+
+        TALLOC_FREE(config_option);
+        return false;
+}
+
+static bool idmap_found_domain_backend(
+        const char *string, regmatch_t matches[], void *private_data)
+{
+        if (matches[1].rm_so == -1) {
+                DBG_WARNING("Found match, but no name??\n");
+                return false;
+        }
+
+        {
+                struct idmap_domain *dom, **tmp;
+                regoff_t len = matches[1].rm_eo - matches[1].rm_so;
+                char domname[len+1];
+
+                memcpy(domname, string + matches[1].rm_so, len);
+                domname[len] = '\0';
+
+                DBG_DEBUG("Found idmap domain \"%s\"\n", domname);
+
+                if (strcmp(domname, "*") == 0) {
+                        return false;
+                }
+
+                dom = idmap_init_named_domain(idmap_domains, domname);
+                if (dom == NULL) {
+                        DBG_NOTICE("Could not init idmap domain %s\n",
+                                   domname);
+                        return false;
+                }
+
+                tmp = talloc_realloc(idmap_domains, idmap_domains,
+                                     struct idmap_domain *, num_domains + 1);
+                if (tmp == NULL) {
+                        DBG_WARNING("talloc_realloc failed\n");
+                        TALLOC_FREE(dom);
+                        return false;
+                }
+                idmap_domains = tmp;
+                idmap_domains[num_domains] = dom;
+                num_domains += 1;
+        }
+
+        return false;
+}
 
 static struct idmap_methods *get_methods(const char *name)
@@ -130 +257 @@
         for (entry = backends; entry != NULL; entry = entry->next) {
                 if (strequal(entry->name, name)) {
-                        DEBUG(0,("Idmap module %s already registered!\n",
+                        DEBUG(5,("Idmap module %s already registered!\n",
                                  name));
                         return NT_STATUS_OBJECT_NAME_COLLISION;
@@ -172 +299 @@
         char *config_option = NULL;
         const char *range;
+        unsigned low_id = 0;
+        unsigned high_id = 0;
 
         result = talloc_zero(mem_ctx, struct idmap_domain);
@@ -186 +315 @@
 
         /*
+         * Check whether the requested backend module exists and
+         * load the methods.
+         */
+
+        result->methods = get_methods(modulename);
+        if (result->methods == NULL) {
+                DEBUG(3, ("idmap backend %s not found\n", modulename));
+
+                status = smb_probe_module("idmap", modulename);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(3, ("Could not probe idmap module %s\n",
+                                  modulename));
+                        goto fail;
+                }
+
+                result->methods = get_methods(modulename);
+        }
+        if (result->methods == NULL) {
+                DEBUG(1, ("idmap backend %s not found\n", modulename));
+                goto fail;
+        }
+
+        /*
          * load ranges and read only information from the config
          */
@@ -196 +348 @@
         }
 
+        result->read_only = lp_parm_bool(-1, config_option, "read only", false);
         range = lp_parm_const_string(-1, config_option, "range", NULL);
+
+        talloc_free(config_option);
+
         if (range == NULL) {
-                DEBUG(1, ("idmap range not specified for domain %s\n",
-                          result->name));
                 if (check_range) {
+                        DEBUG(1, ("idmap range not specified for domain %s\n",
+                                  result->name));
                         goto fail;
                 }
-        } else if (sscanf(range, "%u - %u", &result->low_id,
-                          &result->high_id) != 2)
+        } else if (sscanf(range, "%u - %u", &low_id, &high_id) != 2)
         {
                 DEBUG(1, ("invalid range '%s' specified for domain "
@@ -211 +366 @@
                         goto fail;
                 }
-        }
-
-        result->read_only = lp_parm_bool(-1, config_option, "read only", false);
-
-        talloc_free(config_option);
-
-        if (result->low_id > result->high_id) {
-                DEBUG(1, ("Error: invalid idmap range detected: %lu - %lu\n",
-                          (unsigned long)result->low_id,
-                          (unsigned long)result->high_id));
+        } else if (low_id > high_id) {
+                DEBUG(1, ("Error: invalid idmap range detected: %u - %u\n",
+                          low_id, high_id));
                 if (check_range) {
                         goto fail;
@@ -226 +374 @@
         }
 
-        result->methods = get_methods(modulename);
-        if (result->methods == NULL) {
-                DEBUG(3, ("idmap backend %s not found\n", modulename));
-
-                status = smb_probe_module("idmap", modulename);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(3, ("Could not probe idmap module %s\n",
-                                  modulename));
-                        goto fail;
-                }
-
-                result->methods = get_methods(modulename);
-        }
-        if (result->methods == NULL) {
-                DEBUG(1, ("idmap backend %s not found\n", modulename));
-                goto fail;
-        }
+        result->low_id = low_id;
+        result->high_id = high_id;
 
         status = result->methods->init(result);
@@ -274 +407 @@
         char *config_option;
         const char *backend;
-
-        idmap_init();
+        bool ok;
+
+        ok = idmap_init();
+        if (!ok) {
+                return NULL;
+        }
 
         config_option = talloc_asprintf(talloc_tos(), "idmap config %s",
@@ -286 +423 @@
         backend = lp_parm_const_string(-1, config_option, "backend", NULL);
         if (backend == NULL) {
-                DEBUG(1, ("no backend defined for %s\n", config_option));
+                DEBUG(10, ("no idmap backend configured for domain '%s'\n",
+                           domname));
                 goto fail;
         }
@@ -302 +440 @@
         TALLOC_FREE(result);
         return NULL;
-}
-
-/**
- * Initialize the default domain structure
- * @param[in] mem_ctx           memory context for the result
- * @result The default domain structure
- *
- * This routine takes the module name from the "idmap backend" parameter,
- * passing a possible parameter like ldap:ldap://ldap-url/ to the module.
- */
-
-static struct idmap_domain *idmap_init_default_domain(TALLOC_CTX *mem_ctx)
-{
-        return idmap_init_named_domain(mem_ctx, "*");
-}
-
-/**
- * Initialize the passdb domain structure
- * @param[in] mem_ctx           memory context for the result
- * @result The default domain structure
- *
- * No config, passdb has its own configuration.
- */
-
-static struct idmap_domain *idmap_init_passdb_domain(TALLOC_CTX *mem_ctx)
-{
-        idmap_init();
-
-        /*
-         * Always init the default domain, we can't go without one
-         */
-        if (default_idmap_domain == NULL) {
-                default_idmap_domain = idmap_init_default_domain(NULL);
-        }
-        if (default_idmap_domain == NULL) {
-                return NULL;
-        }
-
-        if (passdb_idmap_domain != NULL) {
-                return passdb_idmap_domain;
-        }
-
-        passdb_idmap_domain = idmap_init_domain(NULL, get_global_sam_name(),
-                                                "passdb", false);
-        if (passdb_idmap_domain == NULL) {
-                DEBUG(1, ("Could not init passdb idmap domain\n"));
-        }
-
-        return passdb_idmap_domain;
 }
 
@@ -368 +457 @@
  */
 
-struct idmap_domain *idmap_find_domain(const char *domname)
-{
-        struct idmap_domain *result;
+static struct idmap_domain *idmap_find_domain(const char *domname)
+{
+        bool ok;
         int i;
 
@@ -376 +465 @@
                    domname?domname:"NULL"));
 
-        idmap_init();
-
-        /*
-         * Always init the default domain, we can't go without one
-         */
-        if (default_idmap_domain == NULL) {
-                default_idmap_domain = idmap_init_default_domain(NULL);
-        }
-        if (default_idmap_domain == NULL) {
+        ok = idmap_init();
+        if (!ok) {
                 return NULL;
         }
@@ -398 +480 @@
         }
 
-        if (idmap_domains == NULL) {
-                /*
-                 * talloc context for all idmap domains
-                 */
-                idmap_domains = TALLOC_ARRAY(NULL, struct idmap_domain *, 1);
-        }
-
-        if (idmap_domains == NULL) {
-                DEBUG(0, ("talloc failed\n"));
+        return default_idmap_domain;
+}
+
+struct idmap_domain *idmap_find_domain_with_sid(const char *domname,
+                                                const struct dom_sid *sid)
+{
+        bool ok;
+
+        ok = idmap_init();
+        if (!ok) {
                 return NULL;
         }
 
-        result = idmap_init_named_domain(idmap_domains, domname);
-        if (result == NULL) {
-                /*
-                 * Could not init that domain -- try the default one
-                 */
-                return default_idmap_domain;
-        }
-
-        ADD_TO_ARRAY(idmap_domains, struct idmap_domain *, result,
-                     &idmap_domains, &num_domains);
-        return result;
+        if (sid_check_is_for_passdb(sid)) {
+                return passdb_idmap_domain;
+        }
+
+        return idmap_find_domain(domname);
 }
 
@@ -468 +545 @@
 }
 
-NTSTATUS idmap_backends_unixid_to_sid(const char *domname, struct id_map *id)
+NTSTATUS idmap_backends_unixid_to_sid(struct id_map *id)
 {
         struct idmap_domain *dom;
         struct id_map *maps[2];
-
-         DEBUG(10, ("idmap_backend_unixid_to_sid: domain = '%s', xid = %d "
-                    "(type %d)\n",
-                    domname?domname:"NULL", id->xid.id, id->xid.type));
+        bool ok;
+        int i;
+
+        ok = idmap_init();
+        if (!ok) {
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        DEBUG(10, ("idmap_backend_unixid_to_sid: xid = %d (type %d)\n",
+                   id->xid.id, id->xid.type));
 
         maps[0] = id;
@@ -484 +567 @@
          */
 
-        dom = idmap_init_passdb_domain(NULL);
+        dom = passdb_idmap_domain;
         if ((dom != NULL)
             && NT_STATUS_IS_OK(dom->methods->unixids_to_sids(dom, maps))
@@ -491 +574 @@
         }
 
-        dom = idmap_find_domain(domname);
+        dom = default_idmap_domain;
+
+        for (i=0; i<num_domains; i++) {
+                if ((id->xid.id >= idmap_domains[i]->low_id) &&
+                    (id->xid.id <= idmap_domains[i]->high_id)) {
+                        dom = idmap_domains[i];
+                        break;
+                }
+        }
+
         if (dom == NULL) {
                 return NT_STATUS_NONE_MAPPED;
@@ -498 +590 @@
         return dom->methods->unixids_to_sids(dom, maps);
 }
-
-NTSTATUS idmap_backends_sid_to_unixid(const char *domain, struct id_map *id)
-{
-        struct idmap_domain *dom;
-        struct id_map *maps[2];
-
-        DEBUG(10, ("idmap_backends_sid_to_unixid: domain = '%s', sid = [%s]\n",
-                   domain?domain:"NULL", sid_string_dbg(id->sid)));
-
-        maps[0] = id;
-        maps[1] = NULL;
-
-        if (sid_check_is_in_builtin(id->sid)
-            || (sid_check_is_in_our_domain(id->sid)))
-        {
-                NTSTATUS status;
-
-                DEBUG(10, ("asking passdb...\n"));
-
-                dom = idmap_init_passdb_domain(NULL);
-                if (dom == NULL) {
-                        return NT_STATUS_NONE_MAPPED;
-                }
-                status = dom->methods->sids_to_unixids(dom, maps);
-
-                if (NT_STATUS_IS_OK(status) && id->status == ID_MAPPED) {
-                        return status;
-                }
-
-                DEBUG(10, ("passdb could not map.\n"));
-
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        dom = idmap_find_domain(domain);
-        if (dom == NULL) {
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        return dom->methods->sids_to_unixids(dom, maps);
-}

vendor/current/source3/winbindd/idmap_ad.c

@@ -32 +32 @@
 #include "libads/ldap_schema.h"
 #include "nss_info.h"
-#include "secrets.h"
 #include "idmap.h"
 #include "../libcli/ldap/ldap_ndr.h"
@@ -40 +39 @@
 #define DBGC_CLASS DBGC_IDMAP
 
-#define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
-
-#define IDMAP_AD_MAX_IDS 30
 #define CHECK_ALLOC_DONE(mem) do { \
      if (!mem) { \
@@ -57 +53 @@
 };
 
-NTSTATUS init_module(void);
-
 /************************************************************************
  ***********************************************************************/
 
-static ADS_STATUS ad_idmap_cached_connection_internal(struct idmap_domain *dom)
-{
-        ADS_STRUCT *ads;
+static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
+{
         ADS_STATUS status;
-        bool local = False;
-        fstring dc_name;
-        struct sockaddr_storage dc_ip;
-        struct idmap_ad_context *ctx;
-        char *ldap_server = NULL;
-        char *realm = NULL;
-        struct winbindd_domain *wb_dom;
+        struct idmap_ad_context * ctx;
 
         DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
@@ -79 +66 @@
         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 
-        if (ctx->ads != NULL) {
-
-                time_t expire;
-                time_t now = time(NULL);
-
-                ads = ctx->ads;
-
-                expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
-
-                /* check for a valid structure */
-                DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
-                          (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
-
-                if ( ads->config.realm && (expire > time(NULL))) {
-                        return ADS_SUCCESS;
-                } else {
-                        /* we own this ADS_STRUCT so make sure it goes away */
-                        DEBUG(7,("Deleting expired krb5 credential cache\n"));
-                        ads->is_mine = True;
-                        ads_destroy( &ads );
-                        ads_kdestroy(WINBIND_CCACHE_NAME);
-                        ctx->ads = NULL;
-                }
-        }
-
-        if (!local) {
-                /* we don't want this to affect the users ccache */
-                setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
-        }
-
-        /*
-         * At this point we only have the NetBIOS domain name.
-         * Check if we can get server nam and realm from SAF cache
-         * and the domain list.
-         */
-        ldap_server = saf_fetch(dom->name);
-        DEBUG(10, ("ldap_server from saf cache: '%s'\n", ldap_server?ldap_server:""));
-
-        wb_dom = find_domain_from_name_noinit(dom->name);
-        if (wb_dom == NULL) {
-                DEBUG(10, ("find_domain_from_name_noinit did not find domain '%s'\n",
-                           dom->name));
-                realm = NULL;
-        } else {
-                DEBUG(10, ("find_domain_from_name_noinit found realm '%s' for "
-                          " domain '%s'\n", wb_dom->alt_name, dom->name));
-                realm = wb_dom->alt_name;
-        }
-
-        if ( (ads = ads_init(realm, dom->name, ldap_server)) == NULL ) {
-                DEBUG(1,("ads_init failed\n"));
-                return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-        }
-
-        /* the machine acct password might have change - fetch it every time */
-        SAFE_FREE(ads->auth.password);
-        ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
-
-        SAFE_FREE(ads->auth.realm);
-        ads->auth.realm = SMB_STRDUP(lp_realm());
-
-        /* setup server affinity */
-
-        get_dc_name(dom->name, realm, dc_name, &dc_ip );
-
-        status = ads_connect(ads);
-        if (!ADS_ERR_OK(status)) {
-                DEBUG(1, ("ad_idmap_cached_connection_internal: failed to "
-                          "connect to AD\n"));
-                ads_destroy(&ads);
-                return status;
-        }
-
-        ads->is_mine = False;
-
-        ctx->ads = ads;
-
-        return ADS_SUCCESS;
-}
-
-/************************************************************************
- ***********************************************************************/
-
-static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
-{
-        ADS_STATUS status;
-        struct idmap_ad_context * ctx;
-
-        status = ad_idmap_cached_connection_internal(dom);
+        status = ads_idmap_cached_connection(&ctx->ads, dom->name);
         if (!ADS_ERR_OK(status)) {
                 return status;
@@ -217 +116 @@
         const char *schema_mode = NULL; 
 
-        ctx = TALLOC_ZERO_P(dom, struct idmap_ad_context);
+        ctx = talloc_zero(dom, struct idmap_ad_context);
         if (ctx == NULL) {
                 DEBUG(0, ("Out of memory!\n"));
@@ -253 +152 @@
 
         return NT_STATUS_OK;
-}
-
-/************************************************************************
- Search up to IDMAP_AD_MAX_IDS entries in maps for a match.
- ***********************************************************************/
-
-static struct id_map *find_map_by_id(struct id_map **maps, enum id_type type, uint32_t id)
-{
-        int i;
-
-        for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
-                if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
-                        return maps[i];
-                }
-        }
-
-        return NULL;    
-}
-
-/************************************************************************
- Search up to IDMAP_AD_MAX_IDS entries in maps for a match
- ***********************************************************************/
-
-static struct id_map *find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
-{
-        int i;
-
-        for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
-                if (dom_sid_equal(maps[i]->sid, sid)) {
-                        return maps[i];
-                }
-        }
-
-        return NULL;    
 }
 
@@ -343 +208 @@
 again:
         bidx = idx;
-        for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
+        for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
                 switch (ids[idx]->xid.type) {
                 case ID_TYPE_UID:     
@@ -468 +333 @@
                 }
 
-                map = find_map_by_id(&ids[bidx], type, id);
+                map = idmap_find_map_by_id(&ids[bidx], type, id);
                 if (!map) {
                         DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
@@ -573 +438 @@
 
         bidx = idx;
-        for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
+        for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 
                 ids[idx]->status = ID_UNKNOWN;
@@ -623 +488 @@
                 }
 
-                map = find_map_by_sid(&ids[bidx], &sid);
+                map = idmap_find_map_by_sid(&ids[bidx], &sid);
                 if (!map) {
                         DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
@@ -738 +603 @@
                 dom = talloc_get_type(e->state, struct idmap_domain);
         } else {
-                dom = TALLOC_ZERO_P(e, struct idmap_domain);
+                dom = talloc_zero(e, struct idmap_domain);
                 if (dom == NULL) {
                         DEBUG(0, ("Out of memory!\n"));
@@ -758 +623 @@
                                       struct idmap_ad_context);
         } else {
-                ctx = TALLOC_ZERO_P(dom, struct idmap_ad_context);
+                ctx = talloc_zero(dom, struct idmap_ad_context);
                 if (ctx == NULL) {
                         DEBUG(0, ("Out of memory!\n"));
@@ -808 +673 @@
                                   const char **shell,
                                   const char **gecos,
-                                  uint32 *gid )
+                                  uint32_t *gid )
 {
         const char *attrs[] = {NULL, /* attr_homedir */
@@ -879 +744 @@
         if (gid) {
                 if (!ads_pull_uint32(ctx->ads, msg_internal, ctx->ad_schema->posix_gidnumber_attr, gid))
-                        *gid = (uint32)-1;
+                        *gid = (uint32_t)-1;
         }
 
@@ -1098 +963 @@
  ***********************************************************************/
 
+static_decl_idmap;
 NTSTATUS idmap_ad_init(void)
 {

vendor/current/source3/winbindd/idmap_autorid.c

@@ -6 +6 @@
  *  for the domains by automatically allocating a range for each domain
  *
- *  Copyright (C) Christian Ambach, 2010-2011
+ *  Copyright (C) Christian Ambach, 2010-2012
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -23 +23 @@
  */
 
-#include "includes.h"
-#include "system/filesys.h"
+/*
+ * This module allocates ranges for domains to be used in a
+ * algorithmic mode like idmap_rid. Multiple ranges are supported
+ * for a single domain: If a rid exceeds the range size, a matching
+ * range is allocated to hold the rid's id.
+ *
+ * Here are the formulas applied:
+ *
+ *
+ * For a sid of the form domain_sid-rid, we have
+ *
+ *   rid = reduced_rid + domain_range_index * range_size
+ *
+ * with
+ *   reduced_rid := rid % range_size
+ *   domain_range_index := rid / range_size
+ *
+ * And reduced_rid fits into a range.
+ *
+ * In the database, we associate a range_number to
+ * the pair domain_sid,domain_range_index.
+ *
+ * Now the unix id for the given sid calculates as:
+ *
+ *   id = reduced_rid + range_low_id
+ *
+ * with
+ *
+ *   range_low_id = low_id + range_number * range_size
+ *
+ *
+ * The inverse calculation goes like this:
+ *
+ * Given a unix id, let
+ *
+ *   normalized_id := id - low_id
+ *   reduced_rid := normalized_id % range_size
+ *   range_number = normalized_id / range_size
+ *
+ * Then we have
+ *
+ *   id = reduced_rid + low_id + range_number * range_size
+ *
+ * From the database, get the domain_sid,domain_range_index pair
+ * belonging to the range_number (if there is already one).
+ *
+ * Then the rid for the unix id calculates as:
+ *
+ *   rid = reduced_rid + domain_range_index * range_size
+ */
+
+#include "idmap_autorid_tdb.h"
 #include "winbindd.h"
-#include "dbwrap.h"
 #include "idmap.h"
+#include "idmap_rw.h"
 #include "../libcli/security/dom_sid.h"
-#include "util_tdb.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_IDMAP
 
-#define HWM "NEXT RANGE"
-#define ALLOC_HWM_UID "NEXT ALLOC UID"
-#define ALLOC_HWM_GID "NEXT ALLOC GID"
-#define ALLOC_RANGE "ALLOC"
-#define CONFIGKEY "CONFIG"
-
-struct autorid_global_config {
-        uint32_t minvalue;
-        uint32_t rangesize;
-        uint32_t maxranges;
-};
-
-struct autorid_domain_config {
-        fstring sid;
-        uint32_t domainnum;
-        struct autorid_global_config *globalcfg;
-};
+#define IDMAP_AUTORID_ALLOC_RESERVED 500
 
 /* handle to the tdb storing domain <-> range assignments */
 static struct db_context *autorid_db;
 
-static NTSTATUS idmap_autorid_get_domainrange(struct db_context *db,
-                                              void *private_data)
-{
+static bool ignore_builtin = false;
+
+static NTSTATUS idmap_autorid_get_alloc_range(struct idmap_domain *dom,
+                                        struct autorid_range_config *range)
+{
+        NTSTATUS status;
+
+        ZERO_STRUCT(*range);
+
+        fstrcpy(range->domsid, ALLOC_RANGE);
+
+        status = idmap_autorid_get_domainrange(autorid_db,
+                                               range,
+                                               dom->read_only);
+
+        return status;
+}
+
+static NTSTATUS idmap_autorid_allocate_id(struct idmap_domain *dom,
+                                          struct unixid *xid) {
+
         NTSTATUS ret;
-        uint32_t domainnum, hwm;
-        char *numstr;
-        struct autorid_domain_config *cfg;
-
-        cfg = (struct autorid_domain_config *)private_data;
-
-        if (!dbwrap_fetch_uint32(db, cfg->sid, &domainnum)) {
-                DEBUG(10, ("Acquiring new range for domain %s\n", cfg->sid));
-
-                /* fetch the current HWM */
-                if (!dbwrap_fetch_uint32(db, HWM, &hwm)) {
-                        DEBUG(1, ("Fatal error while fetching current "
-                                  "HWM value!\n"));
-                        ret = NT_STATUS_INTERNAL_ERROR;
-                        goto error;
-                }
-
-                /* do we have a range left? */
-                if (hwm >= cfg->globalcfg->maxranges) {
-                        DEBUG(1, ("No more domain ranges available!\n"));
-                        ret = NT_STATUS_NO_MEMORY;
-                        goto error;
-                }
-
-                /* increase the HWM */
-                ret = dbwrap_change_uint32_atomic(db, HWM, &domainnum, 1);
-                if (!NT_STATUS_IS_OK(ret)) {
-                        DEBUG(1, ("Fatal error while fetching a new "
-                                  "domain range value!\n"));
-                        goto error;
-                }
-
-                /* store away the new mapping in both directions */
-                ret = dbwrap_trans_store_uint32(db, cfg->sid, domainnum);
-                if (!NT_STATUS_IS_OK(ret)) {
-                        DEBUG(1, ("Fatal error while storing new "
-                                  "domain->range assignment!\n"));
-                        goto error;
-                }
-
-                numstr = talloc_asprintf(db, "%u", domainnum);
-                if (!numstr) {
-                        ret = NT_STATUS_NO_MEMORY;
-                        goto error;
-                }
-
-                ret = dbwrap_trans_store_bystring(db, numstr,
-                                string_term_tdb_data(cfg->sid), TDB_INSERT);
-
-                talloc_free(numstr);
-                if (!NT_STATUS_IS_OK(ret)) {
-                        DEBUG(1, ("Fatal error while storing "
-                                  "new domain->range assignment!\n"));
-                        goto error;
-                }
-                DEBUG(5, ("Acquired new range #%d for domain %s\n",
-                          domainnum, cfg->sid));
-        }
-
-        DEBUG(10, ("Using range #%d for domain %s\n", domainnum, cfg->sid));
-        cfg->domainnum = domainnum;
-
-        return NT_STATUS_OK;
-
-      error:
+        struct autorid_range_config range;
+
+        if (dom->read_only) {
+                DEBUG(3, ("Backend is read-only, refusing "
+                          "new allocation request\n"));
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        /* fetch the range for the allocation pool */
+
+        ret = idmap_autorid_get_alloc_range(dom, &range);
+        if (!NT_STATUS_IS_OK(ret)) {
+                DEBUG(3, ("Could not determine range for allocation pool, "
+                          "check previous messages for reason\n"));
+                return ret;
+        }
+
+        ret = idmap_tdb_common_get_new_id(dom, xid);
+
+        if (!NT_STATUS_IS_OK(ret)) {
+                DEBUG(1, ("Fatal error while allocating new ID!\n"));
+                return ret;
+        }
+
+        xid->id = xid->id + range.low_id;
+
+        DEBUG(10, ("Returned new %s %d from allocation range\n",
+                   (xid->type==ID_TYPE_UID)?"uid":"gid", xid->id));
+
         return ret;
-
+}
+
+/*
+ * map a SID to xid using the idmap_tdb like pool
+ */
+static NTSTATUS idmap_autorid_id_to_sid_alloc(struct idmap_domain *dom,
+                                              struct id_map *map)
+{
+        NTSTATUS ret;
+
+        /* look out for the mapping */
+        ret = idmap_tdb_common_unixid_to_sid(dom, map);
+
+        if (NT_STATUS_IS_OK(ret)) {
+                map->status = ID_MAPPED;
+                return ret;
+        }
+
+        map->status = ID_UNKNOWN;
+
+        DEBUG(10, ("no ID->SID mapping for %d could be found\n", map->xid.id));
+
+        return ret;
 }
 
 static NTSTATUS idmap_autorid_id_to_sid(struct autorid_global_config *cfg,
+                                        struct idmap_domain *dom,
                                         struct id_map *map)
 {
-        uint32_t range;
-        TDB_DATA data;
+        uint32_t range_number;
+        uint32_t domain_range_index = 0;
+        uint32_t normalized_id;
+        uint32_t reduced_rid;
+        uint32_t rid;
+        TDB_DATA data = tdb_null;
         char *keystr;
-        struct dom_sid sid;
+        struct dom_sid domsid;
+        NTSTATUS status;
+        bool ok;
+        const char *q = NULL;
 
         /* can this be one of our ids? */
@@ -152 +197 @@
 
         /* determine the range of this uid */
-        range = ((map->xid.id - cfg->minvalue) / cfg->rangesize);
-
-        keystr = talloc_asprintf(talloc_tos(), "%u", range);
+
+        normalized_id = map->xid.id - cfg->minvalue;
+        range_number = normalized_id / cfg->rangesize;
+
+        keystr = talloc_asprintf(talloc_tos(), "%u", range_number);
         if (!keystr) {
                 return NT_STATUS_NO_MEMORY;
         }
 
-        data = dbwrap_fetch_bystring(autorid_db, talloc_tos(), keystr);
+        status = dbwrap_fetch_bystring(autorid_db, talloc_tos(), keystr, &data);
         TALLOC_FREE(keystr);
 
-        if (!data.dptr) {
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(4, ("id %d belongs to range %d which does not have "
                           "domain mapping, ignoring mapping request\n",
-                          map->xid.id, range));
+                          map->xid.id, range_number));
                 TALLOC_FREE(data.dptr);
                 map->status = ID_UNKNOWN;
@@ -174 +221 @@
                     ALLOC_RANGE,
                     strlen(ALLOC_RANGE)) == 0) {
-                /* this is from the alloc range, there is no mapping back */
-                DEBUG(5, ("id %d belongs to alloc range, cannot map back\n",
+                /*
+                 * this is from the alloc range, check if there is a mapping
+                 */
+                DEBUG(5, ("id %d belongs to allocation range, "
+                          "checking for mapping\n",
                           map->xid.id));
                 TALLOC_FREE(data.dptr);
+                return idmap_autorid_id_to_sid_alloc(dom, map);
+        }
+
+        ok = dom_sid_parse_endp((const char *)data.dptr, &domsid, &q);
+        TALLOC_FREE(data.dptr);
+        if (!ok) {
                 map->status = ID_UNKNOWN;
                 return NT_STATUS_OK;
         }
-
-        string_to_sid(&sid, (const char *)data.dptr);
-        TALLOC_FREE(data.dptr);
-
-        sid_compose(map->sid, &sid,
-                    (map->xid.id - cfg->minvalue -
-                     range * cfg->rangesize));
+        if ((q != NULL) && (*q != '\0'))
+                if (sscanf(q+1, "%"SCNu32, &domain_range_index) != 1) {
+                        DEBUG(10, ("Domain range index not found, "
+                                   "ignoring mapping request\n"));
+                        map->status = ID_UNKNOWN;
+                        return NT_STATUS_OK;
+                }
+
+        reduced_rid = normalized_id % cfg->rangesize;
+        rid = reduced_rid + domain_range_index * cfg->rangesize;
+
+        sid_compose(map->sid, &domsid, rid);
 
         /* We **really** should have some way of validating
@@ -194 +255 @@
 
         map->status = ID_MAPPED;
+        map->xid.type = ID_TYPE_BOTH;
+
         return NT_STATUS_OK;
 }
@@ -201 +264 @@
 **********************************/
 
-static NTSTATUS idmap_autorid_sid_to_id(struct autorid_global_config *global,
-                                        struct autorid_domain_config *domain,
+static NTSTATUS idmap_autorid_sid_to_id_rid(
+                                        struct autorid_global_config *global,
+                                        struct autorid_range_config *range,
                                         struct id_map *map)
 {
         uint32_t rid;
+        uint32_t reduced_rid;
 
         sid_peek_rid(map->sid, &rid);
 
-        /* if the rid is higher than the size of the range, we cannot map it */
-        if (rid >= global->rangesize) {
-                map->status = ID_UNKNOWN;
-                DEBUG(2, ("RID %d is larger then size of range (%d), "
-                          "user cannot be mapped\n", rid, global->rangesize));
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-        map->xid.id = global->minvalue +
-            (global->rangesize * domain->domainnum)+rid;
-
-        /* We **really** should have some way of validating
-           the SID exists and is the correct type here.  But
-           that is a deficiency in the idmap_rid design. */
-
+        reduced_rid = rid % global->rangesize;
+
+        map->xid.id = reduced_rid + range->low_id;
+        map->xid.type = ID_TYPE_BOTH;
         map->status = ID_MAPPED;
 
@@ -235 +290 @@
                                               struct id_map **ids)
 {
+        struct idmap_tdb_common_context *commoncfg;
         struct autorid_global_config *globalcfg;
         NTSTATUS ret;
         int i;
+        int num_tomap = 0;
+        int num_mapped = 0;
 
         /* initialize the status to avoid surprise */
         for (i = 0; ids[i]; i++) {
                 ids[i]->status = ID_UNKNOWN;
-        }
-
-        globalcfg = talloc_get_type(dom->private_data,
+                num_tomap++;
+        }
+
+        commoncfg =
+            talloc_get_type_abort(dom->private_data,
+                                  struct idmap_tdb_common_context);
+
+        globalcfg = talloc_get_type(commoncfg->private_data,
                                     struct autorid_global_config);
 
         for (i = 0; ids[i]; i++) {
 
-                ret = idmap_autorid_id_to_sid(globalcfg, ids[i]);
+                ret = idmap_autorid_id_to_sid(globalcfg, dom, ids[i]);
 
                 if ((!NT_STATUS_IS_OK(ret)) &&
@@ -258 +321 @@
                         goto failure;
                 }
-        }
-        return NT_STATUS_OK;
+
+                if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
+                        num_mapped++;
+                }
+
+        }
+
+        if (num_tomap == num_mapped) {
+                return NT_STATUS_OK;
+        } else if (num_mapped == 0) {
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        return STATUS_SOME_UNMAPPED;
+
 
       failure:
         return ret;
+}
+
+static bool idmap_autorid_sid_is_special(struct dom_sid *sid)
+{
+        bool match;
+
+        match = sid_check_is_in_wellknown_domain(sid);
+        if (match) {
+                return true;
+        }
+
+        return false;
+}
+
+static NTSTATUS idmap_autorid_sid_to_id_special(struct idmap_domain *dom,
+                                                struct id_map *map)
+{
+        struct idmap_tdb_common_context *common =
+                talloc_get_type_abort(dom->private_data,
+                                      struct idmap_tdb_common_context);
+        uint32_t count;
+        struct autorid_range_config range;
+        NTSTATUS status;
+        uint32_t free_id;
+
+        status = idmap_autorid_get_alloc_range(dom, &range);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        /* Take the next free ID, counting from the top */
+        free_id = 0;
+        for (count = 0; count < IDMAP_AUTORID_ALLOC_RESERVED; count++) {
+                struct id_map test_map;
+                struct dom_sid sid;
+
+                test_map.sid = &sid;
+                test_map.xid.type = map->xid.type;
+                test_map.xid.id = range.high_id - count;
+                test_map.status = ID_UNKNOWN;
+
+                status = idmap_tdb_common_unixid_to_sid(dom, &test_map);
+                if (NT_STATUS_EQUAL(NT_STATUS_NONE_MAPPED, status)) {
+                        free_id = test_map.xid.id;
+                        break;
+                }
+
+                if (!NT_STATUS_IS_OK(status)) {
+                        /* error - get out */
+                        return status;
+                }
+
+                /* mapping exists - try next ID */
+        }
+
+        if (free_id == 0) {
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        map->status = ID_MAPPED;
+        map->xid.id = free_id;
+
+        status = common->rw_ops->set_mapping(dom, map);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(2, ("Error storing new mapping: %s\n",
+                          nt_errstr(status)));
+                return status;
+        }
+
+        return NT_STATUS_OK;
+}
+
+struct idmap_autorid_sid_to_id_alloc_ctx {
+        struct idmap_domain *dom;
+        struct id_map *map;
+};
+
+static NTSTATUS idmap_autorid_sid_to_id_alloc_action(
+                                struct db_context *db,
+                                void *private_data)
+{
+        struct idmap_autorid_sid_to_id_alloc_ctx *ctx;
+
+        ctx = (struct idmap_autorid_sid_to_id_alloc_ctx *)private_data;
+
+        if (idmap_autorid_sid_is_special(ctx->map->sid)) {
+                NTSTATUS ret;
+
+                ret = idmap_autorid_sid_to_id_special(ctx->dom, ctx->map);
+                if (NT_STATUS_IS_OK(ret)) {
+                        return NT_STATUS_OK;
+                }
+                if (!NT_STATUS_EQUAL(NT_STATUS_NONE_MAPPED, ret)) {
+                        return ret;
+                }
+
+                DEBUG(10, ("Sepecial sid %s not mapped. falling back to "
+                           "regular allocation\n",
+                           sid_string_dbg(ctx->map->sid)));
+        }
+
+        return idmap_tdb_common_new_mapping(ctx->dom, ctx->map);
+}
+
+/*
+ * map a SID to xid using the idmap_tdb like pool
+ */
+static NTSTATUS idmap_autorid_sid_to_id_alloc(
+                                        struct idmap_tdb_common_context *ctx,
+                                        struct idmap_domain *dom,
+                                        struct id_map *map)
+{
+        NTSTATUS ret;
+        struct idmap_autorid_sid_to_id_alloc_ctx alloc_ctx;
+
+        map->status = ID_UNKNOWN;
+
+        /* see if we already have a mapping */
+        ret = idmap_tdb_common_sid_to_unixid(dom, map);
+
+        if (NT_STATUS_IS_OK(ret)) {
+                map->status = ID_MAPPED;
+                return ret;
+        }
+
+        /* bad things happened */
+        if (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
+                DEBUG(1, ("Looking up SID->ID mapping for %s failed: %s\n",
+                          sid_string_dbg(map->sid), nt_errstr(ret)));
+                return ret;
+        }
+
+        if (dom->read_only) {
+                DEBUG(3, ("Not allocating new mapping for %s, because backend "
+                          "is read-only\n", sid_string_dbg(map->sid)));
+                map->status = ID_UNMAPPED;
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        DEBUG(10, ("Creating new mapping in pool for %s\n",
+                   sid_string_dbg(map->sid)));
+
+        alloc_ctx.dom = dom;
+        alloc_ctx.map = map;
+
+        ret = dbwrap_trans_do(ctx->db, idmap_autorid_sid_to_id_alloc_action,
+                              &alloc_ctx);
+        if (!NT_STATUS_IS_OK(ret)) {
+                DEBUG(1, ("Failed to create a new mapping in alloc range: %s\n",
+                          nt_errstr(ret)));
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        map->status = ID_MAPPED;
+        return NT_STATUS_OK;
+}
+
+static bool idmap_autorid_domsid_is_for_alloc(struct dom_sid *sid)
+{
+        bool match;
+
+        match = sid_check_is_wellknown_domain(sid, NULL);
+        if (match) {
+                return true;
+        }
+
+        return false;
+}
+
+static NTSTATUS idmap_autorid_sid_to_id(struct idmap_tdb_common_context *common,
+                                        struct idmap_domain *dom,
+                                        struct id_map *map)
+{
+        struct autorid_global_config *global =
+                talloc_get_type_abort(common->private_data,
+                                      struct autorid_global_config);
+        struct winbindd_tdc_domain *domain;
+        struct autorid_range_config range;
+        uint32_t rid;
+        struct dom_sid domainsid;
+        NTSTATUS ret;
+
+        ZERO_STRUCT(range);
+        map->status = ID_UNKNOWN;
+
+        DEBUG(10, ("Trying to map %s\n", sid_string_dbg(map->sid)));
+
+        sid_copy(&domainsid, map->sid);
+        if (!sid_split_rid(&domainsid, &rid)) {
+                DEBUG(4, ("Could not determine domain SID from %s, "
+                          "ignoring mapping request\n",
+                          sid_string_dbg(map->sid)));
+                map->status = ID_UNMAPPED;
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        if (idmap_autorid_domsid_is_for_alloc(&domainsid)) {
+                DEBUG(10, ("SID %s is for ALLOC range.\n",
+                           sid_string_dbg(map->sid)));
+
+                return idmap_autorid_sid_to_id_alloc(common, dom, map);
+        }
+
+        if (dom_sid_equal(&domainsid, &global_sid_Builtin) && ignore_builtin) {
+                DEBUG(10, ("Ignoring request for BUILTIN domain\n"));
+                map->status = ID_UNMAPPED;
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        /*
+         * Check if the domain is around
+         */
+        domain = wcache_tdc_fetch_domainbysid(talloc_tos(),
+                                              &domainsid);
+        if (domain == NULL) {
+                DEBUG(10, ("Ignoring unknown domain sid %s\n",
+                           sid_string_dbg(&domainsid)));
+                map->status = ID_UNMAPPED;
+                return NT_STATUS_NONE_MAPPED;
+        }
+        TALLOC_FREE(domain);
+
+        sid_to_fstring(range.domsid, &domainsid);
+
+        range.domain_range_index = rid / (global->rangesize);
+
+        ret = idmap_autorid_get_domainrange(autorid_db, &range, dom->read_only);
+        if (NT_STATUS_EQUAL(ret, NT_STATUS_NOT_FOUND) && dom->read_only) {
+                DEBUG(10, ("read-only is enabled, did not allocate "
+                           "new range for domain %s\n",
+                           sid_string_dbg(&domainsid)));
+                map->status = ID_UNMAPPED;
+                return NT_STATUS_NONE_MAPPED;
+        }
+        if (!NT_STATUS_IS_OK(ret)) {
+                DEBUG(3, ("Could not determine range for domain, "
+                          "check previous messages for reason\n"));
+                return ret;
+        }
+
+        return idmap_autorid_sid_to_id_rid(global, &range, map);
 }
 
@@ -272 +589 @@
                                               struct id_map **ids)
 {
-        struct autorid_global_config *global;
+        struct idmap_tdb_common_context *commoncfg;
         NTSTATUS ret;
         int i;
+        int num_tomap = 0;
+        int num_mapped = 0;
 
         /* initialize the status to avoid surprise */
         for (i = 0; ids[i]; i++) {
                 ids[i]->status = ID_UNKNOWN;
-        }
-
-        global = talloc_get_type(dom->private_data,
-                                 struct autorid_global_config);
+                num_tomap++;
+        }
+
+        commoncfg =
+            talloc_get_type_abort(dom->private_data,
+                                  struct idmap_tdb_common_context);
 
         for (i = 0; ids[i]; i++) {
-                struct winbindd_tdc_domain *domain;
-                struct autorid_domain_config domaincfg;
-                uint32_t rid;
-                struct dom_sid domainsid;
-
-                ZERO_STRUCT(domaincfg);
-
-                sid_copy(&domainsid, ids[i]->sid);
-                if (!sid_split_rid(&domainsid, &rid)) {
-                        DEBUG(4, ("Could not determine domain SID from %s, "
-                                  "ignoring mapping request\n",
-                                  sid_string_dbg(ids[i]->sid)));
-                        continue;
-                }
-
-                /*
-                 * Check if the domain is around
-                 */
-                domain = wcache_tdc_fetch_domainbysid(talloc_tos(),
-                                                      &domainsid);
-                if (domain == NULL) {
-                        DEBUG(10, ("Ignoring unknown domain sid %s\n",
-                                   sid_string_dbg(&domainsid)));
-                        continue;
-                }
-                TALLOC_FREE(domain);
-
-                domaincfg.globalcfg = global;
-                sid_to_fstring(domaincfg.sid, &domainsid);
-
-                ret = dbwrap_trans_do(autorid_db,
-                                      idmap_autorid_get_domainrange,
-                                      &domaincfg);
-
-                if (!NT_STATUS_IS_OK(ret)) {
-                        DEBUG(3, ("Could not determine range for domain, "
-                                  "check previous messages for reason\n"));
-                        goto failure;
-                }
-
-                ret = idmap_autorid_sid_to_id(global, &domaincfg, ids[i]);
-
+                ret = idmap_autorid_sid_to_id(commoncfg, dom, ids[i]);
                 if ((!NT_STATUS_IS_OK(ret)) &&
                     (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
@@ -332 +612 @@
                         DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
                                   sid_string_dbg(ids[i]->sid)));
-                        goto failure;
-                }
-        }
+                        return ret;
+                }
+
+                if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
+                        num_mapped++;
+                }
+        }
+
+        if (num_tomap == num_mapped) {
+                return NT_STATUS_OK;
+        } else if (num_mapped == 0) {
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        return STATUS_SOME_UNMAPPED;
+}
+
+static NTSTATUS idmap_autorid_preallocate_wellknown(struct idmap_domain *dom)
+{
+        const char *groups[] = { "S-1-1-0", "S-1-2-0", "S-1-2-1",
+                "S-1-3-0", "S-1-3-1", "S-1-3-2", "S-1-3-3", "S-1-3-4",
+                "S-1-5-1", "S-1-5-2", "S-1-5-3", "S-1-5-4", "S-1-5-6",
+                "S-1-5-7", "S-1-5-8", "S-1-5-9", "S-1-5-10", "S-1-5-11",
+                "S-1-5-12", "S-1-5-13", "S-1-5-14", "S-1-5-15",
+                "S-1-5-17", "S-1-5-18", "S-1-5-19", "S-1-5-20"
+        };
+
+        struct id_map **maps;
+        int i, num;
+        NTSTATUS status;
+
+        if (dom->read_only) {
+                return NT_STATUS_OK;
+        }
+
+        num = ARRAY_SIZE(groups);
+
+        maps = talloc_array(talloc_tos(), struct id_map*, num+1);
+        if (!maps) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        for (i = 0; i < num; i++) {
+                maps[i] = talloc(maps, struct id_map);
+                if (maps[i] == NULL) {
+                        talloc_free(maps);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                maps[i]->xid.type = ID_TYPE_GID;
+                maps[i]->sid = dom_sid_parse_talloc(maps, groups[i]);
+        }
+
+        maps[num] = NULL;
+
+        status = idmap_autorid_sids_to_unixids(dom, maps);
+
+        DEBUG(10,("Preallocation run finished with status %s\n",
+                  nt_errstr(status)));
+
+        talloc_free(maps);
+
+        return NT_STATUS_IS_OK(status)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
+}
+
+static NTSTATUS idmap_autorid_initialize_action(struct db_context *db,
+                                                void *private_data)
+{
+        struct idmap_domain *dom;
+        struct idmap_tdb_common_context *common;
+        struct autorid_global_config *config;
+        NTSTATUS status;
+
+        dom = (struct idmap_domain *)private_data;
+        common = (struct idmap_tdb_common_context *)dom->private_data;
+        config = (struct autorid_global_config *)common->private_data;
+
+        status = idmap_autorid_init_hwms(db);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        status = idmap_autorid_saveconfig(db, config);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("Failed to store configuration data!\n"));
+                return status;
+        }
+
+        status = idmap_autorid_preallocate_wellknown(dom);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("Failed to preallocate wellknown sids: %s\n",
+                          nt_errstr(status)));
+                return status;
+        }
+
         return NT_STATUS_OK;
-
-      failure:
-        return ret;
-
-}
-
-/* initialize the given HWM to 0 if it does not exist yet */
-static NTSTATUS idmap_autorid_init_hwm(const char *hwm) {
-
+}
+
+static NTSTATUS idmap_autorid_initialize(struct idmap_domain *dom)
+{
+        struct idmap_tdb_common_context *commonconfig;
+        struct autorid_global_config *config;
         NTSTATUS status;
-        int32_t hwmval;
-
-        hwmval = dbwrap_fetch_int32(autorid_db, hwm);
-        if ((hwmval < 0))  {
-                status = dbwrap_trans_store_int32(autorid_db, hwm, 0);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(0,
-                              ("Unable to initialise HWM (%s) in autorid "
-                               "database: %s\n", hwm, nt_errstr(status)));
-                        return NT_STATUS_INTERNAL_DB_ERROR;
-                }
-        }
-
-        return NT_STATUS_OK;
-}
-
-/*
- * open and initialize the database which stores the ranges for the domains
- */
-static NTSTATUS idmap_autorid_db_init(void)
-{
-        NTSTATUS status;
-
-        if (autorid_db) {
-                /* its already open */
-                return NT_STATUS_OK;
-        }
-
-        /* Open idmap repository */
-        autorid_db = db_open(NULL, state_path("autorid.tdb"), 0,
-                             TDB_DEFAULT, O_RDWR | O_CREAT, 0644);
-
-        if (!autorid_db) {
-                DEBUG(0, ("Unable to open idmap_autorid database '%s'\n",
-                          state_path("autorid.tdb")));
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        /* Initialize high water mark for the currently used range to 0 */
-
-        status = idmap_autorid_init_hwm(HWM);
-        NT_STATUS_NOT_OK_RETURN(status);
-
-        status = idmap_autorid_init_hwm(ALLOC_HWM_UID);
-        NT_STATUS_NOT_OK_RETURN(status);
-
-        status = idmap_autorid_init_hwm(ALLOC_HWM_GID);
-
-        return status;
-}
-
-static struct autorid_global_config *idmap_autorid_loadconfig(TALLOC_CTX * ctx)
-{
-
-        TDB_DATA data;
-        struct autorid_global_config *cfg;
-        unsigned long minvalue, rangesize, maxranges;
-
-        data = dbwrap_fetch_bystring(autorid_db, ctx, CONFIGKEY);
-
-        if (!data.dptr) {
-                DEBUG(10, ("No saved config found\n"));
-                return NULL;
-        }
-
-        cfg = TALLOC_ZERO_P(ctx, struct autorid_global_config);
-        if (!cfg) {
-                return NULL;
-        }
-
-        if (sscanf((char *)data.dptr,
-                   "minvalue:%lu rangesize:%lu maxranges:%lu",
-                   &minvalue, &rangesize, &maxranges) != 3) {
-                DEBUG(1,
-                      ("Found invalid configuration data"
-                       "creating new config\n"));
-                return NULL;
-        }
-
-        cfg->minvalue = minvalue;
-        cfg->rangesize = rangesize;
-        cfg->maxranges = maxranges;
-
-        DEBUG(10, ("Loaded previously stored configuration "
-                   "minvalue:%d rangesize:%d\n",
-                   cfg->minvalue, cfg->rangesize));
-
-        return cfg;
-
-}
-
-static NTSTATUS idmap_autorid_saveconfig(struct autorid_global_config *cfg)
-{
-
-        NTSTATUS status;
-        TDB_DATA data;
-        char *cfgstr;
-
-        cfgstr =
-            talloc_asprintf(talloc_tos(),
-                            "minvalue:%u rangesize:%u maxranges:%u",
-                            cfg->minvalue, cfg->rangesize, cfg->maxranges);
-
-        if (!cfgstr) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        data = string_tdb_data(cfgstr);
-
-        status = dbwrap_trans_store_bystring(autorid_db, CONFIGKEY,
-                                             data, TDB_REPLACE);
-
-        talloc_free(cfgstr);
-
-        return status;
-}
-
-static NTSTATUS idmap_autorid_initialize(struct idmap_domain *dom)
-{
-        struct autorid_global_config *config;
-        struct autorid_global_config *storedconfig = NULL;
-        NTSTATUS status;
-        uint32_t hwm;
+        char *db_path;
 
         if (!strequal(dom->name, "*")) {
@@ -477 +723 @@
         }
 
-        config = TALLOC_ZERO_P(dom, struct autorid_global_config);
+        commonconfig = talloc_zero(dom, struct idmap_tdb_common_context);
+        if (!commonconfig) {
+                DEBUG(0, ("Out of memory!\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+        dom->private_data = commonconfig;
+
+        commonconfig->rw_ops = talloc_zero(commonconfig, struct idmap_rw_ops);
+        if (commonconfig->rw_ops == NULL) {
+                DEBUG(0, ("Out of memory!\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        config = talloc_zero(commonconfig, struct autorid_global_config);
         if (!config) {
                 DEBUG(0, ("Out of memory!\n"));
                 return NT_STATUS_NO_MEMORY;
         }
-
-        status = idmap_autorid_db_init();
-        if (!NT_STATUS_IS_OK(status)) {
-                goto error;
-        }
+        commonconfig->private_data = config;
 
         config->minvalue = dom->low_id;
-        config->rangesize = lp_parm_int(-1, "idmap config *", "rangesize", 100000);
-
-        if (config->rangesize < 2000) {
-                DEBUG(1, ("autorid rangesize must be at least 2000\n"));
-                status = NT_STATUS_INVALID_PARAMETER;
-                goto error;
-        }
+        config->rangesize = lp_parm_int(-1, "idmap config *",
+                                        "rangesize", 100000);
 
         config->maxranges = (dom->high_id - dom->low_id + 1) /
@@ -501 +751 @@
 
         if (config->maxranges == 0) {
-                DEBUG(1, ("allowed uid range is smaller then rangesize, "
-                          "increase uid range or decrease rangesize\n"));
+                DEBUG(1, ("Allowed uid range is smaller than rangesize. "
+                          "Increase uid range or decrease rangesize.\n"));
                 status = NT_STATUS_INVALID_PARAMETER;
                 goto error;
@@ -516 +766 @@
         }
 
-        DEBUG(10, ("Current configuration in config is "
-                   "minvalue:%d rangesize:%d maxranges:%d\n",
-                   config->minvalue, config->rangesize, config->maxranges));
-
-        /* read previously stored config and current HWM */
-        storedconfig = idmap_autorid_loadconfig(talloc_tos());
-
-        if (!dbwrap_fetch_uint32(autorid_db, HWM, &hwm)) {
-                DEBUG(1, ("Fatal error while fetching current "
-                          "HWM value!\n"));
-                status = NT_STATUS_INTERNAL_ERROR;
-                goto error;
-        }
-
-        /* did the minimum value or rangesize change? */
-        if (storedconfig &&
-            ((storedconfig->minvalue != config->minvalue) ||
-             (storedconfig->rangesize != config->rangesize))) {
-                DEBUG(1, ("New configuration values for rangesize or "
-                          "minimum uid value conflict with previously "
-                          "used values! Aborting initialization\n"));
-                status = NT_STATUS_INVALID_PARAMETER;
-                goto error;
-        }
-
-        /*
-         * has the highest uid value been reduced to setting that is not
-         * sufficient any more for already existing ranges?
-         */
-        if (hwm > config->maxranges) {
-                DEBUG(1, ("New upper uid limit is too low to cover "
-                          "existing mappings! Aborting initialization\n"));
-                status = NT_STATUS_INVALID_PARAMETER;
-                goto error;
-        }
-
-        status = idmap_autorid_saveconfig(config);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("Failed to store configuration data!\n"));
-                goto error;
-        }
-
         DEBUG(5, ("%d domain ranges with a size of %d are available\n",
                   config->maxranges, config->rangesize));
 
-        dom->private_data = config;
+        ignore_builtin = lp_parm_bool(-1, "idmap config *",
+                                      "ignore builtin", false);
+
+        /* fill the TDB common configuration */
+
+        commonconfig->max_id = config->rangesize - 1
+                             - IDMAP_AUTORID_ALLOC_RESERVED;
+        commonconfig->hwmkey_uid = ALLOC_HWM_UID;
+        commonconfig->hwmkey_gid = ALLOC_HWM_GID;
+        commonconfig->rw_ops->get_new_id = idmap_autorid_allocate_id;
+        commonconfig->rw_ops->set_mapping = idmap_tdb_common_set_mapping;
+
+        db_path = state_path("autorid.tdb");
+        if (db_path == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto error;
+        }
+
+        status = idmap_autorid_db_open(db_path,
+                                       NULL, /* TALLOC_CTX */
+                                       &autorid_db);
+        TALLOC_FREE(db_path);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto error;
+        }
+
+        commonconfig->db = autorid_db;
+
+        status = dbwrap_trans_do(autorid_db,
+                                 idmap_autorid_initialize_action,
+                                 dom);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("Failed to init the idmap database: %s\n",
+                          nt_errstr(status)));
+                goto error;
+        }
 
         goto done;
@@ -570 +812 @@
 
 done:
-        talloc_free(storedconfig);
-
         return status;
-}
-
-static NTSTATUS idmap_autorid_allocate_id(struct idmap_domain *dom,
-                                          struct unixid *xid) {
-
-        NTSTATUS ret;
-        struct autorid_global_config *globalcfg;
-        struct autorid_domain_config domaincfg;
-        uint32_t hwm;
-        const char *hwmkey;
-
-        if (!strequal(dom->name, "*")) {
-                DEBUG(3, ("idmap_autorid_allocate_id: "
-                          "Refusing creation of mapping for domain'%s'. "
-                          "Currently only supported for the default "
-                          "domain \"*\".\n",
-                           dom->name));
-                return NT_STATUS_NOT_IMPLEMENTED;
-        }
-
-        if ((xid->type != ID_TYPE_UID) && (xid->type != ID_TYPE_GID)) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-
-        globalcfg = talloc_get_type(dom->private_data,
-                                    struct autorid_global_config);
-
-        /* fetch the range for the allocation pool */
-
-        ZERO_STRUCT(domaincfg);
-
-        domaincfg.globalcfg = globalcfg;
-        fstrcpy(domaincfg.sid, ALLOC_RANGE);
-
-        ret = dbwrap_trans_do(autorid_db,
-                              idmap_autorid_get_domainrange,
-                              &domaincfg);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(3, ("Could not determine range for allocation pool, "
-                          "check previous messages for reason\n"));
-                return ret;
-        }
-
-        /* fetch the current HWM */
-        hwmkey = (xid->type==ID_TYPE_UID)?ALLOC_HWM_UID:ALLOC_HWM_GID;
-
-        if (!dbwrap_fetch_uint32(autorid_db, hwmkey, &hwm)) {
-                DEBUG(1, ("Failed to fetch current allocation HWM value: %s\n",
-                          nt_errstr(ret)));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        if (hwm >= globalcfg->rangesize) {
-                DEBUG(1, ("allocation range is depleted!\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        ret = dbwrap_change_uint32_atomic(autorid_db, hwmkey, &(xid->id), 1);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(1, ("Fatal error while allocating new ID!\n"));
-                return ret;
-        }
-
-        xid->id = globalcfg->minvalue +
-                  globalcfg->rangesize * domaincfg.domainnum +
-                  xid->id;
-
-        DEBUG(10, ("Returned new %s %d from allocation range\n",
-                   (xid->type==ID_TYPE_UID)?"uid":"gid", xid->id));
-
-        return ret;
 }
 
@@ -657 +825 @@
 };
 
+static_decl_idmap;
 NTSTATUS idmap_autorid_init(void)
 {

vendor/current/source3/winbindd/idmap_hash/idmap_hash.c

@@ -105 +105 @@
  ********************************************************************/
 
-static NTSTATUS be_init(struct idmap_domain *dom)
+static NTSTATUS idmap_hash_initialize(struct idmap_domain *dom)
 {
         struct sid_hash_table *hashed_domains;
@@ -113 +113 @@
         int i;
 
+        if (!strequal(dom->name, "*")) {
+                DBG_ERR("Error: idmap_hash configured for domain '%s'. "
+                        "But the hash module can only be used for the default "
+                        "idmap configuration.\n", dom->name);
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
         /* If the domain SID hash table has been initialized, assume
            that we completed this function previously */
@@ -128 +135 @@
         /* Create the hash table of domain SIDs */
 
-        hashed_domains = TALLOC_ZERO_ARRAY(dom, struct sid_hash_table, 4096);
+        hashed_domains = talloc_zero_array(dom, struct sid_hash_table, 4096);
         BAIL_ON_PTR_NT_ERROR(hashed_domains, nt_status);
 
@@ -138 +145 @@
                 if (is_null_sid(&dom_list[i].sid))
                         continue;
+
+                /*
+                 * Check if the domain from the list is not already configured
+                 * to use another idmap backend. Not checking this makes the
+                 * idmap_hash module map IDs for *all* domains implicitly.  This
+                 * is quite dangerous in setups that use multiple idmap
+                 * configurations.
+                 */
+
+                if (domain_has_idmap_config(dom_list[i].domain_name)) {
+                        continue;
+                }
+
                 if ((hash = hash_domain_sid(&dom_list[i].sid)) == 0)
                         continue;
 
-                DEBUG(5,("hash:be_init() Adding %s (%s) -> %d\n",
+                DBG_INFO("Adding %s (%s) -> %d\n",
                          dom_list[i].domain_name,
                          sid_string_dbg(&dom_list[i].sid),
-                         hash));
+                         hash);
 
                 hashed_domains[hash].sid = talloc(hashed_domains, struct dom_sid);
@@ -167 +187 @@
         int i;
 
+        if (!ids) {
+                nt_status = NT_STATUS_INVALID_PARAMETER;
+                BAIL_ON_NTSTATUS_ERROR(nt_status);
+        }
+
         /* initialize the status to avoid suprise */
         for (i = 0; ids[i]; i++) {
@@ -172 +197 @@
         }
 
-        nt_status = be_init(dom);
+        nt_status = idmap_hash_initialize(dom);
         BAIL_ON_NTSTATUS_ERROR(nt_status);
-
-        if (!ids) {
-                nt_status = NT_STATUS_INVALID_PARAMETER;
-                BAIL_ON_NTSTATUS_ERROR(nt_status);
-        }
 
         for (i=0; ids[i]; i++) {
@@ -217 +237 @@
         int i;
 
+        if (!ids) {
+                nt_status = NT_STATUS_INVALID_PARAMETER;
+                BAIL_ON_NTSTATUS_ERROR(nt_status);
+        }
+
         /* initialize the status to avoid suprise */
         for (i = 0; ids[i]; i++) {
@@ -222 +247 @@
         }
 
-        nt_status = be_init(dom);
+        nt_status = idmap_hash_initialize(dom);
         BAIL_ON_NTSTATUS_ERROR(nt_status);
-
-        if (!ids) {
-                nt_status = NT_STATUS_INVALID_PARAMETER;
-                BAIL_ON_NTSTATUS_ERROR(nt_status);
-        }
 
         for (i=0; ids[i]; i++) {
@@ -348 +368 @@
 
 static struct idmap_methods hash_idmap_methods = {
-        .init            = be_init,
+        .init            = idmap_hash_initialize,
         .unixids_to_sids = unixids_to_sids,
         .sids_to_unixids = sids_to_unixids,
@@ -367 +387 @@
  **********************************************************************/
 
+static_decl_idmap;
 NTSTATUS idmap_hash_init(void)
 {

vendor/current/source3/winbindd/idmap_hash/mapfile.c

@@ -68 +68 @@
                 return false;
 
-        if ((p = x_fgets(buffer, sizeof(buffer)-1, lw_map_file)) == NULL) {
+        p = x_fgets(buffer, sizeof(buffer)-1, lw_map_file);
+        if (p == NULL) {
                 return false;
         }
@@ -74 +75 @@
         /* Strip newlines and carriage returns */
 
-        len = strlen_m(buffer) - 1;
+        len = strlen_m(buffer);
+        if (len == 0) {
+                return false;
+        }
+        len -= 1;
+
         while ((buffer[len] == '\n') || (buffer[len] == '\r')) {
                 buffer[len--] = '\0';
@@ -88 +94 @@
         p++;
 
-        fstrcpy(key, buffer);
-        fstrcpy(value, p);
+        strlcpy(key, buffer, sizeof(fstring));
+        strlcpy(value, p, sizeof(fstring));
 
         /* Eat whitespace */

vendor/current/source3/winbindd/idmap_ldap.c

@@ -38 +38 @@
 
 #include "smbldap.h"
-
-static char *idmap_fetch_secret(const char *backend,
-                                const char *domain, const char *identity)
-{
-        char *tmp, *ret;
-        int r;
-
-        r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
-
-        if (r < 0)
-                return NULL;
-
-        strupper_m(tmp); /* make sure the key is case insensitive */
-        ret = secrets_fetch_generic(tmp, identity);
-
-        SAFE_FREE(tmp);
-
-        return ret;
-}
+#include "passdb/pdb_ldap_schema.h"
 
 struct idmap_ldap_context {
@@ -300 +282 @@
         }
 
-        talloc_autofree_ldapmsg(mem_ctx, result);
+        smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 
         count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
@@ -444 +426 @@
         }
 
-        ctx = TALLOC_ZERO_P(dom, struct idmap_ldap_context);
+        ctx = talloc_zero(dom, struct idmap_ldap_context);
         if ( ! ctx) {
                 DEBUG(0, ("Out of memory!\n"));
@@ -471 +453 @@
         tmp = lp_parm_const_string(-1, config_option, "ldap_base_dn", NULL);
         if ( ! tmp || ! *tmp) {
-                tmp = lp_ldap_idmap_suffix();
+                tmp = lp_ldap_idmap_suffix(talloc_tos());
                 if ( ! tmp) {
                         DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
@@ -488 +470 @@
         ctx->rw_ops->set_mapping = idmap_ldap_set_mapping;
 
+        /* get_credentials deals with setting up creds */
+
         ret = smbldap_init(ctx, winbind_event_context(), ctx->url,
-                           &ctx->smbldap_state);
+                           false, NULL, NULL, &ctx->smbldap_state);
         if (!NT_STATUS_IS_OK(ret)) {
                 DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n", ctx->url));
@@ -656 +640 @@
 }
 
-
-/* max number of ids requested per batch query */
-#define IDMAP_LDAP_MAX_IDS 30
-
 /**********************************
  lookup a set of unix ids.
 **********************************/
-
-/* this function searches up to IDMAP_LDAP_MAX_IDS entries
- * in maps for a match */
-static struct id_map *find_map_by_id(struct id_map **maps,
-                                     enum id_type type,
-                                     uint32_t id)
-{
-        int i;
-
-        for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
-                if (maps[i] == NULL) { /* end of the run */
-                        return NULL;
-                }
-                if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
-                        return maps[i];
-                }
-        }
-
-        return NULL;
-}
 
 static NTSTATUS idmap_ldap_unixids_to_sids(struct idmap_domain *dom,
@@ -839 +799 @@
                 TALLOC_FREE(tmp);
 
-                map = find_map_by_id(&ids[bidx], type, id);
+                map = idmap_find_map_by_id(&ids[bidx], type, id);
                 if (!map) {
                         DEBUG(2, ("WARNING: couldn't match sid (%s) "
@@ -895 +855 @@
  lookup a set of sids.
 **********************************/
-
-/* this function searches up to IDMAP_LDAP_MAX_IDS entries
- * in maps for a match */
-static struct id_map *find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
-{
-        int i;
-
-        for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
-                if (maps[i] == NULL) { /* end of the run */
-                        return NULL;
-                }
-                if (dom_sid_equal(maps[i]->sid, sid)) {
-                        return maps[i];
-                }
-        }
-
-        return NULL;
-}
 
 static NTSTATUS idmap_ldap_sids_to_unixids(struct idmap_domain *dom,
@@ -1046 +988 @@
                 }
 
-                map = find_map_by_sid(&ids[bidx], &sid);
+                map = idmap_find_map_by_sid(&ids[bidx], &sid);
                 if (!map) {
                         DEBUG(2, ("WARNING: couldn't find entry sid (%s) "

vendor/current/source3/winbindd/idmap_nss.c

@@ -31 +31 @@
 
 /*****************************
- Initialise idmap database. 
+ Initialise idmap database.
 *****************************/
 
 static NTSTATUS idmap_nss_int_init(struct idmap_domain *dom)
-{       
+{
         return NT_STATUS_OK;
 }
 
 /**********************************
- lookup a set of unix ids. 
+ lookup a set of unix ids.
 **********************************/
 
@@ -121 +121 @@
 
 /**********************************
- lookup a set of sids. 
+ lookup a set of sids.
 **********************************/
 
@@ -136 +136 @@
                 struct group *gr;
                 enum lsa_SidType type;
+                const char *p = NULL;
                 char *name = NULL;
                 bool ret;
@@ -143 +144 @@
                 (void)winbind_on();
                 ret = winbind_lookup_sid(talloc_tos(), ids[i]->sid, NULL,
-                                         (const char **)&name, &type);
+                                         &p, &type);
                 (void)winbind_off();
+                name = discard_const_p(char, p);
 
                 if (!ret) {

vendor/current/source3/winbindd/idmap_passdb.c

@@ -45 +45 @@
 
         for (i = 0; ids[i]; i++) {
-
                 /* unmapped by default */
                 ids[i]->status = ID_UNMAPPED;
 
-                switch (ids[i]->xid.type) {
-                case ID_TYPE_UID:
-                        if (pdb_uid_to_sid((uid_t)ids[i]->xid.id, ids[i]->sid)) {
-                                ids[i]->status = ID_MAPPED;
-                        }
-                        break;
-                case ID_TYPE_GID:
-                        if (pdb_gid_to_sid((gid_t)ids[i]->xid.id, ids[i]->sid)) {
-                                ids[i]->status = ID_MAPPED;
-                        }
-                        break;
-                default: /* ?? */
-                        ids[i]->status = ID_UNKNOWN;
+                if (pdb_id_to_sid(&ids[i]->xid, ids[i]->sid)) {
+                        ids[i]->status = ID_MAPPED;
                 }
         }
@@ -77 +65 @@
 
         for (i = 0; ids[i]; i++) {
-                enum lsa_SidType type;
-                union unid_t id;
-
-                if (pdb_sid_to_id(ids[i]->sid, &id, &type)) {
-                        switch (type) {
-                        case SID_NAME_USER:
-                                ids[i]->xid.id = id.uid;
-                                ids[i]->xid.type = ID_TYPE_UID;
-                                ids[i]->status = ID_MAPPED;
-                                break;
-
-                        case SID_NAME_DOM_GRP:
-                        case SID_NAME_ALIAS:
-                        case SID_NAME_WKN_GRP:
-                                ids[i]->xid.id = id.gid;
-                                ids[i]->xid.type = ID_TYPE_GID;
-                                ids[i]->status = ID_MAPPED;
-                                break;
-
-                        default: /* ?? */
-                                /* make sure it is marked as unmapped */
-                                ids[i]->status = ID_UNKNOWN;
-                                break;
-                        }
+                if (pdb_sid_to_id(ids[i]->sid, &ids[i]->xid)) {
+                        ids[i]->status = ID_MAPPED;
                 } else {
                         /* Query Failed */

vendor/current/source3/winbindd/idmap_proto.h

@@ -35 +35 @@
 NTSTATUS idmap_allocate_uid(struct unixid *id);
 NTSTATUS idmap_allocate_gid(struct unixid *id);
-NTSTATUS idmap_backends_unixid_to_sid(const char *domname,
-                                      struct id_map *id);
-NTSTATUS idmap_backends_sid_to_unixid(const char *domname,
-                                      struct id_map *id);
+NTSTATUS idmap_backends_unixid_to_sid(struct id_map *id);
 
 /* The following definitions come from winbindd/idmap_nss.c  */
@@ -54 +51 @@
 /* The following definitions come from winbindd/idmap_util.c  */
 
-NTSTATUS idmap_uid_to_sid(const char *domname, struct dom_sid *sid, uid_t uid);
-NTSTATUS idmap_gid_to_sid(const char *domname, struct dom_sid *sid, gid_t gid);
-NTSTATUS idmap_sid_to_uid(const char *dom_name, struct dom_sid *sid, uid_t *uid);
-NTSTATUS idmap_sid_to_gid(const char *domname, struct dom_sid *sid, gid_t *gid);
+NTSTATUS idmap_uid_to_sid(struct dom_sid *sid, uid_t uid);
+NTSTATUS idmap_gid_to_sid(struct dom_sid *sid, gid_t gid);
 bool idmap_unix_id_is_in_range(uint32_t id, struct idmap_domain *dom);
+struct id_map *idmap_find_map_by_id(struct id_map **maps, enum id_type type,
+                                    uint32_t id);
+struct id_map *idmap_find_map_by_sid(struct id_map **maps, struct dom_sid *sid);
+char *idmap_fetch_secret(const char *backend, const char *domain,
+                         const char *identity);
+
+/* max number of ids requested per LDAP batch query */
+#define IDMAP_LDAP_MAX_IDS 30
 
 #endif /* _WINBINDD_IDMAP_PROTO_H_ */

vendor/current/source3/winbindd/idmap_rid.c

@@ -42 +42 @@
         char *config_option = NULL;
 
-        ctx = TALLOC_ZERO_P(dom, struct idmap_rid_context);
+        ctx = talloc_zero(dom, struct idmap_rid_context);
         if (ctx == NULL) {
                 DEBUG(0, ("Out of memory!\n"));
@@ -88 +88 @@
         sid_compose(map->sid, &domain->sid, map->xid.id - dom->low_id + ctx->base_rid);
 
-        /* We **really** should have some way of validating 
-           the SID exists and is the correct type here.  But 
-           that is a deficiency in the idmap_rid design. */
-
         map->status = ID_MAPPED;
+        map->xid.type = ID_TYPE_BOTH;
 
         return NT_STATUS_OK;
@@ -98 +95 @@
 
 /**********************************
- Single sid to id lookup function. 
+ Single sid to id lookup function.
 **********************************/
 
@@ -110 +107 @@
         sid_peek_rid(map->sid, &rid);
         map->xid.id = rid - ctx->base_rid + dom->low_id;
+        map->xid.type = ID_TYPE_BOTH;
 
         /* apply filters before returning result */
@@ -126 +124 @@
 
 /**********************************
- lookup a set of unix ids. 
+ lookup a set of unix ids.
 **********************************/
 
@@ -154 +152 @@
 
 /**********************************
- lookup a set of sids. 
+ lookup a set of sids.
 **********************************/
 
@@ -188 +186 @@
 };
 
+static_decl_idmap;
 NTSTATUS idmap_rid_init(void)
 {

vendor/current/source3/winbindd/idmap_tdb.c

@@ -29 +29 @@
 #include "idmap.h"
 #include "idmap_rw.h"
-#include "dbwrap.h"
+#include "idmap_tdb_common.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
 #include "../libcli/security/security.h"
 #include "util_tdb.h"
@@ -40 +42 @@
 
 #define IDMAP_VERSION 2
-
-struct idmap_tdb_context {
-        struct db_context *db;
-        struct idmap_rw_ops *rw_ops;
-};
 
 /* High water mark keys */
@@ -66 +63 @@
         NTSTATUS status;
         struct dom_sid sid;
-        uint32 rid;
+        uint32_t rid;
         fstring keystr;
         fstring dom_name;
+        TDB_DATA key;
         TDB_DATA key2;
+        TDB_DATA value;
         struct convert_fn_state *s = (struct convert_fn_state *)private_data;
 
-        DEBUG(10,("Converting %s\n", (const char *)rec->key.dptr));
-
-        p = strchr((const char *)rec->key.dptr, '/');
+        key = dbwrap_record_get_key(rec);
+
+        DEBUG(10,("Converting %s\n", (const char *)key.dptr));
+
+        p = strchr((const char *)key.dptr, '/');
         if (!p)
                 return 0;
 
         *p = 0;
-        fstrcpy(dom_name, (const char *)rec->key.dptr);
+        fstrcpy(dom_name, (const char *)key.dptr);
         *p++ = '/';
 
@@ -86 +87 @@
                 /* We must delete the old record. */
                 DEBUG(0,("Unable to find domain %s\n", dom_name ));
-                DEBUG(0,("deleting record %s\n", (const char *)rec->key.dptr ));
-
-                status = rec->delete_rec(rec);
+                DEBUG(0,("deleting record %s\n", (const char *)key.dptr ));
+
+                status = dbwrap_record_delete(rec);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0, ("Unable to delete record %s:%s\n",
-                                (const char *)rec->key.dptr,
+                                (const char *)key.dptr,
                                 nt_errstr(status)));
                         s->failed = true;
@@ -107 +108 @@
         key2 = string_term_tdb_data(keystr);
 
-        status = dbwrap_store(s->db, key2, rec->value, TDB_INSERT);
+        value = dbwrap_record_get_value(rec);
+
+        status = dbwrap_store(s->db, key2, value, TDB_INSERT);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("Unable to add record %s:%s\n",
@@ -116 +119 @@
         }
 
-        status = dbwrap_store(s->db, rec->value, key2, TDB_REPLACE);
+        status = dbwrap_store(s->db, value, key2, TDB_REPLACE);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("Unable to update record %s:%s\n",
-                        (const char *)rec->value.dptr,
+                        (const char *)value.dptr,
                         nt_errstr(status)));
                 s->failed = true;
@@ -125 +128 @@
         }
 
-        status = rec->delete_rec(rec);
+        status = dbwrap_record_delete(rec);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("Unable to delete record %s:%s\n",
-                        (const char *)rec->key.dptr,
+                        (const char *)key.dptr,
                         nt_errstr(status)));
                 s->failed = true;
@@ -143 +146 @@
 static bool idmap_tdb_upgrade(struct idmap_domain *dom, struct db_context *db)
 {
-        int32 vers;
-        bool bigendianheader;
+        int32_t vers;
         struct convert_fn_state s;
-
-        DEBUG(0, ("Upgrading winbindd_idmap.tdb from an old version\n"));
-
-        bigendianheader = (db->get_flags(db) & TDB_BIGENDIAN) ? True : False;
-
-        vers = dbwrap_fetch_int32(db, "IDMAP_VERSION");
-
-        if (((vers == -1) && bigendianheader) || (IREV(vers) == IDMAP_VERSION)) {
-                /* Arrggghh ! Bytereversed or old big-endian - make order independent ! */
+        NTSTATUS status;
+
+        status = dbwrap_fetch_int32_bystring(db, "IDMAP_VERSION", &vers);
+        if (!NT_STATUS_IS_OK(status)) {
+                vers = -1;
+        }
+
+        if (IREV(vers) == IDMAP_VERSION) {
+                /* Arrggghh ! Bytereversed - make order independent ! */
                 /*
                  * high and low records were created on a
@@ -160 +162 @@
                  */
 
-                int32 wm;
-
-                wm = dbwrap_fetch_int32(db, HWM_USER);
+                int32_t wm;
+
+                status = dbwrap_fetch_int32_bystring(db, HWM_USER, &wm);
+                if (!NT_STATUS_IS_OK(status)) {
+                        wm = -1;
+                }
 
                 if (wm != -1) {
@@ -170 +175 @@
                 }
 
-                if (dbwrap_store_int32(db, HWM_USER, wm) == -1) {
-                        DEBUG(0, ("Unable to byteswap user hwm in idmap database\n"));
+                status = dbwrap_store_int32_bystring(db, HWM_USER, wm);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0, ("Unable to byteswap user hwm in idmap "
+                                  "database: %s\n", nt_errstr(status)));
                         return False;
                 }
 
-                wm = dbwrap_fetch_int32(db, HWM_GROUP);
+                status = dbwrap_fetch_int32_bystring(db, HWM_GROUP, &wm);
+                if (!NT_STATUS_IS_OK(status)) {
+                        wm = -1;
+                }
+
                 if (wm != -1) {
                         wm = IREV(wm);
@@ -182 +193 @@
                 }
 
-                if (dbwrap_store_int32(db, HWM_GROUP, wm) == -1) {
-                        DEBUG(0, ("Unable to byteswap group hwm in idmap database\n"));
+                status = dbwrap_store_int32_bystring(db, HWM_GROUP, wm);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0, ("Unable to byteswap group hwm in idmap "
+                                  "database: %s\n", nt_errstr(status)));
                         return False;
                 }
@@ -192 +205 @@
 
         /* the old format stored as DOMAIN/rid - now we store the SID direct */
-        db->traverse(db, convert_fn, &s);
+        status = dbwrap_traverse(db, convert_fn, &s, NULL);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Database traverse failed during conversion\n"));
+                return false;
+        }
 
         if (s.failed) {
@@ -199 +217 @@
         }
 
-        if (dbwrap_store_int32(db, "IDMAP_VERSION", IDMAP_VERSION) == -1) {
-                DEBUG(0, ("Unable to store idmap version in database\n"));
+        status = dbwrap_store_int32_bystring(db, "IDMAP_VERSION",
+                                             IDMAP_VERSION);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Unable to store idmap version in database: %s\n",
+                          nt_errstr(status)));
                 return False;
         }
@@ -209 +230 @@
 static NTSTATUS idmap_tdb_init_hwm(struct idmap_domain *dom)
 {
-        int ret;
         uint32_t low_uid;
         uint32_t low_gid;
         bool update_uid = false;
         bool update_gid = false;
-        struct idmap_tdb_context *ctx;
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
-
-        low_uid = dbwrap_fetch_int32(ctx->db, HWM_USER);
-        if (low_uid == -1 || low_uid < dom->low_id) {
+        struct idmap_tdb_common_context *ctx;
+        NTSTATUS status;
+
+        ctx = talloc_get_type(dom->private_data,
+                              struct idmap_tdb_common_context);
+
+        status = dbwrap_fetch_uint32_bystring(ctx->db, HWM_USER, &low_uid);
+        if (!NT_STATUS_IS_OK(status) || low_uid < dom->low_id) {
                 update_uid = true;
         }
 
-        low_gid = dbwrap_fetch_int32(ctx->db, HWM_GROUP);
-        if (low_gid == -1 || low_gid < dom->low_id) {
+        status = dbwrap_fetch_uint32_bystring(ctx->db, HWM_GROUP, &low_gid);
+        if (!NT_STATUS_IS_OK(status) || low_gid < dom->low_id) {
                 update_gid = true;
         }
@@ -232 +254 @@
         }
 
-        if (ctx->db->transaction_start(ctx->db) != 0) {
+        if (dbwrap_transaction_start(ctx->db) != 0) {
                 DEBUG(0, ("Unable to start upgrade transaction!\n"));
                 return NT_STATUS_INTERNAL_DB_ERROR;
@@ -238 +260 @@
 
         if (update_uid) {
-                ret = dbwrap_store_int32(ctx->db, HWM_USER, dom->low_id);
-                if (ret == -1) {
-                        ctx->db->transaction_cancel(ctx->db);
+                status = dbwrap_store_uint32_bystring(ctx->db, HWM_USER,
+                                                      dom->low_id);
+                if (!NT_STATUS_IS_OK(status)) {
+                        dbwrap_transaction_cancel(ctx->db);
                         DEBUG(0, ("Unable to initialise user hwm in idmap "
-                                  "database\n"));
+                                  "database: %s\n", nt_errstr(status)));
                         return NT_STATUS_INTERNAL_DB_ERROR;
                 }
@@ -248 +271 @@
 
         if (update_gid) {
-                ret = dbwrap_store_int32(ctx->db, HWM_GROUP, dom->low_id);
-                if (ret == -1) {
-                        ctx->db->transaction_cancel(ctx->db);
+                status = dbwrap_store_uint32_bystring(ctx->db, HWM_GROUP,
+                                                      dom->low_id);
+                if (!NT_STATUS_IS_OK(status)) {
+                        dbwrap_transaction_cancel(ctx->db);
                         DEBUG(0, ("Unable to initialise group hwm in idmap "
-                                  "database\n"));
+                                  "database: %s\n", nt_errstr(status)));
                         return NT_STATUS_INTERNAL_DB_ERROR;
                 }
         }
 
-        if (ctx->db->transaction_commit(ctx->db) != 0) {
+        if (dbwrap_transaction_commit(ctx->db) != 0) {
                 DEBUG(0, ("Unable to commit upgrade transaction!\n"));
                 return NT_STATUS_INTERNAL_DB_ERROR;
@@ -273 +297 @@
         int32_t version;
         bool config_error = false;
-        struct idmap_tdb_context *ctx;
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
+        struct idmap_tdb_common_context *ctx;
+
+        ctx = talloc_get_type(dom->private_data,
+                              struct idmap_tdb_common_context);
 
         if (ctx->db) {
@@ -296 +321 @@
 
         /* Open idmap repository */
-        db = db_open(mem_ctx, tdbfile, 0, TDB_DEFAULT, O_RDWR | O_CREAT, 0644);
+        db = db_open(mem_ctx, tdbfile, 0, TDB_DEFAULT, O_RDWR | O_CREAT, 0644,
+                     DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         if (!db) {
                 DEBUG(0, ("Unable to open idmap database\n"));
@@ -304 +330 @@
 
         /* check against earlier versions */
-        version = dbwrap_fetch_int32(db, "IDMAP_VERSION");
+        ret = dbwrap_fetch_int32_bystring(db, "IDMAP_VERSION", &version);
+        if (!NT_STATUS_IS_OK(ret)) {
+                version = -1;
+        }
+
         if (version != IDMAP_VERSION) {
                 if (config_error) {
@@ -313 +343 @@
                         goto done;
                 }
-                if (db->transaction_start(db) != 0) {
+                if (dbwrap_transaction_start(db) != 0) {
                         DEBUG(0, ("Unable to start upgrade transaction!\n"));
                         ret = NT_STATUS_INTERNAL_DB_ERROR;
@@ -320 +350 @@
 
                 if (!idmap_tdb_upgrade(dom, db)) {
-                        db->transaction_cancel(db);
+                        dbwrap_transaction_cancel(db);
                         DEBUG(0, ("Unable to open idmap database, it's in an old format, and upgrade failed!\n"));
                         ret = NT_STATUS_INTERNAL_DB_ERROR;
@@ -326 +356 @@
                 }
 
-                if (db->transaction_commit(db) != 0) {
+                if (dbwrap_transaction_commit(db) != 0) {
                         DEBUG(0, ("Unable to commit upgrade transaction!\n"));
                         ret = NT_STATUS_INTERNAL_DB_ERROR;
@@ -343 +373 @@
 
 /**********************************************************************
- IDMAP ALLOC TDB BACKEND
-**********************************************************************/
-
-/**********************************
- Allocate a new id. 
-**********************************/
-
-struct idmap_tdb_allocate_id_context {
-        const char *hwmkey;
-        const char *hwmtype;
-        uint32_t high_hwm;
-        uint32_t hwm;
-};
-
-static NTSTATUS idmap_tdb_allocate_id_action(struct db_context *db,
-                                             void *private_data)
-{
-        NTSTATUS ret;
-        struct idmap_tdb_allocate_id_context *state;
-        uint32_t hwm;
-
-        state = (struct idmap_tdb_allocate_id_context *)private_data;
-
-        hwm = dbwrap_fetch_int32(db, state->hwmkey);
-        if (hwm == -1) {
-                ret = NT_STATUS_INTERNAL_DB_ERROR;
-                goto done;
-        }
-
-        /* check it is in the range */
-        if (hwm > state->high_hwm) {
-                DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
-                          state->hwmtype, (unsigned long)state->high_hwm));
-                ret = NT_STATUS_UNSUCCESSFUL;
-                goto done;
-        }
-
-        /* fetch a new id and increment it */
-        ret = dbwrap_trans_change_uint32_atomic(db, state->hwmkey, &hwm, 1);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(0, ("Fatal error while fetching a new %s value: %s\n!",
-                          state->hwmtype, nt_errstr(ret)));
-                goto done;
-        }
-
-        /* recheck it is in the range */
-        if (hwm > state->high_hwm) {
-                DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
-                          state->hwmtype, (unsigned long)state->high_hwm));
-                ret = NT_STATUS_UNSUCCESSFUL;
-                goto done;
-        }
-
-        ret = NT_STATUS_OK;
-        state->hwm = hwm;
-
-done:
-        return ret;
-}
-
-static NTSTATUS idmap_tdb_allocate_id(struct idmap_domain *dom,
-                                      struct unixid *xid)
-{
-        const char *hwmkey;
-        const char *hwmtype;
-        uint32_t high_hwm;
-        uint32_t hwm = 0;
-        NTSTATUS status;
-        struct idmap_tdb_allocate_id_context state;
-        struct idmap_tdb_context *ctx;
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
-
-        /* Get current high water mark */
-        switch (xid->type) {
-
-        case ID_TYPE_UID:
-                hwmkey = HWM_USER;
-                hwmtype = "UID";
-                break;
-
-        case ID_TYPE_GID:
-                hwmkey = HWM_GROUP;
-                hwmtype = "GID";
-                break;
-
-        default:
-                DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        high_hwm = dom->high_id;
-
-        state.hwm = hwm;
-        state.high_hwm = high_hwm;
-        state.hwmtype = hwmtype;
-        state.hwmkey = hwmkey;
-
-        status = dbwrap_trans_do(ctx->db, idmap_tdb_allocate_id_action,
-                                 &state);
-
-        if (NT_STATUS_IS_OK(status)) {
-                xid->id = state.hwm;
-                DEBUG(10,("New %s = %d\n", hwmtype, state.hwm));
-        } else {
-                DEBUG(1, ("Error allocating a new %s\n", hwmtype));
-        }
-
-        return status;
-}
-
-/**
- * Allocate a new unix-ID.
- * For now this is for the default idmap domain only.
- * Should be extended later on.
- */
-static NTSTATUS idmap_tdb_get_new_id(struct idmap_domain *dom,
-                                     struct unixid *id)
-{
-        NTSTATUS ret;
-
-        if (!strequal(dom->name, "*")) {
-                DEBUG(3, ("idmap_tdb_get_new_id: "
-                          "Refusing allocation of a new unixid for domain'%s'. "
-                          "Currently only supported for the default "
-                          "domain \"*\".\n",
-                           dom->name));
-                return NT_STATUS_NOT_IMPLEMENTED;
-        }
-
-        ret = idmap_tdb_allocate_id(dom, id);
-
-        return ret;
-}
-
-/**********************************************************************
  IDMAP MAPPING TDB BACKEND
 **********************************************************************/
@@ -486 +380 @@
 *****************************/
 
-static NTSTATUS idmap_tdb_set_mapping(struct idmap_domain *dom,
-                                      const struct id_map *map);
-
 static NTSTATUS idmap_tdb_db_init(struct idmap_domain *dom)
 {
         NTSTATUS ret;
-        struct idmap_tdb_context *ctx;
+        struct idmap_tdb_common_context *ctx;
 
         DEBUG(10, ("idmap_tdb_db_init called for domain '%s'\n", dom->name));
 
-        ctx = talloc_zero(dom, struct idmap_tdb_context);
+        ctx = talloc_zero(dom, struct idmap_tdb_common_context);
         if ( ! ctx) {
                 DEBUG(0, ("Out of memory!\n"));
@@ -516 +407 @@
         }
 
-        ctx->rw_ops->get_new_id = idmap_tdb_get_new_id;
-        ctx->rw_ops->set_mapping = idmap_tdb_set_mapping;
+        ctx->max_id = dom->high_id;
+        ctx->hwmkey_uid = HWM_USER;
+        ctx->hwmkey_gid = HWM_GROUP;
+
+        ctx->rw_ops->get_new_id = idmap_tdb_common_get_new_id;
+        ctx->rw_ops->set_mapping = idmap_tdb_common_set_mapping;
 
         dom->private_data = ctx;
@@ -533 +428 @@
 }
 
-
-/**
- * store a mapping in the database
- */
-
-struct idmap_tdb_set_mapping_context {
-        const char *ksidstr;
-        const char *kidstr;
-};
-
-static NTSTATUS idmap_tdb_set_mapping_action(struct db_context *db,
-                                             void *private_data)
-{
-        NTSTATUS ret;
-        struct idmap_tdb_set_mapping_context *state;
-
-        state = (struct idmap_tdb_set_mapping_context *)private_data;
-
-        DEBUG(10, ("Storing %s <-> %s map\n", state->ksidstr, state->kidstr));
-
-        ret = dbwrap_store_bystring(db, state->ksidstr,
-                                    string_term_tdb_data(state->kidstr),
-                                    TDB_REPLACE);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(0, ("Error storing SID -> ID (%s -> %s): %s\n",
-                          state->ksidstr, state->kidstr, nt_errstr(ret)));
-                goto done;
-        }
-
-        ret = dbwrap_store_bystring(db, state->kidstr,
-                                    string_term_tdb_data(state->ksidstr),
-                                    TDB_REPLACE);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(0, ("Error storing ID -> SID (%s -> %s): %s\n",
-                          state->kidstr, state->ksidstr, nt_errstr(ret)));
-                goto done;
-        }
-
-        DEBUG(10,("Stored %s <-> %s\n", state->ksidstr, state->kidstr));
-        ret = NT_STATUS_OK;
-
-done:
-        return ret;
-}
-
-static NTSTATUS idmap_tdb_set_mapping(struct idmap_domain *dom,
-                                      const struct id_map *map)
-{
-        struct idmap_tdb_context *ctx;
-        NTSTATUS ret;
-        char *ksidstr, *kidstr;
-        struct idmap_tdb_set_mapping_context state;
-
-        if (!map || !map->sid) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        ksidstr = kidstr = NULL;
-
-        /* TODO: should we filter a set_mapping using low/high filters ? */
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
-
-        switch (map->xid.type) {
-
-        case ID_TYPE_UID:
-                kidstr = talloc_asprintf(ctx, "UID %lu",
-                                         (unsigned long)map->xid.id);
-                break;
-
-        case ID_TYPE_GID:
-                kidstr = talloc_asprintf(ctx, "GID %lu",
-                                         (unsigned long)map->xid.id);
-                break;
-
-        default:
-                DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (kidstr == NULL) {
-                DEBUG(0, ("ERROR: Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        ksidstr = sid_string_talloc(ctx, map->sid);
-        if (ksidstr == NULL) {
-                DEBUG(0, ("Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        state.ksidstr = ksidstr;
-        state.kidstr = kidstr;
-
-        ret = dbwrap_trans_do(ctx->db, idmap_tdb_set_mapping_action, &state);
-
-done:
-        talloc_free(ksidstr);
-        talloc_free(kidstr);
-        return ret;
-}
-
-/**
- * Create a new mapping for an unmapped SID, also allocating a new ID.
- * This should be run inside a transaction.
- *
- * TODO:
- * Properly integrate this with multi domain idmap config:
- * Currently, the allocator is default-config only.
- */
-static NTSTATUS idmap_tdb_new_mapping(struct idmap_domain *dom, struct id_map *map)
-{
-        NTSTATUS ret;
-        struct idmap_tdb_context *ctx;
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
-
-        ret = idmap_rw_new_mapping(dom, ctx->rw_ops, map);
-
-        return ret;
-}
-
-
-/**********************************
- Single id to sid lookup function. 
-**********************************/
-
-static NTSTATUS idmap_tdb_id_to_sid(struct idmap_domain *dom, struct id_map *map)
-{
-        NTSTATUS ret;
-        TDB_DATA data;
-        char *keystr;
-        struct idmap_tdb_context *ctx;
-
-        if (!dom || !map) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
-
-        /* apply filters before checking */
-        if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
-                DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
-                                map->xid.id, dom->low_id, dom->high_id));
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        switch (map->xid.type) {
-
-        case ID_TYPE_UID:
-                keystr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
-                break;
-
-        case ID_TYPE_GID:
-                keystr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
-                break;
-
-        default:
-                DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* final SAFE_FREE safe */
-        data.dptr = NULL;
-
-        if (keystr == NULL) {
-                DEBUG(0, ("Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        DEBUG(10,("Fetching record %s\n", keystr));
-
-        /* Check if the mapping exists */
-        data = dbwrap_fetch_bystring(ctx->db, NULL, keystr);
-
-        if (!data.dptr) {
-                DEBUG(10,("Record %s not found\n", keystr));
-                ret = NT_STATUS_NONE_MAPPED;
-                goto done;
-        }
-
-        if (!string_to_sid(map->sid, (const char *)data.dptr)) {
-                DEBUG(10,("INVALID SID (%s) in record %s\n",
-                        (const char *)data.dptr, keystr));
-                ret = NT_STATUS_INTERNAL_DB_ERROR;
-                goto done;
-        }
-
-        DEBUG(10,("Found record %s -> %s\n", keystr, (const char *)data.dptr));
-        ret = NT_STATUS_OK;
-
-done:
-        talloc_free(data.dptr);
-        talloc_free(keystr);
-        return ret;
-}
-
-/**********************************
- Single sid to id lookup function. 
-**********************************/
-
-static NTSTATUS idmap_tdb_sid_to_id(struct idmap_domain *dom, struct id_map *map)
-{
-        NTSTATUS ret;
-        TDB_DATA data;
-        char *keystr;
-        unsigned long rec_id = 0;
-        struct idmap_tdb_context *ctx;
-        TALLOC_CTX *tmp_ctx = talloc_stackframe();
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
-
-        keystr = sid_string_talloc(tmp_ctx, map->sid);
-        if (keystr == NULL) {
-                DEBUG(0, ("Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        DEBUG(10,("Fetching record %s\n", keystr));
-
-        /* Check if sid is present in database */
-        data = dbwrap_fetch_bystring(ctx->db, tmp_ctx, keystr);
-        if (!data.dptr) {
-                DEBUG(10,("Record %s not found\n", keystr));
-                ret = NT_STATUS_NONE_MAPPED;
-                goto done;
-        }
-
-        /* What type of record is this ? */
-        if (sscanf((const char *)data.dptr, "UID %lu", &rec_id) == 1) { /* Try a UID record. */
-                map->xid.id = rec_id;
-                map->xid.type = ID_TYPE_UID;
-                DEBUG(10,("Found uid record %s -> %s \n", keystr, (const char *)data.dptr ));
-                ret = NT_STATUS_OK;
-
-        } else if (sscanf((const char *)data.dptr, "GID %lu", &rec_id) == 1) { /* Try a GID record. */
-                map->xid.id = rec_id;
-                map->xid.type = ID_TYPE_GID;
-                DEBUG(10,("Found gid record %s -> %s \n", keystr, (const char *)data.dptr ));
-                ret = NT_STATUS_OK;
-
-        } else { /* Unknown record type ! */
-                DEBUG(2, ("Found INVALID record %s -> %s\n", keystr, (const char *)data.dptr));
-                ret = NT_STATUS_INTERNAL_DB_ERROR;
-                goto done;
-        }
-
-        /* apply filters before returning result */
-        if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
-                DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
-                                map->xid.id, dom->low_id, dom->high_id));
-                ret = NT_STATUS_NONE_MAPPED;
-        }
-
-done:
-        talloc_free(tmp_ctx);
-        return ret;
-}
-
-/**********************************
- lookup a set of unix ids. 
-**********************************/
-
-static NTSTATUS idmap_tdb_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
-{
-        NTSTATUS ret;
-        int i;
-
-        /* initialize the status to avoid suprise */
-        for (i = 0; ids[i]; i++) {
-                ids[i]->status = ID_UNKNOWN;
-        }
-
-        for (i = 0; ids[i]; i++) {
-                ret = idmap_tdb_id_to_sid(dom, ids[i]);
-                if ( ! NT_STATUS_IS_OK(ret)) {
-
-                        /* if it is just a failed mapping continue */
-                        if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
-
-                                /* make sure it is marked as unmapped */
-                                ids[i]->status = ID_UNMAPPED;
-                                continue;
-                        }
-
-                        /* some fatal error occurred, return immediately */
-                        goto done;
-                }
-
-                /* all ok, id is mapped */
-                ids[i]->status = ID_MAPPED;
-        }
-
-        ret = NT_STATUS_OK;
-
-done:
-        return ret;
-}
-
-/**********************************
- lookup a set of sids. 
-**********************************/
-
-struct idmap_tdb_sids_to_unixids_context {
-        struct idmap_domain *dom;
-        struct id_map **ids;
-        bool allocate_unmapped;
-};
-
-static NTSTATUS idmap_tdb_sids_to_unixids_action(struct db_context *db,
-                                                 void *private_data)
-{
-        struct idmap_tdb_sids_to_unixids_context *state;
-        int i;
-        NTSTATUS ret = NT_STATUS_OK;
-
-        state = (struct idmap_tdb_sids_to_unixids_context *)private_data;
-
-        DEBUG(10, ("idmap_tdb_sids_to_unixids_action: "
-                   " domain: [%s], allocate: %s\n",
-                   state->dom->name,
-                   state->allocate_unmapped ? "yes" : "no"));
-
-        for (i = 0; state->ids[i]; i++) {
-                if ((state->ids[i]->status == ID_UNKNOWN) ||
-                    /* retry if we could not map in previous run: */
-                    (state->ids[i]->status == ID_UNMAPPED))
-                {
-                        NTSTATUS ret2;
-
-                        ret2 = idmap_tdb_sid_to_id(state->dom, state->ids[i]);
-                        if (!NT_STATUS_IS_OK(ret2)) {
-
-                                /* if it is just a failed mapping, continue */
-                                if (NT_STATUS_EQUAL(ret2, NT_STATUS_NONE_MAPPED)) {
-
-                                        /* make sure it is marked as unmapped */
-                                        state->ids[i]->status = ID_UNMAPPED;
-                                        ret = STATUS_SOME_UNMAPPED;
-                                } else {
-                                        /* some fatal error occurred, return immediately */
-                                        ret = ret2;
-                                        goto done;
-                                }
-                        } else {
-                                /* all ok, id is mapped */
-                                state->ids[i]->status = ID_MAPPED;
-                        }
-                }
-
-                if ((state->ids[i]->status == ID_UNMAPPED) &&
-                    state->allocate_unmapped)
-                {
-                        ret = idmap_tdb_new_mapping(state->dom, state->ids[i]);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                goto done;
-                        }
-                }
-        }
-
-done:
-        return ret;
-}
-
-static NTSTATUS idmap_tdb_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
-{
-        struct idmap_tdb_context *ctx;
-        NTSTATUS ret;
-        int i;
-        struct idmap_tdb_sids_to_unixids_context state;
-
-        /* initialize the status to avoid suprise */
-        for (i = 0; ids[i]; i++) {
-                ids[i]->status = ID_UNKNOWN;
-        }
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
-
-        state.dom = dom;
-        state.ids = ids;
-        state.allocate_unmapped = false;
-
-        ret = idmap_tdb_sids_to_unixids_action(ctx->db, &state);
-
-        if (NT_STATUS_EQUAL(ret, STATUS_SOME_UNMAPPED) && !dom->read_only) {
-                state.allocate_unmapped = true;
-                ret = dbwrap_trans_do(ctx->db,
-                                      idmap_tdb_sids_to_unixids_action,
-                                      &state);
-        }
-
-        return ret;
-}
-
-
-/**********************************
- Close the idmap tdb instance
-**********************************/
-
 static struct idmap_methods db_methods = {
         .init = idmap_tdb_db_init,
-        .unixids_to_sids = idmap_tdb_unixids_to_sids,
-        .sids_to_unixids = idmap_tdb_sids_to_unixids,
-        .allocate_id = idmap_tdb_get_new_id,
+        .unixids_to_sids = idmap_tdb_common_unixids_to_sids,
+        .sids_to_unixids = idmap_tdb_common_sids_to_unixids,
+        .allocate_id = idmap_tdb_common_get_new_id,
 };
 

vendor/current/source3/winbindd/idmap_tdb2.c

@@ -37 +37 @@
 #include "idmap.h"
 #include "idmap_rw.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
 #include "../libcli/security/dom_sid.h"
 #include "util_tdb.h"
+#include "idmap_tdb_common.h"
 
 #undef DBGC_CLASS
@@ -45 +47 @@
 
 struct idmap_tdb2_context {
-        struct db_context *db;
         const char *script; /* script to provide idmaps */
-        struct idmap_rw_ops *rw_ops;
 };
 
@@ -53 +53 @@
 #define HWM_GROUP  "GROUP HWM"
 #define HWM_USER   "USER HWM"
-
 
 /*
@@ -61 +60 @@
 {
         NTSTATUS status;
-        uint32 low_id;
-        struct idmap_tdb2_context *ctx;
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
+        uint32_t low_id;
+        struct idmap_tdb_common_context *ctx;
+
+        ctx = talloc_get_type(dom->private_data,
+                              struct idmap_tdb_common_context);
 
         /* Create high water marks for group and user id */
 
-        low_id = dbwrap_fetch_int32(ctx->db, HWM_USER);
-        if ((low_id == -1) || (low_id < dom->low_id)) {
-                status = dbwrap_trans_store_int32(ctx->db, HWM_USER,
-                                                  dom->low_id);
+        status = dbwrap_fetch_uint32_bystring(ctx->db, HWM_USER, &low_id);
+        if (!NT_STATUS_IS_OK(status) || (low_id < dom->low_id)) {
+                status = dbwrap_trans_store_uint32_bystring(ctx->db, HWM_USER,
+                                                            dom->low_id);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0, ("Unable to initialise user hwm in idmap "
@@ -79 +79 @@
         }
 
-        low_id = dbwrap_fetch_int32(ctx->db, HWM_GROUP);
-        if ((low_id == -1) || (low_id < dom->low_id)) {
-                status = dbwrap_trans_store_int32(ctx->db, HWM_GROUP,
-                                                  dom->low_id);
+        status = dbwrap_fetch_uint32_bystring(ctx->db, HWM_GROUP, &low_id);
+        if (!NT_STATUS_IS_OK(status) || (low_id < dom->low_id)) {
+                status = dbwrap_trans_store_uint32_bystring(ctx->db, HWM_GROUP,
+                                                            dom->low_id);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0, ("Unable to initialise group hwm in idmap "
@@ -100 +100 @@
 {
         char *db_path;
-        struct idmap_tdb2_context *ctx;
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
+        struct idmap_tdb_common_context *ctx;
+
+        ctx = talloc_get_type(dom->private_data,
+                              struct idmap_tdb_common_context);
 
         if (ctx->db) {
@@ -113 +114 @@
 
         /* Open idmap repository */
-        ctx->db = db_open(ctx, db_path, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644);
+        ctx->db = db_open(ctx, db_path, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644,
+                          DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         TALLOC_FREE(db_path);
 
@@ -125 +127 @@
 }
 
-
-/*
-  Allocate a new id. 
-*/
-
-struct idmap_tdb2_allocate_id_context {
-        const char *hwmkey;
-        const char *hwmtype;
-        uint32_t high_hwm;
-        uint32_t hwm;
-};
-
-static NTSTATUS idmap_tdb2_allocate_id_action(struct db_context *db,
-                                              void *private_data)
-{
-        NTSTATUS ret;
-        struct idmap_tdb2_allocate_id_context *state;
-        uint32_t hwm;
-
-        state = (struct idmap_tdb2_allocate_id_context *)private_data;
-
-        hwm = dbwrap_fetch_int32(db, state->hwmkey);
-        if (hwm == -1) {
-                ret = NT_STATUS_INTERNAL_DB_ERROR;
-                goto done;
-        }
-
-        /* check it is in the range */
-        if (hwm > state->high_hwm) {
-                DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
-                          state->hwmtype, (unsigned long)state->high_hwm));
-                ret = NT_STATUS_UNSUCCESSFUL;
-                goto done;
-        }
-
-        /* fetch a new id and increment it */
-        ret = dbwrap_trans_change_uint32_atomic(db, state->hwmkey, &hwm, 1);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(1, ("Fatal error while fetching a new %s value\n!",
-                          state->hwmtype));
-                goto done;
-        }
-
-        /* recheck it is in the range */
-        if (hwm > state->high_hwm) {
-                DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
-                          state->hwmtype, (unsigned long)state->high_hwm));
-                ret = NT_STATUS_UNSUCCESSFUL;
-                goto done;
-        }
-
-        ret = NT_STATUS_OK;
-        state->hwm = hwm;
-
-done:
-        return ret;
-}
-
-static NTSTATUS idmap_tdb2_allocate_id(struct idmap_domain *dom,
-                                       struct unixid *xid)
-{
-        const char *hwmkey;
-        const char *hwmtype;
-        uint32_t high_hwm;
-        uint32_t hwm = 0;
-        NTSTATUS status;
-        struct idmap_tdb2_allocate_id_context state;
-        struct idmap_tdb2_context *ctx;
-
-        status = idmap_tdb2_open_db(dom);
-        NT_STATUS_NOT_OK_RETURN(status);
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
-
-        /* Get current high water mark */
-        switch (xid->type) {
-
-        case ID_TYPE_UID:
-                hwmkey = HWM_USER;
-                hwmtype = "UID";
-                break;
-
-        case ID_TYPE_GID:
-                hwmkey = HWM_GROUP;
-                hwmtype = "GID";
-                break;
-
-        default:
-                DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        high_hwm = dom->high_id;
-
-        state.hwm = hwm;
-        state.high_hwm = high_hwm;
-        state.hwmtype = hwmtype;
-        state.hwmkey = hwmkey;
-
-        status = dbwrap_trans_do(ctx->db, idmap_tdb2_allocate_id_action,
-                                 &state);
-
-        if (NT_STATUS_IS_OK(status)) {
-                xid->id = state.hwm;
-                DEBUG(10,("New %s = %d\n", hwmtype, state.hwm));
-        } else {
-                DEBUG(1, ("Error allocating a new %s\n", hwmtype));
-        }
-
-        return status;
-}
-
-/**
- * Allocate a new unix-ID.
- * For now this is for the default idmap domain only.
- * Should be extended later on.
- */
-static NTSTATUS idmap_tdb2_get_new_id(struct idmap_domain *dom,
-                                      struct unixid *id)
-{
-        NTSTATUS ret;
-
-        if (!strequal(dom->name, "*")) {
-                DEBUG(3, ("idmap_tdb2_get_new_id: "
-                          "Refusing creation of mapping for domain'%s'. "
-                          "Currently only supported for the default "
-                          "domain \"*\".\n",
-                           dom->name));
-                return NT_STATUS_NOT_IMPLEMENTED;
-        }
-
-        ret = idmap_tdb2_allocate_id(dom, id);
-
-        return ret;
-}
-
-/*
-  IDMAP MAPPING TDB BACKEND
-*/
-
-static NTSTATUS idmap_tdb2_set_mapping(struct idmap_domain *dom,
-                                       const struct id_map *map);
-
-/*
-  Initialise idmap database. 
-*/
-static NTSTATUS idmap_tdb2_db_init(struct idmap_domain *dom)
-{
-        NTSTATUS ret;
-        struct idmap_tdb2_context *ctx;
-        char *config_option = NULL;
-        const char * idmap_script = NULL;
-
-        ctx = talloc_zero(dom, struct idmap_tdb2_context);
-        if ( ! ctx) {
-                DEBUG(0, ("Out of memory!\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
-        if (config_option == NULL) {
-                DEBUG(0, ("Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto failed;
-        }
-        ctx->script = lp_parm_const_string(-1, config_option, "script", NULL);
-        talloc_free(config_option);
-
-        idmap_script = lp_parm_const_string(-1, "idmap", "script", NULL);
-        if (idmap_script != NULL) {
-                DEBUG(0, ("Warning: 'idmap:script' is deprecated. "
-                          " Please use 'idmap config * : script' instead!\n"));
-        }
-
-        if (strequal(dom->name, "*") && ctx->script == NULL) {
-                /* fall back to idmap:script for backwards compatibility */
-                ctx->script = idmap_script;
-        }
-
-        if (ctx->script) {
-                DEBUG(1, ("using idmap script '%s'\n", ctx->script));
-        }
-
-        ctx->rw_ops = talloc_zero(ctx, struct idmap_rw_ops);
-        if (ctx->rw_ops == NULL) {
-                DEBUG(0, ("Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto failed;
-        }
-
-        ctx->rw_ops->get_new_id = idmap_tdb2_get_new_id;
-        ctx->rw_ops->set_mapping = idmap_tdb2_set_mapping;
-
-        dom->private_data = ctx;
-
-        ret = idmap_tdb2_open_db(dom);
-        if (!NT_STATUS_IS_OK(ret)) {
-                goto failed;
-        }
-
-        return NT_STATUS_OK;
-
-failed:
-        talloc_free(ctx);
-        return ret;
-}
-
-
 /**
  * store a mapping in the database.
@@ -355 +149 @@
 
         /* check wheter sid mapping is already present in db */
-        data = dbwrap_fetch_bystring(db, tmp_ctx, state->ksidstr);
-        if (data.dptr) {
+        ret = dbwrap_fetch_bystring(db, tmp_ctx, state->ksidstr, &data);
+        if (NT_STATUS_IS_OK(ret)) {
                 ret = NT_STATUS_OBJECT_NAME_COLLISION;
                 goto done;
@@ -391 +185 @@
         NTSTATUS ret;
         char *ksidstr, *kidstr;
+        struct idmap_tdb_common_context *commonctx;
         struct idmap_tdb2_set_mapping_context state;
 
@@ -401 +196 @@
         /* TODO: should we filter a set_mapping using low/high filters ? */
 
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
+        commonctx = talloc_get_type(dom->private_data,
+                                    struct idmap_tdb_common_context);
+
+        ctx = talloc_get_type(commonctx->private_data,
+                              struct idmap_tdb2_context);
 
         switch (map->xid.type) {
@@ -434 +233 @@
         state.kidstr = kidstr;
 
-        ret = dbwrap_trans_do(ctx->db, idmap_tdb2_set_mapping_action,
+        ret = dbwrap_trans_do(commonctx->db, idmap_tdb2_set_mapping_action,
                               &state);
 
@@ -442 +241 @@
         return ret;
 }
-
-/**
- * Create a new mapping for an unmapped SID, also allocating a new ID.
- * This should be run inside a transaction.
- *
- * TODO:
-*  Properly integrate this with multi domain idmap config:
- * Currently, the allocator is default-config only.
- */
-static NTSTATUS idmap_tdb2_new_mapping(struct idmap_domain *dom, struct id_map *map)
-{
-        NTSTATUS ret;
-        struct idmap_tdb2_context *ctx;
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
-
-        ret = idmap_rw_new_mapping(dom, ctx->rw_ops, map);
-
-        return ret;
-}
-
 
 /*
@@ -542 +320 @@
         char *keystr;
         NTSTATUS status;
+        struct idmap_tdb_common_context *commonctx;
         struct idmap_tdb2_context *ctx;
 
@@ -552 +331 @@
         NT_STATUS_NOT_OK_RETURN(status);
 
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
+        commonctx = talloc_get_type(dom->private_data,
+                                    struct idmap_tdb_common_context);
+
+        ctx = talloc_get_type(commonctx->private_data,
+                              struct idmap_tdb2_context);
 
         /* apply filters before checking */
@@ -585 +368 @@
 
         /* Check if the mapping exists */
-        data = dbwrap_fetch_bystring(ctx->db, keystr, keystr);
-
-        if (!data.dptr) {
+        status = dbwrap_fetch_bystring(commonctx->db, keystr, keystr, &data);
+
+        if (!NT_STATUS_IS_OK(status)) {
                 char *sidstr;
                 struct idmap_tdb2_set_mapping_context store_state;
@@ -611 +394 @@
                 store_state.kidstr = keystr;
 
-                ret = dbwrap_trans_do(ctx->db, idmap_tdb2_set_mapping_action,
+                ret = dbwrap_trans_do(commonctx->db,
+                                      idmap_tdb2_set_mapping_action,
                                       &store_state);
                 goto done;
@@ -641 +425 @@
         char *keystr;
         unsigned long rec_id = 0;
+        struct idmap_tdb_common_context *commonctx;
         struct idmap_tdb2_context *ctx;
         TALLOC_CTX *tmp_ctx = talloc_stackframe();
@@ -647 +432 @@
         NT_STATUS_NOT_OK_RETURN(ret);
 
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
+        commonctx = talloc_get_type(dom->private_data,
+                                    struct idmap_tdb_common_context);
+
+        ctx = talloc_get_type(commonctx->private_data,
+                              struct idmap_tdb2_context);
 
         keystr = sid_string_talloc(tmp_ctx, map->sid);
@@ -659 +448 @@
 
         /* Check if sid is present in database */
-        data = dbwrap_fetch_bystring(ctx->db, tmp_ctx, keystr);
-        if (!data.dptr) {
+        ret = dbwrap_fetch_bystring(commonctx->db, tmp_ctx, keystr, &data);
+        if (!NT_STATUS_IS_OK(ret)) {
                 char *idstr;
                 struct idmap_tdb2_set_mapping_context store_state;
@@ -696 +485 @@
                 store_state.kidstr = idstr;
 
-                ret = dbwrap_trans_do(ctx->db, idmap_tdb2_set_mapping_action,
+                ret = dbwrap_trans_do(commonctx->db,
+                                      idmap_tdb2_set_mapping_action,
                                       &store_state);
                 goto done;
@@ -733 +523 @@
 
 /*
-  lookup a set of unix ids. 
+  Initialise idmap database.
 */
-static NTSTATUS idmap_tdb2_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
+static NTSTATUS idmap_tdb2_db_init(struct idmap_domain *dom)
 {
         NTSTATUS ret;
-        int i;
-
-        /* initialize the status to avoid suprise */
-        for (i = 0; ids[i]; i++) {
-                ids[i]->status = ID_UNKNOWN;
-        }
-
-        for (i = 0; ids[i]; i++) {
-                ret = idmap_tdb2_id_to_sid(dom, ids[i]);
-                if ( ! NT_STATUS_IS_OK(ret)) {
-
-                        /* if it is just a failed mapping continue */
-                        if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
-
-                                /* make sure it is marked as unmapped */
-                                ids[i]->status = ID_UNMAPPED;
-                                continue;
-                        }
-
-                        /* some fatal error occurred, return immediately */
-                        goto done;
-                }
-
-                /* all ok, id is mapped */
-                ids[i]->status = ID_MAPPED;
-        }
-
-        ret = NT_STATUS_OK;
-
-done:
-        return ret;
-}
-
-/*
-  lookup a set of sids. 
-*/
-
-struct idmap_tdb2_sids_to_unixids_context {
-        struct idmap_domain *dom;
-        struct id_map **ids;
-        bool allocate_unmapped;
-};
-
-static NTSTATUS idmap_tdb2_sids_to_unixids_action(struct db_context *db,
-                                                  void *private_data)
-{
-        struct idmap_tdb2_sids_to_unixids_context *state;
-        int i;
-        NTSTATUS ret = NT_STATUS_OK;
-
-        state = (struct idmap_tdb2_sids_to_unixids_context *)private_data;
-
-        DEBUG(10, ("idmap_tdb2_sids_to_unixids_action: "
-                   " domain: [%s], allocate: %s\n",
-                   state->dom->name,
-                   state->allocate_unmapped ? "yes" : "no"));
-
-        for (i = 0; state->ids[i]; i++) {
-                if ((state->ids[i]->status == ID_UNKNOWN) ||
-                    /* retry if we could not map in previous run: */
-                    (state->ids[i]->status == ID_UNMAPPED))
-                {
-                        NTSTATUS ret2;
-
-                        ret2 = idmap_tdb2_sid_to_id(state->dom, state->ids[i]);
-                        if (!NT_STATUS_IS_OK(ret2)) {
-
-                                /* if it is just a failed mapping, continue */
-                                if (NT_STATUS_EQUAL(ret2, NT_STATUS_NONE_MAPPED)) {
-
-                                        /* make sure it is marked as unmapped */
-                                        state->ids[i]->status = ID_UNMAPPED;
-                                        ret = STATUS_SOME_UNMAPPED;
-                                } else {
-                                        /* some fatal error occurred, return immediately */
-                                        ret = ret2;
-                                        goto done;
-                                }
-                        } else {
-                                /* all ok, id is mapped */
-                                state->ids[i]->status = ID_MAPPED;
-                        }
-                }
-
-                if ((state->ids[i]->status == ID_UNMAPPED) &&
-                    state->allocate_unmapped)
-                {
-                        ret = idmap_tdb2_new_mapping(state->dom, state->ids[i]);
-                        if (!NT_STATUS_IS_OK(ret)) {
-                                goto done;
-                        }
-                }
-        }
-
-done:
-        return ret;
-}
-
-static NTSTATUS idmap_tdb2_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
-{
-        NTSTATUS ret;
-        int i;
-        struct idmap_tdb2_sids_to_unixids_context state;
+        struct idmap_tdb_common_context *commonctx;
         struct idmap_tdb2_context *ctx;
-
-        ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
-
-        /* initialize the status to avoid suprise */
-        for (i = 0; ids[i]; i++) {
-                ids[i]->status = ID_UNKNOWN;
-        }
-
-        state.dom = dom;
-        state.ids = ids;
-        state.allocate_unmapped = false;
-
-        ret = idmap_tdb2_sids_to_unixids_action(ctx->db, &state);
-
-        if (NT_STATUS_EQUAL(ret, STATUS_SOME_UNMAPPED) && !dom->read_only) {
-                state.allocate_unmapped = true;
-                ret = dbwrap_trans_do(ctx->db,
-                                      idmap_tdb2_sids_to_unixids_action,
-                                      &state);
-        }
-
+        char *config_option = NULL;
+        const char * idmap_script = NULL;
+
+        commonctx = talloc_zero(dom, struct idmap_tdb_common_context);
+        if(!commonctx) {
+                DEBUG(0, ("Out of memory!\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        commonctx->rw_ops = talloc_zero(commonctx, struct idmap_rw_ops);
+        if (commonctx->rw_ops == NULL) {
+                DEBUG(0, ("Out of memory!\n"));
+                ret = NT_STATUS_NO_MEMORY;
+                goto failed;
+        }
+
+        ctx = talloc_zero(commonctx, struct idmap_tdb2_context);
+        if (!ctx) {
+                DEBUG(0, ("Out of memory!\n"));
+                ret = NT_STATUS_NO_MEMORY;
+                goto failed;
+        }
+
+        config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
+        if (config_option == NULL) {
+                DEBUG(0, ("Out of memory!\n"));
+                ret = NT_STATUS_NO_MEMORY;
+                goto failed;
+        }
+        ctx->script = lp_parm_const_string(-1, config_option, "script", NULL);
+        talloc_free(config_option);
+
+        idmap_script = lp_parm_const_string(-1, "idmap", "script", NULL);
+        if (idmap_script != NULL) {
+                DEBUG(0, ("Warning: 'idmap:script' is deprecated. "
+                          " Please use 'idmap config * : script' instead!\n"));
+        }
+
+        if (strequal(dom->name, "*") && ctx->script == NULL) {
+                /* fall back to idmap:script for backwards compatibility */
+                ctx->script = idmap_script;
+        }
+
+        if (ctx->script) {
+                DEBUG(1, ("using idmap script '%s'\n", ctx->script));
+        }
+
+        commonctx->max_id = dom->high_id;
+        commonctx->hwmkey_uid = HWM_USER;
+        commonctx->hwmkey_gid = HWM_GROUP;
+
+        commonctx->sid_to_unixid_fn = idmap_tdb2_sid_to_id;
+        commonctx->unixid_to_sid_fn = idmap_tdb2_id_to_sid;
+
+        commonctx->rw_ops->get_new_id = idmap_tdb_common_get_new_id;
+        commonctx->rw_ops->set_mapping = idmap_tdb2_set_mapping;
+
+        commonctx->private_data = ctx;
+        dom->private_data = commonctx;
+
+        ret = idmap_tdb2_open_db(dom);
+        if (!NT_STATUS_IS_OK(ret)) {
+                goto failed;
+        }
+
+        return NT_STATUS_OK;
+
+failed:
+        talloc_free(commonctx);
         return ret;
 }
@@ -869 +605 @@
 static struct idmap_methods db_methods = {
         .init            = idmap_tdb2_db_init,
-        .unixids_to_sids = idmap_tdb2_unixids_to_sids,
-        .sids_to_unixids = idmap_tdb2_sids_to_unixids,
-        .allocate_id     = idmap_tdb2_get_new_id
+        .unixids_to_sids = idmap_tdb_common_unixids_to_sids,
+        .sids_to_unixids = idmap_tdb_common_sids_to_unixids,
+        .allocate_id     = idmap_tdb_common_get_new_id
 };
 
+static_decl_idmap;
 NTSTATUS idmap_tdb2_init(void)
 {

vendor/current/source3/winbindd/idmap_util.c

@@ -25 +25 @@
 #include "idmap_cache.h"
 #include "../libcli/security/security.h"
+#include "secrets.h"
 
 #undef DBGC_CLASS
@@ -32 +33 @@
  Returns the SID mapped to the given UID.
  If mapping is not possible returns an error.
-*****************************************************************/  
-
-NTSTATUS idmap_uid_to_sid(const char *domname, struct dom_sid *sid, uid_t uid)
+*****************************************************************/
+
+NTSTATUS idmap_uid_to_sid(struct dom_sid *sid, uid_t uid)
 {
         NTSTATUS ret;
@@ -40 +41 @@
         bool expired;
 
-        DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
-                  (unsigned long)uid, domname?domname:"NULL"));
+        DEBUG(10, ("idmap_uid_to_sid: uid = [%lu]\n", (unsigned long)uid));
 
         if (winbindd_use_idmap_cache()
@@ -61 +61 @@
 
 backend:
+        ZERO_STRUCT(map);
         map.sid = sid;
         map.xid.type = ID_TYPE_UID;
         map.xid.id = uid;
 
-        ret = idmap_backends_unixid_to_sid(domname, &map);
+        ret = idmap_backends_unixid_to_sid(&map);
         if ( ! NT_STATUS_IS_OK(ret)) {
-                DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid));
-                return ret;
+                DEBUG(10, ("error mapping uid [%lu]: %s\n", (unsigned long)uid,
+                           nt_errstr(ret)));
+                map.status = ID_UNMAPPED;
         }
 
@@ -74 +76 @@
                 if (winbindd_use_idmap_cache()) {
                         struct dom_sid null_sid;
+                        struct unixid id;
+                        id.type = ID_TYPE_UID;
+                        id.id = uid;
                         ZERO_STRUCT(null_sid);
-                        idmap_cache_set_sid2uid(&null_sid, uid);
+                        idmap_cache_set_sid2unixid(&null_sid, &id);
                 }
                 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid));
@@ -82 +87 @@
 
         if (winbindd_use_idmap_cache()) {
-                idmap_cache_set_sid2uid(sid, uid);
+                idmap_cache_set_sid2unixid(sid, &map.xid);
         }
 
@@ -91 +96 @@
  Returns SID mapped to the given GID.
  If mapping is not possible returns an error.
-*****************************************************************/  
-
-NTSTATUS idmap_gid_to_sid(const char *domname, struct dom_sid *sid, gid_t gid)
+*****************************************************************/
+
+NTSTATUS idmap_gid_to_sid(struct dom_sid *sid, gid_t gid)
 {
         NTSTATUS ret;
@@ -99 +104 @@
         bool expired;
 
-        DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
-                  (unsigned long)gid, domname?domname:"NULL"));
+        DEBUG(10, ("idmap_gid_to_sid: gid = [%lu]\n", (unsigned long)gid));
 
         if (winbindd_use_idmap_cache()
@@ -120 +124 @@
 
 backend:
+        ZERO_STRUCT(map);
         map.sid = sid;
         map.xid.type = ID_TYPE_GID;
         map.xid.id = gid;
 
-        ret = idmap_backends_unixid_to_sid(domname, &map);
+        ret = idmap_backends_unixid_to_sid(&map);
         if ( ! NT_STATUS_IS_OK(ret)) {
-                DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid));
-                return ret;
+                DEBUG(10, ("error mapping gid [%lu]: %s\n", (unsigned long)gid,
+                           nt_errstr(ret)));
+                map.status = ID_UNMAPPED;
         }
 
@@ -133 +139 @@
                 if (winbindd_use_idmap_cache()) {
                         struct dom_sid null_sid;
+                        struct unixid id;
+                        id.type = ID_TYPE_GID;
+                        id.id = gid;
                         ZERO_STRUCT(null_sid);
-                        idmap_cache_set_sid2gid(&null_sid, gid);
+                        idmap_cache_set_sid2unixid(&null_sid, &id);
                 }
                 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
@@ -141 +150 @@
 
         if (winbindd_use_idmap_cache()) {
-                idmap_cache_set_sid2gid(sid, gid);
-        }
-
-        return NT_STATUS_OK;
-}
-
-/*****************************************************************
- Returns the UID mapped to the given SID.
- If mapping is not possible or SID maps to a GID returns an error.
-*****************************************************************/  
-
-NTSTATUS idmap_sid_to_uid(const char *dom_name, struct dom_sid *sid, uid_t *uid)
-{
-        NTSTATUS ret;
-        struct id_map map;
-        bool expired;
-
-        DEBUG(10,("idmap_sid_to_uid: sid = [%s], domain = '%s'\n",
-                  sid_string_dbg(sid), dom_name));
-
-        if (winbindd_use_idmap_cache()
-            && idmap_cache_find_sid2uid(sid, uid, &expired)) {
-                DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
-                           (int)(*uid), expired ? " (expired)": ""));
-                if (expired && idmap_is_online()) {
-                        DEBUG(10, ("revalidating expired entry\n"));
-                        goto backend;
-                }
-                if ((*uid) == -1) {
-                        DEBUG(10, ("Returning negative cache entry\n"));
-                        return NT_STATUS_NONE_MAPPED;
-                }
-                DEBUG(10, ("Returning positive cache entry\n"));
-                return NT_STATUS_OK;
-        }
-
-backend:
-        map.sid = sid;
-        map.xid.type = ID_TYPE_UID;     
-
-        ret = idmap_backends_sid_to_unixid(dom_name, &map);
-
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
-                           nt_errstr(ret)));
-                if (winbindd_use_idmap_cache()) {
-                        idmap_cache_set_sid2uid(sid, -1);
-                }
-                return ret;
-        }
-
-        if (map.status != ID_MAPPED) {
-                DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
-                if (winbindd_use_idmap_cache()) {
-                        idmap_cache_set_sid2uid(sid, -1);
-                }
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        if (map.xid.type != ID_TYPE_UID) {
-                DEBUG(10, ("sid [%s] not mapped to a uid "
-                           "[%u,%u,%u]\n",
-                           sid_string_dbg(sid),
-                           map.status,
-                           map.xid.type,
-                           map.xid.id));
-                if (winbindd_use_idmap_cache()) {
-                        idmap_cache_set_sid2uid(sid, -1);
-                }
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        *uid = (uid_t)map.xid.id;
-        if (winbindd_use_idmap_cache()) {
-                idmap_cache_set_sid2uid(sid, *uid);
-        }
-        return NT_STATUS_OK;
-}
-
-/*****************************************************************
- Returns the GID mapped to the given SID.
- If mapping is not possible or SID maps to a UID returns an error.
-*****************************************************************/  
-
-NTSTATUS idmap_sid_to_gid(const char *domname, struct dom_sid *sid, gid_t *gid)
-{
-        NTSTATUS ret;
-        struct id_map map;
-        bool expired;
-
-        DEBUG(10,("idmap_sid_to_gid: sid = [%s], domain = '%s'\n",
-                  sid_string_dbg(sid), domname));
-
-        if (winbindd_use_idmap_cache()
-            && idmap_cache_find_sid2gid(sid, gid, &expired)) {
-                DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
-                           (int)(*gid), expired ? " (expired)": ""));
-                if (expired && idmap_is_online()) {
-                        DEBUG(10, ("revalidating expired entry\n"));
-                        goto backend;
-                }
-                if ((*gid) == -1) {
-                        DEBUG(10, ("Returning negative cache entry\n"));
-                        return NT_STATUS_NONE_MAPPED;
-                }
-                DEBUG(10, ("Returning positive cache entry\n"));
-                return NT_STATUS_OK;
-        }
-
-backend:
-        map.sid = sid;
-        map.xid.type = ID_TYPE_GID;
-
-        ret = idmap_backends_sid_to_unixid(domname, &map);
-
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
-                           nt_errstr(ret)));
-                if (winbindd_use_idmap_cache()) {
-                        idmap_cache_set_sid2gid(sid, -1);
-                }
-                return ret;
-        }
-
-        if (map.status != ID_MAPPED) {
-                DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
-                if (winbindd_use_idmap_cache()) {
-                        idmap_cache_set_sid2gid(sid, -1);
-                }
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        if (map.xid.type != ID_TYPE_GID) {
-                DEBUG(10, ("sid [%s] not mapped to a gid "
-                           "[%u,%u,%u]\n",
-                           sid_string_dbg(sid),
-                           map.status,
-                           map.xid.type,
-                           map.xid.id));
-                if (winbindd_use_idmap_cache()) {
-                        idmap_cache_set_sid2gid(sid, -1);
-                }
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        *gid = map.xid.id;
-        if (winbindd_use_idmap_cache()) {
-                idmap_cache_set_sid2gid(sid, *gid);
-        }
+                idmap_cache_set_sid2unixid(sid, &map.xid);
+        }
+
         return NT_STATUS_OK;
 }
@@ -311 +174 @@
         return true;
 }
+
+/**
+ * Helper for unixids_to_sids: find entry by id in mapping array,
+ * search up to IDMAP_AD_MAX_IDS entries
+ */
+struct id_map *idmap_find_map_by_id(struct id_map **maps, enum id_type type,
+                                    uint32_t id)
+{
+        int i;
+
+        for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
+                if (maps[i] == NULL) { /* end of the run */
+                        return NULL;
+                }
+                if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
+                        return maps[i];
+                }
+        }
+
+        return NULL;
+}
+
+/**
+ * Helper for sids_to_unix_ids: find entry by SID in mapping array,
+ * search up to IDMAP_AD_MAX_IDS entries
+ */
+struct id_map *idmap_find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
+{
+        int i;
+
+        for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
+                if (maps[i] == NULL) { /* end of the run */
+                        return NULL;
+                }
+                if (dom_sid_equal(maps[i]->sid, sid)) {
+                        return maps[i];
+                }
+        }
+
+        return NULL;
+}
+
+char *idmap_fetch_secret(const char *backend, const char *domain,
+                         const char *identity)
+{
+        char *tmp, *ret;
+        int r;
+
+        r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
+
+        if (r < 0)
+                return NULL;
+
+        /* make sure the key is case insensitive */
+        if (!strupper_m(tmp)) {
+                SAFE_FREE(tmp);
+                return NULL;
+        }
+
+        ret = secrets_fetch_generic(tmp, identity);
+
+        SAFE_FREE(tmp);
+
+        return ret;
+}

vendor/current/source3/winbindd/nss_info.c

@@ -67 +67 @@
 
         if ( nss_get_backend(name) ) {
-                DEBUG(0,("smb_register_idmap_nss: idmap module %s "
+                DEBUG(5,("smb_register_idmap_nss: idmap module %s "
                          "already registered!\n", name));
                 return NT_STATUS_OBJECT_NAME_COLLISION;
@@ -119 +119 @@
         struct nss_domain_entry *nss_domain;
 
-        nss_domain = TALLOC_ZERO_P(nss_domain_list, struct nss_domain_entry);
+        nss_domain = talloc_zero(nss_domain_list, struct nss_domain_entry);
         if (!nss_domain) {
                 DEBUG(0, ("nss_domain_list_add_domain: talloc() failure!\n"));

vendor/current/source3/winbindd/nss_info_template.c

@@ -49 +49 @@
         *homedir = talloc_strdup( ctx, lp_template_homedir() );
         *shell   = talloc_strdup( ctx, lp_template_shell() );
-        *gecos   = NULL;
 
         if ( !*homedir || !*shell ) {

vendor/current/source3/winbindd/wb_dsgetdcname.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct wb_dsgetdcname_state {
@@ -46 +46 @@
         }
 
-        if (strequal(domain_name, "BUILTIN")
-            || strequal(domain_name, get_global_sam_name())) {
+        if (strequal(domain_name, "BUILTIN")) {
                 /*
-                 * Two options here: Give back our own address, or say there's
-                 * nobody around. Right now opting for the latter, one measure
-                 * to prevent the loopback connects. This might change if
-                 * needed.
+                 * This makes no sense
                  */
                 tevent_req_nterror(req, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND);
                 return tevent_req_post(req, ev);
+        }
+
+        if (strequal(domain_name, get_global_sam_name())) {
+                int role = lp_server_role();
+                if ( role != ROLE_ACTIVE_DIRECTORY_DC ) {
+                        /*
+                         * Two options here: Give back our own address, or say there's
+                         * nobody around. Right now opting for the latter, one measure
+                         * to prevent the loopback connects. This might change if
+                         * needed.
+                         */
+                        tevent_req_nterror(req, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND);
+                        return tevent_req_post(req, ev);
+                }
         }
 

vendor/current/source3/winbindd/wb_fill_pwent.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct wb_fill_pwent_state {
@@ -30 +30 @@
 static bool fillup_pw_field(const char *lp_template,
                             const char *username,
+                            const char *grpname,
                             const char *domname,
                             uid_t uid,
@@ -37 +38 @@
 
 static void wb_fill_pwent_sid2uid_done(struct tevent_req *subreq);
-static void wb_fill_pwent_sid2gid_done(struct tevent_req *subreq);
+static void wb_fill_pwent_getgrsid_done(struct tevent_req *subreq);
 
 struct tevent_req *wb_fill_pwent_send(TALLOC_CTX *mem_ctx,
@@ -55 +56 @@
         state->pw = pw;
 
-        subreq = wb_sid2uid_send(state, state->ev, &state->info->user_sid);
+        subreq = wb_sids2xids_send(state, state->ev, &state->info->user_sid, 1);
         if (tevent_req_nomem(subreq, req)) {
                 return tevent_req_post(req, ev);
@@ -70 +71 @@
                 req, struct wb_fill_pwent_state);
         NTSTATUS status;
-
-        status = wb_sid2uid_recv(subreq, &state->pw->pw_uid);
+        struct unixid xids[1];
+
+        status = wb_sids2xids_recv(subreq, xids, ARRAY_SIZE(xids));
         TALLOC_FREE(subreq);
         if (tevent_req_nterror(req, status)) {
@@ -77 +79 @@
         }
 
-        subreq = wb_sid2gid_send(state, state->ev, &state->info->group_sid);
+        /*
+         * We are filtering further down in sids2xids, but that filtering
+         * depends on the actual type of the sid handed in (as determined
+         * by lookupsids). Here we need to filter for the type of object
+         * actually requested, in this case uid.
+         */
+        if (!(xids[0].type == ID_TYPE_UID || xids[0].type == ID_TYPE_BOTH)) {
+                tevent_req_nterror(req, NT_STATUS_NONE_MAPPED);
+                return;
+        }
+
+        state->pw->pw_uid = (uid_t)xids[0].id;
+
+        subreq = wb_getgrsid_send(state, state->ev, &state->info->group_sid, 0);
         if (tevent_req_nomem(subreq, req)) {
                 return;
         }
-        tevent_req_set_callback(subreq, wb_fill_pwent_sid2gid_done, req);
-}
-
-static void wb_fill_pwent_sid2gid_done(struct tevent_req *subreq)
+        tevent_req_set_callback(subreq, wb_fill_pwent_getgrsid_done, req);
+}
+
+static void wb_fill_pwent_getgrsid_done(struct tevent_req *subreq)
 {
         struct tevent_req *req = tevent_req_callback_data(
@@ -91 +106 @@
                 req, struct wb_fill_pwent_state);
         struct winbindd_domain *domain;
-        char *dom_name;
+        const char *dom_name;
+        const char *grp_name;
         fstring user_name, output_username;
         char *mapped_name = NULL;
+        struct talloc_dict *members;
+        TALLOC_CTX *tmp_ctx = talloc_stackframe();
         NTSTATUS status;
-
-        status = wb_sid2gid_recv(subreq, &state->pw->pw_gid);
+        bool ok;
+
+        /* xid handling is done in getgrsid() */
+        status = wb_getgrsid_recv(subreq,
+                                  tmp_ctx,
+                                  &dom_name,
+                                  &grp_name,
+                                  &state->pw->pw_gid,
+                                  &members);
         TALLOC_FREE(subreq);
         if (tevent_req_nterror(req, status)) {
+                talloc_free(tmp_ctx);
                 return;
         }
@@ -104 +130 @@
         domain = find_domain_from_sid_noinit(&state->info->user_sid);
         if (domain == NULL) {
+                talloc_free(tmp_ctx);
                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
                 return;
@@ -112 +139 @@
 
         fstrcpy(user_name, state->info->acct_name);
-        strlower_m(user_name);
+        if (!strlower_m(user_name)) {
+                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                return;
+        }
         status = normalize_name_map(state, domain, user_name, &mapped_name);
 
@@ -130 +160 @@
         }
 
-        fstrcpy(state->pw->pw_name, output_username);
-        fstrcpy(state->pw->pw_gecos, state->info->full_name);
+        strlcpy(state->pw->pw_name,
+                output_username,
+                sizeof(state->pw->pw_name));
+        /* FIXME The full_name can be longer than 255 chars */
+        strlcpy(state->pw->pw_gecos,
+                state->info->full_name != NULL ? state->info->full_name : "",
+                sizeof(state->pw->pw_gecos));
 
         /* Home directory and shell */
-
-        if (!fillup_pw_field(lp_template_homedir(), user_name, dom_name,
-                             state->pw->pw_uid, state->pw->pw_gid,
-                             state->info->homedir, state->pw->pw_dir)) {
+        ok = fillup_pw_field(lp_template_homedir(),
+                             user_name,
+                             grp_name,
+                             dom_name,
+                             state->pw->pw_uid,
+                             state->pw->pw_gid,
+                             state->info->homedir,
+                             state->pw->pw_dir);
+        if (!ok) {
+                talloc_free(tmp_ctx);
                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
                 return;
         }
 
-        if (!fillup_pw_field(lp_template_shell(), user_name, dom_name,
-                             state->pw->pw_uid, state->pw->pw_gid,
-                             state->info->shell, state->pw->pw_shell)) {
+        ok = fillup_pw_field(lp_template_shell(),
+                             user_name,
+                             grp_name,
+                             dom_name,
+                             state->pw->pw_uid,
+                             state->pw->pw_gid,
+                             state->info->shell,
+                             state->pw->pw_shell);
+        talloc_free(tmp_ctx);
+        if (!ok) {
                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
                 return;
@@ -163 +211 @@
 static bool fillup_pw_field(const char *lp_template,
                             const char *username,
+                            const char *grpname,
                             const char *domname,
                             uid_t uid,
@@ -169 +218 @@
                             fstring out)
 {
-        char *templ;
+        const char *templ;
+        char *result;
 
         if (out == NULL)
                 return False;
 
-        /* The substitution of %U and %D in the 'template
-           homedir' is done by talloc_sub_specified() below.
-           If we have an in string (which means the value has already
-           been set in the nss_info backend), then use that.
-           Otherwise use the template value passed in. */
+        templ = lp_template;
 
         if ((in != NULL) && (in[0] != '\0') && (lp_security() == SEC_ADS)) {
-                templ = talloc_sub_specified(talloc_tos(), in,
-                                             username, domname,
-                                             uid, gid);
-        } else {
-                templ = talloc_sub_specified(talloc_tos(), lp_template,
-                                             username, domname,
-                                             uid, gid);
-        }
-
-        if (!templ)
+                /*
+                 * The backend has already filled in the required value. Use
+                 * that instead of the template.
+                 */
+                templ = in;
+        }
+
+        result = talloc_sub_specified(talloc_tos(), templ,
+                                      username, grpname, domname,
+                                      uid, gid);
+        if (result == NULL) {
                 return False;
-
-        safe_strcpy(out, templ, sizeof(fstring) - 1);
-        TALLOC_FREE(templ);
+        }
+
+        fstrcpy(out, result);
+        TALLOC_FREE(result);
 
         return True;

vendor/current/source3/winbindd/wb_getgrsid.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 
@@ -92 +92 @@
         case SID_NAME_ALIAS:
         case SID_NAME_WKN_GRP:
+        /*
+         * also treat user-type SIDS (they might map to ID_TYPE_BOTH)
+         */
+        case SID_NAME_USER:
+        case SID_NAME_COMPUTER:
                 break;
         default:
@@ -98 +103 @@
         }
 
-        subreq = wb_sid2gid_send(state, state->ev, &state->sid);
+        subreq = wb_sids2xids_send(state, state->ev, &state->sid, 1);
         if (tevent_req_nomem(subreq, req)) {
                 return;
@@ -112 +117 @@
                 req, struct wb_getgrsid_state);
         NTSTATUS status;
-
-        status = wb_sid2gid_recv(subreq, &state->gid);
+        struct unixid xids[1];
+
+        status = wb_sids2xids_recv(subreq, xids, ARRAY_SIZE(xids));
         TALLOC_FREE(subreq);
         if (tevent_req_nterror(req, status)) {
                 return;
         }
+
+        /*
+         * We are filtering further down in sids2xids, but that filtering
+         * depends on the actual type of the sid handed in (as determined
+         * by lookupsids). Here we need to filter for the type of object
+         * actually requested, in this case uid.
+         */
+        if (!(xids[0].type == ID_TYPE_GID || xids[0].type == ID_TYPE_BOTH)) {
+                tevent_req_nterror(req, NT_STATUS_NONE_MAPPED);
+                return;
+        }
+
+        state->gid = (gid_t)xids[0].id;
+
+        if (state->type == SID_NAME_USER || state->type == SID_NAME_COMPUTER) {
+                /*
+                 * special treatment for a user sid that is
+                 * mapped to ID_TYPE_BOTH:
+                 * create a group with the sid/xid as only member
+                 */
+                const char *name;
+
+                if (xids[0].type != ID_TYPE_BOTH) {
+                        tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
+                        return;
+                }
+
+                state->members = talloc_dict_init(state);
+                if (tevent_req_nomem(state->members, req)) {
+                        return;
+                }
+
+                name = fill_domain_username_talloc(talloc_tos(),
+                                                   state->domname,
+                                                   state->name,
+                                                   true /* can_assume */);
+                if (tevent_req_nomem(name, req)) {
+                        return;
+                }
+
+                status = add_wbint_Principal_to_dict(talloc_tos(),
+                                                     &state->sid,
+                                                     &name,
+                                                     state->type,
+                                                     state->members);
+                if (!NT_STATUS_IS_OK(status)) {
+                        tevent_req_nterror(req, status);
+                        return;
+                }
+
+                tevent_req_done(req);
+                return;
+        }
+
+        /*
+         * the "regular" case of a group type sid.
+         */
+
         subreq = wb_group_members_send(state, state->ev, &state->sid,
                                        state->type, state->max_nesting);

vendor/current/source3/winbindd/wb_getpwsid.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 
 struct wb_getpwsid_state {
-        struct winbindd_domain *user_domain;
         struct tevent_context *ev;
         struct dom_sid sid;
@@ -51 +50 @@
         state->pw = pw;
 
-        state->user_domain = find_domain_from_sid_noinit(user_sid);
-        if (state->user_domain == NULL) {
-                tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
-                return tevent_req_post(req, ev);
-        }
-
         subreq = wb_queryuser_send(state, ev, &state->sid);
         if (tevent_req_nomem(subreq, req)) {
@@ -75 +68 @@
         status = wb_queryuser_recv(subreq, state, &state->userinfo);
         TALLOC_FREE(subreq);
-        if (tevent_req_nterror(req, status)) {
-                return;
-        }
-
-        if ((state->userinfo->acct_name != NULL)
-            && (state->userinfo->acct_name[0] != '\0')) {
+        if (NT_STATUS_IS_OK(status)
+            && (state->userinfo->acct_name != NULL)
+            && (state->userinfo->acct_name[0] != '\0'))
+        {
                 /*
-                 * QueryUser got us a name, let's got directly to the
+                 * QueryUser got us a name, let's go directly to the
                  * fill_pwent step
                  */
@@ -95 +86 @@
 
         /*
-         * QueryUser didn't get us a name, do it via LSA.
+         * Either query_user did not succeed, or it
+         * succeeded but did not return an acct_name.
+         * (TODO: Can this happen at all???)
+         * ==> Try lsa_lookupsids.
          */
-        subreq = wb_lookupsid_send(state, state->ev,
-                                   &state->userinfo->user_sid);
+        if (state->userinfo == NULL) {
+                state->userinfo = talloc_zero(state, struct wbint_userinfo);
+                if (tevent_req_nomem(state->userinfo, req)) {
+                        return;
+                }
+
+                /* a successful query_user call would have filled these */
+                sid_copy(&state->userinfo->user_sid, &state->sid);
+                state->userinfo->homedir = NULL;
+                state->userinfo->shell = NULL;
+                state->userinfo->primary_gid = (gid_t)-1;
+        }
+
+        subreq = wb_lookupsid_send(state, state->ev, &state->sid);
         if (tevent_req_nomem(subreq, req)) {
                 return;
@@ -121 +127 @@
                 return;
         }
+
+        switch (type) {
+        case SID_NAME_USER:
+        case SID_NAME_COMPUTER:
+                /*
+                 * user case: we only need the account name from lookup_sids
+                 */
+                break;
+        case SID_NAME_DOM_GRP:
+        case SID_NAME_ALIAS:
+        case SID_NAME_WKN_GRP:
+                /*
+                 * also treat group-type SIDs (they might map to ID_TYPE_BOTH)
+                 */
+                sid_copy(&state->userinfo->group_sid, &state->sid);
+                break;
+        default:
+                tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
+                return;
+        }
+
         subreq = wb_fill_pwent_send(state, state->ev, state->userinfo,
                                     state->pw);
@@ -144 +171 @@
 NTSTATUS wb_getpwsid_recv(struct tevent_req *req)
 {
-        NTSTATUS status;
-
-        if (tevent_req_is_nterror(req, &status)) {
-                return status;
-        }
-        return NT_STATUS_OK;
+        return tevent_req_simple_recv_ntstatus(req);
 }

vendor/current/source3/winbindd/wb_gettoken.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 #include "passdb/machine_sid.h"

vendor/current/source3/winbindd/wb_gid2sid.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "idmap_cache.h"
 #include "idmap.h"
@@ -27 +27 @@
 struct wb_gid2sid_state {
         struct tevent_context *ev;
-        char *dom_name;
         struct dom_sid sid;
 };
@@ -39 +38 @@
         struct tevent_req *req, *subreq;
         struct wb_gid2sid_state *state;
-        struct winbindd_domain *domain;
         struct winbindd_child *child;
         bool expired;
@@ -65 +63 @@
         }
 
-        state->dom_name = NULL;
-
-        for (domain = domain_list(); domain != NULL; domain = domain->next) {
-                if (domain->have_idmap_config
-                    && (gid >= domain->id_range_low)
-                    && (gid <= domain->id_range_high)) {
-                        state->dom_name = domain->name;
-                        break;
-                }
-        }
-
         child = idmap_child();
 
         subreq = dcerpc_wbint_Gid2Sid_send(
-                state, ev, child->binding_handle, state->dom_name,
+                state, ev, child->binding_handle,
                 gid, &state->sid);
         if (tevent_req_nomem(subreq, req)) {

vendor/current/source3/winbindd/wb_group_members.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../librpc/gen_ndr/ndr_security.h"
 #include "../libcli/security/security.h"
@@ -140 +140 @@
                                                  struct wbint_Principal *groups)
 {
-        struct tevent_req *req, *subreq;
+        struct tevent_req *req, *subreq = NULL;
         struct wb_groups_members_state *state;
         NTSTATUS status;
@@ -291 +291 @@
                                          int max_depth)
 {
-        struct tevent_req *req, *subreq;
+        struct tevent_req *req, *subreq = NULL;
         struct wb_group_members_state *state;
         NTSTATUS status;
@@ -350 +350 @@
 }
 
+
+/**
+ * compose a wbint_Principal and add it to  talloc_dict
+ *
+ * NOTE: this has a side effect: *name needs to be talloc'd
+ * and it is talloc_move'd to mem_ctx.
+ */
+NTSTATUS add_wbint_Principal_to_dict(TALLOC_CTX *mem_ctx,
+                                     struct dom_sid *sid,
+                                     const char **name,
+                                     enum lsa_SidType type,
+                                     struct talloc_dict *dict)
+{
+        struct wbint_Principal *m;
+        DATA_BLOB key;
+        bool ok;
+
+        m = talloc(mem_ctx, struct wbint_Principal);
+        if (m == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        sid_copy(&m->sid, sid);
+        m->name = talloc_move(m, name);
+        m->type = type;
+
+        key = data_blob_const(&m->sid, sizeof(m->sid));
+
+        ok = talloc_dict_set(dict, key, &m);
+        if (!ok) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        return NT_STATUS_OK;
+}
+
 static void wb_group_members_done(struct tevent_req *subreq)
 {
@@ -356 +392 @@
         struct wb_group_members_state *state = tevent_req_data(
                 req, struct wb_group_members_state);
-        int i, num_groups, new_users, new_groups;
+        int i, num_groups, new_groups;
         int num_members = 0;
         struct wbint_Principal *members = NULL;
@@ -367 +403 @@
         }
 
-        new_users = new_groups = 0;
+        new_groups = 0;
         for (i=0; i<num_members; i++) {
                 switch (members[i].type) {
@@ -398 +434 @@
                          * Add a copy of members[i] to state->users
                          */
-                        struct wbint_Principal *m;
-                        struct dom_sid *sid;
-                        DATA_BLOB key;
-
-                        m = talloc(talloc_tos(), struct wbint_Principal);
-                        if (tevent_req_nomem(m, req)) {
+                        status = add_wbint_Principal_to_dict(talloc_tos(),
+                                                             &members[i].sid,
+                                                             &members[i].name,
+                                                             members[i].type,
+                                                             state->users);
+                        if (tevent_req_nterror(req, status)) {
                                 return;
                         }
-                        sid_copy(&m->sid, &members[i].sid);
-                        m->name = talloc_move(m, &members[i].name);
-                        m->type = members[i].type;
-
-                        sid = &members[i].sid;
-                        key = data_blob_const(
-                                sid, ndr_size_dom_sid(sid, 0));
-
-                        if (!talloc_dict_set(state->users, key, &m)) {
-                                tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
-                                return;
-                        }
+
                         break;
                 }

vendor/current/source3/winbindd/wb_lookupname.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 

vendor/current/source3/winbindd/wb_lookupsid.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 

vendor/current/source3/winbindd/wb_lookupsids.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 #include "passdb/machine_sid.h"
@@ -124 +124 @@
         state->num_sids = num_sids;
 
-        state->single_sids = TALLOC_ARRAY(state, uint32_t, num_sids);
+        state->single_sids = talloc_array(state, uint32_t, num_sids);
         if (tevent_req_nomem(state->single_sids, req)) {
                 return tevent_req_post(req, ev);
         }
 
-        state->res_domains = TALLOC_ZERO_P(state, struct lsa_RefDomainList);
+        state->res_domains = talloc_zero(state, struct lsa_RefDomainList);
         if (tevent_req_nomem(state->res_domains, req)) {
                 return tevent_req_post(req, ev);
         }
-        state->res_domains->domains = TALLOC_ARRAY(
+        state->res_domains->domains = talloc_array(
                 state->res_domains, struct lsa_DomainInfo, num_sids);
         if (tevent_req_nomem(state->res_domains->domains, req)) {
@@ -139 +139 @@
         }
 
-        state->res_names = TALLOC_ZERO_P(state, struct lsa_TransNameArray);
+        state->res_names = talloc_zero(state, struct lsa_TransNameArray);
         if (tevent_req_nomem(state->res_names, req)) {
                 return tevent_req_post(req, ev);
         }
-        state->res_names->names = TALLOC_ARRAY(
+        state->res_names->names = talloc_array(
                 state->res_names, struct lsa_TranslatedName, num_sids);
         if (tevent_req_nomem(state->res_names->names, req)) {
@@ -186 +186 @@
                 d = &state->domains[state->domains_done];
 
-                if (sid_check_is_domain(&d->sid)) {
+                if (sid_check_is_our_sam(&d->sid)) {
                         state->rids.num_rids = d->sids.num_sids;
-                        state->rids.rids = TALLOC_ARRAY(state, uint32_t,
+                        state->rids.rids = talloc_array(state, uint32_t,
                                                         state->rids.num_rids);
                         if (tevent_req_nomem(state->rids.rids, req)) {
@@ -256 +256 @@
         }
 
-        if (sid_check_is_in_our_domain(sid)) {
+        if (sid_check_is_in_our_sam(sid)) {
                 /*
                  * Passdb lookup via lookuprids
@@ -321 +321 @@
         }
 
-        wb_domain = find_domain_from_sid_noinit(sid);
+        wb_domain = find_lookup_domain_from_sid(sid);
         if (wb_domain == NULL) {
                 return NULL;
         }
 
-        domains = TALLOC_REALLOC_ARRAY(
+        domains = talloc_realloc(
                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains+1);
         if (domains == NULL) {
@@ -338 +338 @@
         domain->domain = wb_domain;
 
-        domain->sids.sids = TALLOC_ARRAY(domains, struct lsa_SidPtr, num_sids);
+        domain->sids.sids = talloc_array(domains, struct lsa_SidPtr, num_sids);
         if (domains->sids.sids == NULL) {
                 goto fail;
@@ -344 +344 @@
         domain->sids.num_sids = 0;
 
-        domain->sid_indexes = TALLOC_ARRAY(domains, uint32_t, num_sids);
+        domain->sid_indexes = talloc_array(domains, uint32_t, num_sids);
         if (domain->sid_indexes == NULL) {
                 TALLOC_FREE(domain->sids.sids);
@@ -355 +355 @@
          * Realloc to the state it was in before
          */
-        *pdomains = TALLOC_REALLOC_ARRAY(
+        *pdomains = talloc_realloc(
                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains);
         return NULL;
@@ -368 +368 @@
 
         for (i=0; i<list->count; i++) {
-                if (sid_equal(domain->sid, list->domains[i].sid)) {
+                if (dom_sid_equal(domain->sid, list->domains[i].sid)) {
                         *idx = i;
                         return true;
@@ -485 +485 @@
                             state->res_domains, state->res_names,
                             res_sid_index)) {
-                        tevent_req_nomem(NULL, req);
+                        tevent_req_oom(req);
                         return;
                 }
@@ -548 +548 @@
                     state->res_domains, state->res_names,
                     res_sid_index)) {
-                tevent_req_nomem(NULL, req);
+                tevent_req_oom(req);
                 return;
         }
@@ -623 +623 @@
                             state->res_domains, state->res_names,
                             res_sid_index)) {
-                        tevent_req_nomem(NULL, req);
+                        tevent_req_oom(req);
                         return;
                 }
@@ -649 +649 @@
          *
          */
-        SMB_ASSERT(state->res_names->count == state->num_sids);
+        if (state->res_names->count != state->num_sids) {
+                DEBUG(0, ("res_names->count = %d, expected %d\n",
+                          state->res_names->count, state->num_sids));
+                return NT_STATUS_INTERNAL_ERROR;
+        }
 
         /*

vendor/current/source3/winbindd/wb_lookupuseraliases.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct wb_lookupuseraliases_state {
@@ -45 +45 @@
         }
         state->sids.num_sids = num_sids;
-        state->sids.sids = CONST_DISCARD(struct dom_sid *, sids);
+        state->sids.sids = discard_const_p(struct dom_sid, sids);
 
         subreq = dcerpc_wbint_LookupUserAliases_send(

vendor/current/source3/winbindd/wb_lookupusergroups.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 
@@ -38 +38 @@
         struct tevent_req *req, *subreq;
         struct wb_lookupusergroups_state *state;
+        NTSTATUS status;
 
         req = tevent_req_create(mem_ctx, &state,
@@ -45 +46 @@
         }
         sid_copy(&state->sid, sid);
+
+        status = lookup_usergroups_cached(NULL,
+                                          state,
+                                          &state->sid,
+                                          &state->sids.num_sids,
+                                          &state->sids.sids);
+        if (NT_STATUS_IS_OK(status)) {
+                tevent_req_done(req);
+                return tevent_req_post(req, ev);
+        }
 
         subreq = dcerpc_wbint_LookupUserGroups_send(

vendor/current/source3/winbindd/wb_next_grent.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "passdb/machine_sid.h"
 
@@ -27 +27 @@
         int max_nesting;
         struct getgrent_state *gstate;
-        struct wbint_Principals next_groups;
         struct winbindd_gr *gr;
         struct talloc_dict *members;
@@ -35 +34 @@
 static void wb_next_grent_getgrsid_done(struct tevent_req *subreq);
 
+static void wb_next_grent_send_do(struct tevent_req *req,
+                                  struct wb_next_grent_state *state)
+{
+        struct tevent_req *subreq;
+
+        if (state->gstate->next_group >= state->gstate->num_groups) {
+                TALLOC_FREE(state->gstate->groups);
+
+                state->gstate->domain = wb_next_domain(state->gstate->domain);
+                if (state->gstate->domain == NULL) {
+                        tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES);
+                        return;
+                }
+
+                subreq = wb_query_group_list_send(state, state->ev,
+                                                  state->gstate->domain);
+                if (tevent_req_nomem(subreq, req)) {
+                        return;
+                }
+                tevent_req_set_callback(subreq, wb_next_grent_fetch_done, req);
+                return;
+        }
+
+        subreq = wb_getgrsid_send(
+                state, state->ev,
+                &state->gstate->groups[state->gstate->next_group].sid,
+                state->max_nesting);
+        if (tevent_req_nomem(subreq, req)) {
+                return;
+        }
+        tevent_req_set_callback(subreq, wb_next_grent_getgrsid_done, req);
+}
+
 struct tevent_req *wb_next_grent_send(TALLOC_CTX *mem_ctx,
                                       struct tevent_context *ev,
@@ -41 +73 @@
                                       struct winbindd_gr *gr)
 {
-        struct tevent_req *req, *subreq;
+        struct tevent_req *req;
         struct wb_next_grent_state *state;
 
@@ -53 +85 @@
         state->max_nesting = max_nesting;
 
-        if (state->gstate->next_group >= state->gstate->num_groups) {
-                TALLOC_FREE(state->gstate->groups);
-
-                if (state->gstate->domain == NULL) {
-                        state->gstate->domain = domain_list();
-                } else {
-                        state->gstate->domain = state->gstate->domain->next;
-                }
-
-                if ((state->gstate->domain != NULL)
-                    && sid_check_is_domain(&state->gstate->domain->sid)) {
-                        state->gstate->domain = state->gstate->domain->next;
-                }
-
-                if (state->gstate->domain == NULL) {
-                        tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES);
-                        return tevent_req_post(req, ev);
-                }
-                subreq = dcerpc_wbint_QueryGroupList_send(
-                        state, state->ev, dom_child_handle(state->gstate->domain),
-                        &state->next_groups);
-                if (tevent_req_nomem(subreq, req)) {
-                        return tevent_req_post(req, ev);
-                }
-                tevent_req_set_callback(subreq, wb_next_grent_fetch_done, req);
-                return req;
+        wb_next_grent_send_do(req, state);
+        if (!tevent_req_is_in_progress(req)) {
+                return tevent_req_post(req, ev);
         }
 
-        subreq = wb_getgrsid_send(
-                state, state->ev,
-                &state->gstate->groups[state->gstate->next_group].sid,
-                state->max_nesting);
-        if (tevent_req_nomem(subreq, req)) {
-                return tevent_req_post(req, ev);
-        }
-        tevent_req_set_callback(subreq, wb_next_grent_getgrsid_done, req);
         return req;
 }
@@ -98 +99 @@
         struct wb_next_grent_state *state = tevent_req_data(
                 req, struct wb_next_grent_state);
-        NTSTATUS status, result;
+        NTSTATUS status;
 
-        status = dcerpc_wbint_QueryGroupList_recv(subreq, state, &result);
+        status = wb_query_group_list_recv(subreq, state->gstate,
+                                          &state->gstate->num_groups,
+                                          &state->gstate->groups);
         TALLOC_FREE(subreq);
-        if (tevent_req_nterror(req, status)) {
+        if (!NT_STATUS_IS_OK(status)) {
                 /* Ignore errors here, just log it */
-                DEBUG(10, ("query_user_list for domain %s returned %s\n",
-                           state->gstate->domain->name,
-                           nt_errstr(status)));
-                return;
-        }
-        if (!NT_STATUS_IS_OK(result)) {
-                /* Ignore errors here, just log it */
-                DEBUG(10, ("query_user_list for domain %s returned %s/%s\n",
-                           state->gstate->domain->name,
-                           nt_errstr(status), nt_errstr(result)));
-                tevent_req_nterror(req, result);
-                return;
-        }
-
-        state->gstate->num_groups = state->next_groups.num_principals;
-        state->gstate->groups = talloc_move(
-                state->gstate, &state->next_groups.principals);
-
-        if (state->gstate->num_groups == 0) {
-                state->gstate->domain = state->gstate->domain->next;
-
-                if ((state->gstate->domain != NULL)
-                    && sid_check_is_domain(&state->gstate->domain->sid)) {
-                        state->gstate->domain = state->gstate->domain->next;
-                }
-
-                if (state->gstate->domain == NULL) {
-                        tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES);
-                        return;
-                }
-                subreq = dcerpc_wbint_QueryGroupList_send(
-                        state, state->ev, dom_child_handle(state->gstate->domain),
-                        &state->next_groups);
-                if (tevent_req_nomem(subreq, req)) {
-                        return;
-                }
-                tevent_req_set_callback(subreq, wb_next_grent_fetch_done, req);
-                return;
+                DEBUG(10, ("query_group_list for domain %s returned %s\n",
+                           state->gstate->domain->name, nt_errstr(status)));
+                state->gstate->num_groups = 0;
         }
 
         state->gstate->next_group = 0;
 
-        subreq = wb_getgrsid_send(
-                state, state->ev,
-                &state->gstate->groups[state->gstate->next_group].sid,
-                state->max_nesting);
-        if (tevent_req_nomem(subreq, req)) {
-                return;
-        }
-        tevent_req_set_callback(subreq, wb_next_grent_getgrsid_done, req);
-        return;
+        wb_next_grent_send_do(req, state);
 }
 
@@ -169 +129 @@
                                   &state->gr->gr_gid, &state->members);
         TALLOC_FREE(subreq);
-        if (tevent_req_nterror(req, status)) {
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
+                state->gstate->next_group += 1;
+
+                wb_next_grent_send_do(req, state);
+
+                return;
+        } else if (tevent_req_nterror(req, status)) {
                 return;
         }
+
         if (!fill_grent(talloc_tos(), state->gr, domname, name,
                         state->gr->gr_gid)) {

vendor/current/source3/winbindd/wb_next_pwent.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "passdb/machine_sid.h"
 
@@ -32 +32 @@
 static void wb_next_pwent_fill_done(struct tevent_req *subreq);
 
-static struct winbindd_domain *wb_next_find_domain(struct winbindd_domain *domain)
+static void wb_next_pwent_send_do(struct tevent_req *req,
+                                  struct wb_next_pwent_state *state)
 {
-        if (domain == NULL) {
-                domain = domain_list();
-        } else {
-                domain = domain->next;
+        struct tevent_req *subreq;
+
+        if (state->gstate->next_user >= state->gstate->num_users) {
+                TALLOC_FREE(state->gstate->users);
+
+                state->gstate->domain = wb_next_domain(state->gstate->domain);
+                if (state->gstate->domain == NULL) {
+                        tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES);
+                        return;
+                }
+
+                subreq = wb_query_user_list_send(state, state->ev,
+                                                 state->gstate->domain);
+                if (tevent_req_nomem(subreq, req)) {
+                        return;
+                }
+
+                tevent_req_set_callback(subreq, wb_next_pwent_fetch_done, req);
+                return;
         }
 
-        if ((domain != NULL)
-            && sid_check_is_domain(&domain->sid)) {
-                domain = domain->next;
+        subreq = wb_fill_pwent_send(state, state->ev,
+                                &state->gstate->users[state->gstate->next_user],
+                                state->pw);
+        if (tevent_req_nomem(subreq, req)) {
+                return;
         }
 
-        if (domain == NULL) {
-                return NULL;
-        }
-
-        return domain;
+        tevent_req_set_callback(subreq, wb_next_pwent_fill_done, req);
 }
 
@@ -57 +71 @@
                                       struct winbindd_pw *pw)
 {
-        struct tevent_req *req, *subreq;
+        struct tevent_req *req;
         struct wb_next_pwent_state *state;
 
@@ -68 +82 @@
         state->pw = pw;
 
-        if (state->gstate->next_user >= state->gstate->num_users) {
-                TALLOC_FREE(state->gstate->users);
-
-                state->gstate->domain = wb_next_find_domain(state->gstate->domain);
-                if (state->gstate->domain == NULL) {
-                        tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES);
-                        return tevent_req_post(req, ev);
-                }
-                subreq = wb_query_user_list_send(state, state->ev,
-                                                 state->gstate->domain);
-                if (tevent_req_nomem(subreq, req)) {
-                        return tevent_req_post(req, ev);
-                }
-                tevent_req_set_callback(subreq, wb_next_pwent_fetch_done, req);
-                return req;
+        wb_next_pwent_send_do(req, state);
+        if (!tevent_req_is_in_progress(req)) {
+                return tevent_req_post(req, ev);
         }
 
-        subreq = wb_fill_pwent_send(
-                state, state->ev,
-                &state->gstate->users[state->gstate->next_user],
-                state->pw);
-        if (tevent_req_nomem(subreq, req)) {
-                return tevent_req_post(req, ev);
-        }
-        tevent_req_set_callback(subreq, wb_next_pwent_fill_done, req);
         return req;
 }
@@ -116 +110 @@
         }
 
-        if (state->gstate->num_users == 0) {
-                state->gstate->domain = state->gstate->domain->next;
-
-                if ((state->gstate->domain != NULL)
-                    && sid_check_is_domain(&state->gstate->domain->sid)) {
-                        state->gstate->domain = state->gstate->domain->next;
-                }
-
-                if (state->gstate->domain == NULL) {
-                        tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES);
-                        return;
-                }
-                subreq = wb_query_user_list_send(state, state->ev,
-                                                 state->gstate->domain);
-                if (tevent_req_nomem(subreq, req)) {
-                        return;
-                }
-                tevent_req_set_callback(subreq, wb_next_pwent_fetch_done, req);
-                return;
-        }
-
         state->gstate->next_user = 0;
 
-        subreq = wb_fill_pwent_send(
-                state, state->ev,
-                &state->gstate->users[state->gstate->next_user],
-                state->pw);
-        if (tevent_req_nomem(subreq, req)) {
-                return;
-        }
-        tevent_req_set_callback(subreq, wb_next_pwent_fill_done, req);
+        wb_next_pwent_send_do(req, state);
 }
 
@@ -166 +132 @@
                 state->gstate->next_user += 1;
 
-                if (state->gstate->next_user >= state->gstate->num_users) {
-                        TALLOC_FREE(state->gstate->users);
-
-                        state->gstate->domain = wb_next_find_domain(state->gstate->domain);
-                        if (state->gstate->domain == NULL) {
-                                tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES);
-                                return;
-                        }
-
-                        subreq = wb_query_user_list_send(state, state->ev,
-                                        state->gstate->domain);
-                        if (tevent_req_nomem(subreq, req)) {
-                                return;
-                        }
-                        tevent_req_set_callback(subreq, wb_next_pwent_fetch_done, req);
-                        return;
-                }
-
-                subreq = wb_fill_pwent_send(state,
-                                            state->ev,
-                                            &state->gstate->users[state->gstate->next_user],
-                                            state->pw);
-                if (tevent_req_nomem(subreq, req)) {
-                        return;
-                }
-                tevent_req_set_callback(subreq, wb_next_pwent_fill_done, req);
+                wb_next_pwent_send_do(req, state);
 
                 return;

vendor/current/source3/winbindd/wb_query_user_list.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct wb_query_user_list_state {

vendor/current/source3/winbindd/wb_queryuser.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 

vendor/current/source3/winbindd/wb_seqnum.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct wb_seqnum_state {

vendor/current/source3/winbindd/wb_seqnums.c

@@ -22 +22 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct wb_seqnums_state {

vendor/current/source3/winbindd/wb_uid2sid.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "idmap_cache.h"
 #include "idmap.h"
@@ -27 +27 @@
 struct wb_uid2sid_state {
         struct tevent_context *ev;
-        char *dom_name;
         struct dom_sid sid;
 };
@@ -39 +38 @@
         struct tevent_req *req, *subreq;
         struct wb_uid2sid_state *state;
-        struct winbindd_domain *domain;
         struct winbindd_child *child;
         bool expired;
@@ -65 +63 @@
         }
 
-        state->dom_name = NULL;
-
-        for (domain = domain_list(); domain != NULL; domain = domain->next) {
-                if (domain->have_idmap_config
-                    && (uid >= domain->id_range_low)
-                    && (uid <= domain->id_range_high)) {
-                        state->dom_name = domain->name;
-                        break;
-                }
-        }
-
         child = idmap_child();
 
         subreq = dcerpc_wbint_Uid2Sid_send(
-                state, ev, child->binding_handle, state->dom_name,
+                state, ev, child->binding_handle,
                 uid, &state->sid);
         if (tevent_req_nomem(subreq, req)) {

vendor/current/source3/winbindd/winbindd.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -32 +32 @@
 #include "../librpc/gen_ndr/srv_samr.h"
 #include "secrets.h"
+#include "rpc_client/cli_netlogon.h"
 #include "idmap.h"
 #include "lib/addrchange.h"
@@ -37 +38 @@
 #include "auth.h"
 #include "messages.h"
+#include "../lib/util/pidfile.h"
+#include "util_cluster.h"
+#include "source4/lib/messaging/irpc.h"
+#include "source4/lib/messaging/messaging.h"
+#include "lib/param/param.h"
+#include "lib/async_req/async_sock.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
 
+#define SCRUB_CLIENTS_INTERVAL 5
+
 static bool client_is_idle(struct winbindd_cli_state *state);
 static void remove_client(struct winbindd_cli_state *state);
+static void winbindd_setup_max_fds(void);
 
 static bool opt_nocache = False;
@@ -49 +59 @@
 extern bool override_logfile;
 
+struct tevent_context *winbind_event_context(void)
+{
+        static struct tevent_context *ev = NULL;
+
+        if (ev != NULL) {
+                return ev;
+        }
+
+        /*
+         * Note we MUST use the NULL context here, not the autofree context,
+         * to avoid side effects in forked children exiting.
+         */
+        ev = samba_tevent_context_init(NULL);
+        if (ev == NULL) {
+                smb_panic("Could not init winbindd's messaging context.\n");
+        }
+        return ev;
+}
+
 struct messaging_context *winbind_messaging_context(void)
 {
-        struct messaging_context *msg_ctx = server_messaging_context();
-        if (likely(msg_ctx != NULL)) {
-                return msg_ctx;
-        }
-        smb_panic("Could not init winbindd's messaging context.\n");
-        return NULL;
+        static struct messaging_context *msg = NULL;
+
+        if (msg != NULL) {
+                return msg;
+        }
+
+        /*
+         * Note we MUST use the NULL context here, not the autofree context,
+         * to avoid side effects in forked children exiting.
+         */
+        msg = messaging_init(NULL, winbind_event_context());
+        if (msg == NULL) {
+                smb_panic("Could not init winbindd's messaging context.\n");
+        }
+        return msg;
+}
+
+struct imessaging_context *winbind_imessaging_context(void)
+{
+        static struct imessaging_context *msg = NULL;
+        struct messaging_context *msg_ctx;
+        struct server_id myself;
+        struct loadparm_context *lp_ctx;
+
+        if (msg != NULL) {
+                return msg;
+        }
+
+        msg_ctx = server_messaging_context();
+        if (msg_ctx == NULL) {
+                smb_panic("server_messaging_context failed\n");
+        }
+        myself = messaging_server_id(msg_ctx);
+
+        lp_ctx = loadparm_init_s3(NULL, loadparm_s3_helpers());
+        if (lp_ctx == NULL) {
+                smb_panic("Could not load smb.conf to init winbindd's imessaging context.\n");
+        }
+
+        /*
+         * Note we MUST use the NULL context here, not the autofree context,
+         * to avoid side effects in forked children exiting.
+         */
+        msg = imessaging_init(NULL, lp_ctx, myself, winbind_event_context(),
+                              false);
+        talloc_unlink(NULL, lp_ctx);
+
+        if (msg == NULL) {
+                smb_panic("Could not init winbindd's messaging context.\n");
+        }
+        return msg;
 }
 
@@ -66 +140 @@
 
         if (lp_loaded()) {
-                char *fname = lp_configfile();
+                char *fname = lp_next_configfile(talloc_tos());
 
                 if (file_exist(fname) && !strcsequal(fname,get_dyn_CONFIGFILE())) {
@@ -81 +155 @@
 
         reopen_logs();
-        ret = lp_load(get_dyn_CONFIGFILE(),False,False,True,True);
+        ret = lp_load_global(get_dyn_CONFIGFILE());
 
         reopen_logs();
         load_interfaces();
+        winbindd_setup_max_fds();
 
         return(ret);
 }
 
-
-/**************************************************************************** **
- Handle a fault..
- **************************************************************************** */
-
-static void fault_quit(void)
-{
-        dump_core();
-}
 
 static void winbindd_status(void)
@@ -170 +236 @@
 
                 if (asprintf(&path, "%s/%s",
-                        get_winbind_pipe_dir(), WINBINDD_SOCKET_NAME) > 0) {
+                        lp_winbindd_socket_directory(), WINBINDD_SOCKET_NAME) > 0) {
                         unlink(path);
                         SAFE_FREE(path);
@@ -193 +259 @@
 
         if (is_parent) {
-                serverid_deregister(procid_self());
-                pidfile_unlink();
+                struct messaging_context *msg = winbind_messaging_context();
+                struct server_id self = messaging_server_id(msg);
+                serverid_deregister(self);
+                pidfile_unlink(lp_pid_directory(), "winbindd");
         }
 
@@ -212 +280 @@
                  signum, (int)*is_parent));
         terminate(*is_parent);
+}
+
+/*
+  handle stdin becoming readable when we are in --foreground mode
+ */
+static void winbindd_stdin_handler(struct tevent_context *ev,
+                               struct tevent_fd *fde,
+                               uint16_t flags,
+                               void *private_data)
+{
+        char c;
+        if (read(0, &c, 1) != 1) {
+                bool *is_parent = talloc_get_type_abort(private_data, bool);
+
+                /* we have reached EOF on stdin, which means the
+                   parent has exited. Shutdown the server */
+                DEBUG(0,("EOF on stdin (is_parent=%d)\n",
+                         (int)*is_parent));
+                terminate(*is_parent);
+        }
 }
 
@@ -262 +350 @@
 }
 
+bool winbindd_setup_stdin_handler(bool parent, bool foreground)
+{
+        bool *is_parent;
+
+        if (foreground) {
+                struct stat st;
+
+                is_parent = talloc(winbind_event_context(), bool);
+                if (!is_parent) {
+                        return false;
+                }
+
+                *is_parent = parent;
+
+                /* if we are running in the foreground then look for
+                   EOF on stdin, and exit if it happens. This allows
+                   us to die if the parent process dies
+                   Only do this on a pipe or socket, no other device.
+                */
+                if (fstat(0, &st) != 0) {
+                        return false;
+                }
+                if (S_ISFIFO(st.st_mode) || S_ISSOCK(st.st_mode)) {
+                        tevent_add_fd(winbind_event_context(),
+                                        is_parent,
+                                        0,
+                                        TEVENT_FD_READ,
+                                        winbindd_stdin_handler,
+                                        is_parent);
+                }
+        }
+
+        return true;
+}
+
 static void winbindd_sig_hup_handler(struct tevent_context *ev,
                                      struct tevent_signal *se,
@@ -388 +511 @@
                                        DATA_BLOB *data)
 {
-        uint8 ret;
+        uint8_t ret;
         pid_t child_pid;
         NTSTATUS status;
@@ -400 +523 @@
          * code can safely use fork/waitpid...
          */
-        child_pid = sys_fork();
+        child_pid = fork();
 
         if (child_pid == -1) {
@@ -427 +550 @@
         CatchSignal(SIGCHLD, SIG_DFL);
 
-        ret = (uint8)winbindd_validate_cache_nobackup();
+        ret = (uint8_t)winbindd_validate_cache_nobackup();
         DEBUG(10, ("winbindd_msg_validata_cache: got return value %d\n", ret));
         messaging_send_buf(msg_ctx, server_id, MSG_WINBIND_VALIDATE_CACHE, &ret,
@@ -460 +583 @@
         { WINBINDD_CCACHE_NTLMAUTH, winbindd_ccache_ntlm_auth, "NTLMAUTH" },
         { WINBINDD_CCACHE_SAVE, winbindd_ccache_save, "CCACHE_SAVE" },
-
-        /* WINS functions */
-
-        { WINBINDD_WINS_BYNAME, winbindd_wins_byname, "WINS_BYNAME" },
-        { WINBINDD_WINS_BYIP, winbindd_wins_byip, "WINS_BYIP" },
 
         /* End of list */
@@ -556 +674 @@
           winbindd_pam_chng_pswd_auth_crap_send,
           winbindd_pam_chng_pswd_auth_crap_recv },
+        { WINBINDD_WINS_BYIP, "WINS_BYIP",
+          winbindd_wins_byip_send, winbindd_wins_byip_recv },
+        { WINBINDD_WINS_BYNAME, "WINS_BYNAME",
+          winbindd_wins_byname_send, winbindd_wins_byname_recv },
 
         { 0, NULL, NULL, NULL }
@@ -589 +711 @@
         state->cmd_name = "unknown request";
         state->recv_fn = NULL;
-        state->last_access = time(NULL);
+        /* client is newest */
+        winbindd_promote_client(state);
 
         /* Process command */
@@ -700 +823 @@
 static void winbind_client_request_read(struct tevent_req *req);
 static void winbind_client_response_written(struct tevent_req *req);
+static void winbind_client_activity(struct tevent_req *req);
 
 static void request_finished(struct winbindd_cli_state *state)
 {
         struct tevent_req *req;
+
+        /* free client socket monitoring request */
+        TALLOC_FREE(state->io_req);
 
         TALLOC_FREE(state->request);
@@ -717 +844 @@
         }
         tevent_req_set_callback(req, winbind_client_response_written, state);
+        state->io_req = req;
 }
 
@@ -725 +853 @@
         ssize_t ret;
         int err;
+
+        state->io_req = NULL;
 
         ret = wb_resp_write_recv(req, &err);
@@ -752 +882 @@
         }
         tevent_req_set_callback(req, winbind_client_request_read, state);
+        state->io_req = req;
 }
 
@@ -786 +917 @@
         if (sock == -1) {
                 if (errno != EINTR) {
-                        DEBUG(0, ("Faild to accept socket - %s\n",
+                        DEBUG(0, ("Failed to accept socket - %s\n",
                                   strerror(errno)));
                 }
@@ -796 +927 @@
         /* Create new connection structure */
 
-        if ((state = TALLOC_ZERO_P(NULL, struct winbindd_cli_state)) == NULL) {
+        if ((state = talloc_zero(NULL, struct winbindd_cli_state)) == NULL) {
                 close(sock);
                 return;
@@ -809 +940 @@
                 return;
         }
-
-        state->last_access = time(NULL);        
 
         state->privileged = privileged;
@@ -822 +951 @@
         }
         tevent_req_set_callback(req, winbind_client_request_read, state);
+        state->io_req = req;
 
         /* Add to connection list */
@@ -834 +964 @@
         ssize_t ret;
         int err;
+
+        state->io_req = NULL;
 
         ret = wb_req_read_recv(req, state, &state->request, &err);
@@ -850 +982 @@
                 return;
         }
+
+        req = wait_for_read_send(state, winbind_event_context(), state->sock,
+                                 true);
+        if (req == NULL) {
+                DEBUG(0, ("winbind_client_request_read[%d:%s]:"
+                          " wait_for_read_send failed - removing client\n",
+                          (int)state->pid, state->cmd_name));
+                remove_client(state);
+                return;
+        }
+        tevent_req_set_callback(req, winbind_client_activity, state);
+        state->io_req = req;
+
         process_request(state);
+}
+
+static void winbind_client_activity(struct tevent_req *req)
+{
+        struct winbindd_cli_state *state =
+            tevent_req_callback_data(req, struct winbindd_cli_state);
+        int err;
+        bool has_data;
+
+        has_data = wait_for_read_recv(req, &err);
+
+        if (has_data) {
+                DEBUG(0, ("winbind_client_activity[%d:%s]:"
+                          "unexpected data from client - removing client\n",
+                          (int)state->pid, state->cmd_name));
+        } else {
+                if (err == EPIPE) {
+                        DEBUG(6, ("winbind_client_activity[%d:%s]: "
+                                  "client has closed connection - removing "
+                                  "client\n",
+                                  (int)state->pid, state->cmd_name));
+                } else {
+                        DEBUG(2, ("winbind_client_activity[%d:%s]: "
+                                  "client socket error (%s) - removing "
+                                  "client\n",
+                                  (int)state->pid, state->cmd_name,
+                                  strerror(err)));
+                }
+        }
+
+        remove_client(state);
 }
 
@@ -865 +1041 @@
                 return;
         }
+
+        /*
+         * We need to remove a pending wb_req_read_*
+         * or wb_resp_write_* request before closing the
+         * socket.
+         *
+         * This is important as they might have used tevent_add_fd() and we
+         * use the epoll * backend on linux. So we must remove the tevent_fd
+         * before closing the fd.
+         *
+         * Otherwise we might hit a race with close_conns_after_fork() (via
+         * winbindd_reinit_after_fork()) where a file description
+         * is still open in a child, which means it's still active in
+         * the parents epoll queue, but the related tevent_fd is already
+         * already gone in the parent.
+         *
+         * See bug #11141.
+         */
+        TALLOC_FREE(state->io_req);
 
         if (state->sock != -1) {
@@ -901 +1096 @@
 {
         struct winbindd_cli_state *state, *remove_state = NULL;
-        time_t last_access = 0;
         int nidle = 0;
 
@@ -907 +1101 @@
                 if (client_is_idle(state)) {
                         nidle++;
-                        if (!last_access || state->last_access < last_access) {
-                                last_access = state->last_access;
-                                remove_state = state;
-                        }
+                        /* list is sorted by access time */
+                        remove_state = state;
                 }
         }
@@ -922 +1114 @@
 
         return False;
+}
+
+/*
+ * Terminate all clients whose requests have taken longer than
+ * "winbind request timeout" seconds to process, or have been
+ * idle for more than "winbind request timeout" seconds.
+ */
+
+static void remove_timed_out_clients(void)
+{
+        struct winbindd_cli_state *state, *prev = NULL;
+        time_t curr_time = time(NULL);
+        int timeout_val = lp_winbind_request_timeout();
+
+        for (state = winbindd_client_list_tail(); state; state = prev) {
+                time_t expiry_time;
+
+                prev = winbindd_client_list_prev(state);
+                expiry_time = state->last_access + timeout_val;
+
+                if (curr_time > expiry_time) {
+                        if (client_is_idle(state)) {
+                                DEBUG(5,("Idle client timed out, "
+                                        "shutting down sock %d, pid %u\n",
+                                        state->sock,
+                                        (unsigned int)state->pid));
+                        } else {
+                                DEBUG(5,("Client request timed out, "
+                                        "shutting down sock %d, pid %u\n",
+                                        state->sock,
+                                        (unsigned int)state->pid));
+                        }
+                        remove_client(state);
+                } else {
+                        /* list is sorted, previous clients in
+                           list are newer */
+                        break;
+                }
+        }
+}
+
+static void winbindd_scrub_clients_handler(struct tevent_context *ev,
+                                           struct tevent_timer *te,
+                                           struct timeval current_time,
+                                           void *private_data)
+{
+        remove_timed_out_clients();
+        if (tevent_add_timer(ev, ev,
+                             timeval_current_ofs(SCRUB_CLIENTS_INTERVAL, 0),
+                             winbindd_scrub_clients_handler, NULL) == NULL) {
+                DEBUG(0, ("winbindd: failed to reschedule client scrubber\n"));
+                exit(1);
+        }
 }
 
@@ -949 +1194 @@
                 }
         }
+        remove_timed_out_clients();
         new_connection(s->fd, s->privileged);
 }
@@ -956 +1202 @@
  */
 
-const char *get_winbind_pipe_dir(void)
-{
-        return lp_parm_const_string(-1, "winbindd", "socket dir", WINBINDD_SOCKET_DIR);
-}
-
 char *get_winbind_priv_pipe_dir(void)
 {
-        return lock_path(WINBINDD_PRIV_SOCKET_SUBDIR);
+        return state_path(WINBINDD_PRIV_SOCKET_SUBDIR);
+}
+
+static void winbindd_setup_max_fds(void)
+{
+        int num_fds = MAX_OPEN_FUDGEFACTOR;
+        int actual_fds;
+
+        num_fds += lp_winbind_max_clients();
+        /* Add some more to account for 2 sockets open
+           when the client transitions from unprivileged
+           to privileged socket
+        */
+        num_fds += lp_winbind_max_clients() / 10;
+
+        /* Add one socket per child process
+           (yeah there are child processes other than the
+           domain children but only domain children can vary
+           with configuration
+        */
+        num_fds += lp_winbind_max_domain_connections() *
+                   (lp_allow_trusted_domains() ? WINBIND_MAX_DOMAINS_HINT : 1);
+
+        actual_fds = set_maxfiles(num_fds);
+
+        if (actual_fds < num_fds) {
+                DEBUG(1, ("winbindd_setup_max_fds: Information only: "
+                          "requested %d open files, %d are available.\n",
+                          num_fds, actual_fds));
+        }
 }
 
@@ -971 +1241 @@
         struct winbindd_listen_state *priv_state = NULL;
         struct tevent_fd *fde;
+        int rc;
+        char *socket_path;
 
         pub_state = talloc(winbind_event_context(),
@@ -980 +1252 @@
         pub_state->privileged = false;
         pub_state->fd = create_pipe_sock(
-                get_winbind_pipe_dir(), WINBINDD_SOCKET_NAME, 0755);
+                lp_winbindd_socket_directory(), WINBINDD_SOCKET_NAME, 0755);
         if (pub_state->fd == -1) {
+                goto failed;
+        }
+        rc = listen(pub_state->fd, 5);
+        if (rc < 0) {
                 goto failed;
         }
@@ -1000 +1276 @@
         }
 
+        socket_path = get_winbind_priv_pipe_dir();
+        if (socket_path == NULL) {
+                goto failed;
+        }
+
         priv_state->privileged = true;
         priv_state->fd = create_pipe_sock(
-                get_winbind_priv_pipe_dir(), WINBINDD_SOCKET_NAME, 0750);
+                socket_path, WINBINDD_SOCKET_NAME, 0750);
+        TALLOC_FREE(socket_path);
         if (priv_state->fd == -1) {
+                goto failed;
+        }
+        rc = listen(priv_state->fd, 5);
+        if (rc < 0) {
                 goto failed;
         }
@@ -1016 +1302 @@
         tevent_fd_set_auto_close(fde);
 
+        winbindd_scrub_clients_handler(winbind_event_context(), NULL,
+                                       timeval_current(), NULL);
         return true;
 failed:
@@ -1033 +1321 @@
 }
 
-void winbindd_register_handlers(void)
-{
+static void winbindd_register_handlers(struct messaging_context *msg_ctx,
+                                       bool foreground)
+{
+        NTSTATUS status;
         /* Setup signal handlers */
 
         if (!winbindd_setup_sig_term_handler(true))
+                exit(1);
+        if (!winbindd_setup_stdin_handler(true, foreground))
                 exit(1);
         if (!winbindd_setup_sig_hup_handler(NULL))
@@ -1058 +1350 @@
         /* get broadcast messages */
 
-        if (!serverid_register(procid_self(),
-                               FLAG_MSG_GENERAL|FLAG_MSG_DBWRAP)) {
+        if (!serverid_register(messaging_server_id(msg_ctx),
+                               FLAG_MSG_GENERAL |
+                               FLAG_MSG_WINBIND |
+                               FLAG_MSG_DBWRAP)) {
                 DEBUG(1, ("Could not register myself in serverid.tdb\n"));
                 exit(1);
@@ -1066 +1360 @@
         /* React on 'smbcontrol winbindd reload-config' in the same way
            as to SIGHUP signal */
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_SMB_CONF_UPDATED, msg_reload_services);
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_SHUTDOWN, msg_shutdown);
 
         /* Handle online/offline messages. */
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_WINBIND_OFFLINE, winbind_msg_offline);
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_WINBIND_ONLINE, winbind_msg_online);
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_WINBIND_ONLINESTATUS, winbind_msg_onlinestatus);
 
@@ -1085 +1379 @@
                            MSG_WINBIND_DOMAIN_ONLINE, winbind_msg_domain_online);
 
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_DUMP_EVENT_LIST, winbind_msg_dump_event_list);
 
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_WINBIND_VALIDATE_CACHE,
                            winbind_msg_validate_cache);
 
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_WINBIND_DUMP_DOMAIN_LIST,
                            winbind_msg_dump_domain_list);
 
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_WINBIND_IP_DROPPED,
                            winbind_msg_ip_dropped_parent);
 
         /* Register handler for MSG_DEBUG. */
-        messaging_register(winbind_messaging_context(), NULL,
+        messaging_register(msg_ctx, NULL,
                            MSG_DEBUG,
                            winbind_msg_debug);
@@ -1130 +1424 @@
         }
 
+        status = wb_irpc_register();
+
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Could not register IRPC handlers\n"));
+                exit(1);
+        }
 }
 
@@ -1218 +1518 @@
 /* Main function */
 
-int main(int argc, char **argv, char **envp)
+int main(int argc, const char **argv)
 {
         static bool is_daemon = False;
@@ -1245 +1545 @@
         TALLOC_CTX *frame;
         NTSTATUS status;
+        bool ok;
 
         /*
@@ -1252 +1553 @@
         frame = talloc_stackframe();
 
+        /*
+         * We want total control over the permissions on created files,
+         * so set our umask to 0.
+         */
+        umask(0);
+
+        setup_logging("winbindd", DEBUG_DEFAULT_STDOUT);
+
         /* glibc (?) likes to print "User defined signal 1" and exit if a
            SIGUSR[12] is received before a handler is installed */
@@ -1258 +1567 @@
         CatchSignal(SIGUSR2, SIG_IGN);
 
-        fault_setup((void (*)(void *))fault_quit );
-        dump_core_setup("winbindd");
-
-        load_case_tables();
+        fault_setup();
+        dump_core_setup("winbindd", lp_logfile(talloc_tos()));
+
+        smb_init_locale();
 
         /* Initialise for running in non-root mode */
@@ -1279 +1588 @@
         /* Initialise samba/rpc client stuff */
 
-        pc = poptGetContext("winbindd", argc, (const char **)argv, long_options, 0);
+        pc = poptGetContext("winbindd", argc, argv, long_options, 0);
 
         while ((opt = poptGetNextOpt(pc)) != -1) {
@@ -1319 +1628 @@
          * in production.
          */
-        dump_core_setup("winbindd");
-
+        dump_core_setup("winbindd", lp_logfile(talloc_tos()));
         if (is_daemon && interactive) {
                 d_fprintf(stderr,"\nERROR: "
@@ -1345 +1653 @@
                 }
         }
+
         if (log_stdout) {
                 setup_logging("winbindd", DEBUG_STDOUT);
@@ -1356 +1665 @@
 
         if (!lp_load_initial_only(get_dyn_CONFIGFILE())) {
-                DEBUG(0, ("error opening config file\n"));
+                DEBUG(0, ("error opening config file '%s'\n", get_dyn_CONFIGFILE()));
                 exit(1);
         }
@@ -1363 +1672 @@
          * path is by default basename(lp_logfile()).
          */
-        dump_core_setup("winbindd");
+        dump_core_setup("winbindd", lp_logfile(talloc_tos()));
+
+        if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC
+            && !lp_parm_bool(-1, "server role check", "inhibit", false)) {
+                DEBUG(0, ("server role = 'active directory domain controller' not compatible with running the winbindd binary. \n"));
+                DEBUGADD(0, ("You should start 'samba' instead, and it will control starting the internal AD DC winbindd implementation, which is not the same as this one\n"));
+                exit(1);
+        }
+
+        if (!cluster_probe_ok()) {
+                exit(1);
+        }
 
         /* Initialise messaging system */
@@ -1376 +1696 @@
         }
 
-        if (!directory_exist(lp_lockdir())) {
-                mkdir(lp_lockdir(), 0755);
+        ok = directory_create_or_exist(lp_lock_directory(), 0755);
+        if (!ok) {
+                DEBUG(0, ("Failed to create directory %s for lock files - %s\n",
+                          lp_lock_directory(), strerror(errno)));
+                exit(1);
+        }
+
+        ok = directory_create_or_exist(lp_pid_directory(), 0755);
+        if (!ok) {
+                DEBUG(0, ("Failed to create directory %s for pid files - %s\n",
+                          lp_pid_directory(), strerror(errno)));
+                exit(1);
         }
 
@@ -1391 +1721 @@
                 DEBUG(0,("Could not initialize domain trust account secrets. Giving up\n"));
                 return False;
+        }
+
+        status = rpccli_pre_open_netlogon_creds();
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("rpccli_pre_open_netlogon_creds() - %s\n",
+                          nt_errstr(status)));
+                exit(1);
         }
 
@@ -1407 +1744 @@
                 become_daemon(Fork, no_process_group, log_stdout);
 
-        pidfile_create("winbindd");
+        pidfile_create(lp_pid_directory(), "winbindd");
 
 #if HAVE_SETPGID
@@ -1427 +1764 @@
         status = reinit_after_fork(winbind_messaging_context(),
                                    winbind_event_context(),
-                                   procid_self(), false);
+                                   false, NULL);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("reinit_after_fork() failed\n"));
-                exit(1);
-        }
-
-        winbindd_register_handlers();
-
-        status = init_system_info();
+                exit_daemon("Winbindd reinit_after_fork() failed", map_errno_from_nt_status(status));
+        }
+
+        /*
+         * Do not initialize the parent-child-pipe before becoming
+         * a daemon: this is used to detect a died parent in the child
+         * process.
+         */
+        status = init_before_fork();
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("ERROR: failed to setup system user info: %s.\n",
-                          nt_errstr(status)));
-                exit(1);
+                exit_daemon(nt_errstr(status), map_errno_from_nt_status(status));
+        }
+
+        winbindd_register_handlers(winbind_messaging_context(), !Fork);
+
+        if (!messaging_parent_dgm_cleanup_init(winbind_messaging_context())) {
+                exit(1);
+        }
+
+        status = init_system_session_info();
+        if (!NT_STATUS_IS_OK(status)) {
+                exit_daemon("Winbindd failed to setup system user info", map_errno_from_nt_status(status));
         }
 
@@ -1451 +1799 @@
 
         if (!winbindd_setup_listeners()) {
-                DEBUG(0,("winbindd_setup_listeners() failed\n"));
-                exit(1);
-        }
+                exit_daemon("Winbindd failed to setup listeners", EPIPE);
+        }
+
+        irpc_add_name(winbind_imessaging_context(), "winbind_server");
 
         TALLOC_FREE(frame);
+
+        if (!interactive) {
+                daemon_ready("winbindd");
+        }
+
         /* Loop waiting for requests */
         while (1) {

vendor/current/source3/winbindd/winbindd.h

@@ -26 +26 @@
 #include "nsswitch/winbind_struct_protocol.h"
 #include "nsswitch/libwbclient/wbclient.h"
-#include "librpc/gen_ndr/wbint.h"
+#include "librpc/gen_ndr/dcerpc.h"
+#include "librpc/gen_ndr/winbind.h"
 
 #include "talloc_dict.h"
-#include "smb_ldap.h"
 
 #include "../lib/util/tevent_ntstatus.h"
@@ -68 +68 @@
         struct tevent_queue *out_queue;
         struct winbindd_response *response;        /* Respose to client */
-        bool getpwent_initialized;                /* Has getpwent_state been
-                                                   * initialized? */
-        bool getgrent_initialized;                /* Has getgrent_state been
-                                                   * initialized? */
+        struct tevent_req *io_req; /* wb_req_read_* or wb_resp_write_* */
 
         struct getpwent_state *pwent_state; /* State for getpwent() */
@@ -107 +104 @@
         struct cli_state *cli;
 
+        enum dcerpc_AuthLevel auth_level;
+
         struct rpc_pipe_client *samr_pipe;
         struct policy_handle sam_connect_handle, sam_domain_handle;
@@ -115 +114 @@
 
         struct rpc_pipe_client *netlogon_pipe;
+        struct netlogon_creds_cli_context *netlogon_creds;
+        uint32_t netlogon_flags;
+        bool netlogon_force_reauth;
 };
 
@@ -139 +141 @@
         struct dcerpc_binding_handle *binding_handle;
 
-        struct timed_event *lockout_policy_event;
-        struct timed_event *machine_password_change_event;
+        struct tevent_timer *lockout_policy_event;
+        struct tevent_timer *machine_password_change_event;
 
         const struct winbindd_child_dispatch_table *table;
@@ -148 +150 @@
 
 struct winbindd_domain {
-        fstring name;                          /* Domain name (NetBIOS) */
-        fstring alt_name;                      /* alt Domain name, if any (FQDN for ADS) */
-        fstring forest_name;                   /* Name of the AD forest we're in */
+        char *name;                            /* Domain name (NetBIOS) */
+        char *alt_name;                        /* alt Domain name, if any (FQDN for ADS) */
+        char *forest_name;                     /* Name of the AD forest we're in */
         struct dom_sid sid;                           /* SID for this domain */
-        uint32 domain_flags;                   /* Domain flags from netlogon.h */
-        uint32 domain_type;                    /* Domain type from netlogon.h */
-        uint32 domain_trust_attribs;           /* Trust attribs from netlogon.h */
+        uint32_t domain_flags;                   /* Domain flags from netlogon.h */
+        uint32_t domain_type;                    /* Domain type from netlogon.h */
+        uint32_t domain_trust_attribs;           /* Trust attribs from netlogon.h */
         bool initialized;                      /* Did we already ask for the domain mode? */
         bool native_mode;                      /* is this a win2k domain in native mode ? */
@@ -160 +162 @@
         bool primary;                          /* is this our primary domain ? */
         bool internal;                         /* BUILTIN and member SAM */
+        bool rodc;                             /* Are we an RODC for this AD domain? (do some operations locally) */
         bool online;                           /* is this domain available ? */
         time_t startup_time;                   /* When we set "startup" true. monotonic clock */
         bool startup;                          /* are we in the first 30 seconds after startup_time ? */
 
-        bool can_do_samlogon_ex; /* Due to the lack of finer control what type
-                                  * of DC we have, let us try to do a
-                                  * credential-chain less samlogon_ex call
-                                  * with AD and schannel. If this fails with
-                                  * DCERPC_FAULT_OP_RNG_ERROR, then set this
-                                  * to False. This variable is around so that
-                                  * we don't have to try _ex every time. */
-
         bool can_do_ncacn_ip_tcp;
-        bool can_do_validation6;
 
         /* Lookup methods for this domain (LDAP or RPC) */
@@ -186 +180 @@
         void *private_data;
 
-        /*
-         * idmap config settings, used to tell the idmap child which
-         * special domain config to use for a mapping
-         */
-        bool have_idmap_config;
-        uint32_t id_range_low, id_range_high;
-
         /* A working DC */
         pid_t dc_probe_pid; /* Child we're using to detect the DC. */
-        fstring dcname;
+        char *dcname;
         struct sockaddr_storage dcaddr;
 
@@ -201 +188 @@
 
         time_t last_seq_check;
-        uint32 sequence_number;
+        uint32_t sequence_number;
         NTSTATUS last_status;
 
@@ -214 +201 @@
         /* Callback we use to try put us back online. */
 
-        uint32 check_online_timeout;
-        struct timed_event *check_online_event;
+        uint32_t check_online_timeout;
+        struct tevent_timer *check_online_event;
 
         /* Linked list info */
@@ -238 +225 @@
         NTSTATUS (*query_user_list)(struct winbindd_domain *domain,
                                    TALLOC_CTX *mem_ctx,
-                                   uint32 *num_entries, 
+                                   uint32_t *num_entries,
                                    struct wbint_userinfo **info);
 
@@ -244 +231 @@
         NTSTATUS (*enum_dom_groups)(struct winbindd_domain *domain,
                                     TALLOC_CTX *mem_ctx,
-                                    uint32 *num_entries, 
+                                    uint32_t *num_entries,
                                     struct wb_acct_info **info);
 
@@ -250 +237 @@
         NTSTATUS (*enum_local_groups)(struct winbindd_domain *domain,
                                     TALLOC_CTX *mem_ctx,
-                                    uint32 *num_entries, 
+                                    uint32_t *num_entries,
                                     struct wb_acct_info **info);
 
@@ -273 +260 @@
                                   TALLOC_CTX *mem_ctx,
                                   const struct dom_sid *domain_sid,
-                                  uint32 *rids,
+                                  uint32_t *rids,
                                   size_t num_rids,
                                   char **domain_name,
@@ -291 +278 @@
                                       TALLOC_CTX *mem_ctx,
                                       const struct dom_sid *user_sid,
-                                      uint32 *num_groups, struct dom_sid **user_gids);
+                                      uint32_t *num_groups, struct dom_sid **user_gids);
 
         /* Lookup all aliases that the sids delivered are member of. This is
@@ -297 +284 @@
         NTSTATUS (*lookup_useraliases)(struct winbindd_domain *domain,
                                        TALLOC_CTX *mem_ctx,
-                                       uint32 num_sids,
+                                       uint32_t num_sids,
                                        const struct dom_sid *sids,
-                                       uint32 *num_aliases,
-                                       uint32 **alias_rids);
+                                       uint32_t *num_aliases,
+                                       uint32_t **alias_rids);
 
         /* find all members of the group with the specified group_rid */
@@ -307 +294 @@
                                     const struct dom_sid *group_sid,
                                     enum lsa_SidType type,
-                                    uint32 *num_names, 
+                                    uint32_t *num_names,
                                     struct dom_sid **sid_mem, char ***names,
-                                    uint32 **name_types);
+                                    uint32_t **name_types);
 
         /* return the current global sequence number */
-        NTSTATUS (*sequence_number)(struct winbindd_domain *domain, uint32 *seq);
+        NTSTATUS (*sequence_number)(struct winbindd_domain *domain, uint32_t *seq);
 
         /* return the lockout policy */
@@ -353 +340 @@
         const char *dns_name;
         struct dom_sid sid;
-        uint32 trust_flags;
-        uint32 trust_attribs;
-        uint32 trust_type;
+        uint32_t trust_flags;
+        uint32_t trust_attribs;
+        uint32_t trust_type;
 };
 
@@ -388 +375 @@
         time_t renew_until;
         time_t refresh_time;
-        struct timed_event *event;
+        struct tevent_timer *event;
 };
 
@@ -396 +383 @@
 #define WINBINDD_RESCAN_FREQ lp_winbind_cache_time()
 #define WINBINDD_PAM_AUTH_KRB5_RENEW_TIME 2592000 /* one month */
-#define DOM_SEQUENCE_NONE ((uint32)-1)
-
-#define winbind_event_context server_event_context
+#define DOM_SEQUENCE_NONE ((uint32_t)-1)
 
 #endif /* _WINBINDD_H */

vendor/current/source3/winbindd/winbindd_ads.c

@@ -28 +28 @@
 #include "../libds/common/flags.h"
 #include "ads.h"
-#include "secrets.h"
 #include "../libcli/ldap/ldap_ndr.h"
 #include "../libcli/security/security.h"
@@ -40 +39 @@
 
 extern struct winbindd_methods reconnect_methods;
+extern struct winbindd_methods msrpc_methods;
+
+#define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
+
+/**
+ * Check if cached connection can be reused. If the connection cannot
+ * be reused the ADS_STRUCT is freed and the pointer is set to NULL.
+ */
+static void ads_cached_connection_reuse(ADS_STRUCT **adsp)
+{
+
+        ADS_STRUCT *ads = *adsp;
+
+        if (ads != NULL) {
+                time_t expire;
+                time_t now = time(NULL);
+
+                expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
+
+                DEBUG(7, ("Current tickets expire in %d seconds (at %d, time "
+                          "is now %d)\n", (uint32_t)expire - (uint32_t)now,
+                          (uint32_t) expire, (uint32_t) now));
+
+                if ( ads->config.realm && (expire > now)) {
+                        return;
+                } else {
+                        /* we own this ADS_STRUCT so make sure it goes away */
+                        DEBUG(7,("Deleting expired krb5 credential cache\n"));
+                        ads->is_mine = True;
+                        ads_destroy( &ads );
+                        ads_kdestroy(WINBIND_CCACHE_NAME);
+                        *adsp = NULL;
+                }
+        }
+}
+
+/**
+ * @brief Establish a connection to a DC
+ *
+ * @param[out]   adsp             ADS_STRUCT that will be created
+ * @param[in]    target_realm     Realm of domain to connect to
+ * @param[in]    target_dom_name  'workgroup' name of domain to connect to
+ * @param[in]    ldap_server      DNS name of server to connect to
+ * @param[in]    password         Our machine acount secret
+ * @param[in]    auth_realm       Realm of local domain for creating krb token
+ * @param[in]    renewable        Renewable ticket time
+ *
+ * @return ADS_STATUS
+ */
+static ADS_STATUS ads_cached_connection_connect(ADS_STRUCT **adsp,
+                                                const char *target_realm,
+                                                const char *target_dom_name,
+                                                const char *ldap_server,
+                                                char *password,
+                                                char *auth_realm,
+                                                time_t renewable)
+{
+        ADS_STRUCT *ads;
+        ADS_STATUS status;
+        struct sockaddr_storage dc_ss;
+        fstring dc_name;
+
+        if (auth_realm == NULL) {
+                return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
+        }
+
+        /* we don't want this to affect the users ccache */
+        setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
+
+        ads = ads_init(target_realm, target_dom_name, ldap_server);
+        if (!ads) {
+                DEBUG(1,("ads_init for domain %s failed\n", target_dom_name));
+                return ADS_ERROR(LDAP_NO_MEMORY);
+        }
+
+        SAFE_FREE(ads->auth.password);
+        SAFE_FREE(ads->auth.realm);
+
+        ads->auth.renewable = renewable;
+        ads->auth.password = password;
+
+        ads->auth.realm = SMB_STRDUP(auth_realm);
+        if (!strupper_m(ads->auth.realm)) {
+                ads_destroy(&ads);
+                return ADS_ERROR_NT(NT_STATUS_INTERNAL_ERROR);
+        }
+
+        /* Setup the server affinity cache.  We don't reaally care
+           about the name.  Just setup affinity and the KRB5_CONFIG
+           file. */
+        get_dc_name(ads->server.workgroup, ads->server.realm, dc_name, &dc_ss);
+
+        status = ads_connect(ads);
+        if (!ADS_ERR_OK(status)) {
+                DEBUG(1,("ads_connect for domain %s failed: %s\n",
+                         target_dom_name, ads_errstr(status)));
+                ads_destroy(&ads);
+                return status;
+        }
+
+        /* set the flag that says we don't own the memory even
+           though we do so that ads_destroy() won't destroy the
+           structure we pass back by reference */
+
+        ads->is_mine = False;
+
+        *adsp = ads;
+
+        return status;
+}
+
+ADS_STATUS ads_idmap_cached_connection(ADS_STRUCT **adsp, const char *dom_name)
+{
+        char *ldap_server, *realm, *password;
+        struct winbindd_domain *wb_dom;
+        ADS_STATUS status;
+
+        ads_cached_connection_reuse(adsp);
+        if (*adsp != NULL) {
+                return ADS_SUCCESS;
+        }
+
+        /*
+         * At this point we only have the NetBIOS domain name.
+         * Check if we can get server nam and realm from SAF cache
+         * and the domain list.
+         */
+        ldap_server = saf_fetch(talloc_tos(), dom_name);
+        DEBUG(10, ("ldap_server from saf cache: '%s'\n",
+                   ldap_server ? ldap_server : ""));
+
+        wb_dom = find_domain_from_name(dom_name);
+        if (wb_dom == NULL) {
+                DEBUG(10, ("could not find domain '%s'\n", dom_name));
+                return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
+        }
+
+        DEBUG(10, ("find_domain_from_name found realm '%s' for "
+                          " domain '%s'\n", wb_dom->alt_name, dom_name));
+
+        if (!get_trust_pw_clear(dom_name, &password, NULL, NULL)) {
+                TALLOC_FREE(ldap_server);
+                return ADS_ERROR_NT(NT_STATUS_CANT_ACCESS_DOMAIN_INFO);
+        }
+
+        if (IS_DC) {
+                SMB_ASSERT(wb_dom->alt_name != NULL);
+                realm = SMB_STRDUP(wb_dom->alt_name);
+        } else {
+                struct winbindd_domain *our_domain = wb_dom;
+
+                /* always give preference to the alt_name in our
+                   primary domain if possible */
+
+                if (!wb_dom->primary) {
+                        our_domain = find_our_domain();
+                }
+
+                if (our_domain->alt_name != NULL) {
+                        realm = SMB_STRDUP(our_domain->alt_name);
+                } else {
+                        realm = SMB_STRDUP(lp_realm());
+                }
+        }
+
+        status = ads_cached_connection_connect(
+                adsp,                   /* Returns ads struct. */
+                wb_dom->alt_name,       /* realm to connect to. */
+                dom_name,               /* 'workgroup' name for ads_init */
+                ldap_server,            /* DNS name to connect to. */
+                password,               /* password for auth realm. */
+                realm,                  /* realm used for krb5 ticket. */
+                0);                     /* renewable ticket time. */
+
+        SAFE_FREE(realm);
+        TALLOC_FREE(ldap_server);
+
+        return status;
+}
 
 /*
@@ -47 +225 @@
 static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
 {
-        ADS_STRUCT *ads;
         ADS_STATUS status;
-        fstring dc_name;
-        struct sockaddr_storage dc_ss;
+        char *password, *realm;
 
         DEBUG(10,("ads_cached_connection\n"));
+        ads_cached_connection_reuse((ADS_STRUCT **)&domain->private_data);
 
         if (domain->private_data) {
-
-                time_t expire;
-                time_t now = time(NULL);
-
-                /* check for a valid structure */
-                ads = (ADS_STRUCT *)domain->private_data;
-
-                expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
-
-                DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
-                          (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
-
-                if ( ads->config.realm && (expire > now)) {
-                        return ads;
-                } else {
-                        /* we own this ADS_STRUCT so make sure it goes away */
-                        DEBUG(7,("Deleting expired krb5 credential cache\n"));
-                        ads->is_mine = True;
-                        ads_destroy( &ads );
-                        ads_kdestroy("MEMORY:winbind_ccache");
-                        domain->private_data = NULL;
-                }
-        }
-
-        /* we don't want this to affect the users ccache */
-        setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
-
-        ads = ads_init(domain->alt_name, domain->name, NULL);
-        if (!ads) {
-                DEBUG(1,("ads_init for domain %s failed\n", domain->name));
+                return (ADS_STRUCT *)domain->private_data;
+        }
+
+        /* the machine acct password might have change - fetch it every time */
+
+        if (!get_trust_pw_clear(domain->name, &password, NULL, NULL)) {
                 return NULL;
         }
 
-        /* the machine acct password might have change - fetch it every time */
-
-        SAFE_FREE(ads->auth.password);
-        SAFE_FREE(ads->auth.realm);
-
         if ( IS_DC ) {
-
-                if ( !pdb_get_trusteddom_pw( domain->name, &ads->auth.password, NULL, NULL ) ) {
-                        ads_destroy( &ads );
-                        return NULL;
-                }
-                ads->auth.realm = SMB_STRDUP( ads->server.realm );
-                strupper_m( ads->auth.realm );
+                SMB_ASSERT(domain->alt_name != NULL);
+                realm = SMB_STRDUP(domain->alt_name);
         }
         else {
                 struct winbindd_domain *our_domain = domain;
 
-                ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 
                 /* always give preference to the alt_name in our
@@ -113 +255 @@
                         our_domain = find_our_domain();
 
-                if ( our_domain->alt_name[0] != '\0' ) {
-                        ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
-                        strupper_m( ads->auth.realm );
+                if (our_domain->alt_name != NULL) {
+                        realm = SMB_STRDUP( our_domain->alt_name );
                 }
                 else
-                        ads->auth.realm = SMB_STRDUP( lp_realm() );
-        }
-
-        ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME;
-
-        /* Setup the server affinity cache.  We don't reaally care
-           about the name.  Just setup affinity and the KRB5_CONFIG
-           file. */
-
-        get_dc_name( ads->server.workgroup, ads->server.realm, dc_name, &dc_ss );
-
-        status = ads_connect(ads);
-        if (!ADS_ERR_OK(status) || !ads->config.realm) {
-                DEBUG(1,("ads_connect for domain %s failed: %s\n",
-                         domain->name, ads_errstr(status)));
-                ads_destroy(&ads);
-
+                        realm = SMB_STRDUP( lp_realm() );
+        }
+
+        status = ads_cached_connection_connect(
+                                        (ADS_STRUCT **)&domain->private_data,
+                                        domain->alt_name,
+                                        domain->name, NULL,
+                                        password, realm,
+                                        WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
+        SAFE_FREE(realm);
+
+        if (!ADS_ERR_OK(status)) {
                 /* if we get ECONNREFUSED then it might be a NT4
                    server, fall back to MSRPC */
@@ -146 +282 @@
         }
 
-        /* set the flag that says we don't own the memory even
-           though we do so that ads_destroy() won't destroy the
-           structure we pass back by reference */
-
-        ads->is_mine = False;
-
-        domain->private_data = (void *)ads;
-        return ads;
-}
-
+        return (ADS_STRUCT *)domain->private_data;
+}
 
 /* Query display info for a realm. This is the basic user list fn */
 static NTSTATUS query_user_list(struct winbindd_domain *domain,
                                TALLOC_CTX *mem_ctx,
-                               uint32 *num_entries, 
+                               uint32_t *num_entries,
                                struct wbint_userinfo **pinfo)
 {
@@ -192 +320 @@
                 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
                 status = ads_ntstatus(rc);
+                goto done;
         } else if (!res) {
                 DEBUG(1,("query_user_list ads_search returned NULL res\n"));
-
                 goto done;
         }
@@ -204 +332 @@
         }
 
-        (*pinfo) = TALLOC_ZERO_ARRAY(mem_ctx, struct wbint_userinfo, count);
+        (*pinfo) = talloc_zero_array(mem_ctx, struct wbint_userinfo, count);
         if (!*pinfo) {
                 status = NT_STATUS_NO_MEMORY;
@@ -214 +342 @@
         for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
                 struct wbint_userinfo *info = &((*pinfo)[count]);
-                uint32 group;
-                uint32 atype;
+                uint32_t group;
+                uint32_t atype;
 
                 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
@@ -224 +352 @@
 
                 info->acct_name = ads_pull_username(ads, mem_ctx, msg);
-                info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
+                info->full_name = ads_pull_string(ads, mem_ctx, msg, "displayName");
+                if (info->full_name == NULL) {
+                        info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
+                }
                 info->homedir = NULL;
                 info->shell = NULL;
@@ -281 +412 @@
 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries, 
+                                uint32_t *num_entries,
                                 struct wb_acct_info **info)
 {
@@ -360 +491 @@
         }
 
-        (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct wb_acct_info, count);
+        (*info) = talloc_zero_array(mem_ctx, struct wb_acct_info, count);
         if (!*info) {
                 status = NT_STATUS_NO_MEMORY;
@@ -371 +502 @@
                 char *name, *gecos;
                 struct dom_sid sid;
-                uint32 rid;
+                uint32_t rid;
 
                 name = ads_pull_username(ads, mem_ctx, msg);
@@ -407 +538 @@
 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries, 
+                                uint32_t *num_entries,
                                 struct wb_acct_info **info)
 {
@@ -434 +565 @@
                             enum lsa_SidType *type)
 {
-        return reconnect_methods.name_to_sid(domain, mem_ctx,
-                                             domain_name, name, flags,
-                                             sid, type);
+        return msrpc_methods.name_to_sid(domain, mem_ctx, domain_name, name,
+                                         flags, sid, type);
 }
 
@@ -447 +577 @@
                             enum lsa_SidType *type)
 {
-        return reconnect_methods.sid_to_name(domain, mem_ctx, sid,
-                                             domain_name, name, type);
+        return msrpc_methods.sid_to_name(domain, mem_ctx, sid,
+                                         domain_name, name, type);
 }
 
@@ -455 +585 @@
                               TALLOC_CTX *mem_ctx,
                               const struct dom_sid *sid,
-                              uint32 *rids,
+                              uint32_t *rids,
                               size_t num_rids,
                               char **domain_name,
@@ -461 +591 @@
                               enum lsa_SidType **types)
 {
-        return reconnect_methods.rids_to_names(domain, mem_ctx, sid,
-                                               rids, num_rids,
-                                               domain_name, names, types);
+        return msrpc_methods.rids_to_names(domain, mem_ctx, sid,
+                                           rids, num_rids,
+                                           domain_name, names, types);
 }
 
@@ -484 +614 @@
         char *ldap_exp;
         char *sidstr;
-        uint32 group_rid;
+        uint32_t group_rid;
         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
         struct netr_SamInfo3 *user = NULL;
         gid_t gid = -1;
         int ret;
-        char *ads_name;
+        char *full_name;
 
         DEBUG(3,("ads: query_user\n"));
@@ -498 +628 @@
         /* try netsamlogon cache first */
 
-        if ( (user = netsamlogon_cache_get( mem_ctx, sid )) != NULL ) 
+        if ( (user = netsamlogon_cache_get( mem_ctx, sid )) != NULL )
         {
                 DEBUG(5,("query_user: Cache lookup succeeded for %s\n", 
@@ -515 +645 @@
 
                 TALLOC_FREE(user);
+
+                if (info->full_name == NULL) {
+                        /* this might fail so we don't check the return code */
+                        wcache_query_user_fullname(domain,
+                                                   mem_ctx,
+                                                   sid,
+                                                   &info->full_name);
+                }
 
                 return NT_STATUS_OK;
@@ -593 +731 @@
          * the ads struct, potentially invalidating the ldap message.
          */
-        ads_name = ads_pull_string(ads, mem_ctx, msg, "name");
+        full_name = ads_pull_string(ads, mem_ctx, msg, "displayName");
+        if (full_name == NULL) {
+                full_name = ads_pull_string(ads, mem_ctx, msg, "name");
+        }
 
         ads_msgfree(ads, msg);
@@ -609 +750 @@
 
         if (info->full_name == NULL) {
-                info->full_name = ads_name;
+                info->full_name = full_name;
         } else {
-                TALLOC_FREE(ads_name);
+                TALLOC_FREE(full_name);
         }
 
@@ -786 +927 @@
         }
 
-        group_sids = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, num_strings + 1);
+        group_sids = talloc_zero_array(mem_ctx, struct dom_sid, num_strings + 1);
         if (!group_sids) {
                 status = NT_STATUS_NO_MEMORY;
@@ -849 +990 @@
                                   TALLOC_CTX *mem_ctx,
                                   const struct dom_sid *sid,
-                                  uint32 *p_num_groups, struct dom_sid **user_sids)
+                                  uint32_t *p_num_groups, struct dom_sid **user_sids)
 {
         ADS_STRUCT *ads = NULL;
@@ -860 +1001 @@
         int i;
         struct dom_sid primary_group;
-        uint32 primary_group_rid;
+        uint32_t primary_group_rid;
         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
         uint32_t num_groups = 0;
@@ -985 +1126 @@
         }
 
-        *p_num_groups = (uint32)num_groups;
+        *p_num_groups = (uint32_t)num_groups;
         status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 
@@ -999 +1140 @@
 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
                                    TALLOC_CTX *mem_ctx,
-                                   uint32 num_sids, const struct dom_sid *sids,
-                                   uint32 *num_aliases, uint32 **alias_rids)
-{
-        return reconnect_methods.lookup_useraliases(domain, mem_ctx,
-                                                    num_sids, sids,
-                                                    num_aliases,
-                                                    alias_rids);
+                                   uint32_t num_sids, const struct dom_sid *sids,
+                                   uint32_t *num_aliases, uint32_t **alias_rids)
+{
+        return msrpc_methods.lookup_useraliases(domain, mem_ctx, num_sids, sids,
+                                                num_aliases, alias_rids);
+}
+
+static NTSTATUS add_primary_group_members(
+        ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, uint32_t rid,
+        char ***all_members, size_t *num_all_members)
+{
+        char *filter;
+        NTSTATUS status = NT_STATUS_NO_MEMORY;
+        ADS_STATUS rc;
+        const char *attrs[] = { "dn", NULL };
+        LDAPMessage *res = NULL;
+        LDAPMessage *msg;
+        char **members;
+        size_t num_members;
+        ads_control args;
+
+        filter = talloc_asprintf(
+                mem_ctx, "(&(objectCategory=user)(primaryGroupID=%u))",
+                (unsigned)rid);
+        if (filter == NULL) {
+                goto done;
+        }
+
+        args.control = ADS_EXTENDED_DN_OID;
+        args.val = ADS_EXTENDED_DN_HEX_STRING;
+        args.critical = True;
+
+        rc = ads_do_search_all_args(ads, ads->config.bind_path,
+                                    LDAP_SCOPE_SUBTREE, filter, attrs, &args,
+                                    &res);
+
+        if (!ADS_ERR_OK(rc)) {
+                status = ads_ntstatus(rc);
+                DEBUG(1,("%s: ads_search: %s\n", __func__, ads_errstr(rc)));
+                goto done;
+        }
+        if (res == NULL) {
+                DEBUG(1,("%s: ads_search returned NULL res\n", __func__));
+                goto done;
+        }
+
+        num_members = ads_count_replies(ads, res);
+
+        DEBUG(10, ("%s: Got %ju primary group members\n", __func__,
+                   (uintmax_t)num_members));
+
+        if (num_members == 0) {
+                status = NT_STATUS_OK;
+                goto done;
+        }
+
+        members = talloc_realloc(mem_ctx, *all_members, char *,
+                                 *num_all_members + num_members);
+        if (members == NULL) {
+                DEBUG(1, ("%s: talloc_realloc failed\n", __func__));
+                goto done;
+        }
+        *all_members = members;
+
+        for (msg = ads_first_entry(ads, res); msg != NULL;
+             msg = ads_next_entry(ads, msg)) {
+                char *dn;
+
+                dn = ads_get_dn(ads, members, msg);
+                if (dn == NULL) {
+                        DEBUG(1, ("%s: ads_get_dn failed\n", __func__));
+                        continue;
+                }
+
+                members[*num_all_members] = dn;
+                *num_all_members += 1;
+        }
+
+        status = NT_STATUS_OK;
+done:
+        if (res != NULL) {
+                ads_msgfree(ads, res);
+        }
+        TALLOC_FREE(filter);
+        return status;
 }
 
@@ -1015 +1234 @@
                                 const struct dom_sid *group_sid,
                                 enum lsa_SidType type,
-                                uint32 *num_names,
+                                uint32_t *num_names,
                                 struct dom_sid **sid_mem, char ***names,
-                                uint32 **name_types)
+                                uint32_t **name_types)
 {
         ADS_STATUS rc;
@@ -1032 +1251 @@
         enum lsa_SidType *name_types_nocache = NULL;
         char **domains_nocache = NULL;     /* only needed for rpccli_lsa_lookup_sids */
-        uint32 num_nocache = 0;
+        uint32_t num_nocache = 0;
         TALLOC_CTX *tmp_ctx = NULL;
+        uint32_t rid;
 
         DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
@@ -1044 +1264 @@
                 DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
                 status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
+
+        if (!sid_peek_rid(group_sid, &rid)) {
+                DEBUG(1, ("%s: sid_peek_rid failed\n", __func__));
+                status = NT_STATUS_INVALID_PARAMETER;
                 goto done;
         }
@@ -1088 +1314 @@
 
         DEBUG(10, ("ads lookup_groupmem: got %d sids via extended dn call\n", (int)num_members));
+
+        status = add_primary_group_members(ads, mem_ctx, rid,
+                                           &members, &num_members);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("%s: add_primary_group_members failed: %s\n",
+                           __func__, nt_errstr(status)));
+                goto done;
+        }
+
+        DEBUG(10, ("%s: Got %d sids after adding primary group members\n",
+                   __func__, (int)num_members));
 
         /* Now that we have a list of sids, we need to get the
@@ -1102 +1339 @@
 
         if (num_members) {
-                (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, num_members);
-                (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
-                (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
-                (sid_mem_nocache) = TALLOC_ZERO_ARRAY(tmp_ctx, struct dom_sid, num_members);
+                (*sid_mem) = talloc_zero_array(mem_ctx, struct dom_sid, num_members);
+                (*names) = talloc_zero_array(mem_ctx, char *, num_members);
+                (*name_types) = talloc_zero_array(mem_ctx, uint32_t, num_members);
+                (sid_mem_nocache) = talloc_zero_array(tmp_ctx, struct dom_sid, num_members);
 
                 if ((members == NULL) || (*sid_mem == NULL) ||
@@ -1244 +1481 @@
 
 /* find the sequence number for a domain */
-static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
+static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32_t *seq)
 {
         ADS_STRUCT *ads = NULL;
@@ -1277 +1514 @@
                         ads->is_mine = True;
                         ads_destroy(&ads);
-                        ads_kdestroy("MEMORY:winbind_ccache");
+                        ads_kdestroy(WINBIND_CCACHE_NAME);
                         domain->private_data = NULL;
                 }
@@ -1289 +1526 @@
                                struct samr_DomInfo12 *policy)
 {
-        return reconnect_methods.lockout_policy(domain, mem_ctx, policy);
+        return msrpc_methods.lockout_policy(domain, mem_ctx, policy);
 }
 
@@ -1297 +1534 @@
                                 struct samr_DomInfo1 *policy)
 {
-        return reconnect_methods.password_policy(domain, mem_ctx, policy);
+        return msrpc_methods.password_policy(domain, mem_ctx, policy);
 }
 
@@ -1308 +1545 @@
         WERROR werr;
         int                     i;
-        uint32                  flags;  
+        uint32_t                flags;
         struct rpc_pipe_client *cli;
         int ret_count;
@@ -1373 +1610 @@
 
                 if ((trust->trust_attributes
-                     == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) &&
+                     == LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) &&
                     !domain->primary )
                 {
@@ -1385 +1622 @@
                 /* add to the trusted domain cache */
 
-                fstrcpy(d.name, trust->netbios_name);
-                fstrcpy(d.alt_name, trust->dns_name);
+                d.name = discard_const_p(char, trust->netbios_name);
+                d.alt_name = discard_const_p(char, trust->dns_name);
+
                 if (trust->sid) {
                         sid_copy(&d.sid, trust->sid);

vendor/current/source3/winbindd/winbindd_allocate_gid.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_allocate_gid_state {

vendor/current/source3/winbindd/winbindd_allocate_uid.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_allocate_uid_state {

vendor/current/source3/winbindd/winbindd_cache.c

@@ -29 +29 @@
 #include "tdb_validate.h"
 #include "../libcli/auth/libcli_auth.h"
-#include "../librpc/gen_ndr/ndr_wbint.h"
+#include "../librpc/gen_ndr/ndr_winbind.h"
 #include "ads.h"
 #include "nss_info.h"
@@ -47 +47 @@
 extern struct winbindd_methods reconnect_methods;
 #ifdef HAVE_ADS
-extern struct winbindd_methods ads_methods;
+extern struct winbindd_methods reconnect_ads_methods;
 #endif
 extern struct winbindd_methods builtin_passdb_methods;
@@ -60 +60 @@
 static const char *non_centry_keys[] = {
         "SEQNUM/",
-        "DR/",
-        "DE/",
         "WINBINDD_OFFLINE",
         WINBINDD_CACHE_VERSION_KEYSTR,
@@ -102 +100 @@
 struct cache_entry {
         NTSTATUS status;
-        uint32 sequence_number;
+        uint32_t sequence_number;
         uint64_t timeout;
-        uint8 *data;
-        uint32 len, ofs;
+        uint8_t *data;
+        uint32_t len, ofs;
 };
 
@@ -123 +121 @@
         if (domain->internal) {
                 domain->backend = &builtin_passdb_methods;
-                domain->initialized = True;
+        }
+
+        if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
+                domain->initialized = true;
         }
 
         if (strequal(domain->name, get_global_sam_name()) &&
-            sid_check_is_domain(&domain->sid)) {
+            sid_check_is_our_sam(&domain->sid)) {
                 domain->backend = &sam_passdb_methods;
-                domain->initialized = True;
         }
 
         if ( !domain->initialized ) {
-                init_dc_connection( domain );
+                /* We do not need a connection to an RW DC for cache operation */
+                init_dc_connection(domain, false);
         }
 
@@ -168 +169 @@
                     && !lp_winbind_rpc_only()) {
                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
-                        domain->backend = &ads_methods;
+                        domain->backend = &reconnect_ads_methods;
                 } else {
 #endif  /* HAVE_ADS */
@@ -228 +229 @@
 
 /*
-  pull a uint32 from a cache entry 
+  pull a uint32_t from a cache entry
 */
-static uint32 centry_uint32(struct cache_entry *centry)
-{
-        uint32 ret;
+static uint32_t centry_uint32(struct cache_entry *centry)
+{
+        uint32_t ret;
 
         if (!centry_check_bytes(centry, 4)) {
@@ -243 +244 @@
 
 /*
-  pull a uint16 from a cache entry 
+  pull a uint16_t from a cache entry
 */
-static uint16 centry_uint16(struct cache_entry *centry)
-{
-        uint16 ret;
+static uint16_t centry_uint16(struct cache_entry *centry)
+{
+        uint16_t ret;
         if (!centry_check_bytes(centry, 2)) {
                 smb_panic_fn("centry_uint16");
@@ -257 +258 @@
 
 /*
-  pull a uint8 from a cache entry 
+  pull a uint8_t from a cache entry
 */
-static uint8 centry_uint8(struct cache_entry *centry)
-{
-        uint8 ret;
+static uint8_t centry_uint8(struct cache_entry *centry)
+{
+        uint8_t ret;
         if (!centry_check_bytes(centry, 1)) {
                 smb_panic_fn("centry_uint8");
@@ -281 +282 @@
         ret = IVAL(centry->data, centry->ofs);
         centry->ofs += 4;
-        ret += (uint64)IVAL(centry->data, centry->ofs) << 32;
+        ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
         centry->ofs += 4;
         return ret;
@@ -299 +300 @@
 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 {
-        uint32 len;
+        uint32_t len;
         char *ret;
 
@@ -313 +314 @@
         }
 
-        ret = TALLOC_ARRAY(mem_ctx, char, len+1);
+        ret = talloc_array(mem_ctx, char, len+1);
         if (!ret) {
                 smb_panic_fn("centry_string out of memory\n");
@@ -328 +329 @@
 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 {
-        uint32 len;
+        uint32_t len;
         char *ret;
 
@@ -343 +344 @@
         }
 
-        ret = TALLOC_ARRAY(mem_ctx, char, 16);
+        ret = talloc_array(mem_ctx, char, 16);
         if (!ret) {
                 smb_panic_fn("centry_hash out of memory\n");
@@ -398 +399 @@
 }
 
+struct wcache_seqnum_state {
+        uint32_t *seqnum;
+        uint32_t *last_seq_check;
+};
+
+static int wcache_seqnum_parser(TDB_DATA key, TDB_DATA data,
+                                void *private_data)
+{
+        struct wcache_seqnum_state *state = private_data;
+
+        if (data.dsize != 8) {
+                DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
+                           (int)data.dsize));
+                return -1;
+        }
+
+        *state->seqnum = IVAL(data.dptr, 0);
+        *state->last_seq_check = IVAL(data.dptr, 4);
+        return 0;
+}
+
 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
                                 uint32_t *last_seq_check)
 {
-        char *key;
-        TDB_DATA data;
+        struct wcache_seqnum_state state = {
+                .seqnum = seqnum, .last_seq_check = last_seq_check
+        };
+        size_t len = strlen(domain_name);
+        char keystr[len+8];
+        TDB_DATA key = { .dptr = (uint8_t *)keystr, .dsize = sizeof(keystr) };
+        int ret;
 
         if (wcache->tdb == NULL) {
@@ -409 +436 @@
         }
 
-        key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
-        if (key == NULL) {
-                DEBUG(10, ("talloc failed\n"));
-                return false;
-        }
-
-        data = tdb_fetch_bystring(wcache->tdb, key);
-        TALLOC_FREE(key);
-
-        if (data.dptr == NULL) {
-                DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
-                           domain_name));
-                return false;
-        }
-        if (data.dsize != 8) {
-                DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
-                           (int)data.dsize));
-                SAFE_FREE(data.dptr);
-                return false;
-        }
-
-        *seqnum = IVAL(data.dptr, 0);
-        *last_seq_check = IVAL(data.dptr, 4);
-        SAFE_FREE(data.dptr);
-
-        return true;
+        snprintf(keystr, sizeof(keystr),  "SEQNUM/%s", domain_name);
+
+        ret = tdb_parse_record(wcache->tdb, key, wcache_seqnum_parser,
+                               &state);
+        return (ret == 0);
 }
 
 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 {
-        uint32 last_check, time_diff;
+        uint32_t last_check, time_diff;
 
         if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
@@ -453 +459 @@
                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
                         domain->name, domain->sequence_number,
-                        (uint32)domain->last_seq_check));
+                        (uint32_t)domain->last_seq_check));
                 return NT_STATUS_UNSUCCESSFUL;
         }
@@ -459 +465 @@
         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n", 
                 domain->name, domain->sequence_number, 
-                (uint32)domain->last_seq_check));
+                (uint32_t)domain->last_seq_check));
 
         return NT_STATUS_OK;
@@ -467 +473 @@
                          time_t last_seq_check)
 {
-        char *key_str;
+        size_t len = strlen(domain_name);
+        char keystr[len+8];
+        TDB_DATA key = { .dptr = (uint8_t *)keystr, .dsize = sizeof(keystr) };
         uint8_t buf[8];
         int ret;
@@ -476 +484 @@
         }
 
-        key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
-        if (key_str == NULL) {
-                DEBUG(10, ("talloc_asprintf failed\n"));
-                return false;
-        }
+        snprintf(keystr, sizeof(keystr),  "SEQNUM/%s", domain_name);
 
         SIVAL(buf, 0, seqnum);
         SIVAL(buf, 4, last_seq_check);
 
-        ret = tdb_store_bystring(wcache->tdb, key_str,
-                                 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
-        TALLOC_FREE(key_str);
-        if (ret == -1) {
+        ret = tdb_store(wcache->tdb, key, make_tdb_data(buf, sizeof(buf)),
+                        TDB_REPLACE);
+        if (ret != 0) {
                 DEBUG(10, ("tdb_store_bystring failed: %s\n",
                            tdb_errorstr(wcache->tdb)));
-                TALLOC_FREE(key_str);
                 return false;
         }
@@ -671 +673 @@
 {
         if (strequal(domain->name, get_global_sam_name()) &&
-            sid_check_is_domain(&domain->sid)) {
+            sid_check_is_our_sam(&domain->sid)) {
                 return true;
         }
@@ -758 +760 @@
   make sure we have at least len bytes available in a centry 
 */
-static void centry_expand(struct cache_entry *centry, uint32 len)
+static void centry_expand(struct cache_entry *centry, uint32_t len)
 {
         if (centry->len - centry->ofs >= len)
@@ -782 +784 @@
 
 /*
-  push a uint32 into a centry 
+  push a uint32_t into a centry
 */
-static void centry_put_uint32(struct cache_entry *centry, uint32 v)
+static void centry_put_uint32(struct cache_entry *centry, uint32_t v)
 {
         centry_expand(centry, 4);
@@ -792 +794 @@
 
 /*
-  push a uint16 into a centry 
+  push a uint16_t into a centry
 */
-static void centry_put_uint16(struct cache_entry *centry, uint16 v)
+static void centry_put_uint16(struct cache_entry *centry, uint16_t v)
 {
         centry_expand(centry, 2);
@@ -802 +804 @@
 
 /*
-  push a uint8 into a centry 
+  push a uint8_t into a centry
 */
-static void centry_put_uint8(struct cache_entry *centry, uint8 v)
+static void centry_put_uint8(struct cache_entry *centry, uint8_t v)
 {
         centry_expand(centry, 1);
@@ -839 +841 @@
    push a 16 byte hash into a centry - treat as 16 byte string.
  */
-static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
+static void centry_put_hash16(struct cache_entry *centry, const uint8_t val[16])
 {
         centry_put_uint8(centry, 16);
@@ -859 +861 @@
 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 {
-        uint32 status_value = NT_STATUS_V(status);
+        uint32_t status_value = NT_STATUS_V(status);
         centry_put_uint32(centry, status_value);
 }
@@ -889 +891 @@
   start a centry for output. When finished, call centry_end()
 */
-struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
+static struct cache_entry *centry_start(struct winbindd_domain *domain,
+                                        NTSTATUS status)
 {
         struct cache_entry *centry;
@@ -899 +902 @@
 
         centry->len = 8192; /* reasonable default */
-        centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
+        centry->data = SMB_XMALLOC_ARRAY(uint8_t, centry->len);
         centry->ofs = 0;
         centry->sequence_number = domain->sequence_number;
@@ -958 +961 @@
         centry_put_sid(centry, sid);
         fstrcpy(uname, name);
-        strupper_m(uname);
+        (void)strupper_m(uname);
         centry_end(centry, "NS/%s/%s", domain_name, uname);
         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
@@ -990 +993 @@
 
         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
-        DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string, 
-                  name, nt_errstr(status)));
+        DEBUG(10,("wcache_save_sid_to_name: %s -> %s\\%s (%s)\n", sid_string,
+                  domain_name, name, nt_errstr(status)));
         centry_free(centry);
 }
@@ -1084 +1087 @@
 
         fstrcpy(uname, name);
-        strupper_m(uname);
+        (void)strupper_m(uname);
         centry_end(centry, "NSS/NA/%s", uname);
 
@@ -1105 +1108 @@
 
         fstrcpy(uname, alias);
-        strupper_m(uname);
+        (void)strupper_m(uname);
         centry_end(centry, "NSS/AN/%s", uname);
 
@@ -1131 +1134 @@
                 goto do_query;
 
-        if ( (upper_name = SMB_STRDUP(name)) == NULL )
+        upper_name = talloc_strdup(mem_ctx, name);
+        if (upper_name == NULL) {
                 return NT_STATUS_NO_MEMORY;
-        strupper_m(upper_name);
+        }
+        if (!strupper_m(upper_name)) {
+                talloc_free(upper_name);
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
 
-        SAFE_FREE( upper_name );
+        talloc_free(upper_name);
 
         if (!centry)
@@ -1206 +1214 @@
                 goto do_query;
 
-        if ( (upper_name = SMB_STRDUP(alias)) == NULL )
+        upper_name = talloc_strdup(mem_ctx, alias);
+        if (upper_name == NULL) {
                 return NT_STATUS_NO_MEMORY;
-        strupper_m(upper_name);
+        }
+        if (!strupper_m(upper_name)) {
+                talloc_free(upper_name);
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
 
-        SAFE_FREE( upper_name );
+        talloc_free(upper_name);
 
         if (!centry)
@@ -1276 +1289 @@
         TDB_DATA data;
         fstring key_str, tmp;
-        uint32 rid;
+        uint32_t rid;
 
         if (!cache->tdb) {
@@ -1307 +1320 @@
                           TALLOC_CTX *mem_ctx, 
                           const struct dom_sid *sid,
-                          const uint8 **cached_nt_pass,
-                          const uint8 **cached_salt)
+                          const uint8_t **cached_nt_pass,
+                          const uint8_t **cached_salt)
 {
         struct winbind_cache *cache = get_cache(domain);
         struct cache_entry *centry = NULL;
         NTSTATUS status;
-        time_t t;
-        uint32 rid;
+        uint32_t rid;
         fstring tmp;
 
@@ -1340 +1352 @@
         }
 
-        t = centry_time(centry);
+        /*
+         * We don't use the time element at this moment,
+         * but we have to consume it, so that we don't
+         * neet to change the disk format of the cache.
+         */
+        (void)centry_time(centry);
 
         /* In the salted case this isn't actually the nt_hash itself,
@@ -1347 +1364 @@
            if we are returning a salted cred. */
 
-        *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
+        *cached_nt_pass = (const uint8_t *)centry_hash16(centry, mem_ctx);
         if (*cached_nt_pass == NULL) {
                 fstring sidstr;
@@ -1364 +1381 @@
         /* We only have 17 bytes more data in the salted cred case. */
         if (centry->len - centry->ofs == 17) {
-                *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
+                *cached_salt = (const uint8_t *)centry_hash16(centry, mem_ctx);
         } else {
                 *cached_salt = NULL;
@@ -1387 +1404 @@
 NTSTATUS wcache_save_creds(struct winbindd_domain *domain, 
                            const struct dom_sid *sid,
-                           const uint8 nt_pass[NT_HASH_LEN])
+                           const uint8_t nt_pass[NT_HASH_LEN])
 {
         struct cache_entry *centry;
         fstring sid_string;
-        uint32 rid;
-        uint8 cred_salt[NT_HASH_LEN];
-        uint8 salted_hash[NT_HASH_LEN];
+        uint32_t rid;
+        uint8_t cred_salt[NT_HASH_LEN];
+        uint8_t salted_hash[NT_HASH_LEN];
 
         if (is_null_sid(sid)) {
@@ -1431 +1448 @@
 static NTSTATUS query_user_list(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries, 
+                                uint32_t *num_entries,
                                 struct wbint_userinfo **info)
 {
@@ -1453 +1470 @@
                 goto do_cached;
 
-        (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
+        (*info) = talloc_array(mem_ctx, struct wbint_userinfo, *num_entries);
         if (! (*info)) {
                 smb_panic_fn("query_user_list out of memory");
@@ -1506 +1523 @@
                         DEBUG(3, ("query_user_list: flushing "
                                   "connection cache\n"));
-                        invalidate_cm_connection(&domain->conn);
+                        invalidate_cm_connection(domain);
                 }
                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
@@ -1582 +1599 @@
 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries, 
+                                uint32_t *num_entries,
                                 struct wb_acct_info **info)
 {
@@ -1605 +1622 @@
                 goto do_cached;
 
-        (*info) = TALLOC_ARRAY(mem_ctx, struct wb_acct_info, *num_entries);
+        (*info) = talloc_array(mem_ctx, struct wb_acct_info, *num_entries);
         if (! (*info)) {
                 smb_panic_fn("enum_dom_groups out of memory");
@@ -1677 +1694 @@
 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries, 
+                                uint32_t *num_entries,
                                 struct wb_acct_info **info)
 {
@@ -1700 +1717 @@
                 goto do_cached;
 
-        (*info) = TALLOC_ARRAY(mem_ctx, struct wb_acct_info, *num_entries);
+        (*info) = talloc_array(mem_ctx, struct wb_acct_info, *num_entries);
         if (! (*info)) {
                 smb_panic_fn("enum_dom_groups out of memory");
@@ -1882 +1899 @@
                 /* Only save the reverse mapping if this was not a UPN */
                 if (!strchr(name, '@')) {
-                        strupper_m(CONST_DISCARD(char *,domain_name));
-                        strlower_m(CONST_DISCARD(char *,name));
+                        if (!strupper_m(discard_const_p(char, domain_name))) {
+                                return NT_STATUS_INVALID_PARAMETER;
+                        }
+                        (void)strlower_m(discard_const_p(char, name));
                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
                 }
@@ -1891 +1910 @@
 }
 
-NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
-                            const struct dom_sid *sid,
-                            TALLOC_CTX *mem_ctx,
-                            char **domain_name,
-                            char **name,
-                            enum lsa_SidType *type)
+static NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
+                                   const struct dom_sid *sid,
+                                   TALLOC_CTX *mem_ctx,
+                                   char **domain_name,
+                                   char **name,
+                                   enum lsa_SidType *type)
 {
         struct winbind_cache *cache = get_cache(domain);
@@ -2001 +2020 @@
                               TALLOC_CTX *mem_ctx,
                               const struct dom_sid *domain_sid,
-                              uint32 *rids,
+                              uint32_t *rids,
                               size_t num_rids,
                               char **domain_name,
@@ -2027 +2046 @@
         }
 
-        *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
-        *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
+        *names = talloc_array(mem_ctx, char *, num_rids);
+        *types = talloc_array(mem_ctx, enum lsa_SidType, num_rids);
 
         if ((*names == NULL) || (*types == NULL)) {
@@ -2077 +2096 @@
                         /* something's definitely wrong */
                         result = centry->status;
+                        centry_free(centry);
                         goto error;
                 }
@@ -2110 +2130 @@
                         old_status) {
                         have_mapped = have_unmapped = false;
+
+                        *names = talloc_array(mem_ctx, char *, num_rids);
+                        if (*names == NULL) {
+                                result = NT_STATUS_NO_MEMORY;
+                                goto error;
+                        }
+
+                        *types = talloc_array(mem_ctx, enum lsa_SidType,
+                                              num_rids);
+                        if (*types == NULL) {
+                                result = NT_STATUS_NO_MEMORY;
+                                goto error;
+                        }
 
                         for (i=0; i<num_rids; i++) {
@@ -2283 +2316 @@
 }
 
+
+/**
+* @brief Query a fullname from the username cache (for further gecos processing)
+*
+* @param domain         A pointer to the winbindd_domain struct.
+* @param mem_ctx        The talloc context.
+* @param user_sid       The user sid.
+* @param full_name      A pointer to the full_name string.
+*
+* @return NTSTATUS code
+*/
+NTSTATUS wcache_query_user_fullname(struct winbindd_domain *domain,
+                                    TALLOC_CTX *mem_ctx,
+                                    const struct dom_sid *user_sid,
+                                    const char **full_name)
+{
+        NTSTATUS status;
+        struct wbint_userinfo info;
+
+        status = wcache_query_user(domain, mem_ctx, user_sid, &info);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        if (info.full_name != NULL) {
+                *full_name = talloc_strdup(mem_ctx, info.full_name);
+                if (*full_name == NULL) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+
+        return NT_STATUS_OK;
+}
+
 /* Lookup user information from a rid */
 static NTSTATUS query_user(struct winbindd_domain *domain,
@@ -2396 +2463 @@
                                   TALLOC_CTX *mem_ctx,
                                   const struct dom_sid *user_sid,
-                                  uint32 *num_groups, struct dom_sid **user_gids)
+                                  uint32_t *num_groups, struct dom_sid **user_gids)
 {
         struct cache_entry *centry = NULL;
@@ -2546 +2613 @@
 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
                                    TALLOC_CTX *mem_ctx,
-                                   uint32 num_sids, const struct dom_sid *sids,
-                                   uint32 *num_aliases, uint32 **alias_rids)
+                                   uint32_t num_sids, const struct dom_sid *sids,
+                                   uint32_t *num_aliases, uint32_t **alias_rids)
 {
         struct cache_entry *centry = NULL;
@@ -2652 +2719 @@
         *sid_mem = talloc_array(mem_ctx, struct dom_sid, *num_names);
         *names = talloc_array(mem_ctx, char *, *num_names);
-        *name_types = talloc_array(mem_ctx, uint32, *num_names);
+        *name_types = talloc_array(mem_ctx, uint32_t, *num_names);
 
         if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
@@ -2681 +2748 @@
                                 const struct dom_sid *group_sid,
                                 enum lsa_SidType type,
-                                uint32 *num_names,
+                                uint32_t *num_names,
                                 struct dom_sid **sid_mem, char ***names,
-                                uint32 **name_types)
+                                uint32_t **name_types)
 {
         struct cache_entry *centry = NULL;
@@ -2752 +2819 @@
 
 /* find the sequence number for a domain */
-static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
+static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32_t *seq)
 {
         refresh_sequence_number(domain, false);
@@ -2796 +2863 @@
 
 do_fetch_cache:
-        trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
+        trusts->array = talloc_zero_array(mem_ctx, struct netr_DomainTrust, num_domains);
         if (!trusts->array) {
                 TALLOC_FREE(dom_list);
@@ -3034 +3101 @@
         struct winbind_cache *cache;
 
-        /* dont clear cached U/SID and UG/SID entries when we want to logon
+        /* don't clear cached U/SID and UG/SID entries when we want to logon
          * offline - gd */
 
@@ -3119 +3186 @@
 bool init_wcache(void)
 {
+        char *db_path;
+
         if (wcache == NULL) {
                 wcache = SMB_XMALLOC_P(struct winbind_cache);
@@ -3127 +3196 @@
                 return true;
 
+        db_path = state_path("winbindd_cache.tdb");
+        if (db_path == NULL) {
+                return false;
+        }
+
         /* when working offline we must not clear the cache on restart */
-        wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
+        wcache->tdb = tdb_open_log(db_path,
                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE, 
                                 TDB_INCOMPATIBLE_HASH |
                                         (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
                                 O_RDWR|O_CREAT, 0600);
-
+        TALLOC_FREE(db_path);
         if (wcache->tdb == NULL) {
                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
@@ -3151 +3225 @@
 {
         bool cache_bad = true;
-        uint32 vers;
+        uint32_t vers;
 
         if (!init_wcache()) {
@@ -3165 +3239 @@
 
         if (cache_bad) {
+                char *db_path;
+
                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
                         "and re-creating with version number %d\n",
@@ -3172 +3248 @@
                 wcache->tdb = NULL;
 
-                if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
+                db_path = state_path("winbindd_cache.tdb");
+                if (db_path == NULL) {
+                        return false;
+                }
+
+                if (unlink(db_path) == -1) {
                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
-                                cache_path("winbindd_cache.tdb"),
+                                db_path,
                                 strerror(errno) ));
+                        TALLOC_FREE(db_path);
                         return false;
                 }
+                TALLOC_FREE(db_path);
                 if (!init_wcache()) {
                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
@@ -3290 +3373 @@
 void wcache_flush_cache(void)
 {
+        char *db_path;
+
         if (!wcache)
                 return;
@@ -3300 +3385 @@
         }
 
+        db_path = state_path("winbindd_cache.tdb");
+        if (db_path == NULL) {
+                return;
+        }
+
         /* when working offline we must not clear the cache on restart */
-        wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
-                                WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE, 
+        wcache->tdb = tdb_open_log(db_path,
+                                WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
                                 TDB_INCOMPATIBLE_HASH |
                                 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
                                 O_RDWR|O_CREAT, 0600);
-
+        TALLOC_FREE(db_path);
         if (!wcache->tdb) {
                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
@@ -3405 +3495 @@
         if (ret == 0) {
                 return NT_STATUS_OK;
-        } else if ((ret == -1) || (wcache_cred_list == NULL)) {
+        } else if ((ret < 0) || (wcache_cred_list == NULL)) {
                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
         }
@@ -3534 +3624 @@
 
         centry = SMB_XMALLOC_P(struct cache_entry);
-        centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
+        centry->data = (unsigned char *)smb_memdup(data.dptr, data.dsize);
         if (!centry->data) {
                 SAFE_FREE(centry);
@@ -3719 +3809 @@
 {
         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
-        int32 num_entries, i;
+        int32_t num_entries, i;
 
         if (!centry) {
@@ -3725 +3815 @@
         }
 
-        num_entries = (int32)centry_uint32(centry);
+        num_entries = (int32_t)centry_uint32(centry);
 
         for (i=0; i< num_entries; i++) {
@@ -3750 +3840 @@
 {
         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
-        int32 num_entries, i;
+        int32_t num_entries, i;
 
         if (!centry) {
@@ -3777 +3867 @@
 {
         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
-        int32 num_groups, i;
+        int32_t num_groups, i;
 
         if (!centry) {
@@ -3803 +3893 @@
 {
         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
-        int32 num_aliases, i;
+        int32_t num_aliases, i;
 
         if (!centry) {
@@ -3828 +3918 @@
 {
         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
-        int32 num_names, i;
+        int32_t num_names, i;
 
         if (!centry) {
@@ -4051 +4141 @@
 
         /* Paranoia check. */
-        if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
+        if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0 ||
+            strncmp("NDR/", (const char *)kbuf.dptr, 4) == 0) {
                 max_key_len = 1024 * 1024;
         }
@@ -4092 +4183 @@
 
         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
-        dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
+        dump_data(0, (uint8_t *)kbuf.dptr, kbuf.dsize);
         DEBUG(0,("data :\n"));
-        dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
+        dump_data(0, (uint8_t *)dbuf.dptr, dbuf.dsize);
         v_state->unknown_key = true;
         v_state->success = false;
@@ -4179 +4270 @@
 {
         int ret = -1;
-        const char *tdb_path = cache_path("winbindd_cache.tdb");
+        char *tdb_path = NULL;
         TDB_CONTEXT *tdb = NULL;
         uint32_t vers_id;
@@ -4187 +4278 @@
         smb_panic_fn = validate_panic;
 
-        tdb = tdb_open_log(tdb_path, 
+        tdb_path = state_path("winbindd_cache.tdb");
+        if (tdb_path == NULL) {
+                goto done;
+        }
+
+        tdb = tdb_open_log(tdb_path,
                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
                            TDB_INCOMPATIBLE_HASH |
-                           ( lp_winbind_offline_logon() 
-                             ? TDB_DEFAULT 
+                           ( lp_winbind_offline_logon()
+                             ? TDB_DEFAULT
                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
-                           O_RDWR|O_CREAT, 
+                           O_RDWR|O_CREAT,
                            0600);
         if (!tdb) {
@@ -4235 +4331 @@
 
 done:
+        TALLOC_FREE(tdb_path);
         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
         smb_panic_fn = smb_panic;
@@ -4247 +4344 @@
 {
         int ret = -1;
-        const char *tdb_path = cache_path("winbindd_cache.tdb");
+        char *tdb_path;
 
         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
         smb_panic_fn = validate_panic;
 
+        tdb_path = state_path("winbindd_cache.tdb");
+        if (tdb_path == NULL) {
+                goto err_panic_restore;
+        }
 
         if (wcache == NULL || wcache->tdb == NULL) {
@@ -4264 +4365 @@
         }
 
+        TALLOC_FREE(tdb_path);
+err_panic_restore:
         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
                    "function\n"));
@@ -4314 +4417 @@
         if ( !set_only ) {
                 if ( !*domains ) {
-                        list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
+                        list = talloc_array( NULL, struct winbindd_tdc_domain, 1 );
                         idx = 0;
                 } else {
-                        list = TALLOC_REALLOC_ARRAY( *domains, *domains, 
+                        list = talloc_realloc( *domains, *domains, 
                                                      struct winbindd_tdc_domain,  
                                                      (*num_domains)+1);
@@ -4329 +4432 @@
                 return false;
 
-        list[idx].domain_name = talloc_strdup( list, new_dom->name );
-        list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
+        list[idx].domain_name = talloc_strdup(list, new_dom->name);
+        if (list[idx].domain_name == NULL) {
+                return false;
+        }
+        if (new_dom->alt_name != NULL) {
+                list[idx].dns_name = talloc_strdup(list, new_dom->alt_name);
+                if (list[idx].dns_name == NULL) {
+                        return false;
+                }
+        }
 
         if ( !is_null_sid( &new_dom->sid ) ) {
@@ -4413 +4524 @@
                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
                                  domains[i].domain_name,
-                                 domains[i].dns_name,
+                                 domains[i].dns_name ? domains[i].dns_name : "",
                                  sid_to_fstring(tmp, &domains[i].sid),
                                  domains[i].trust_flags,
@@ -4444 +4555 @@
 {
         fstring domain_name, dns_name, sid_string;      
-        uint32 type, attribs, flags;
+        uint32_t type, attribs, flags;
         int num_domains;
         int len = 0;
@@ -4457 +4568 @@
         }
 
-        list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
+        list = talloc_array( NULL, struct winbindd_tdc_domain, num_domains );
         if ( !list ) {
                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
@@ -4464 +4575 @@
 
         for ( i=0; i<num_domains; i++ ) {
-                len += tdb_unpack( buf+len, buflen-len, "fffddd",
+                int this_len;
+
+                this_len = tdb_unpack( buf+len, buflen-len, "fffddd",
                                    domain_name,
                                    dns_name,
@@ -4472 +4585 @@
                                    &type );
 
-                if ( len == -1 ) {
+                if ( this_len == -1 ) {
                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
                         TALLOC_FREE( list );                    
                         return 0;
                 }
+                len += this_len;
 
                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
@@ -4484 +4598 @@
 
                 list[i].domain_name = talloc_strdup( list, domain_name );
-                list[i].dns_name = talloc_strdup( list, dns_name );
+                list[i].dns_name = NULL;
+                if (dns_name[0] != '\0') {
+                        list[i].dns_name = talloc_strdup(list, dns_name);
+                }
                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {                   
                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
@@ -4531 +4648 @@
         SAFE_FREE( key.dptr );
 
-        return ( ret != -1 );   
+        return ( ret == 0 );
 }
 
@@ -4611 +4728 @@
 }
 
+static struct winbindd_tdc_domain *wcache_tdc_dup_domain(
+        TALLOC_CTX *mem_ctx, const struct winbindd_tdc_domain *src)
+{
+        struct winbindd_tdc_domain *dst;
+
+        dst = talloc(mem_ctx, struct winbindd_tdc_domain);
+        if (dst == NULL) {
+                goto fail;
+        }
+        dst->domain_name = talloc_strdup(dst, src->domain_name);
+        if (dst->domain_name == NULL) {
+                goto fail;
+        }
+
+        dst->dns_name = NULL;
+        if (src->dns_name != NULL) {
+                dst->dns_name = talloc_strdup(dst, src->dns_name);
+                if (dst->dns_name == NULL) {
+                        goto fail;
+                }
+        }
+
+        sid_copy(&dst->sid, &src->sid);
+        dst->trust_flags = src->trust_flags;
+        dst->trust_type = src->trust_type;
+        dst->trust_attribs = src->trust_attribs;
+        return dst;
+fail:
+        TALLOC_FREE(dst);
+        return NULL;
+}
+
 /*********************************************************************
  ********************************************************************/
@@ -4624 +4773 @@
 
         if ( !init_wcache() ) {
-                return false;
+                return NULL;
         }
 
@@ -4638 +4787 @@
                                   name));
 
-                        d = TALLOC_P( ctx, struct winbindd_tdc_domain );
-                        if ( !d )
-                                break;                  
-
-                        d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
-                        d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
-                        sid_copy( &d->sid, &dom_list[i].sid );
-                        d->trust_flags   = dom_list[i].trust_flags;
-                        d->trust_type    = dom_list[i].trust_type;
-                        d->trust_attribs = dom_list[i].trust_attribs;
-
+                        d = wcache_tdc_dup_domain(ctx, &dom_list[i]);
                         break;
                 }
@@ -4674 +4813 @@
 
         if (!init_wcache()) {
-                return false;
+                return NULL;
         }
 
@@ -4682 +4821 @@
 
         for (i = 0; i<num_domains; i++) {
-                if (sid_equal(sid, &(dom_list[i].sid))) {
+                if (dom_sid_equal(sid, &(dom_list[i].sid))) {
                         DEBUG(10, ("wcache_tdc_fetch_domainbysid: "
                                    "Found domain %s for SID %s\n",
@@ -4688 +4827 @@
                                    sid_string_dbg(sid)));
 
-                        d = TALLOC_P(ctx, struct winbindd_tdc_domain);
-                        if (!d)
-                                break;
-
-                        d->domain_name = talloc_strdup(d,
-                                                       dom_list[i].domain_name);
-
-                        d->dns_name = talloc_strdup(d, dom_list[i].dns_name);
-                        sid_copy(&d->sid, &dom_list[i].sid);
-                        d->trust_flags = dom_list[i].trust_flags;
-                        d->trust_type = dom_list[i].trust_type;
-                        d->trust_attribs = dom_list[i].trust_attribs;
-
+                        d = wcache_tdc_dup_domain(ctx, &dom_list[i]);
                         break;
                 }
@@ -4734 +4861 @@
                                     const char *shell,
                                     const char *gecos,
-                                    uint32 gid)
+                                    uint32_t gid)
 {
         struct cache_entry *centry;
@@ -4835 +4962 @@
 };
 
-static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
+static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, const char *domain_name,
                            uint32_t opnum, const DATA_BLOB *req,
                            TDB_DATA *pkey)

vendor/current/source3/winbindd/winbindd_ccache_access.c

@@ -7 +7 @@
    Copyright (C) Jeremy Allison 2006 (minor fixes to fit into Samba and
                                       protect against integer wrap).
+   Copyright (C) Andrew Bartlett 2011
 
    This program is free software; you can redistribute it and/or modify
@@ -24 +25 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "../libcli/auth/ntlmssp.h"
+#include "auth/gensec/gensec.h"
+#include "auth_generic.h"
 
 #undef DBGC_CLASS
@@ -42 +44 @@
 }
 
-static NTSTATUS do_ntlm_auth_with_hashes(const char *username,
-                                        const char *domain,
-                                        const unsigned char lm_hash[LM_HASH_LEN],
-                                        const unsigned char nt_hash[NT_HASH_LEN],
-                                        const DATA_BLOB initial_msg,
-                                        const DATA_BLOB challenge_msg,
-                                        DATA_BLOB *auth_msg,
-                                        uint8_t session_key[16])
+static NTSTATUS do_ntlm_auth_with_stored_pw(const char *username,
+                                            const char *domain,
+                                            const char *password,
+                                            const DATA_BLOB initial_msg,
+                                            const DATA_BLOB challenge_msg,
+                                            TALLOC_CTX *mem_ctx,
+                                            DATA_BLOB *auth_msg,
+                                            uint8_t session_key[16],
+                                            uint8_t *new_spnego)
 {
         NTSTATUS status;
-        struct ntlmssp_state *ntlmssp_state = NULL;
-        DATA_BLOB dummy_msg, reply;
-
-        status = ntlmssp_client_start(NULL,
-                                      global_myname(),
-                                      lp_workgroup(),
-                                      lp_client_ntlmv2_auth(),
-                                      &ntlmssp_state);
+        struct auth_generic_state *auth_generic_state = NULL;
+        DATA_BLOB reply, session_key_blob;
+
+        status = auth_generic_client_prepare(mem_ctx, &auth_generic_state);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -67 +66 @@
         }
 
-        status = ntlmssp_set_username(ntlmssp_state, username);
+        status = auth_generic_set_username(auth_generic_state, username);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -75 +74 @@
         }
 
-        status = ntlmssp_set_domain(ntlmssp_state, domain);
+        status = auth_generic_set_domain(auth_generic_state, domain);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -83 +82 @@
         }
 
-        status = ntlmssp_set_hashes(ntlmssp_state, lm_hash, nt_hash);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("Could not set hashes: %s\n",
-                        nt_errstr(status)));
-                goto done;
-        }
-
-        ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
-
-        /* We need to get our protocol handler into the right state. So first
-           we ask it to generate the initial message. Actually the client has already
-           sent its own initial message, so we're going to drop this one on the floor.
-           The client might have sent a different message, for example with different
-           negotiation options, but as far as I can tell this won't hurt us. (Unless
-           the client sent a different username or domain, in which case that's their
-           problem for telling us the wrong username or domain.)
-           Since we have a copy of the initial message that the client sent, we could
-           resolve any discrepancies if we had to.
-        */
-        dummy_msg = data_blob_null;
+        status = auth_generic_set_password(auth_generic_state, password);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("Could not set password: %s\n",
+                        nt_errstr(status)));
+                goto done;
+        }
+
+        if (initial_msg.length == 0) {
+                gensec_want_feature(auth_generic_state->gensec_security,
+                                    GENSEC_FEATURE_SESSION_KEY);
+        }
+
+        status = auth_generic_client_start_by_name(auth_generic_state,
+                                                   "ntlmssp_resume_ccache");
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("Could not start NTLMSSP resume mech: %s\n",
+                        nt_errstr(status)));
+                goto done;
+        }
+
+        /*
+         * We inject the inital NEGOTIATE message our caller used
+         * in order to get the state machine into the correct possition.
+         */
         reply = data_blob_null;
-        status = ntlmssp_update(ntlmssp_state, dummy_msg, &reply);
-        data_blob_free(&dummy_msg);
+        status = gensec_update(auth_generic_state->gensec_security,
+                               talloc_tos(), initial_msg, &reply);
         data_blob_free(&reply);
 
@@ -116 +119 @@
 
         /* Now we are ready to handle the server's actual response. */
-        status = ntlmssp_update(ntlmssp_state, challenge_msg, &reply);
-
+        status = gensec_update(auth_generic_state->gensec_security,
+                               mem_ctx, challenge_msg, &reply);
         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
                 DEBUG(1, ("We didn't get a response to the challenge! [%s]\n",
@@ -125 +128 @@
         }
 
-        if (ntlmssp_state->session_key.length != 16) {
+        status = gensec_session_key(auth_generic_state->gensec_security,
+                                    talloc_tos(), &session_key_blob);
+        if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
+                DEBUG(1, ("We didn't get the session key we requested! [%s]\n",
+                        nt_errstr(status)));
+                data_blob_free(&reply);
+                goto done;
+        }
+
+        if (session_key_blob.length != 16) {
                 DEBUG(1, ("invalid session key length %d\n",
-                          (int)ntlmssp_state->session_key.length));
+                          (int)session_key_blob.length));
                 data_blob_free(&reply);
                 goto done;
         }
-
-        *auth_msg = data_blob(reply.data, reply.length);
-        memcpy(session_key, ntlmssp_state->session_key.data, 16);
+        memcpy(session_key, session_key_blob.data, 16);
+        data_blob_free(&session_key_blob);
+        *auth_msg = reply;
+        *new_spnego = gensec_have_feature(auth_generic_state->gensec_security,
+                                          GENSEC_FEATURE_NEW_SPNEGO);
         status = NT_STATUS_OK;
 
 done:
-        TALLOC_FREE(ntlmssp_state);
+        TALLOC_FREE(auth_generic_state);
         return status;
 }
@@ -145 +159 @@
         int ret;
         uid_t ret_uid;
+        gid_t ret_gid;
 
         ret_uid = (uid_t)-1;
 
-        ret = sys_getpeereid(state->sock, &ret_uid);
+        ret = getpeereid(state->sock, &ret_uid, &ret_gid);
         if (ret != 0) {
                 DEBUG(1, ("check_client_uid: Could not get socket peer uid: %s; "
@@ -155 +170 @@
         }
 
-        if (uid != ret_uid) {
+        if (uid != ret_uid && ret_uid != sec_initial_uid()) {
                 DEBUG(1, ("check_client_uid: Client lied about its uid: said %u, "
                         "actually was %u; denying access\n",
@@ -172 +187 @@
         struct WINBINDD_MEMORY_CREDS *entry;
         DATA_BLOB initial, challenge, auth;
-        uint32 initial_blob_len, challenge_blob_len, extra_len;
+        uint32_t initial_blob_len, challenge_blob_len, extra_len;
 
         /* Ensure null termination */
@@ -258 +273 @@
                 state->request->data.ccache_ntlm_auth.challenge_blob_len);
 
-        result = do_ntlm_auth_with_hashes(
-                name_user, name_domain, entry->lm_hash, entry->nt_hash,
-                initial, challenge, &auth,
-                state->response->data.ccache_ntlm_auth.session_key);
+        result = do_ntlm_auth_with_stored_pw(
+                name_user, name_domain, entry->pass,
+                initial, challenge, talloc_tos(), &auth,
+                state->response->data.ccache_ntlm_auth.session_key,
+                &state->response->data.ccache_ntlm_auth.new_spnego);
 
         if (!NT_STATUS_IS_OK(result)) {

vendor/current/source3/winbindd/winbindd_change_machine_acct.c

@@ -21 +21 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_change_machine_acct_state {
@@ -53 +53 @@
                  * Internal domains are passdb based, we can always
                  * contact them.
+                 *
+                 * This also protects us from changing the password on
+                 * the AD DC without updating all the right databases.
+                 * Do not remove this until that code is fixed.
                  */
                 tevent_req_done(req);

vendor/current/source3/winbindd/winbindd_check_machine_acct.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_check_machine_acct_state {

vendor/current/source3/winbindd/winbindd_cm.c

@@ -77 +77 @@
 #include "passdb.h"
 #include "messages.h"
+#include "auth/gensec/gensec.h"
+#include "../libcli/smb/smbXcli_base.h"
+#include "libcli/auth/netlogon_creds_cli.h"
+#include "auth.h"
+#include "rpc_server/rpc_ncacn_np.h"
+#include "auth/credentials/credentials.h"
+#include "lib/param/param.h"
 
 #undef DBGC_CLASS
@@ -89 +96 @@
 extern bool override_logfile;
 
-static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
+static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain, bool need_rw_dc);
 static void set_dc_type_and_flags( struct winbindd_domain *domain );
+static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain );
 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
                     struct dc_name_ip **dcs, int *num_dcs);
@@ -171 +179 @@
                            check so always does network calls. */
 
-                        init_dc_connection_network(domain);
+                        init_dc_connection_network(domain, true);
                         break;
                 }
@@ -188 +196 @@
         int num_dcs = 0;
         TALLOC_CTX *mem_ctx = NULL;
-        pid_t parent_pid = sys_getpid();
+        pid_t parent_pid = getpid();
         char *lfile = NULL;
         NTSTATUS status;
@@ -206 +214 @@
         }
 
-        domain->dc_probe_pid = sys_fork();
+        domain->dc_probe_pid = fork();
 
         if (domain->dc_probe_pid == (pid_t)-1) {
@@ -242 +250 @@
                                    pid_to_procid(parent_pid),
                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
-                                   (uint8 *)domain->name,
+                                   (const uint8_t *)domain->name,
                                    strlen(domain->name)+1);
                 _exit(1);
@@ -254 +262 @@
                                    pid_to_procid(parent_pid),
                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
-                                   (uint8 *)domain->name,
+                                   (const uint8_t *)domain->name,
                                    strlen(domain->name)+1);
                 _exit(1);
@@ -264 +272 @@
                                    pid_to_procid(parent_pid),
                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
-                                   (uint8 *)domain->name,
+                                   (const uint8_t *)domain->name,
                                    strlen(domain->name)+1);
                 _exit(0);
@@ -275 +283 @@
                            pid_to_procid(parent_pid),
                            MSG_WINBIND_TRY_TO_GO_ONLINE,
-                           (uint8 *)domain->name,
+                           (const uint8_t *)domain->name,
                            strlen(domain->name)+1);
         _exit(0);
@@ -284 +292 @@
 ****************************************************************/
 
-static void check_domain_online_handler(struct event_context *ctx,
-                                        struct timed_event *te,
+static void check_domain_online_handler(struct tevent_context *ctx,
+                                        struct tevent_timer *te,
                                         struct timeval now,
                                         void *private_data)
@@ -420 +428 @@
         calc_new_online_timeout_check(domain);
 
-        domain->check_online_event = event_add_timed(winbind_event_context(),
+        domain->check_online_event = tevent_add_timer(winbind_event_context(),
                                                 NULL,
                                                 timeval_current_ofs(domain->check_online_timeout,0),
@@ -439 +447 @@
                                    pid_to_procid(parent_pid),
                                    MSG_WINBIND_DOMAIN_OFFLINE,
-                                   (uint8 *)domain->name,
+                                   (uint8_t *)domain->name,
                                    strlen(domain->name) + 1);
         }
@@ -453 +461 @@
                                            pid_to_procid(idmap->pid), 
                                            MSG_WINBIND_OFFLINE, 
-                                           (uint8 *)domain->name, 
+                                           (const uint8_t *)domain->name,
                                            strlen(domain->name)+1);
                 }                       
@@ -525 +533 @@
                                    pid_to_procid(parent_pid),
                                    MSG_WINBIND_DOMAIN_ONLINE,
-                                   (uint8 *)domain->name,
+                                   (uint8_t *)domain->name,
                                    strlen(domain->name) + 1);
         }
@@ -539 +547 @@
                                            pid_to_procid(idmap->pid), 
                                            MSG_WINBIND_ONLINE, 
-                                           (uint8 *)domain->name, 
+                                           (const uint8_t *)domain->name,
                                            strlen(domain->name)+1);
                 }                       
@@ -596 +604 @@
         TALLOC_FREE(domain->check_online_event);
 
-        domain->check_online_event = event_add_timed(winbind_event_context(),
+        domain->check_online_event = tevent_add_timer(winbind_event_context(),
                                                      NULL,
                                                      tev,
@@ -621 +629 @@
            remove it. */
         saf_delete(domain->name);
-        if (*domain->alt_name) {
+        if (domain->alt_name != NULL) {
                 add_failed_connection_entry(domain->alt_name, server, result);
                 saf_delete(domain->alt_name);
@@ -659 +667 @@
                 *password = smb_xstrdup("");
         }
+}
+
+static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx,
+                                       struct cli_credentials **_creds)
+{
+
+        TALLOC_CTX *frame = talloc_stackframe();
+        NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
+        struct loadparm_context *lp_ctx;
+        char *username = NULL;
+        char *netbios_domain = NULL;
+        char *password = NULL;
+        struct cli_credentials *creds = NULL;
+        bool ok;
+
+        cm_get_ipc_userpass(&username, &netbios_domain, &password);
+
+        lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
+        if (lp_ctx == NULL) {
+                DEBUG(1, ("loadparm_init_s3 failed\n"));
+                status = NT_STATUS_INTERNAL_ERROR;
+                goto fail;
+        }
+
+        creds = cli_credentials_init(mem_ctx);
+        if (creds == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        cli_credentials_set_conf(creds, lp_ctx);
+        cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS);
+
+        ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
+        if (!ok) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        ok = cli_credentials_set_username(creds, username, CRED_SPECIFIED);
+        if (!ok) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        ok = cli_credentials_set_password(creds, password, CRED_SPECIFIED);
+        if (!ok) {
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        *_creds = creds;
+        creds = NULL;
+        status = NT_STATUS_OK;
+ fail:
+        TALLOC_FREE(creds);
+        SAFE_FREE(username);
+        SAFE_FREE(netbios_domain);
+        SAFE_FREE(password);
+        TALLOC_FREE(frame);
+        return status;
+}
+
+static bool cm_is_ipc_credentials(struct cli_credentials *creds)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        char *ipc_account = NULL;
+        char *ipc_domain = NULL;
+        char *ipc_password = NULL;
+        const char *creds_account = NULL;
+        const char *creds_domain = NULL;
+        const char *creds_password = NULL;
+        bool ret = false;
+
+        cm_get_ipc_userpass(&ipc_account, &ipc_domain, &ipc_password);
+
+        creds_account = cli_credentials_get_username(creds);
+        creds_domain = cli_credentials_get_domain(creds);
+        creds_password = cli_credentials_get_password(creds);
+
+        if (!strequal(ipc_domain, creds_domain)) {
+                goto done;
+        }
+
+        if (!strequal(ipc_account, creds_account)) {
+                goto done;
+        }
+
+        if (!strcsequal(ipc_password, creds_password)) {
+                goto done;
+        }
+
+        ret = true;
+ done:
+        SAFE_FREE(ipc_account);
+        SAFE_FREE(ipc_domain);
+        SAFE_FREE(ipc_password);
+        TALLOC_FREE(frame);
+        return ret;
 }
 
@@ -725 +832 @@
                                 return false;
                         }
-                        if (strlen(domain->alt_name) == 0) {
-                                fstrcpy(domain->alt_name,
-                                        domain_info->domain_name);
+                        if (domain->alt_name == NULL) {
+                                domain->alt_name = talloc_strdup(domain,
+                                                                 domain_info->domain_name);
+                                if (domain->alt_name == NULL) {
+                                        DEBUG(0, ("talloc_strdup failed\n"));
+                                        talloc_destroy(mem_ctx);
+                                        return false;
+                                }
                         }
-                        if (strlen(domain->forest_name) == 0) {
-                                fstrcpy(domain->forest_name,
-                                        domain_info->forest_name);
+                        if (domain->forest_name == NULL) {
+                                domain->forest_name = talloc_strdup(domain,
+                                                                    domain_info->forest_name);
+                                if (domain->forest_name == NULL) {
+                                        DEBUG(0, ("talloc_strdup failed\n"));
+                                        talloc_destroy(mem_ctx);
+                                        return false;
+                                }
                         }
                 }
@@ -778 +895 @@
  * Helper function to assemble trust password and account name
  */
-static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
-                                char **machine_password,
-                                char **machine_account,
-                                char **machine_krb5_principal)
-{
-        const char *account_name;
-        const char *name = NULL;
+static NTSTATUS get_trust_credentials(struct winbindd_domain *domain,
+                                      TALLOC_CTX *mem_ctx,
+                                      bool netlogon,
+                                      struct cli_credentials **_creds)
+{
+        const struct winbindd_domain *creds_domain = NULL;
+        struct cli_credentials *creds;
+        NTSTATUS status;
+        bool force_machine_account = false;
 
         /* If we are a DC and this is not our own domain */
 
-        if (IS_DC) {
-                name = domain->name;
+        if (!domain->active_directory) {
+                if (!netlogon) {
+                        /*
+                         * For non active directory domains
+                         * we can only use NTLMSSP for SMB.
+                         *
+                         * But the trust account is not allowed
+                         * to use SMB with NTLMSSP.
+                         */
+                        force_machine_account = true;
+                }
+        }
+
+        if (IS_DC && !force_machine_account) {
+                creds_domain = domain;
         } else {
-                struct winbindd_domain *our_domain = find_our_domain();
-
-                if (!our_domain)
-                        return NT_STATUS_INVALID_SERVER_STATE;          
-
-                name = our_domain->name;                
-        }       
-
-        if (!get_trust_pw_clear(name, machine_password,
-                                &account_name, NULL))
-        {
+                creds_domain = find_our_domain();
+                if (creds_domain == NULL) {
+                        return NT_STATUS_INVALID_SERVER_STATE;
+                }
+        }
+
+        status = pdb_get_trust_credentials(creds_domain->name,
+                                           creds_domain->alt_name,
+                                           mem_ctx,
+                                           &creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto ipc_fallback;
+        }
+
+        if (domain->primary && lp_security() == SEC_ADS) {
+                cli_credentials_set_kerberos_state(creds,
+                                                   CRED_AUTO_USE_KERBEROS);
+        } else if (domain->active_directory) {
+                cli_credentials_set_kerberos_state(creds,
+                                                   CRED_MUST_USE_KERBEROS);
+        } else {
+                cli_credentials_set_kerberos_state(creds,
+                                                   CRED_DONT_USE_KERBEROS);
+        }
+
+        if (creds_domain != domain) {
+                /*
+                 * We can only use schannel against a direct trust
+                 */
+                cli_credentials_set_secure_channel_type(creds,
+                                                        SEC_CHAN_NULL);
+        }
+
+        *_creds = creds;
+        return NT_STATUS_OK;
+
+ ipc_fallback:
+        if (netlogon) {
                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
         }
 
-        if ((machine_account != NULL) &&
-            (asprintf(machine_account, "%s$", account_name) == -1))
-        {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* For now assume our machine account only exists in our domain */
-
-        if (machine_krb5_principal != NULL)
-        {
-                struct winbindd_domain *our_domain = find_our_domain();
-
-                if (!our_domain) {
-                        return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;                       
-                }
-
-                if (asprintf(machine_krb5_principal, "%s$@%s",
-                             account_name, our_domain->alt_name) == -1)
-                {
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                strupper_m(*machine_krb5_principal);
-        }
-
+        status = cm_get_ipc_credentials(mem_ctx, &creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        *_creds = creds;
         return NT_STATUS_OK;
 }
@@ -838 +978 @@
 ************************************************************************/
 
-static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
+static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
                                       const int sockfd,
                                       const char *controller,
@@ -844 +984 @@
                                       bool *retry)
 {
-        char *machine_password = NULL;
-        char *machine_krb5_principal = NULL;
-        char *machine_account = NULL;
-        char *ipc_username = NULL;
-        char *ipc_domain = NULL;
-        char *ipc_password = NULL;
+        bool try_ipc_auth = false;
+        const char *machine_password = NULL;
+        const char *machine_krb5_principal = NULL;
+        const char *machine_account = NULL;
+        const char *machine_domain = NULL;
+        int flags = 0;
+        struct cli_credentials *creds = NULL;
+        enum credentials_use_kerberos krb5_state;
 
         struct named_mutex *mutex;
@@ -855 +997 @@
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 
-        struct sockaddr peeraddr;
-        socklen_t peeraddr_len;
-
-        struct sockaddr_in *peeraddr_in =
-                (struct sockaddr_in *)(void *)&peeraddr;
+        enum smb_signing_setting smb_sign_client_connections = lp_client_ipc_signing();
+
+        if (smb_sign_client_connections == SMB_SIGNING_DEFAULT) {
+                /*
+                 * If we are connecting to our own AD domain, require
+                 * smb signing to disrupt MITM attacks
+                 */
+                if (domain->primary && lp_security() == SEC_ADS) {
+                        smb_sign_client_connections = SMB_SIGNING_REQUIRED;
+                /*
+                 * If we are in or are an AD domain and connecting to another
+                 * AD domain in our forest
+                 * then require smb signing to disrupt MITM attacks
+                 */
+                } else if ((lp_security() == SEC_ADS ||
+                            lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC)
+                           && domain->active_directory
+                           && (domain->domain_trust_attribs
+                               & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)) {
+                        smb_sign_client_connections = SMB_SIGNING_REQUIRED;
+                }
+        }
 
         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
@@ -869 +1028 @@
                                  WINBIND_SERVER_MUTEX_WAIT_TIME);
         if (mutex == NULL) {
+                close(sockfd);
                 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
                          controller));
@@ -875 +1035 @@
         }
 
-        if ((*cli = cli_initialise()) == NULL) {
+        flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
+
+        *cli = cli_state_create(NULL, sockfd,
+                                controller, domain->alt_name,
+                                smb_sign_client_connections, flags);
+        if (*cli == NULL) {
+                close(sockfd);
                 DEBUG(1, ("Could not cli_initialize\n"));
                 result = NT_STATUS_NO_MEMORY;
@@ -881 +1047 @@
         }
 
-        (*cli)->timeout = 10000;        /* 10 seconds */
-        (*cli)->fd = sockfd;
-        (*cli)->desthost = talloc_strdup((*cli), controller);
-        if ((*cli)->desthost == NULL) {
-                result = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        (*cli)->use_kerberos = True;
-
-        peeraddr_len = sizeof(peeraddr);
-
-        if ((getpeername((*cli)->fd, &peeraddr, &peeraddr_len) != 0)) {
-                DEBUG(0,("cm_prepare_connection: getpeername failed with: %s\n",
-                        strerror(errno)));
-                result = NT_STATUS_UNSUCCESSFUL;
-                goto done;
-        }
-
-        if ((peeraddr_len != sizeof(struct sockaddr_in))
-#ifdef HAVE_IPV6
-            && (peeraddr_len != sizeof(struct sockaddr_in6))
-#endif
-            ) {
-                DEBUG(0,("cm_prepare_connection: got unexpected peeraddr len %d\n",
-                        peeraddr_len));
-                result = NT_STATUS_UNSUCCESSFUL;
-                goto done;
-        }
-
-        if ((peeraddr_in->sin_family != PF_INET)
-#ifdef HAVE_IPV6
-            && (peeraddr_in->sin_family != PF_INET6)
-#endif
-            ) {
-                DEBUG(0,("cm_prepare_connection: got unexpected family %d\n",
-                        peeraddr_in->sin_family));
-                result = NT_STATUS_UNSUCCESSFUL;
-                goto done;
-        }
-
-        result = cli_negprot(*cli);
+        cli_set_timeout(*cli, 10000); /* 10 seconds */
+
+        result = smbXcli_negprot((*cli)->conn, (*cli)->timeout,
+                                 lp_client_ipc_min_protocol(),
+                                 lp_client_ipc_max_protocol());
 
         if (!NT_STATUS_IS_OK(result)) {
@@ -929 +1058 @@
         }
 
-        if (!is_dc_trusted_domain_situation(domain->name) &&
-            (*cli)->protocol >= PROTOCOL_NT1 &&
-            (*cli)->capabilities & CAP_EXTENDED_SECURITY)
-        {
-                ADS_STATUS ads_status;
-
-                result = get_trust_creds(domain, &machine_password,
-                                         &machine_account,
-                                         &machine_krb5_principal);
+        if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_NT1 &&
+            smb1cli_conn_capabilities((*cli)->conn) & CAP_EXTENDED_SECURITY) {
+                try_ipc_auth = true;
+        } else if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
+                try_ipc_auth = true;
+        } else if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
+                /*
+                 * If we are forcing on SMB signing, then we must
+                 * require authentication unless this is a one-way
+                 * trust, and we have no stored user/password
+                 */
+                try_ipc_auth = true;
+        }
+
+        if (try_ipc_auth) {
+                result = get_trust_credentials(domain, talloc_tos(), false, &creds);
                 if (!NT_STATUS_IS_OK(result)) {
-                        goto anon_fallback;
-                }
-
-                if (lp_security() == SEC_ADS) {
-
-                        /* Try a krb5 session */
-
-                        (*cli)->use_kerberos = True;
-                        DEBUG(5, ("connecting to %s from %s with kerberos principal "
-                                  "[%s] and realm [%s]\n", controller, global_myname(),
-                                  machine_krb5_principal, domain->alt_name));
-
-                        winbindd_set_locator_kdc_envs(domain);
-
-                        ads_status = cli_session_setup_spnego(*cli,
-                                                              machine_krb5_principal, 
-                                                              machine_password,
-                                                              lp_workgroup(),
-                                                              domain->alt_name);
-
-                        if (!ADS_ERR_OK(ads_status)) {
-                                DEBUG(4,("failed kerberos session setup with %s\n",
-                                         ads_errstr(ads_status)));
-                        }
-
-                        result = ads_ntstatus(ads_status);
-                        if (NT_STATUS_IS_OK(result)) {
-                                /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
-                                result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
-                                if (!NT_STATUS_IS_OK(result)) {
-                                        goto done;
-                                }
-                                goto session_setup_done;
-                        }
-                }
-
+                        DEBUG(1, ("get_trust_credentials(%s) failed: %s\n",
+                                  domain->name, nt_errstr(result)));
+                        goto done;
+                }
+        } else {
+                /*
+                 * Without SPNEGO or NTLMSSP (perhaps via SMB2) we
+                 * would try and authentication with our machine
+                 * account password and fail.  This is very rare in
+                 * the modern world however
+                 */
+                creds = cli_credentials_init_anon(talloc_tos());
+                if (creds == NULL) {
+                        result = NT_STATUS_NO_MEMORY;
+                        DEBUG(1, ("cli_credentials_init_anon(%s) failed: %s\n",
+                                  domain->name, nt_errstr(result)));
+                        goto done;
+                }
+        }
+
+        krb5_state = cli_credentials_get_kerberos_state(creds);
+
+        machine_krb5_principal = cli_credentials_get_principal(creds,
+                                                        talloc_tos());
+        if (machine_krb5_principal == NULL) {
+                krb5_state = CRED_DONT_USE_KERBEROS;
+        }
+
+        machine_account = cli_credentials_get_username(creds);
+        machine_password = cli_credentials_get_password(creds);
+        machine_domain = cli_credentials_get_domain(creds);
+
+        if (krb5_state != CRED_DONT_USE_KERBEROS) {
+
+                /* Try a krb5 session */
+
+                (*cli)->use_kerberos = True;
+                DEBUG(5, ("connecting to %s from %s with kerberos principal "
+                          "[%s] and realm [%s]\n", controller, lp_netbios_name(),
+                          machine_krb5_principal, domain->alt_name));
+
+                winbindd_set_locator_kdc_envs(domain);
+
+                result = cli_session_setup(*cli,
+                                           machine_krb5_principal,
+                                           machine_password,
+                                           strlen(machine_password)+1,
+                                           machine_password,
+                                           strlen(machine_password)+1,
+                                           machine_domain);
+
+                if (NT_STATUS_IS_OK(result)) {
+                        goto session_setup_done;
+                }
+
+                DEBUG(4,("failed kerberos session setup with %s\n",
+                         nt_errstr(result)));
+        }
+
+        if (krb5_state != CRED_MUST_USE_KERBEROS) {
                 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
                 (*cli)->use_kerberos = False;
 
-                DEBUG(5, ("connecting to %s from %s with username "
-                          "[%s]\\[%s]\n",  controller, global_myname(),
-                          lp_workgroup(), machine_account));
-
-                ads_status = cli_session_setup_spnego(*cli,
-                                                      machine_account, 
-                                                      machine_password, 
-                                                      lp_workgroup(),
-                                                      NULL);
-                if (!ADS_ERR_OK(ads_status)) {
-                        DEBUG(4, ("authenticated session setup failed with %s\n",
-                                ads_errstr(ads_status)));
-                }
-
-                result = ads_ntstatus(ads_status);
-                if (NT_STATUS_IS_OK(result)) {
-                        /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
-                        result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
-                        if (!NT_STATUS_IS_OK(result)) {
-                                goto done;
-                        }
-                        goto session_setup_done;
-                }
-        }
-
-        /* Fall back to non-kerberos session setup with auth_user */
-
+                DEBUG(5, ("connecting to %s from %s using NTLMSSP with username "
+                          "[%s]\\[%s]\n",  controller, lp_netbios_name(),
+                          machine_domain, machine_account));
+
+                result = cli_session_setup(*cli,
+                                           machine_account,
+                                           machine_password,
+                                           strlen(machine_password)+1,
+                                           machine_password,
+                                           strlen(machine_password)+1,
+                                           machine_domain);
+        }
+
+        if (NT_STATUS_IS_OK(result)) {
+                goto session_setup_done;
+        }
+
+        /*
+         * If we are not going to validiate the conneciton
+         * with SMB signing, then allow us to fall back to
+         * anonymous
+         */
+        if (NT_STATUS_EQUAL(result, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)
+            || NT_STATUS_EQUAL(result, NT_STATUS_TRUSTED_DOMAIN_FAILURE)
+            || NT_STATUS_EQUAL(result, NT_STATUS_INVALID_ACCOUNT_NAME)
+            || NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS)
+            || NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE))
+        {
+                if (cli_credentials_is_anonymous(creds)) {
+                        goto done;
+                }
+
+                if (!cm_is_ipc_credentials(creds)) {
+                        goto ipc_fallback;
+                }
+
+                if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
+                        goto done;
+                }
+
+                goto anon_fallback;
+        }
+
+        DEBUG(4, ("authenticated session setup failed with %s\n",
+                nt_errstr(result)));
+
+        goto done;
+
+ ipc_fallback:
+        result = cm_get_ipc_credentials(talloc_tos(), &creds);
+        if (!NT_STATUS_IS_OK(result)) {
+                goto done;
+        }
+
+        if (cli_credentials_is_anonymous(creds)) {
+                TALLOC_FREE(creds);
+                goto anon_fallback;
+        }
+
+        machine_account = cli_credentials_get_username(creds);
+        machine_password = cli_credentials_get_password(creds);
+        machine_domain = cli_credentials_get_domain(creds);
+
+        /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the ipc creds. */
         (*cli)->use_kerberos = False;
 
-        cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
-
-        if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
-            (strlen(ipc_username) > 0)) {
-
-                /* Only try authenticated if we have a username */
-
-                DEBUG(5, ("connecting to %s from %s with username "
-                          "[%s]\\[%s]\n",  controller, global_myname(),
-                          ipc_domain, ipc_username));
-
-                if (NT_STATUS_IS_OK(cli_session_setup(
-                                            *cli, ipc_username,
-                                            ipc_password, strlen(ipc_password)+1,
-                                            ipc_password, strlen(ipc_password)+1,
-                                            ipc_domain))) {
-                        /* Successful logon with given username. */
-                        result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
-                        if (!NT_STATUS_IS_OK(result)) {
-                                goto done;
-                        }
-                        goto session_setup_done;
-                } else {
-                        DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
-                                ipc_domain, ipc_username ));
-                }
-        }
+        DEBUG(5, ("connecting to %s from %s using NTLMSSP with username "
+                  "[%s]\\[%s]\n",  controller, lp_netbios_name(),
+                  machine_domain, machine_account));
+
+        result = cli_session_setup(*cli,
+                                   machine_account,
+                                   machine_password,
+                                   strlen(machine_password)+1,
+                                   machine_password,
+                                   strlen(machine_password)+1,
+                                   machine_domain);
+
+        if (NT_STATUS_IS_OK(result)) {
+                goto session_setup_done;
+        }
+
+        /*
+         * If we are not going to validiate the conneciton
+         * with SMB signing, then allow us to fall back to
+         * anonymous
+         */
+        if (NT_STATUS_EQUAL(result, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)
+            || NT_STATUS_EQUAL(result, NT_STATUS_TRUSTED_DOMAIN_FAILURE)
+            || NT_STATUS_EQUAL(result, NT_STATUS_INVALID_ACCOUNT_NAME)
+            || NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS)
+            || NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE))
+        {
+                goto anon_fallback;
+        }
+
+        DEBUG(4, ("authenticated session setup failed with %s\n",
+                nt_errstr(result)));
+
+        goto done;
 
  anon_fallback:
+
+        if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
+                goto done;
+        }
 
         /* Fall back to anonymous connection, this might fail later */
@@ -1042 +1250 @@
                 controller ));
 
-        if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
-                                              NULL, 0, ""))) {
+        (*cli)->use_kerberos = False;
+
+        result = cli_session_setup(*cli, "", "", 0, "", 0, "");
+        if (NT_STATUS_IS_OK(result)) {
                 DEBUG(5, ("Connected anonymously\n"));
-                result = cli_init_creds(*cli, "", "", "");
-                if (!NT_STATUS_IS_OK(result)) {
-                        goto done;
-                }
                 goto session_setup_done;
         }
 
-        result = cli_nt_error(*cli);
-
-        if (NT_STATUS_IS_OK(result))
-                result = NT_STATUS_UNSUCCESSFUL;
-
         /* We can't session setup */
-
         goto done;
 
  session_setup_done:
 
-        /* cache the server name for later connections */
-
-        saf_store( domain->name, (*cli)->desthost );
-        if (domain->alt_name && (*cli)->use_kerberos) {
-                saf_store( domain->alt_name, (*cli)->desthost );
-        }
-
-        winbindd_set_locator_kdc_envs(domain);
-
-        result = cli_tcon_andx(*cli, "IPC$", "IPC", "", 0);
+        /*
+         * This should be a short term hack until
+         * dynamic re-authentication is implemented.
+         *
+         * See Bug 9175 - winbindd doesn't recover from
+         * NT_STATUS_NETWORK_SESSION_EXPIRED
+         */
+        if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
+                smbXcli_session_set_disconnect_expired((*cli)->smb2.session);
+        }
+
+        result = cli_tree_connect(*cli, "IPC$", "IPC", "", 0);
 
         if (!NT_STATUS_IS_OK(result)) {
@@ -1079 +1281 @@
         }
 
+        /* cache the server name for later connections */
+
+        saf_store(domain->name, controller);
+        if (domain->alt_name && (*cli)->use_kerberos) {
+                saf_store(domain->alt_name, controller);
+        }
+
+        winbindd_set_locator_kdc_envs(domain);
+
         TALLOC_FREE(mutex);
         *retry = False;
 
-        /* set the domain if empty; needed for schannel connections */
-        if ( !(*cli)->domain[0] ) {
-                result = cli_set_domain((*cli), domain->name);
-                if (!NT_STATUS_IS_OK(result)) {
-                        SAFE_FREE(ipc_username);
-                        SAFE_FREE(ipc_domain);
-                        SAFE_FREE(ipc_password);
-                        return result;
-                }
-        }
-
         result = NT_STATUS_OK;
 
  done:
         TALLOC_FREE(mutex);
-        SAFE_FREE(machine_account);
-        SAFE_FREE(machine_password);
-        SAFE_FREE(machine_krb5_principal);
-        SAFE_FREE(ipc_username);
-        SAFE_FREE(ipc_domain);
-        SAFE_FREE(ipc_password);
 
         if (!NT_STATUS_IS_OK(result)) {
@@ -1148 +1342 @@
                         return False;
 
-        *dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
+        *dcs = talloc_realloc(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
 
         if (*dcs == NULL)
@@ -1160 +1354 @@
 
 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
-                                  struct sockaddr_storage *pss, uint16 port,
+                                  struct sockaddr_storage *pss, uint16_t port,
                                   struct sockaddr_storage **addrs, int *num)
 {
-        *addrs = TALLOC_REALLOC_ARRAY(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
+        *addrs = talloc_realloc(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
 
         if (*addrs == NULL) {
@@ -1184 +1378 @@
                 const struct winbindd_domain *domain,
                 struct sockaddr_storage *pss,
-                fstring name )
+                char **name)
 {
         struct ip_service ip_list;
@@ -1190 +1384 @@
         NTSTATUS status;
         const char *dc_name;
-
+        fstring nbtname;
+#ifdef HAVE_ADS
+        bool is_ad_domain = false;
+#endif
         ip_list.ss = *pss;
         ip_list.port = 0;
@@ -1198 +1395 @@
            None of these failures should be considered critical for now */
 
-        if (lp_security() == SEC_ADS) {
+        if ((lp_security() == SEC_ADS) && (domain->alt_name != NULL)) {
+                is_ad_domain = true;
+        } else if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
+                is_ad_domain = domain->active_directory;
+        }
+
+        if (is_ad_domain) {
                 ADS_STRUCT *ads;
                 ADS_STATUS ads_status;
@@ -1211 +1414 @@
                 if (ADS_ERR_OK(ads_status)) {
                         /* We got a cldap packet. */
-                        fstrcpy(name, ads->config.ldap_server_name);
-                        namecache_store(name, 0x20, 1, &ip_list);
+                        *name = talloc_strdup(mem_ctx,
+                                             ads->config.ldap_server_name);
+                        if (*name == NULL) {
+                                return false;
+                        }
+                        namecache_store(*name, 0x20, 1, &ip_list);
 
                         DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
@@ -1218 +1425 @@
                         if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
                                 if (ads_closest_dc(ads)) {
-                                        char *sitename = sitename_fetch(ads->config.realm);
+                                        char *sitename = sitename_fetch(mem_ctx, ads->config.realm);
 
                                         /* We're going to use this KDC for this realm/domain.
@@ -1227 +1434 @@
                                                                         domain->name,
                                                                         sitename,
-                                                                        pss,
-                                                                        name);
-
-                                        SAFE_FREE(sitename);
+                                                                        pss);
+
+                                        TALLOC_FREE(sitename);
                                 } else {
                                         /* use an off site KDC */
@@ -1236 +1442 @@
                                                                         domain->name,
                                                                         NULL,
-                                                                        pss,
-                                                                        name);
+                                                                        pss);
                                 }
                                 winbindd_set_locator_kdc_envs(domain);
 
                                 /* Ensure we contact this DC also. */
-                                saf_store( domain->name, name);
-                                saf_store( domain->alt_name, name);
+                                saf_store(domain->name, *name);
+                                saf_store(domain->alt_name, *name);
                         }
 
@@ -1259 +1464 @@
                            &dc_name, NULL);
         if (NT_STATUS_IS_OK(status)) {
-                fstrcpy(name, dc_name);
-                namecache_store(name, 0x20, 1, &ip_list);
+                *name = talloc_strdup(mem_ctx, dc_name);
+                if (*name == NULL) {
+                        return false;
+                }
+                namecache_store(*name, 0x20, 1, &ip_list);
                 return True;
         }
@@ -1266 +1474 @@
         /* try node status request */
 
-        if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
-                namecache_store(name, 0x20, 1, &ip_list);
-                return True;
+        if (name_status_find(domain->name, 0x1c, 0x20, pss, nbtname) ) {
+                namecache_store(nbtname, 0x20, 1, &ip_list);
+
+                if (name != NULL) {
+                        *name = talloc_strdup(mem_ctx, nbtname);
+                        if (*name == NULL) {
+                                return false;
+                        }
+                }
+
+                return true;
         }
         return False;
@@ -1311 +1527 @@
         }
 
-        if (sec == SEC_ADS) {
+        if ((sec == SEC_ADS) && (domain->alt_name != NULL)) {
                 char *sitename = NULL;
 
@@ -1325 +1541 @@
                 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
 
-                sitename = sitename_fetch(domain->alt_name);
+                sitename = sitename_fetch(mem_ctx, domain->alt_name);
                 if (sitename) {
 
@@ -1349 +1565 @@
 
                         SAFE_FREE(ip_list);
-                        SAFE_FREE(sitename);
+                        TALLOC_FREE(sitename);
                         iplist_size = 0;
                 }
@@ -1373 +1589 @@
         }
 
-        /* Try standard netbios queries if no ADS */
+        /* Try standard netbios queries if no ADS and fall back to DNS queries
+         * if alt_name is available */
         if (*num_dcs == 0) {
                 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
-                       False);
+                       false);
+                if (iplist_size == 0) {
+                        if (domain->alt_name != NULL) {
+                                get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
+                                       &iplist_size, true);
+                        }
+                }
 
                 for ( i=0; i<iplist_size; i++ ) {
@@ -1410 +1633 @@
 static bool find_new_dc(TALLOC_CTX *mem_ctx,
                         struct winbindd_domain *domain,
-                        fstring dcname, struct sockaddr_storage *pss, int *fd)
+                        char **dcname, struct sockaddr_storage *pss, int *fd)
 {
         struct dc_name_ip *dcs = NULL;
@@ -1416 +1639 @@
 
         const char **dcnames = NULL;
-        int num_dcnames = 0;
+        size_t num_dcnames = 0;
 
         struct sockaddr_storage *addrs = NULL;
@@ -1438 +1661 @@
                         return False;
                 }
-                if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 445,
+                if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, TCP_SMB_PORT,
                                       &addrs, &num_addrs)) {
                         return False;
@@ -1469 +1692 @@
         if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
                 /* Ok, we've got a name for the DC */
-                fstrcpy(dcname, dcnames[fd_index]);
-                return True;
+                *dcname = talloc_strdup(mem_ctx, dcnames[fd_index]);
+                if (*dcname == NULL) {
+                        return false;
+                }
+                return true;
         }
 
@@ -1512 +1738 @@
         char *value = NULL;
 
-        if (cli == NULL) {
+        if (!cli_state_is_connected(cli)) {
                 return;
         }
-        if (cli->fd == -1) {
-                return;
-        }
-        get_peer_addr(cli->fd, addr, sizeof(addr));
+
+        print_sockaddr(addr, sizeof(addr),
+                       smbXcli_conn_remote_sockaddr(cli->conn));
 
         key = current_dc_key(talloc_tos(), domain_name);
@@ -1540 +1765 @@
                                     char **p_dc_name, char **p_dc_ip)
 {
-        char *key, *value, *p;
+        char *key, *p;
+        char *value = NULL;
         bool ret = false;
         char *dc_name = NULL;
@@ -1549 +1775 @@
                 goto done;
         }
-        if (!gencache_get(key, &value, NULL)) {
+        if (!gencache_get(key, mem_ctx, &value, NULL)) {
                 goto done;
         }
@@ -1578 +1804 @@
         TALLOC_FREE(dc_ip);
         TALLOC_FREE(key);
+        TALLOC_FREE(value);
         return ret;
+}
+
+NTSTATUS wb_open_internal_pipe(TALLOC_CTX *mem_ctx,
+                               const struct ndr_interface_table *table,
+                               struct rpc_pipe_client **ret_pipe)
+{
+        struct rpc_pipe_client *cli = NULL;
+        const struct auth_session_info *session_info;
+        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+
+
+        session_info = get_session_info_system();
+        SMB_ASSERT(session_info != NULL);
+
+        /* create a connection to the specified pipe */
+        if (lp_parm_bool(-1, "winbindd", "use external pipes", false)) {
+                status = rpc_pipe_open_interface(mem_ctx,
+                                                 table,
+                                                 session_info,
+                                                 NULL,
+                                                 winbind_messaging_context(),
+                                                 &cli);
+        } else {
+                status = rpc_pipe_open_internal(mem_ctx,
+                                                &table->syntax_id,
+                                                session_info,
+                                                NULL,
+                                                winbind_messaging_context(),
+                                                &cli);
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("open_internal_pipe: Could not connect to %s pipe: %s\n",
+                          table->name, nt_errstr(status)));
+                return status;
+        }
+
+        if (ret_pipe) {
+                *ret_pipe = cli;
+        }
+
+        return NT_STATUS_OK;
 }
 
@@ -1586 +1854 @@
         TALLOC_CTX *mem_ctx;
         NTSTATUS result;
-        char *saf_servername = saf_fetch( domain->name );
+        char *saf_servername;
         int retries;
 
         if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
-                SAFE_FREE(saf_servername);
                 set_domain_offline(domain);
                 return NT_STATUS_NO_MEMORY;
         }
+
+        saf_servername = saf_fetch(mem_ctx, domain->name );
 
         /* we have to check the server affinity cache here since 
@@ -1609 +1878 @@
                 /* convert an ip address to a name */
                 if (is_ipaddress( saf_servername ) ) {
-                        fstring saf_name;
+                        char *dcname = NULL;
                         struct sockaddr_storage ss;
 
                         if (!interpret_string_addr(&ss, saf_servername,
                                                 AI_NUMERICHOST)) {
+                                TALLOC_FREE(mem_ctx);
                                 return NT_STATUS_UNSUCCESSFUL;
                         }
-                        if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
-                                fstrcpy( domain->dcname, saf_name );
+                        if (dcip_to_name(mem_ctx, domain, &ss, &dcname)) {
+                                domain->dcname = talloc_strdup(domain,
+                                                               dcname);
+                                if (domain->dcname == NULL) {
+                                        TALLOC_FREE(mem_ctx);
+                                        return NT_STATUS_NO_MEMORY;
+                                }
                         } else {
                                 winbind_add_failed_connection_entry(
@@ -1624 +1899 @@
                         }
                 } else {
-                        fstrcpy( domain->dcname, saf_servername );
-                }
-
-                SAFE_FREE( saf_servername );
+                        domain->dcname = talloc_strdup(domain, saf_servername);
+                        if (domain->dcname == NULL) {
+                                TALLOC_FREE(mem_ctx);
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                }
         }
 
@@ -1633 +1910 @@
                 int fd = -1;
                 bool retry = False;
+                char *dcname = NULL;
 
                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
 
                 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
-                        domain->dcname, domain->name ));
-
-                if (*domain->dcname 
+                        domain->dcname ? domain->dcname : "", domain->name ));
+
+                if (domain->dcname != NULL
                         && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
                         && (resolve_name(domain->dcname, &domain->dcaddr, 0x20, true)))
@@ -1653 +1931 @@
                 }
 
-                if ((fd == -1) 
-                        && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
+                if ((fd == -1) &&
+                    !find_new_dc(mem_ctx, domain, &dcname, &domain->dcaddr, &fd))
                 {
                         /* This is the one place where we will
@@ -1663 +1941 @@
                         break;
                 }
+                if (dcname != NULL) {
+                        talloc_free(domain->dcname);
+
+                        domain->dcname = talloc_move(domain, &dcname);
+                        if (domain->dcname == NULL) {
+                                result = NT_STATUS_NO_MEMORY;
+                                break;
+                        }
+                }
 
                 new_conn->cli = NULL;
@@ -1678 +1965 @@
 
         if (NT_STATUS_IS_OK(result)) {
+                bool seal_pipes = true;
 
                 winbindd_set_locator_kdc_envs(domain);
@@ -1697 +1985 @@
                 store_current_dc_in_gencache(domain->name, domain->dcname,
                                              new_conn->cli);
+
+                seal_pipes = lp_winbind_sealed_pipes();
+                seal_pipes = lp_parm_bool(-1, "winbind sealed pipes",
+                                          domain->name,
+                                          seal_pipes);
+
+                if (seal_pipes) {
+                        new_conn->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
+                } else {
+                        new_conn->auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+                }
         } else {
                 /* Ensure we setup the retry handler. */
@@ -1708 +2007 @@
 /* Close down all open pipes on a connection. */
 
-void invalidate_cm_connection(struct winbindd_cm_conn *conn)
+void invalidate_cm_connection(struct winbindd_domain *domain)
 {
         NTSTATUS result;
+        struct winbindd_cm_conn *conn = &domain->conn;
 
         /* We're closing down a possibly dead
@@ -1769 +2069 @@
         }
 
+        conn->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
+        conn->netlogon_force_reauth = false;
+        conn->netlogon_flags = 0;
+        TALLOC_FREE(conn->netlogon_creds);
+
         if (conn->cli) {
                 cli_shutdown(conn->cli);
@@ -1782 +2087 @@
 
         for (domain = domain_list(); domain; domain = domain->next) {
-                struct cli_state *cli = domain->conn.cli;
-
                 /*
                  * first close the low level SMB TCP connection
@@ -1789 +2092 @@
                  * requests in invalidate_cm_connection()
                  */
-                if (cli && cli->fd != -1) {
-                        close(domain->conn.cli->fd);
-                        domain->conn.cli->fd = -1;
-                }
-
-                invalidate_cm_connection(&domain->conn);
+                if (cli_state_is_connected(domain->conn.cli)) {
+                        smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
+                }
+
+                invalidate_cm_connection(domain);
         }
 
@@ -1829 +2131 @@
    Bypass online status check so always does network calls. */
 
-static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
+static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain, bool need_rw_dc)
 {
         NTSTATUS result;
+        bool skip_connection = domain->internal;
+        if (need_rw_dc && domain->rodc) {
+                skip_connection = false;
+        }
 
         /* Internal connections never use the network. */
-        if (domain->internal) {
-                domain->initialized = True;
-                return NT_STATUS_OK;
-        }
-
-        if (connection_ok(domain)) {
+        if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
+                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+        }
+
+        /* Still ask the internal LSA and SAMR server about the local domain */
+        if (skip_connection || connection_ok(domain)) {
                 if (!domain->initialized) {
                         set_dc_type_and_flags(domain);
@@ -1846 +2152 @@
         }
 
-        invalidate_cm_connection(&domain->conn);
+        invalidate_cm_connection(domain);
+
+        if (!domain->primary && !domain->initialized) {
+                /*
+                 * Before we connect to a trust, work out if it is an
+                 * AD domain by asking our own domain.
+                 */
+                set_dc_type_and_flags_trustinfo(domain);
+        }
 
         result = cm_open_connection(domain, &domain->conn);
@@ -1857 +2171 @@
 }
 
-NTSTATUS init_dc_connection(struct winbindd_domain *domain)
-{
-        if (domain->internal) {
+NTSTATUS init_dc_connection(struct winbindd_domain *domain, bool need_rw_dc)
+{
+        if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
         }
@@ -1868 +2182 @@
         }
 
-        return init_dc_connection_network(domain);
-}
-
-static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain)
+        return init_dc_connection_network(domain, need_rw_dc);
+}
+
+static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain, bool need_rw_dc)
 {
         NTSTATUS status;
 
-        status = init_dc_connection(domain);
+        status = init_dc_connection(domain, need_rw_dc);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -1899 +2213 @@
         struct netr_DomainTrustList trusts;
         int i;
-        uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
+        uint32_t flags = (NETR_TRUST_FLAG_IN_FOREST |
                         NETR_TRUST_FLAG_OUTBOUND |
                         NETR_TRUST_FLAG_INBOUND);
@@ -1914 +2228 @@
         }
 
+        mem_ctx = talloc_stackframe();
         our_domain = find_our_domain();
-
-        if ( !connection_ok(our_domain) ) {
-                DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));           
+        if (our_domain->internal) {
+                result = init_dc_connection(our_domain, false);
+                if (!NT_STATUS_IS_OK(result)) {
+                        DEBUG(3,("set_dc_type_and_flags_trustinfo: "
+                                 "Not able to make a connection to our domain: %s\n",
+                                  nt_errstr(result)));
+                        TALLOC_FREE(mem_ctx);
+                        return false;
+                }
+        }
+
+        /* This won't work unless our domain is AD */
+        if ( !our_domain->active_directory ) {
+                TALLOC_FREE(mem_ctx);
                 return False;
         }
 
-        /* This won't work unless our domain is AD */
-
-        if ( !our_domain->active_directory ) {
+        if (our_domain->internal) {
+                result = wb_open_internal_pipe(mem_ctx, &ndr_table_netlogon, &cli);
+        } else if (!connection_ok(our_domain)) {
+                DEBUG(3,("set_dc_type_and_flags_trustinfo: "
+                         "No connection to our domain!\n"));
+                TALLOC_FREE(mem_ctx);
                 return False;
-        }
-
-        /* Use DsEnumerateDomainTrusts to get us the trust direction
-           and type */
-
-        result = cm_connect_netlogon(our_domain, &cli);
+        } else {
+                result = cm_connect_netlogon(our_domain, &cli);
+        }
 
         if (!NT_STATUS_IS_OK(result)) {
@@ -1936 +2262 @@
                           "a connection to %s for PIPE_NETLOGON (%s)\n", 
                           domain->name, nt_errstr(result)));
+                TALLOC_FREE(mem_ctx);
                 return False;
         }
-
         b = cli->binding_handle;
 
-        if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
-                DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
-                return False;
-        }       
-
+        /* Use DsEnumerateDomainTrusts to get us the trust direction and type. */
         result = dcerpc_netr_DsrEnumerateDomainTrusts(b, mem_ctx,
                                                       cli->desthost,
@@ -1955 +2277 @@
                         "failed to query trusted domain list: %s\n",
                         nt_errstr(result)));
-                talloc_destroy(mem_ctx);
+                TALLOC_FREE(mem_ctx);
                 return false;
         }
@@ -1962 +2284 @@
                         "failed to query trusted domain list: %s\n",
                         win_errstr(werr)));
-                talloc_destroy(mem_ctx);
+                TALLOC_FREE(mem_ctx);
                 return false;
         }
@@ -1974 +2296 @@
                         domain->domain_trust_attribs  = trusts.array[i].trust_attributes;
 
-                        if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
+                        if ( domain->domain_type == LSA_TRUST_TYPE_UPLEVEL )
                                 domain->active_directory = True;
 
@@ -1992 +2314 @@
 
                         domain->can_do_ncacn_ip_tcp = domain->active_directory;
-                        domain->can_do_validation6 = domain->active_directory;
 
                         domain->initialized = True;
@@ -2000 +2321 @@
         }
 
-        talloc_destroy( mem_ctx );
+        TALLOC_FREE(mem_ctx);
 
         return domain->initialized;     
@@ -2023 +2344 @@
         union lsa_PolicyInformation *lsa_info = NULL;
 
-        if (!connection_ok(domain)) {
+        if (!domain->internal && !connection_ok(domain)) {
                 return;
         }
@@ -2036 +2357 @@
         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
 
-        status = cli_rpc_pipe_open_noauth(domain->conn.cli,
-                                          &ndr_table_dssetup.syntax_id,
-                                          &cli);
+        if (domain->internal) {
+                status = wb_open_internal_pipe(mem_ctx,
+                                               &ndr_table_dssetup,
+                                               &cli);
+        } else {
+                status = cli_rpc_pipe_open_noauth(domain->conn.cli,
+                                                  &ndr_table_dssetup,
+                                                  &cli);
+        }
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -2087 +2414 @@
 
 no_dssetup:
-        status = cli_rpc_pipe_open_noauth(domain->conn.cli,
-                                          &ndr_table_lsarpc.syntax_id, &cli);
-
+        if (domain->internal) {
+                status = wb_open_internal_pipe(mem_ctx,
+                                               &ndr_table_lsarpc,
+                                               &cli);
+        } else {
+                status = cli_rpc_pipe_open_noauth(domain->conn.cli,
+                                                  &ndr_table_lsarpc, &cli);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
@@ -2116 +2448 @@
 
                 if (lsa_info->dns.name.string) {
-                        fstrcpy(domain->name, lsa_info->dns.name.string);
+                        if (!strequal(domain->name, lsa_info->dns.name.string))
+                        {
+                                DEBUG(1, ("set_dc_type_and_flags_connect: DC "
+                                          "for domain %s claimed it was a DC "
+                                          "for domain %s, refusing to "
+                                          "initialize\n",
+                                          domain->name,
+                                          lsa_info->dns.name.string));
+                                TALLOC_FREE(cli);
+                                TALLOC_FREE(mem_ctx);
+                                return;
+                        }
+                        talloc_free(domain->name);
+                        domain->name = talloc_strdup(domain,
+                                                     lsa_info->dns.name.string);
+                        if (domain->name == NULL) {
+                                goto done;
+                        }
                 }
 
                 if (lsa_info->dns.dns_domain.string) {
-                        fstrcpy(domain->alt_name,
-                                lsa_info->dns.dns_domain.string);
+                        if (domain->alt_name != NULL &&
+                            !strequal(domain->alt_name,
+                                      lsa_info->dns.dns_domain.string))
+                        {
+                                DEBUG(1, ("set_dc_type_and_flags_connect: DC "
+                                          "for domain %s (%s) claimed it was "
+                                          "a DC for domain %s, refusing to "
+                                          "initialize\n",
+                                          domain->alt_name, domain->name,
+                                          lsa_info->dns.dns_domain.string));
+                                TALLOC_FREE(cli);
+                                TALLOC_FREE(mem_ctx);
+                                return;
+                        }
+                        talloc_free(domain->alt_name);
+                        domain->alt_name =
+                                talloc_strdup(domain,
+                                              lsa_info->dns.dns_domain.string);
+                        if (domain->alt_name == NULL) {
+                                goto done;
+                        }
                 }
 
@@ -2128 +2496 @@
 
                 if (lsa_info->dns.dns_forest.string) {
-                        fstrcpy(domain->forest_name,
-                                lsa_info->dns.dns_forest.string);
+                        talloc_free(domain->forest_name);
+                        domain->forest_name =
+                                talloc_strdup(domain,
+                                              lsa_info->dns.dns_forest.string);
+                        if (domain->forest_name == NULL) {
+                                goto done;
+                        }
 
                         if (strequal(domain->forest_name, domain->alt_name)) {
@@ -2137 +2510 @@
 
                 if (lsa_info->dns.sid) {
+                        if (!is_null_sid(&domain->sid) &&
+                            !dom_sid_equal(&domain->sid,
+                                           lsa_info->dns.sid))
+                        {
+                                DEBUG(1, ("set_dc_type_and_flags_connect: DC "
+                                          "for domain %s (%s) claimed it was "
+                                          "a DC for domain %s, refusing to "
+                                          "initialize\n",
+                                          dom_sid_string(talloc_tos(),
+                                                         &domain->sid),
+                                          domain->name,
+                                          dom_sid_string(talloc_tos(),
+                                                         lsa_info->dns.sid)));
+                                TALLOC_FREE(cli);
+                                TALLOC_FREE(mem_ctx);
+                                return;
+                        }
                         sid_copy(&domain->sid, lsa_info->dns.sid);
                 }
@@ -2158 +2548 @@
 
                         if (lsa_info->account_domain.name.string) {
-                                fstrcpy(domain->name,
-                                        lsa_info->account_domain.name.string);
+                                if (!strequal(domain->name,
+                                        lsa_info->account_domain.name.string))
+                                {
+                                        DEBUG(1,
+                                              ("set_dc_type_and_flags_connect: "
+                                               "DC for domain %s claimed it was"
+                                               " a DC for domain %s, refusing "
+                                               "to initialize\n", domain->name,
+                                               lsa_info->
+                                                account_domain.name.string));
+                                        TALLOC_FREE(cli);
+                                        TALLOC_FREE(mem_ctx);
+                                        return;
+                                }
+                                talloc_free(domain->name);
+                                domain->name =
+                                        talloc_strdup(domain,
+                                                      lsa_info->account_domain.name.string);
                         }
 
                         if (lsa_info->account_domain.sid) {
+                                if (!is_null_sid(&domain->sid) &&
+                                    !dom_sid_equal(&domain->sid,
+                                                lsa_info->account_domain.sid))
+                                {
+                                        DEBUG(1,
+                                              ("set_dc_type_and_flags_connect: "
+                                               "DC for domain %s (%s) claimed "
+                                               "it was a DC for domain %s, "
+                                               "refusing to initialize\n",
+                                               dom_sid_string(talloc_tos(),
+                                                              &domain->sid),
+                                               domain->name,
+                                               dom_sid_string(talloc_tos(),
+                                                lsa_info->account_domain.sid)));
+                                        TALLOC_FREE(cli);
+                                        TALLOC_FREE(mem_ctx);
+                                        return;
+                                }
                                 sid_copy(&domain->sid, lsa_info->account_domain.sid);
                         }
@@ -2176 +2600 @@
 
         domain->can_do_ncacn_ip_tcp = domain->active_directory;
-        domain->can_do_validation6 = domain->active_directory;
 
         TALLOC_FREE(cli);
@@ -2193 +2616 @@
         /* we always have to contact our primary domain */
 
-        if ( domain->primary ) {
+        if ( domain->primary || domain->internal) {
                 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
-                          "primary domain\n"));
+                          "primary or internal domain\n"));
                 set_dc_type_and_flags_connect( domain );
                 return;         
@@ -2217 +2640 @@
 
 static NTSTATUS cm_get_schannel_creds(struct winbindd_domain *domain,
-                                   struct netlogon_creds_CredentialState **ppdc)
+                                   struct netlogon_creds_cli_context **ppdc)
 {
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
         struct rpc_pipe_client *netlogon_pipe;
 
-        if (lp_client_schannel() == False) {
-                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+        *ppdc = NULL;
+
+        if ((!IS_DC) && (!domain->primary)) {
+                return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
+        }
+
+        if (domain->conn.netlogon_creds != NULL) {
+                if (!(domain->conn.netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
+                        return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
+                }
+                *ppdc = domain->conn.netlogon_creds;
+                return NT_STATUS_OK;
         }
 
@@ -2231 +2664 @@
         }
 
-        /* Return a pointer to the struct netlogon_creds_CredentialState from the
-           netlogon pipe. */
-
-        if (!domain->conn.netlogon_pipe->dc) {
-                return NT_STATUS_INTERNAL_ERROR; /* This shouldn't happen. */
-        }
-
-        *ppdc = domain->conn.netlogon_pipe->dc;
+        if (domain->conn.netlogon_creds == NULL) {
+                return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
+        }
+
+        if (!(domain->conn.netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
+                return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
+        }
+
+        *ppdc = domain->conn.netlogon_creds;
         return NT_STATUS_OK;
 }
 
 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
+                        bool need_rw_dc,
                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
 {
         struct winbindd_cm_conn *conn;
         NTSTATUS status, result;
-        struct netlogon_creds_CredentialState *p_creds;
-        char *machine_password = NULL;
-        char *machine_account = NULL;
-        char *domain_name = NULL;
-
-        if (sid_check_is_domain(&domain->sid)) {
-                return open_internal_samr_conn(mem_ctx, domain, cli, sam_handle);
-        }
-
-        status = init_dc_connection_rpc(domain);
+        struct netlogon_creds_cli_context *p_creds;
+        struct cli_credentials *creds = NULL;
+        bool retry = false; /* allow one retry attempt for expired session */
+
+        if (sid_check_is_our_sam(&domain->sid)) {
+                if (domain->rodc == false || need_rw_dc == false) {
+                        return open_internal_samr_conn(mem_ctx, domain, cli, sam_handle);
+                }
+        }
+
+retry:
+        status = init_dc_connection_rpc(domain, need_rw_dc);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -2276 +2713 @@
          */
 
-        if ((conn->cli->user_name[0] == '\0') ||
-            (conn->cli->domain[0] == '\0') || 
-            (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
-        {
-                status = get_trust_creds(domain, &machine_password,
-                                         &machine_account, NULL);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(10, ("cm_connect_sam: No no user available for "
-                                   "domain %s, trying schannel\n", conn->cli->domain));
-                        goto schannel;
-                }
-                domain_name = domain->name;
-        } else {
-                machine_password = SMB_STRDUP(conn->cli->password);
-                machine_account = SMB_STRDUP(conn->cli->user_name);
-                domain_name = conn->cli->domain;
-        }
-
-        if (!machine_password || !machine_account) {
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        /* We have an authenticated connection. Use a NTLMSSP SPNEGO
-           authenticated SAMR pipe with sign & seal. */
-        status = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
-                                                  &ndr_table_samr.syntax_id,
-                                                  NCACN_NP,
-                                                  DCERPC_AUTH_LEVEL_PRIVACY,
-                                                  domain_name,
-                                                  machine_account,
-                                                  machine_password,
-                                                  &conn->samr_pipe);
+        result = get_trust_credentials(domain, talloc_tos(), false, &creds);
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(10, ("cm_connect_sam: No user available for "
+                           "domain %s, trying schannel\n", domain->name));
+                goto schannel;
+        }
+
+        if (cli_credentials_is_anonymous(creds)) {
+                goto anonymous;
+        }
+
+        /*
+         * We have an authenticated connection. Use a SPNEGO
+         * authenticated SAMR pipe with sign & seal.
+         */
+        status = cli_rpc_pipe_open_with_creds(conn->cli,
+                                              &ndr_table_samr,
+                                              NCACN_NP,
+                                              DCERPC_AUTH_TYPE_SPNEGO,
+                                              conn->auth_level,
+                                              smbXcli_conn_remote_name(conn->cli->conn),
+                                              creds,
+                                              &conn->samr_pipe);
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)
+            && !retry) {
+                invalidate_cm_connection(domain);
+                retry = true;
+                goto retry;
+        }
 
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
                           "pipe for domain %s using NTLMSSP "
-                          "authenticated pipe: user %s\\%s. Error was "
-                          "%s\n", domain->name, domain_name,
-                          machine_account, nt_errstr(status)));
+                          "authenticated pipe: user %s. Error was "
+                          "%s\n", domain->name,
+                          cli_credentials_get_unparsed_name(creds, talloc_tos()),
+                          nt_errstr(status)));
                 goto schannel;
         }
@@ -2321 +2756 @@
         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
                   "domain %s using NTLMSSP authenticated "
-                  "pipe: user %s\\%s\n", domain->name,
-                  domain_name, machine_account));
+                  "pipe: user %s\n", domain->name,
+                  cli_credentials_get_unparsed_name(creds, talloc_tos())));
 
         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
@@ -2329 +2764 @@
                                       &conn->sam_connect_handle,
                                       &result);
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR) && !retry) {
+                invalidate_cm_connection(domain);
+                TALLOC_FREE(conn->samr_pipe);
+                retry = true;
+                goto retry;
+        }
+
         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
                 goto open_domain;
@@ -2354 +2797 @@
                 goto anonymous;
         }
-        status = cli_rpc_pipe_open_schannel_with_key
-                (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
-                 DCERPC_AUTH_LEVEL_PRIVACY,
-                 domain->name, &p_creds, &conn->samr_pipe);
+        TALLOC_FREE(creds);
+        result = get_trust_credentials(domain, talloc_tos(), true, &creds);
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(10, ("cm_connect_sam: No user available for "
+                           "domain %s (error %s), trying anon\n", domain->name,
+                           nt_errstr(result)));
+                goto anonymous;
+        }
+        status = cli_rpc_pipe_open_schannel_with_creds
+                (conn->cli, &ndr_table_samr, NCACN_NP,
+                 creds, p_creds, &conn->samr_pipe);
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)
+            && !retry) {
+                invalidate_cm_connection(domain);
+                retry = true;
+                goto retry;
+        }
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -2373 +2830 @@
                                       &conn->sam_connect_handle,
                                       &result);
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR) && !retry) {
+                invalidate_cm_connection(domain);
+                TALLOC_FREE(conn->samr_pipe);
+                retry = true;
+                goto retry;
+        }
+
         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
                 goto open_domain;
@@ -2385 +2850 @@
 
  anonymous:
-        if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+
+        /* Finally fall back to anonymous. */
+        if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
                 status = NT_STATUS_DOWNGRADE_DETECTED;
-                DEBUG(1, ("Unwilling to make SAMR connection to domain %s "
+                DEBUG(1, ("Unwilling to make SAMR connection to domain %s"
                           "without connection level security, "
-                          "must set 'winbind sealed pipes = false' "
-                          "to proceed: %s\n",
+                          "must set 'winbind sealed pipes = false' and "
+                          "'require strong key = false' to proceed: %s\n",
                           domain->name, nt_errstr(status)));
                 goto done;
         }
-
-        /* Finally fall back to anonymous. */
-        status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
+        status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr,
                                           &conn->samr_pipe);
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)
+            && !retry) {
+                invalidate_cm_connection(domain);
+                retry = true;
+                goto retry;
+        }
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -2408 +2880 @@
                                       &conn->sam_connect_handle,
                                       &result);
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR) && !retry) {
+                invalidate_cm_connection(domain);
+                TALLOC_FREE(conn->samr_pipe);
+                retry = true;
+                goto retry;
+        }
+
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
@@ -2449 +2929 @@
                 return status;
         } else if (!NT_STATUS_IS_OK(status)) {
-                invalidate_cm_connection(conn);
+                invalidate_cm_connection(domain);
                 return status;
         }
@@ -2455 +2935 @@
         *cli = conn->samr_pipe;
         *sam_handle = conn->sam_domain_handle;
-        SAFE_FREE(machine_password);
-        SAFE_FREE(machine_account);
         return status;
 }
@@ -2464 +2942 @@
 ***********************************************************************/
 
-NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
-                            TALLOC_CTX *mem_ctx,
-                            struct rpc_pipe_client **cli)
+static NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
+                                   TALLOC_CTX *mem_ctx,
+                                   struct rpc_pipe_client **cli)
 {
         struct winbindd_cm_conn *conn;
-        struct netlogon_creds_CredentialState *creds;
+        struct netlogon_creds_cli_context *p_creds = NULL;
+        struct cli_credentials *creds = NULL;
         NTSTATUS status;
 
         DEBUG(10,("cm_connect_lsa_tcp\n"));
 
-        status = init_dc_connection_rpc(domain);
+        status = init_dc_connection_rpc(domain, false);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -2483 +2962 @@
         if (conn->lsa_pipe_tcp &&
             conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
-            conn->lsa_pipe_tcp->auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY &&
+            conn->lsa_pipe_tcp->auth->auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY &&
             rpccli_is_connected(conn->lsa_pipe_tcp)) {
                 goto done;
@@ -2490 +2969 @@
         TALLOC_FREE(conn->lsa_pipe_tcp);
 
-        status = cm_get_schannel_creds(domain, &creds);
+        status = cm_get_schannel_creds(domain, &p_creds);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
         }
 
-        status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
-                                                     &ndr_table_lsarpc.syntax_id,
-                                                     NCACN_IP_TCP,
-                                                     DCERPC_AUTH_LEVEL_PRIVACY,
-                                                     domain->name,
-                                                     &creds,
-                                                     &conn->lsa_pipe_tcp);
+        status = get_trust_credentials(domain, talloc_tos(), true, &creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
+        status = cli_rpc_pipe_open_schannel_with_creds(conn->cli,
+                                                       &ndr_table_lsarpc,
+                                                       NCACN_IP_TCP,
+                                                       creds,
+                                                       p_creds,
+                                                       &conn->lsa_pipe_tcp);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
@@ -2524 +3007 @@
         struct winbindd_cm_conn *conn;
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-        struct netlogon_creds_CredentialState *p_creds;
-
-        result = init_dc_connection_rpc(domain);
+        struct netlogon_creds_cli_context *p_creds;
+        struct cli_credentials *creds = NULL;
+        bool retry = false; /* allow one retry attempt for expired session */
+
+retry:
+        result = init_dc_connection_rpc(domain, false);
         if (!NT_STATUS_IS_OK(result))
                 return result;
@@ -2538 +3024 @@
         TALLOC_FREE(conn->lsa_pipe);
 
-        if ((conn->cli->user_name[0] == '\0') ||
-            (conn->cli->domain[0] == '\0') || 
-            (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
-                DEBUG(10, ("cm_connect_lsa: No no user available for "
-                           "domain %s, trying schannel\n", conn->cli->domain));
+        result = get_trust_credentials(domain, talloc_tos(), false, &creds);
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(10, ("cm_connect_lsa: No user available for "
+                           "domain %s, trying schannel\n", domain->name));
                 goto schannel;
         }
 
-        /* We have an authenticated connection. Use a NTLMSSP SPNEGO
-         * authenticated LSA pipe with sign & seal. */
-        result = cli_rpc_pipe_open_spnego_ntlmssp
-                (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
-                 DCERPC_AUTH_LEVEL_PRIVACY,
-                 conn->cli->domain, conn->cli->user_name, conn->cli->password,
+        if (cli_credentials_is_anonymous(creds)) {
+                goto anonymous;
+        }
+
+        /*
+         * We have an authenticated connection. Use a SPNEGO
+         * authenticated LSA pipe with sign & seal.
+         */
+        result = cli_rpc_pipe_open_with_creds
+                (conn->cli, &ndr_table_lsarpc, NCACN_NP,
+                 DCERPC_AUTH_TYPE_SPNEGO,
+                 conn->auth_level,
+                 smbXcli_conn_remote_name(conn->cli->conn),
+                 creds,
                  &conn->lsa_pipe);
+
+        if (NT_STATUS_EQUAL(result, NT_STATUS_NETWORK_SESSION_EXPIRED)
+            && !retry) {
+                invalidate_cm_connection(domain);
+                retry = true;
+                goto retry;
+        }
 
         if (!NT_STATUS_IS_OK(result)) {
                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
                           "domain %s using NTLMSSP authenticated pipe: user "
-                          "%s\\%s. Error was %s. Trying schannel.\n",
-                          domain->name, conn->cli->domain,
-                          conn->cli->user_name, nt_errstr(result)));
+                          "%s. Error was %s. Trying schannel.\n",
+                          domain->name,
+                          cli_credentials_get_unparsed_name(creds, talloc_tos()),
+                          nt_errstr(result)));
                 goto schannel;
         }
 
         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
-                  "NTLMSSP authenticated pipe: user %s\\%s\n",
-                  domain->name, conn->cli->domain, conn->cli->user_name ));
+                  "NTLMSSP authenticated pipe: user %s\n",
+                  domain->name, cli_credentials_get_unparsed_name(creds, talloc_tos())));
 
         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
                                         SEC_FLAG_MAXIMUM_ALLOWED,
                                         &conn->lsa_policy);
+        if (NT_STATUS_EQUAL(result, NT_STATUS_IO_DEVICE_ERROR) && !retry) {
+                invalidate_cm_connection(domain);
+                TALLOC_FREE(conn->lsa_pipe);
+                retry = true;
+                goto retry;
+        }
+
         if (NT_STATUS_IS_OK(result)) {
                 goto done;
@@ -2592 +3100 @@
                 goto anonymous;
         }
-        result = cli_rpc_pipe_open_schannel_with_key
-                (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
-                 DCERPC_AUTH_LEVEL_PRIVACY,
-                 domain->name, &p_creds, &conn->lsa_pipe);
+
+        TALLOC_FREE(creds);
+        result = get_trust_credentials(domain, talloc_tos(), true, &creds);
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(10, ("cm_connect_lsa: No user available for "
+                           "domain %s (error %s), trying anon\n", domain->name,
+                           nt_errstr(result)));
+                goto anonymous;
+        }
+        result = cli_rpc_pipe_open_schannel_with_creds
+                (conn->cli, &ndr_table_lsarpc, NCACN_NP,
+                 creds, p_creds, &conn->lsa_pipe);
+
+        if (NT_STATUS_EQUAL(result, NT_STATUS_NETWORK_SESSION_EXPIRED)
+            && !retry) {
+                invalidate_cm_connection(domain);
+                retry = true;
+                goto retry;
+        }
 
         if (!NT_STATUS_IS_OK(result)) {
@@ -2609 +3132 @@
                                         SEC_FLAG_MAXIMUM_ALLOWED,
                                         &conn->lsa_policy);
+
+        if (NT_STATUS_EQUAL(result, NT_STATUS_IO_DEVICE_ERROR) && !retry) {
+                invalidate_cm_connection(domain);
+                TALLOC_FREE(conn->lsa_pipe);
+                retry = true;
+                goto retry;
+        }
+
         if (NT_STATUS_IS_OK(result)) {
                 goto done;
@@ -2620 +3151 @@
  anonymous:
 
-        if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+        if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
                 result = NT_STATUS_DOWNGRADE_DETECTED;
                 DEBUG(1, ("Unwilling to make LSA connection to domain %s "
                           "without connection level security, "
-                          "must set 'winbind sealed pipes = false' "
-                          "to proceed: %s\n",
+                          "must set 'winbind sealed pipes = false' and "
+                          "'require strong key = false' to proceed: %s\n",
                           domain->name, nt_errstr(result)));
                 goto done;
@@ -2631 +3162 @@
 
         result = cli_rpc_pipe_open_noauth(conn->cli,
-                                          &ndr_table_lsarpc.syntax_id,
+                                          &ndr_table_lsarpc,
                                           &conn->lsa_pipe);
+
+        if (NT_STATUS_EQUAL(result, NT_STATUS_NETWORK_SESSION_EXPIRED)
+            && !retry) {
+                invalidate_cm_connection(domain);
+                retry = true;
+                goto retry;
+        }
+
         if (!NT_STATUS_IS_OK(result)) {
-                result = NT_STATUS_PIPE_NOT_AVAILABLE;
                 goto done;
         }
@@ -2641 +3179 @@
                                         SEC_FLAG_MAXIMUM_ALLOWED,
                                         &conn->lsa_policy);
+
+        if (NT_STATUS_EQUAL(result, NT_STATUS_IO_DEVICE_ERROR) && !retry) {
+                invalidate_cm_connection(domain);
+                TALLOC_FREE(conn->lsa_pipe);
+                retry = true;
+                goto retry;
+        }
+
  done:
         if (!NT_STATUS_IS_OK(result)) {
-                invalidate_cm_connection(conn);
+                invalidate_cm_connection(domain);
                 return result;
         }
@@ -2668 +3214 @@
                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
                     NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
-                        invalidate_cm_connection(&domain->conn);
+                        invalidate_cm_connection(domain);
                         status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
                 }
@@ -2679 +3225 @@
                  * failed - maybe it is a trusted domain we can't connect to ?
                  * do not try tcp next time - gd
+                 *
+                 * This also prevents NETLOGON over TCP
                  */
                 domain->can_do_ncacn_ip_tcp = false;
@@ -2693 +3241 @@
 ****************************************************************************/
 
-NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
-                             struct rpc_pipe_client **cli)
-{
+static NTSTATUS cm_connect_netlogon_transport(struct winbindd_domain *domain,
+                                              enum dcerpc_transport_t transport,
+                                              struct rpc_pipe_client **cli)
+{
+        struct messaging_context *msg_ctx = winbind_messaging_context();
         struct winbindd_cm_conn *conn;
         NTSTATUS result;
-
-        uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-        uint8  mach_pwd[16];
         enum netr_SchannelType sec_chan_type;
-        const char *account_name;
-        struct rpc_pipe_client *netlogon_pipe = NULL;
+        struct netlogon_creds_CredentialState *netlogon_creds = NULL;
+        struct cli_credentials *creds = NULL;
 
         *cli = NULL;
 
-        result = init_dc_connection_rpc(domain);
+        result = init_dc_connection_rpc(domain, domain->rodc);
         if (!NT_STATUS_IS_OK(result)) {
                 return result;
@@ -2720 +3267 @@
 
         TALLOC_FREE(conn->netlogon_pipe);
-
-        result = cli_rpc_pipe_open_noauth(conn->cli,
-                                          &ndr_table_netlogon.syntax_id,
-                                          &netlogon_pipe);
+        conn->netlogon_flags = 0;
+        TALLOC_FREE(conn->netlogon_creds);
+
+        result = get_trust_credentials(domain, talloc_tos(), true, &creds);
         if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(10, ("cm_connect_sam: No user available for "
+                           "domain %s when trying schannel\n", domain->name));
+                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+        }
+
+        if (cli_credentials_is_anonymous(creds)) {
+                DEBUG(1, ("get_trust_credential only gave anonymous for %s, unable to make get NETLOGON credentials\n",
+                          domain->name));
+                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+        }
+
+        sec_chan_type = cli_credentials_get_secure_channel_type(creds);
+        if (sec_chan_type == SEC_CHAN_NULL) {
+                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+        }
+
+        result = rpccli_create_netlogon_creds_with_creds(creds,
+                                                         domain->dcname,
+                                                         msg_ctx,
+                                                         domain,
+                                                         &conn->netlogon_creds);
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(1, ("rpccli_create_netlogon_creds failed for %s, "
+                          "unable to create NETLOGON credentials: %s\n",
+                          domain->name, nt_errstr(result)));
                 return result;
         }
 
-        if ((!IS_DC) && (!domain->primary)) {
-                /* Clear the schannel request bit and drop down */
-                neg_flags &= ~NETLOGON_NEG_SCHANNEL;            
-                goto no_schannel;
-        }
-
-        if (lp_client_schannel() != False) {
-                neg_flags |= NETLOGON_NEG_SCHANNEL;
-        }
-
-        if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
-                               &sec_chan_type))
-        {
-                TALLOC_FREE(netlogon_pipe);
-                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
-        }
-
-        result = rpccli_netlogon_setup_creds(
-                 netlogon_pipe,
-                 domain->dcname, /* server name. */
-                 domain->name,   /* domain name */
-                 global_myname(), /* client name */
-                 account_name,   /* machine account */
-                 mach_pwd,       /* machine password */
-                 sec_chan_type,  /* from get_trust_pw */
-                 &neg_flags);
-
+        result = rpccli_setup_netlogon_creds_with_creds(conn->cli, transport,
+                                                conn->netlogon_creds,
+                                                conn->netlogon_force_reauth,
+                                                creds);
+        conn->netlogon_force_reauth = false;
         if (!NT_STATUS_IS_OK(result)) {
-                TALLOC_FREE(netlogon_pipe);
+                DEBUG(1, ("rpccli_setup_netlogon_creds failed for %s, "
+                          "unable to setup NETLOGON credentials: %s\n",
+                          domain->name, nt_errstr(result)));
                 return result;
         }
 
-        if ((lp_client_schannel() == True) &&
-                        ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
-                DEBUG(3, ("Server did not offer schannel\n"));
-                TALLOC_FREE(netlogon_pipe);
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
- no_schannel:
-        if ((lp_client_schannel() == False) ||
-                ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
-                if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+        result = netlogon_creds_cli_get(conn->netlogon_creds,
+                                        talloc_tos(),
+                                        &netlogon_creds);
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(1, ("netlogon_creds_cli_get failed for %s, "
+                          "unable to get NETLOGON credentials: %s\n",
+                          domain->name, nt_errstr(result)));
+                return result;
+        }
+        conn->netlogon_flags = netlogon_creds->negotiate_flags;
+        TALLOC_FREE(netlogon_creds);
+
+        if (!(conn->netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
+                if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
                         result = NT_STATUS_DOWNGRADE_DETECTED;
-                        DEBUG(1, ("Unwilling to make connection to domain %s "
+                        DEBUG(1, ("Unwilling to make connection to domain %s"
                                   "without connection level security, "
-                                  "must set 'winbind sealed pipes = false' "
-                                  "to proceed: %s\n",
+                                  "must set 'winbind sealed pipes = false' and "
+                                  "'require strong key = false' to proceed: %s\n",
                                   domain->name, nt_errstr(result)));
-                        TALLOC_FREE(netlogon_pipe);
-                        invalidate_cm_connection(conn);
+                        invalidate_cm_connection(domain);
                         return result;
                 }
-                /*
-                 * NetSamLogonEx only works for schannel
-                 */
-                domain->can_do_samlogon_ex = False;
-
-                /* We're done - just keep the existing connection to NETLOGON
-                 * open */
-                conn->netlogon_pipe = netlogon_pipe;
+                result = cli_rpc_pipe_open_noauth_transport(conn->cli,
+                                                            transport,
+                                                            &ndr_table_netlogon,
+                                                            &conn->netlogon_pipe);
+                if (!NT_STATUS_IS_OK(result)) {
+                        invalidate_cm_connection(domain);
+                        return result;
+                }
+
                 *cli = conn->netlogon_pipe;
                 return NT_STATUS_OK;
@@ -2798 +3353 @@
         */
 
-        result = cli_rpc_pipe_open_schannel_with_key(
-                conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
-                DCERPC_AUTH_LEVEL_PRIVACY, domain->name, &netlogon_pipe->dc,
+        result = cli_rpc_pipe_open_schannel_with_creds(
+                conn->cli, &ndr_table_netlogon, transport,
+                creds,
+                conn->netlogon_creds,
                 &conn->netlogon_pipe);
-
-        /* We can now close the initial netlogon pipe. */
-        TALLOC_FREE(netlogon_pipe);
-
         if (!NT_STATUS_IS_OK(result)) {
                 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
                           "was %s\n", nt_errstr(result)));
 
-                invalidate_cm_connection(conn);
+                invalidate_cm_connection(domain);
                 return result;
         }
-
-        /*
-         * Always try netr_LogonSamLogonEx. We will fall back for NT4
-         * which gives DCERPC_FAULT_OP_RNG_ERROR (function not
-         * supported). We used to only try SamLogonEx for AD, but
-         * Samba DCs can also do it. And because we don't distinguish
-         * between Samba and NT4, always try it once.
-         */
-        domain->can_do_samlogon_ex = true;
 
         *cli = conn->netlogon_pipe;
         return NT_STATUS_OK;
+}
+
+/****************************************************************************
+Open a LSA connection to a DC, suiteable for LSA lookup calls.
+****************************************************************************/
+
+NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
+                             struct rpc_pipe_client **cli)
+{
+        NTSTATUS status;
+
+        status = init_dc_connection_rpc(domain, domain->rodc);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        if (domain->active_directory && domain->can_do_ncacn_ip_tcp) {
+                status = cm_connect_netlogon_transport(domain, NCACN_IP_TCP, cli);
+                if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
+                    NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
+                    NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
+                        invalidate_cm_connection(domain);
+                        status = cm_connect_netlogon_transport(domain, NCACN_IP_TCP, cli);
+                }
+                if (NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                /*
+                 * we tried twice to connect via ncan_ip_tcp and schannel and
+                 * failed - maybe it is a trusted domain we can't connect to ?
+                 * do not try tcp next time - gd
+                 *
+                 * This also prevents LSA over TCP
+                 */
+                domain->can_do_ncacn_ip_tcp = false;
+        }
+
+        status = cm_connect_netlogon_transport(domain, NCACN_NP, cli);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
+                /*
+                 * SMB2 session expired, needs reauthentication. Drop
+                 * connection and retry.
+                 */
+                invalidate_cm_connection(domain);
+                status = cm_connect_netlogon_transport(domain, NCACN_NP, cli);
+        }
+
+        return status;
 }
 
@@ -2872 +3464 @@
         for (domain = domain_list(); domain != NULL; domain = domain->next) {
                 char sockaddr[INET6_ADDRSTRLEN];
-                if (domain->conn.cli == NULL) {
+
+                if (!cli_state_is_connected(domain->conn.cli)) {
                         continue;
                 }
-                if (domain->conn.cli->fd == -1) {
-                        continue;
-                }
-                client_socket_addr(domain->conn.cli->fd, sockaddr,
-                                   sizeof(sockaddr));
+
+                print_sockaddr(sockaddr, sizeof(sockaddr),
+                               smbXcli_conn_local_sockaddr(domain->conn.cli->conn));
+
                 if (strequal(sockaddr, addr)) {
-                        close(domain->conn.cli->fd);
-                        domain->conn.cli->fd = -1;
+                        smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
                 }
         }

vendor/current/source3/winbindd/winbindd_cred_cache.c

@@ -39 +39 @@
 
 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
-static void krb5_ticket_gain_handler(struct event_context *,
-                                     struct timed_event *,
+static void krb5_ticket_gain_handler(struct tevent_context *,
+                                     struct tevent_timer *,
                                      struct timeval,
                                      void *);
@@ -105 +105 @@
 ****************************************************************/
 
-static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
-                                        struct timed_event *te,
+static void krb5_ticket_refresh_handler(struct tevent_context *event_ctx,
+                                        struct tevent_timer *te,
                                         struct timeval now,
                                         void *private_data)
@@ -286 +286 @@
                 entry->refresh_time = new_start;
         }
-        entry->event = event_add_timed(winbind_event_context(), entry,
+        entry->event = tevent_add_timer(winbind_event_context(), entry,
                                        timeval_set(new_start, 0),
                                        krb5_ticket_refresh_handler,
@@ -298 +298 @@
 ****************************************************************/
 
-static void krb5_ticket_gain_handler(struct event_context *event_ctx,
-                                     struct timed_event *te,
+static void krb5_ticket_gain_handler(struct tevent_context *event_ctx,
+                                     struct tevent_timer *te,
                                      struct timeval now,
                                      void *private_data)
@@ -386 +386 @@
                 entry->refresh_time = t.tv_sec;
         }
-        entry->event = event_add_timed(winbind_event_context(),
+        entry->event = tevent_add_timer(winbind_event_context(),
                                        entry,
                                        t,
@@ -405 +405 @@
 {
         entry->refresh_time = 0;
-        entry->event = event_add_timed(winbind_event_context(),
+        entry->event = tevent_add_timer(winbind_event_context(),
                                        entry,
                                        t,
@@ -418 +418 @@
 
         for (cur = ccache_list; cur; cur = cur->next) {
-                struct timed_event *new_event;
+                struct tevent_timer *new_event;
 
                 /*
@@ -425 +425 @@
                  */
                 if (cur->refresh_time == 0) {
-                        new_event = event_add_timed(winbind_event_context(),
+                        new_event = tevent_add_timer(winbind_event_context(),
                                                     cur,
                                                     t,
@@ -431 +431 @@
                                                     cur);
                 } else {
-                        new_event = event_add_timed(winbind_event_context(),
+                        new_event = tevent_add_timer(winbind_event_context(),
                                                     cur,
                                                     t,
@@ -502 +502 @@
         struct timeval t;
         NTSTATUS ntret;
-#ifdef HAVE_KRB5
-        int ret;
-#endif
 
         if ((username == NULL && princ_name == NULL) ||
@@ -516 +513 @@
                 return NT_STATUS_NO_MORE_ENTRIES;
         }
-
-        /* If it is cached login, destroy krb5 ticket
-         * to avoid surprise. */
-#ifdef HAVE_KRB5
-        if (postponed_request) {
-                /* ignore KRB5_FCC_NOFILE error here */
-                ret = ads_kdestroy(ccname);
-                if (ret == KRB5_FCC_NOFILE) {
-                        ret = 0;
-                }
-                if (ret) {
-                        DEBUG(0, ("add_ccache_to_list: failed to destroy "
-                                   "user krb5 ccache %s with %s\n", ccname,
-                                   error_message(ret)));
-                        return krb5_to_nt_status(ret);
-                }
-                DEBUG(10, ("add_ccache_to_list: successfully destroyed "
-                           "krb5 ccache %s for user %s\n", ccname,
-                           username));
-        }
-#endif
 
         /* Reference count old entries */
@@ -572 +548 @@
                                         entry->refresh_time = t.tv_sec;
                                 }
-                                entry->event = event_add_timed(winbind_event_context(),
+                                entry->event = tevent_add_timer(winbind_event_context(),
                                                                entry,
                                                                t,
@@ -612 +588 @@
         }
 
-        entry = TALLOC_P(NULL, struct WINBINDD_CCACHE_ENTRY);
+        entry = talloc(NULL, struct WINBINDD_CCACHE_ENTRY);
         if (!entry) {
                 return NT_STATUS_NO_MEMORY;
@@ -670 +646 @@
                         entry->refresh_time = t.tv_sec;
                 }
-                entry->event = event_add_timed(winbind_event_context(),
+                entry->event = tevent_add_timer(winbind_event_context(),
                                                entry,
                                                t,
@@ -847 +823 @@
 #endif
 
-        /* Create and store the password hashes. */
-        E_md4hash(pass, memcredp->nt_hash);
-        E_deshash(pass, memcredp->lm_hash);
-
         if (pass) {
+                /* Create and store the password hashes. */
+                E_md4hash(pass, memcredp->nt_hash);
+                E_deshash(pass, memcredp->lm_hash);
+
                 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
                 memcpy(memcredp->pass, pass,
@@ -938 +914 @@
         }
 
-        memcredp = TALLOC_ZERO_P(NULL, struct WINBINDD_MEMORY_CREDS);
+        memcredp = talloc_zero(NULL, struct WINBINDD_MEMORY_CREDS);
         if (!memcredp) {
                 return NT_STATUS_NO_MEMORY;

vendor/current/source3/winbindd/winbindd_creds.c

@@ -33 +33 @@
                             const struct dom_sid *sid,
                             struct netr_SamInfo3 **info3,
-                            const uint8 *cached_nt_pass[NT_HASH_LEN],
-                            const uint8 *cred_salt[NT_HASH_LEN])
+                            const uint8_t *cached_nt_pass[NT_HASH_LEN],
+                            const uint8_t *cred_salt[NT_HASH_LEN])
 {
         struct netr_SamInfo3 *info;

vendor/current/source3/winbindd/winbindd_dsgetdcname.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_dsgetdcname_state {
@@ -58 +58 @@
                   request->data.dsgetdcname.domain_name));
 
-        ds_flags = get_dsgetdc_flags(request->flags);
+        ds_flags = get_dsgetdc_flags(request->data.dsgetdcname.flags);
 
         status = GUID_from_string(request->data.dsgetdcname.domain_guid,
@@ -102 +102 @@
         struct winbindd_dsgetdcname_state *state = tevent_req_data(
                 req, struct winbindd_dsgetdcname_state);
+        struct GUID_txt_buf guid_str_buf;
         char *guid_str;
         NTSTATUS status;
@@ -110 +111 @@
         }
 
-        guid_str = GUID_string(talloc_tos(), &state->dc_info->domain_guid);
-        if (guid_str == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
 
         fstrcpy(response->data.dsgetdcname.dc_unc,
@@ -121 +118 @@
         response->data.dsgetdcname.dc_address_type =
                 state->dc_info->dc_address_type;
+
+        guid_str = GUID_buf_string(&state->dc_info->domain_guid,
+                                   &guid_str_buf);
         fstrcpy(response->data.dsgetdcname.domain_guid, guid_str);
-        TALLOC_FREE(guid_str);
+
         fstrcpy(response->data.dsgetdcname.domain_name,
                 state->dc_info->domain_name);

vendor/current/source3/winbindd/winbindd_dual.c

@@ -30 +30 @@
 #include "includes.h"
 #include "winbindd.h"
+#include "rpc_client/rpc_client.h"
 #include "nsswitch/wb_reqtrans.h"
 #include "secrets.h"
@@ -37 +38 @@
 #include "messages.h"
 #include "../lib/util/tevent_unix.h"
+#include "lib/param/loadparm.h"
+#include "lib/util/sys_rw.h"
+#include "lib/util/sys_rw_data.h"
 
 #undef DBGC_CLASS
@@ -42 +46 @@
 
 extern bool override_logfile;
-extern struct winbindd_methods cache_methods;
 
 static struct winbindd_child *winbindd_children = NULL;
@@ -48 +51 @@
 /* Read some data from a client connection */
 
-static NTSTATUS child_read_request(struct winbindd_cli_state *state)
+static NTSTATUS child_read_request(int sock, struct winbindd_request *wreq)
 {
         NTSTATUS status;
 
-        /* Read data */
-
-        status = read_data(state->sock, (char *)state->request,
-                           sizeof(*state->request));
-
+        status = read_data_ntstatus(sock, (char *)wreq, sizeof(*wreq));
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(3, ("child_read_request: read_data failed: %s\n",
@@ -63 +62 @@
         }
 
-        if (state->request->extra_len == 0) {
-                state->request->extra_data.data = NULL;
+        if (wreq->extra_len == 0) {
+                wreq->extra_data.data = NULL;
                 return NT_STATUS_OK;
         }
 
-        DEBUG(10, ("Need to read %d extra bytes\n", (int)state->request->extra_len));
-
-        state->request->extra_data.data =
-                SMB_MALLOC_ARRAY(char, state->request->extra_len + 1);
-
-        if (state->request->extra_data.data == NULL) {
+        DEBUG(10, ("Need to read %d extra bytes\n", (int)wreq->extra_len));
+
+        wreq->extra_data.data = SMB_MALLOC_ARRAY(char, wreq->extra_len + 1);
+        if (wreq->extra_data.data == NULL) {
                 DEBUG(0, ("malloc failed\n"));
                 return NT_STATUS_NO_MEMORY;
@@ -79 +76 @@
 
         /* Ensure null termination */
-        state->request->extra_data.data[state->request->extra_len] = '\0';
-
-        status= read_data(state->sock, state->request->extra_data.data,
-                          state->request->extra_len);
-
+        wreq->extra_data.data[wreq->extra_len] = '\0';
+
+        status = read_data_ntstatus(sock, wreq->extra_data.data,
+                                    wreq->extra_len);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0, ("Could not read extra data: %s\n",
@@ -89 +85 @@
         }
         return status;
+}
+
+static NTSTATUS child_write_response(int sock, struct winbindd_response *wrsp)
+{
+        struct iovec iov[2];
+        int iov_count;
+
+        iov[0].iov_base = (void *)wrsp;
+        iov[0].iov_len = sizeof(struct winbindd_response);
+        iov_count = 1;
+
+        if (wrsp->length > sizeof(struct winbindd_response)) {
+                iov[1].iov_base = (void *)wrsp->extra_data.data;
+                iov[1].iov_len = wrsp->length-iov[0].iov_len;
+                iov_count = 2;
+        }
+
+        DEBUG(10, ("Writing %d bytes to parent\n", (int)wrsp->length));
+
+        if (write_data_iov(sock, iov, iov_count) != wrsp->length) {
+                DEBUG(0, ("Could not write result\n"));
+                return NT_STATUS_INVALID_HANDLE;
+        }
+
+        return NT_STATUS_OK;
 }
 
@@ -99 +120 @@
 struct wb_child_request_state {
         struct tevent_context *ev;
+        struct tevent_req *subreq;
         struct winbindd_child *child;
         struct winbindd_request *request;
@@ -110 +132 @@
 static void wb_child_request_done(struct tevent_req *subreq);
 
+static void wb_child_request_cleanup(struct tevent_req *req,
+                                     enum tevent_req_state req_state);
+
 struct tevent_req *wb_child_request_send(TALLOC_CTX *mem_ctx,
                                          struct tevent_context *ev,
@@ -130 +155 @@
         if (!tevent_queue_add(child->queue, ev, req,
                               wb_child_request_trigger, NULL)) {
-                tevent_req_nomem(NULL, req);
+                tevent_req_oom(req);
                 return tevent_req_post(req, ev);
         }
+
+        tevent_req_set_cleanup_fn(req, wb_child_request_cleanup);
+
         return req;
 }
@@ -153 +181 @@
                 return;
         }
+
+        state->subreq = subreq;
         tevent_req_set_callback(subreq, wb_child_request_done, req);
         tevent_req_set_endtime(req, state->ev, timeval_current_ofs(300, 0));
@@ -166 +196 @@
 
         ret = wb_simple_trans_recv(subreq, state, &state->response, &err);
-        TALLOC_FREE(subreq);
+        /* Freeing the subrequest is deferred until the cleanup function,
+         * which has to know whether a subrequest exists, and consequently
+         * decide whether to shut down the pipe to the child process.
+         */
         if (ret == -1) {
-                /*
-                 * The basic parent/child communication broke, close
-                 * our socket
-                 */
-                close(state->child->sock);
-                state->child->sock = -1;
-                DLIST_REMOVE(winbindd_children, state->child);
                 tevent_req_error(req, err);
                 return;
@@ -192 +218 @@
         *presponse = talloc_move(mem_ctx, &state->response);
         return 0;
+}
+
+static void wb_child_request_cleanup(struct tevent_req *req,
+                                     enum tevent_req_state req_state)
+{
+        struct wb_child_request_state *state =
+            tevent_req_data(req, struct wb_child_request_state);
+
+        if (state->subreq == NULL) {
+                /* nothing to cleanup */
+                return;
+        }
+
+        TALLOC_FREE(state->subreq);
+
+        if (req_state == TEVENT_REQ_DONE) {
+                /* transmitted request and got response */
+                return;
+        }
+
+        /*
+         * Failed to transmit and receive response, or request
+         * cancelled while being serviced.
+         * The basic parent/child communication broke, close
+         * our socket
+         */
+        close(state->child->sock);
+        state->child->sock = -1;
+        DLIST_REMOVE(winbindd_children, state->child);
 }
 
@@ -369 +424 @@
                 return;
         }
-        fstrcpy(state->domain->name, response->data.domain_info.name);
-        fstrcpy(state->domain->alt_name, response->data.domain_info.alt_name);
+
+        talloc_free(state->domain->name);
+        state->domain->name = talloc_strdup(state->domain,
+                                            response->data.domain_info.name);
+        if (state->domain->name == NULL) {
+                tevent_req_error(req, ENOMEM);
+                return;
+        }
+
+        if (response->data.domain_info.alt_name[0] != '\0') {
+                talloc_free(state->domain->alt_name);
+
+                state->domain->alt_name = talloc_strdup(state->domain,
+                                response->data.domain_info.alt_name);
+                if (state->domain->alt_name == NULL) {
+                        tevent_req_error(req, ENOMEM);
+                        return;
+                }
+        }
+
         state->domain->native_mode = response->data.domain_info.native_mode;
         state->domain->active_directory =
@@ -456 +529 @@
                 char *logbase = NULL;
 
-                if (*lp_logfile()) {
+                if (*lp_logfile(talloc_tos())) {
                         char *end = NULL;
 
-                        if (asprintf(&logbase, "%s", lp_logfile()) < 0) {
+                        if (asprintf(&logbase, "%s", lp_logfile(talloc_tos())) < 0) {
                                 smb_panic("Internal error: asprintf failed");
                         }
@@ -524 +597 @@
 {
         flush_negative_conn_cache_for_domain(domain->name);
-        if (*domain->alt_name) {
+        if (domain->alt_name != NULL) {
                 flush_negative_conn_cache_for_domain(domain->alt_name);
         }
@@ -608 +681 @@
 
                 DEBUG(10,("winbind_msg_offline: sending message to pid %u for domain %s.\n",
-                        (unsigned int)child->pid, domain->name ));
+                        (unsigned int)child->pid, child->domain->name ));
 
                 messaging_send_buf(msg_ctx, pid_to_procid(child->pid),
                                    MSG_WINBIND_OFFLINE,
-                                   (uint8 *)child->domain->name,
+                                   (const uint8_t *)child->domain->name,
                                    strlen(child->domain->name)+1);
         }
@@ -661 +734 @@
                                                    pid_to_procid(idmap->pid), 
                                                    MSG_WINBIND_ONLINE,
-                                                   (uint8 *)domain->name,
+                                                   (const uint8_t *)domain->name,
                                                    strlen(domain->name)+1);
                         }
@@ -686 +759 @@
                 messaging_send_buf(msg_ctx, pid_to_procid(child->pid),
                                    MSG_WINBIND_ONLINE,
-                                   (uint8 *)child->domain->name,
+                                   (const uint8_t *)child->domain->name,
                                    strlen(child->domain->name)+1);
         }
@@ -748 +821 @@
 
         messaging_send_buf(msg_ctx, *sender, MSG_WINBIND_ONLINESTATUS, 
-                           (uint8 *)message, strlen(message) + 1);
+                           (const uint8_t *)message, strlen(message) + 1);
 
         talloc_destroy(mem_ctx);
@@ -825 +898 @@
                 messaging_send_buf(msg_ctx, *sender,
                                    MSG_WINBIND_DUMP_DOMAIN_LIST,
-                                   (uint8_t *)message, strlen(message) + 1);
+                                   (const uint8_t *)message, strlen(message) + 1);
 
                 talloc_destroy(mem_ctx);
@@ -859 +932 @@
 }
 
-static void account_lockout_policy_handler(struct event_context *ctx,
-                                           struct timed_event *te,
+static void account_lockout_policy_handler(struct tevent_context *ctx,
+                                           struct tevent_timer *te,
                                            struct timeval now,
                                            void *private_data)
@@ -898 +971 @@
         }
 
-        child->lockout_policy_event = event_add_timed(winbind_event_context(), NULL,
+        child->lockout_policy_event = tevent_add_timer(winbind_event_context(), NULL,
                                                       timeval_current_ofs(3600, 0),
                                                       account_lockout_policy_handler,
@@ -976 +1049 @@
 }
 
-static void machine_password_change_handler(struct event_context *ctx,
-                                            struct timed_event *te,
+static void machine_password_change_handler(struct tevent_context *ctx,
+                                            struct tevent_timer *te,
                                             struct timeval now,
                                             void *private_data)
 {
+        struct messaging_context *msg_ctx = winbind_messaging_context();
         struct winbindd_child *child =
                 (struct winbindd_child *)private_data;
         struct rpc_pipe_client *netlogon_pipe = NULL;
-        TALLOC_CTX *frame;
         NTSTATUS result;
         struct timeval next_change;
@@ -1021 +1094 @@
         }
 
-        frame = talloc_stackframe();
-
-        result = trust_pw_find_change_and_store_it(netlogon_pipe,
-                                                   frame,
-                                                   child->domain->name);
-        TALLOC_FREE(frame);
+        result = trust_pw_change(child->domain->conn.netlogon_creds,
+                                 msg_ctx,
+                                 netlogon_pipe->binding_handle,
+                                 child->domain->name,
+                                 false); /* force */
 
         DEBUG(10, ("machine_password_change_handler: "
-                   "trust_pw_find_change_and_store_it returned %s\n",
+                   "trust_pw_change returned %s\n",
                    nt_errstr(result)));
 
@@ -1038 +1110 @@
                          "Killing connections to domain %s\n",
                          child->domain->name));
-                TALLOC_FREE(child->domain->conn.netlogon_pipe);
+                invalidate_cm_connection(child->domain);
         }
 
@@ -1060 +1132 @@
 
 done:
-        child->machine_password_change_event = event_add_timed(winbind_event_context(), NULL,
+        child->machine_password_change_event = tevent_add_timer(winbind_event_context(), NULL,
                                                               next_change,
                                                               machine_password_change_handler,
@@ -1183 +1255 @@
                 winbind_messaging_context(),
                 winbind_event_context(),
-                procid_self(),
-                true);
+                true, NULL);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("reinit_after_fork() failed\n"));
@@ -1295 +1366 @@
 }
 
+struct child_handler_state {
+        struct winbindd_child *child;
+        struct winbindd_cli_state cli;
+};
+
+static void child_handler(struct tevent_context *ev, struct tevent_fd *fde,
+                          uint16_t flags, void *private_data)
+{
+        struct child_handler_state *state =
+                (struct child_handler_state *)private_data;
+        NTSTATUS status;
+
+        /* fetch a request from the main daemon */
+        status = child_read_request(state->cli.sock, state->cli.request);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                /* we lost contact with our parent */
+                _exit(0);
+        }
+
+        DEBUG(4,("child daemon request %d\n",
+                 (int)state->cli.request->cmd));
+
+        ZERO_STRUCTP(state->cli.response);
+        state->cli.request->null_term = '\0';
+        state->cli.mem_ctx = talloc_tos();
+        child_process_request(state->child, &state->cli);
+
+        DEBUG(4, ("Finished processing child request %d\n",
+                  (int)state->cli.request->cmd));
+
+        SAFE_FREE(state->cli.request->extra_data.data);
+
+        status = child_write_response(state->cli.sock, state->cli.response);
+        if (!NT_STATUS_IS_OK(status)) {
+                exit(1);
+        }
+}
+
 static bool fork_domain_child(struct winbindd_child *child)
 {
         int fdpair[2];
-        struct winbindd_cli_state state;
+        struct child_handler_state state;
         struct winbindd_request request;
         struct winbindd_response response;
@@ -1304 +1414 @@
         NTSTATUS status;
         ssize_t nwritten;
+        struct tevent_fd *fde;
 
         if (child->domain) {
@@ -1319 +1430 @@
 
         ZERO_STRUCT(state);
-        state.pid = sys_getpid();
-        state.request = &request;
-        state.response = &response;
-
-        child->pid = sys_fork();
+        state.child = child;
+        state.cli.pid = getpid();
+        state.cli.request = &request;
+        state.cli.response = &response;
+
+        child->pid = fork();
 
         if (child->pid == -1) {
                 DEBUG(0, ("Could not fork: %s\n", strerror(errno)));
+                close(fdpair[0]);
+                close(fdpair[1]);
                 return False;
         }
@@ -1360 +1474 @@
         child_domain = child->domain;
 
-        DEBUG(10, ("Child process %d\n", (int)sys_getpid()));
-
-        state.sock = fdpair[0];
+        DEBUG(10, ("Child process %d\n", (int)getpid()));
+
+        state.cli.sock = fdpair[0];
         close(fdpair[1]);
 
         status = winbindd_reinit_after_fork(child, child->logfilename);
 
-        nwritten = sys_write(state.sock, &status, sizeof(status));
+        nwritten = sys_write(state.cli.sock, &status, sizeof(status));
         if (nwritten != sizeof(status)) {
                 DEBUG(1, ("fork_domain_child: Could not write status: "
@@ -1444 +1558 @@
                 }
 
-                child->lockout_policy_event = event_add_timed(
+                child->lockout_policy_event = tevent_add_timer(
                         winbind_event_context(), NULL, timeval_zero(),
                         account_lockout_policy_handler,
@@ -1458 +1572 @@
                 if (calculate_next_machine_pwd_change(child->domain->name,
                                                        &next_change)) {
-                        child->machine_password_change_event = event_add_timed(
+                        child->machine_password_change_event = tevent_add_timer(
                                 winbind_event_context(), NULL, next_change,
                                 machine_password_change_handler,
@@ -1465 +1579 @@
         }
 
+        fde = tevent_add_fd(winbind_event_context(), NULL, state.cli.sock,
+                            TEVENT_FD_READ, child_handler, &state);
+        if (fde == NULL) {
+                DEBUG(1, ("tevent_add_fd failed\n"));
+                _exit(1);
+        }
+
         while (1) {
 
                 int ret;
-                struct pollfd *pfds;
-                int num_pfds;
-                int timeout;
-                struct timeval t;
-                struct timeval *tp;
                 TALLOC_CTX *frame = talloc_stackframe();
-                struct iovec iov[2];
-                int iov_count;
-
-                if (run_events_poll(winbind_event_context(), 0, NULL, 0)) {
-                        TALLOC_FREE(frame);
-                        continue;
+
+                ret = tevent_loop_once(winbind_event_context());
+                if (ret != 0) {
+                        DEBUG(1, ("tevent_loop_once failed: %s\n",
+                                  strerror(errno)));
+                        _exit(1);
                 }
 
@@ -1490 +1606 @@
                 }
 
-                pfds = TALLOC_ZERO_P(talloc_tos(), struct pollfd);
-                if (pfds == NULL) {
-                        DEBUG(1, ("talloc failed\n"));
-                        _exit(1);
-                }
-
-                pfds->fd = state.sock;
-                pfds->events = POLLIN|POLLHUP;
-                num_pfds = 1;
-
-                timeout = INT_MAX;
-
-                if (!event_add_to_poll_args(
-                            winbind_event_context(), talloc_tos(),
-                            &pfds, &num_pfds, &timeout)) {
-                        DEBUG(1, ("event_add_to_poll_args failed\n"));
-                        _exit(1);
-                }
-                tp = get_timed_events_timeout(winbind_event_context(), &t);
-                if (tp) {
-                        DEBUG(11,("select will use timeout of %u.%u seconds\n",
-                                (unsigned int)tp->tv_sec, (unsigned int)tp->tv_usec ));
-                }
-
-                ret = sys_poll(pfds, num_pfds, timeout);
-
-                if (run_events_poll(winbind_event_context(), ret,
-                                    pfds, num_pfds)) {
-                        /* We got a signal - continue. */
-                        TALLOC_FREE(frame);
-                        continue;
-                }
-
-                TALLOC_FREE(pfds);
-
-                if (ret == 0) {
-                        DEBUG(11,("nothing is ready yet, continue\n"));
-                        TALLOC_FREE(frame);
-                        continue;
-                }
-
-                if (ret == -1 && errno == EINTR) {
-                        /* We got a signal - continue. */
-                        TALLOC_FREE(frame);
-                        continue;
-                }
-
-                if (ret == -1 && errno != EINTR) {
-                        DEBUG(0,("poll error occured\n"));
-                        TALLOC_FREE(frame);
-                        perror("poll");
-                        _exit(1);
-                }
-
-                /* fetch a request from the main daemon */
-                status = child_read_request(&state);
-
-                if (!NT_STATUS_IS_OK(status)) {
-                        /* we lost contact with our parent */
-                        _exit(0);
-                }
-
-                DEBUG(4,("child daemon request %d\n", (int)state.request->cmd));
-
-                ZERO_STRUCTP(state.response);
-                state.request->null_term = '\0';
-                state.mem_ctx = frame;
-                child_process_request(child, &state);
-
-                DEBUG(4, ("Finished processing child request %d\n",
-                          (int)state.request->cmd));
-
-                SAFE_FREE(state.request->extra_data.data);
-
-                iov[0].iov_base = (void *)state.response;
-                iov[0].iov_len = sizeof(struct winbindd_response);
-                iov_count = 1;
-
-                if (state.response->length > sizeof(struct winbindd_response)) {
-                        iov[1].iov_base =
-                                (void *)state.response->extra_data.data;
-                        iov[1].iov_len = state.response->length-iov[0].iov_len;
-                        iov_count = 2;
-                }
-
-                DEBUG(10, ("Writing %d bytes to parent\n",
-                           (int)state.response->length));
-
-                if (write_data_iov(state.sock, iov, iov_count) !=
-                    state.response->length) {
-                        DEBUG(0, ("Could not write result\n"));
-                        exit(1);
-                }
                 TALLOC_FREE(frame);
         }

vendor/current/source3/winbindd/winbindd_dual_ndr.c

@@ -31 +31 @@
 #include "winbindd/winbindd_proto.h"
 #include "ntdomain.h"
-#include "librpc/gen_ndr/srv_wbint.h"
+#include "librpc/gen_ndr/srv_winbind.h"
 
 struct wbint_bh_state {
@@ -97 +97 @@
         ok = wbint_bh_is_connected(h);
         if (!ok) {
-                tevent_req_nterror(req, NT_STATUS_INVALID_CONNECTION);
+                tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
                 return tevent_req_post(req, ev);
         }
@@ -145 +145 @@
                 state->response->length - sizeof(struct winbindd_response));
         if (state->response->extra_data.data && !state->out_data.data) {
-                tevent_req_nomem(NULL, req);
+                tevent_req_oom(req);
                 return;
         }
@@ -202 +202 @@
         ok = wbint_bh_is_connected(h);
         if (!ok) {
-                tevent_req_nterror(req, NT_STATUS_INVALID_CONNECTION);
+                tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
                 return tevent_req_post(req, ev);
         }
@@ -284 +284 @@
                                          &wbint_bh_ops,
                                          NULL,
-                                         &ndr_table_wbint,
+                                         &ndr_table_winbind,
                                          &hs,
                                          struct wbint_bh_state,
@@ -305 +305 @@
         bool ret;
 
-        wbint_get_pipe_fns(&fns, &num_fns);
+        winbind_get_pipe_fns(&fns, &num_fns);
 
         if (state->request->data.ndrcmd >= num_fns) {

vendor/current/source3/winbindd/winbindd_dual_srv.c

@@ -26 +26 @@
 #include "rpc_client/cli_pipe.h"
 #include "ntdomain.h"
-#include "librpc/gen_ndr/srv_wbint.h"
+#include "librpc/gen_ndr/srv_winbind.h"
 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
+#include "../librpc/gen_ndr/ndr_lsa_c.h"
 #include "idmap.h"
 #include "../libcli/security/security.h"
+#include "../libcli/auth/netlogon_creds_cli.h"
+#include "passdb.h"
+#include "../source4/dsdb/samdb/samdb.h"
 
 void _wbint_Ping(struct pipes_struct *p, struct wbint_Ping *r)
@@ -40 +44 @@
 {
         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
-                invalidate_cm_connection(&domain->conn);
+                invalidate_cm_connection(domain);
                 /* We invalidated the connection. */
                 return true;
@@ -75 +79 @@
 {
         struct winbindd_domain *domain = wb_child_domain();
+        struct lsa_RefDomainList *domains = r->out.domains;
         NTSTATUS status;
 
@@ -88 +93 @@
          */
         status = rpc_lookup_sids(p->mem_ctx, domain, r->in.sids,
-                                 &r->out.domains, &r->out.names);
+                                 &domains, &r->out.names);
+
+        if (domains != NULL) {
+                r->out.domains = domains;
+        }
+
         reset_cm_connection_on_error(domain, status);
         return status;
@@ -107 +117 @@
         reset_cm_connection_on_error(domain, status);
         return status;
-}
-
-NTSTATUS _wbint_Sid2Uid(struct pipes_struct *p, struct wbint_Sid2Uid *r)
-{
-        uid_t uid;
-        NTSTATUS status;
-
-        status = idmap_sid_to_uid(r->in.dom_name ? r->in.dom_name : "",
-                                  r->in.sid, &uid);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-        *r->out.uid = uid;
-        return NT_STATUS_OK;
-}
-
-NTSTATUS _wbint_Sid2Gid(struct pipes_struct *p, struct wbint_Sid2Gid *r)
-{
-        gid_t gid;
-        NTSTATUS status;
-
-        status = idmap_sid_to_gid(r->in.dom_name ? r->in.dom_name : "",
-                                  r->in.sid, &gid);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-        *r->out.gid = gid;
-        return NT_STATUS_OK;
 }
 
@@ -152 +134 @@
                 uint32_t num_ids;
 
-                dom = idmap_find_domain(d->name.string);
+                dom = idmap_find_domain_with_sid(d->name.string, d->sid);
                 if (dom == NULL) {
-                        DEBUG(10, ("idmap domain %s not found\n",
-                                   d->name.string));
+                        DEBUG(10, ("idmap domain %s:%s not found\n",
+                                   d->name.string, sid_string_dbg(d->sid)));
                         continue;
                 }
@@ -167 +149 @@
                 }
 
-                ids = TALLOC_REALLOC_ARRAY(talloc_tos(), ids,
+                ids = talloc_realloc(talloc_tos(), ids,
                                            struct id_map, num_ids);
                 if (ids == NULL) {
                         goto nomem;
                 }
-                id_ptrs = TALLOC_REALLOC_ARRAY(talloc_tos(), id_ptrs,
+                id_ptrs = talloc_realloc(talloc_tos(), id_ptrs,
                                                struct id_map *, num_ids+1);
                 if (id_ptrs == NULL) {
                         goto nomem;
                 }
-                id_idx = TALLOC_REALLOC_ARRAY(talloc_tos(), id_idx,
+                id_idx = talloc_realloc(talloc_tos(), id_idx,
                                               uint32_t, num_ids);
                 if (id_idx == NULL) {
                         goto nomem;
                 }
-                sids = TALLOC_REALLOC_ARRAY(talloc_tos(), sids,
+                sids = talloc_realloc(talloc_tos(), sids,
                                             struct dom_sid, num_ids);
                 if (sids == NULL) {
@@ -190 +172 @@
                 num_ids = 0;
 
+                /*
+                 * Convert the input data into a list of
+                 * id_map structs suitable for handing in
+                 * to the idmap sids_to_unixids method.
+                 */
                 for (j=0; j<r->in.ids->num_ids; j++) {
                         struct wbint_TransID *id = &r->in.ids->ids[j];
@@ -211 +198 @@
                            nt_errstr(status)));
 
+                /*
+                 * Extract the results for handing them back to the caller.
+                 */
                 for (j=0; j<num_ids; j++) {
                         struct wbint_TransID *id = &r->in.ids->ids[id_idx[j]];
 
                         if (ids[j].status != ID_MAPPED) {
+                                id->xid.id = UINT32_MAX;
+                                id->xid.type = ID_TYPE_NOT_SPECIFIED;
                                 continue;
                         }
-                        id->unix_id = ids[j].xid.id;
+
+                        id->xid = ids[j].xid;
                 }
         }
@@ -231 +224 @@
 NTSTATUS _wbint_Uid2Sid(struct pipes_struct *p, struct wbint_Uid2Sid *r)
 {
-        return idmap_uid_to_sid(r->in.dom_name ? r->in.dom_name : "",
-                                r->out.sid, r->in.uid);
+        return idmap_uid_to_sid(r->out.sid, r->in.uid);
 }
 
 NTSTATUS _wbint_Gid2Sid(struct pipes_struct *p, struct wbint_Gid2Sid *r)
 {
-        return idmap_gid_to_sid(r->in.dom_name ? r->in.dom_name : "",
-                                r->out.sid, r->in.gid);
+        return idmap_gid_to_sid(r->out.sid, r->in.gid);
 }
 
@@ -391 +382 @@
 {
         struct winbindd_domain *domain = wb_child_domain();
-        uint32_t i, num_groups;
-        struct wb_acct_info *groups;
+        uint32_t i;
+        uint32_t num_local_groups = 0;
+        struct wb_acct_info *local_groups = NULL;
+        uint32_t num_dom_groups = 0;
+        struct wb_acct_info *dom_groups = NULL;
+        uint32_t ti = 0;
+        uint64_t num_total = 0;
         struct wbint_Principal *result;
         NTSTATUS status;
+        bool include_local_groups = false;
 
         if (domain == NULL) {
@@ -400 +397 @@
         }
 
+        switch (lp_server_role()) {
+        case ROLE_ACTIVE_DIRECTORY_DC:
+                if (domain->internal) {
+                        /*
+                         * we want to include local groups
+                         * for BUILTIN and WORKGROUP
+                         */
+                        include_local_groups = true;
+                }
+                break;
+        default:
+                /*
+                 * We might include local groups in more
+                 * setups later, but that requires more work
+                 * elsewhere.
+                 */
+                break;
+        }
+
+        if (include_local_groups) {
+                status = domain->methods->enum_local_groups(domain, talloc_tos(),
+                                                            &num_local_groups,
+                                                            &local_groups);
+                reset_cm_connection_on_error(domain, status);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+        }
+
         status = domain->methods->enum_dom_groups(domain, talloc_tos(),
-                                                  &num_groups, &groups);
+                                                  &num_dom_groups,
+                                                  &dom_groups);
         reset_cm_connection_on_error(domain, status);
         if (!NT_STATUS_IS_OK(status)) {
@@ -407 +434 @@
         }
 
+        num_total = num_local_groups + num_dom_groups;
+        if (num_total > UINT32_MAX) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
         result = talloc_array(r->out.groups, struct wbint_Principal,
-                              num_groups);
+                              num_total);
         if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
 
-        for (i=0; i<num_groups; i++) {
-                sid_compose(&result[i].sid, &domain->sid, groups[i].rid);
-                result[i].type = SID_NAME_DOM_GRP;
-                result[i].name = talloc_strdup(result, groups[i].acct_name);
-                if (result[i].name == NULL) {
+        for (i = 0; i < num_local_groups; i++) {
+                struct wb_acct_info *lg = &local_groups[i];
+                struct wbint_Principal *rg = &result[ti++];
+
+                sid_compose(&rg->sid, &domain->sid, lg->rid);
+                rg->type = SID_NAME_ALIAS;
+                rg->name = talloc_strdup(result, lg->acct_name);
+                if (rg->name == NULL) {
                         TALLOC_FREE(result);
-                        TALLOC_FREE(groups);
+                        TALLOC_FREE(dom_groups);
+                        TALLOC_FREE(local_groups);
                         return NT_STATUS_NO_MEMORY;
                 }
         }
-
-        r->out.groups->num_principals = num_groups;
+        num_local_groups = 0;
+        TALLOC_FREE(local_groups);
+
+        for (i = 0; i < num_dom_groups; i++) {
+                struct wb_acct_info *dg = &dom_groups[i];
+                struct wbint_Principal *rg = &result[ti++];
+
+                sid_compose(&rg->sid, &domain->sid, dg->rid);
+                rg->type = SID_NAME_DOM_GRP;
+                rg->name = talloc_strdup(result, dg->acct_name);
+                if (rg->name == NULL) {
+                        TALLOC_FREE(result);
+                        TALLOC_FREE(dom_groups);
+                        TALLOC_FREE(local_groups);
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+        num_dom_groups = 0;
+        TALLOC_FREE(dom_groups);
+
+        r->out.groups->num_principals = ti;
         r->out.groups->principals = result;
 
-        TALLOC_FREE(groups);
         return NT_STATUS_OK;
 }
@@ -591 +645 @@
 
 again:
-        invalidate_cm_connection(&domain->conn);
+        invalidate_cm_connection(domain);
+        domain->conn.netlogon_force_reauth = true;
 
         {
@@ -633 +688 @@
                                      struct wbint_ChangeMachineAccount *r)
 {
+        struct messaging_context *msg_ctx = winbind_messaging_context();
         struct winbindd_domain *domain;
-        int num_retries = 0;
         NTSTATUS status;
         struct rpc_pipe_client *netlogon_pipe;
-        TALLOC_CTX *tmp_ctx;
-
-again:
+
         domain = wb_child_domain();
         if (domain == NULL) {
@@ -645 +698 @@
         }
 
-        invalidate_cm_connection(&domain->conn);
-
-        {
-                status = cm_connect_netlogon(domain, &netlogon_pipe);
-        }
-
-        /* There is a race condition between fetching the trust account
-           password and the periodic machine password change.  So it's
-           possible that the trust account password has been changed on us.
-           We are returned NT_STATUS_ACCESS_DENIED if this happens. */
-
-#define MAX_RETRIES 3
-
-        if ((num_retries < MAX_RETRIES)
-             && NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
-                num_retries++;
-                goto again;
-        }
-
+        status = cm_connect_netlogon(domain, &netlogon_pipe);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
@@ -669 +704 @@
         }
 
-        tmp_ctx = talloc_new(p->mem_ctx);
-
-        status = trust_pw_find_change_and_store_it(netlogon_pipe,
-                                                   tmp_ctx,
-                                                   domain->name);
-        talloc_destroy(tmp_ctx);
+        status = trust_pw_change(domain->conn.netlogon_creds,
+                                 msg_ctx,
+                                 netlogon_pipe->binding_handle,
+                                 domain->name,
+                                 true); /* force */
 
         /* Pass back result code - zero for success, other values for
@@ -699 +733 @@
         fstring logon_server;
         struct dcerpc_binding_handle *b;
+        bool retry = false;
 
         domain = wb_child_domain();
@@ -705 +740 @@
         }
 
+reconnect:
         status = cm_connect_netlogon(domain, &netlogon_pipe);
         reset_cm_connection_on_error(domain, status);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
+                DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
+                          nt_errstr(status)));
                 return status;
         }
@@ -715 +752 @@
 
         fstr_sprintf(logon_server, "\\\\%s", domain->dcname);
+        *r->out.dcname = talloc_strdup(p->mem_ctx, domain->dcname);
+        if (*r->out.dcname == NULL) {
+                DEBUG(2, ("Could not allocate memory\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
 
         /*
@@ -726 +768 @@
                                           2, &info, &werr);
 
+        if (!dcerpc_binding_handle_is_connected(b) && !retry) {
+                DEBUG(10, ("Session might have expired. "
+                           "Reconnect and retry once.\n"));
+                invalidate_cm_connection(domain);
+                retry = true;
+                goto reconnect;
+        }
+
         reset_cm_connection_on_error(domain, status);
         if (!NT_STATUS_IS_OK(status)) {
@@ -743 +793 @@
         return NT_STATUS_OK;
 }
+
+NTSTATUS _winbind_DsrUpdateReadOnlyServerDnsRecords(struct pipes_struct *p,
+                                                    struct winbind_DsrUpdateReadOnlyServerDnsRecords *r)
+{
+        struct winbindd_domain *domain;
+        NTSTATUS status;
+        struct rpc_pipe_client *netlogon_pipe;
+
+        domain = wb_child_domain();
+        if (domain == NULL) {
+                return NT_STATUS_REQUEST_NOT_ACCEPTED;
+        }
+
+        status = cm_connect_netlogon(domain, &netlogon_pipe);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
+                goto done;
+        }
+
+        status = netlogon_creds_cli_DsrUpdateReadOnlyServerDnsRecords(domain->conn.netlogon_creds,
+                                                                      netlogon_pipe->binding_handle,
+                                                                      r->in.site_name,
+                                                                      r->in.dns_ttl,
+                                                                      r->in.dns_names);
+
+        /* Pass back result code - zero for success, other values for
+           specific failures. */
+
+        DEBUG(3,("DNS records for domain %s %s\n", domain->name,
+                NT_STATUS_IS_OK(status) ? "changed" : "unchanged"));
+
+ done:
+        DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
+              ("Update of DNS records via RW DC %s returned %s\n",
+               domain->name, nt_errstr(status)));
+
+        return status;
+}
+
+NTSTATUS _winbind_SamLogon(struct pipes_struct *p,
+                        struct winbind_SamLogon *r)
+{
+        struct winbindd_domain *domain;
+        NTSTATUS status;
+        DATA_BLOB lm_response, nt_response;
+        domain = wb_child_domain();
+        if (domain == NULL) {
+                return NT_STATUS_REQUEST_NOT_ACCEPTED;
+        }
+
+        /* TODO: Handle interactive logons here */
+        if (r->in.validation_level != 3 ||
+            r->in.logon.network == NULL ||
+            (r->in.logon_level != NetlogonNetworkInformation
+             && r->in.logon_level != NetlogonNetworkTransitiveInformation)) {
+                return NT_STATUS_REQUEST_NOT_ACCEPTED;
+        }
+
+
+        lm_response = data_blob_talloc(p->mem_ctx, r->in.logon.network->lm.data, r->in.logon.network->lm.length);
+        nt_response = data_blob_talloc(p->mem_ctx, r->in.logon.network->nt.data, r->in.logon.network->nt.length);
+
+        status = winbind_dual_SamLogon(domain, p->mem_ctx,
+                                       r->in.logon.network->identity_info.parameter_control,
+                                       r->in.logon.network->identity_info.account_name.string,
+                                       r->in.logon.network->identity_info.domain_name.string,
+                                       r->in.logon.network->identity_info.workstation.string,
+                                       r->in.logon.network->challenge,
+                                       lm_response, nt_response, &r->out.validation.sam3);
+        return status;
+}
+
+static WERROR _winbind_LogonControl_REDISCOVER(struct pipes_struct *p,
+                             struct winbindd_domain *domain,
+                             struct winbind_LogonControl *r)
+{
+        NTSTATUS status;
+        struct rpc_pipe_client *netlogon_pipe = NULL;
+        struct netr_NETLOGON_INFO_2 *info2 = NULL;
+        WERROR check_result = WERR_INTERNAL_ERROR;
+
+        info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
+        if (info2 == NULL) {
+                return WERR_NOMEM;
+        }
+
+        if (domain->internal) {
+                check_result = WERR_OK;
+                goto check_return;
+        }
+
+        /*
+         * For now we just force a reconnect
+         *
+         * TODO: take care of the optional '\dcname'
+         */
+        invalidate_cm_connection(domain);
+        domain->conn.netlogon_force_reauth = true;
+        status = cm_connect_netlogon(domain, &netlogon_pipe);
+        reset_cm_connection_on_error(domain, status);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
+                status = NT_STATUS_NO_LOGON_SERVERS;
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(2, ("%s: domain[%s/%s] cm_connect_netlogon() returned %s\n",
+                          __func__, domain->name, domain->alt_name,
+                          nt_errstr(status)));
+                /*
+                 * Here we return a top level error!
+                 * This is different than TC_QUERY or TC_VERIFY.
+                 */
+                return ntstatus_to_werror(status);
+        }
+        check_result = WERR_OK;
+
+check_return:
+        info2->pdc_connection_status = WERR_OK;
+        if (domain->dcname != NULL) {
+                info2->flags |= NETLOGON_HAS_IP;
+                info2->flags |= NETLOGON_HAS_TIMESERV;
+                info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
+                                                         domain->dcname);
+                if (info2->trusted_dc_name == NULL) {
+                        return WERR_NOMEM;
+                }
+        } else {
+                info2->trusted_dc_name = talloc_strdup(info2, "");
+                if (info2->trusted_dc_name == NULL) {
+                        return WERR_NOMEM;
+                }
+        }
+        info2->tc_connection_status = check_result;
+
+        if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
+                DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
+                          "pdc_connection[%s] tc_connection[%s]\n",
+                          __func__, domain->name, domain->alt_name,
+                          domain->dcname,
+                          win_errstr(info2->pdc_connection_status),
+                          win_errstr(info2->tc_connection_status)));
+        }
+
+        r->out.query->info2 = info2;
+
+        DEBUG(5, ("%s: succeeded.\n", __func__));
+        return WERR_OK;
+}
+
+static WERROR _winbind_LogonControl_TC_QUERY(struct pipes_struct *p,
+                             struct winbindd_domain *domain,
+                             struct winbind_LogonControl *r)
+{
+        NTSTATUS status;
+        struct rpc_pipe_client *netlogon_pipe = NULL;
+        struct netr_NETLOGON_INFO_2 *info2 = NULL;
+        WERROR check_result = WERR_INTERNAL_ERROR;
+
+        info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
+        if (info2 == NULL) {
+                return WERR_NOMEM;
+        }
+
+        if (domain->internal) {
+                check_result = WERR_OK;
+                goto check_return;
+        }
+
+        status = cm_connect_netlogon(domain, &netlogon_pipe);
+        reset_cm_connection_on_error(domain, status);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
+                status = NT_STATUS_NO_LOGON_SERVERS;
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
+                          nt_errstr(status)));
+                check_result = ntstatus_to_werror(status);
+                goto check_return;
+        }
+        check_result = WERR_OK;
+
+check_return:
+        info2->pdc_connection_status = WERR_OK;
+        if (domain->dcname != NULL) {
+                info2->flags |= NETLOGON_HAS_IP;
+                info2->flags |= NETLOGON_HAS_TIMESERV;
+                info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
+                                                         domain->dcname);
+                if (info2->trusted_dc_name == NULL) {
+                        return WERR_NOMEM;
+                }
+        } else {
+                info2->trusted_dc_name = talloc_strdup(info2, "");
+                if (info2->trusted_dc_name == NULL) {
+                        return WERR_NOMEM;
+                }
+        }
+        info2->tc_connection_status = check_result;
+
+        if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
+                DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
+                          "pdc_connection[%s] tc_connection[%s]\n",
+                          __func__, domain->name, domain->alt_name,
+                          domain->dcname,
+                          win_errstr(info2->pdc_connection_status),
+                          win_errstr(info2->tc_connection_status)));
+        }
+
+        r->out.query->info2 = info2;
+
+        DEBUG(5, ("%s: succeeded.\n", __func__));
+        return WERR_OK;
+}
+
+static WERROR _winbind_LogonControl_TC_VERIFY(struct pipes_struct *p,
+                             struct winbindd_domain *domain,
+                             struct winbind_LogonControl *r)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        NTSTATUS status;
+        NTSTATUS result;
+        struct lsa_String trusted_domain_name = {};
+        struct lsa_StringLarge trusted_domain_name_l = {};
+        struct rpc_pipe_client *local_lsa_pipe = NULL;
+        struct policy_handle local_lsa_policy = {};
+        struct dcerpc_binding_handle *local_lsa = NULL;
+        struct rpc_pipe_client *netlogon_pipe = NULL;
+        struct cli_credentials *creds = NULL;
+        struct samr_Password *cur_nt_hash = NULL;
+        uint32_t trust_attributes = 0;
+        struct samr_Password new_owf_password = {};
+        int cmp_new = -1;
+        struct samr_Password old_owf_password = {};
+        int cmp_old = -1;
+        const struct lsa_TrustDomainInfoInfoEx *local_tdo = NULL;
+        bool fetch_fti = false;
+        struct lsa_ForestTrustInformation *new_fti = NULL;
+        struct netr_TrustInfo *trust_info = NULL;
+        struct netr_NETLOGON_INFO_2 *info2 = NULL;
+        struct dcerpc_binding_handle *b = NULL;
+        WERROR check_result = WERR_INTERNAL_ERROR;
+        WERROR verify_result = WERR_INTERNAL_ERROR;
+        bool retry = false;
+
+        trusted_domain_name.string = domain->name;
+        trusted_domain_name_l.string = domain->name;
+
+        info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
+        if (info2 == NULL) {
+                TALLOC_FREE(frame);
+                return WERR_NOMEM;
+        }
+
+        if (domain->internal) {
+                check_result = WERR_OK;
+                goto check_return;
+        }
+
+        status = pdb_get_trust_credentials(domain->name,
+                                           domain->alt_name,
+                                           frame,
+                                           &creds);
+        if (NT_STATUS_IS_OK(status)) {
+                cur_nt_hash = cli_credentials_get_nt_hash(creds, frame);
+                TALLOC_FREE(creds);
+        }
+
+        if (!domain->primary) {
+                union lsa_TrustedDomainInfo *tdi = NULL;
+
+                status = open_internal_lsa_conn(frame, &local_lsa_pipe,
+                                                &local_lsa_policy);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("%s:%s: open_internal_lsa_conn() failed - %s\n",
+                                 __location__, __func__, nt_errstr(status)));
+                        TALLOC_FREE(frame);
+                        return WERR_INTERNAL_ERROR;
+                }
+                local_lsa = local_lsa_pipe->binding_handle;
+
+                status = dcerpc_lsa_QueryTrustedDomainInfoByName(local_lsa, frame,
+                                                        &local_lsa_policy,
+                                                        &trusted_domain_name,
+                                                        LSA_TRUSTED_DOMAIN_INFO_INFO_EX,
+                                                        &tdi, &result);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) failed - %s\n",
+                                 __location__, __func__, domain->name, nt_errstr(status)));
+                        TALLOC_FREE(frame);
+                        return WERR_INTERNAL_ERROR;
+                }
+                if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+                        DEBUG(1,("%s:%s: domain[%s] not found via LSA, might be removed already.\n",
+                                 __location__, __func__, domain->name));
+                        TALLOC_FREE(frame);
+                        return WERR_NO_SUCH_DOMAIN;
+                }
+                if (!NT_STATUS_IS_OK(result)) {
+                        DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) returned %s\n",
+                                 __location__, __func__, domain->name, nt_errstr(result)));
+                        TALLOC_FREE(frame);
+                        return WERR_INTERNAL_ERROR;
+                }
+                if (tdi == NULL) {
+                        DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName() "
+                                 "returned no trusted domain information\n",
+                                 __location__, __func__));
+                        TALLOC_FREE(frame);
+                        return WERR_INTERNAL_ERROR;
+                }
+
+                local_tdo = &tdi->info_ex;
+                trust_attributes = local_tdo->trust_attributes;
+        }
+
+        if (trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
+                struct lsa_ForestTrustInformation *old_fti = NULL;
+
+                status = dcerpc_lsa_lsaRQueryForestTrustInformation(local_lsa, frame,
+                                                        &local_lsa_policy,
+                                                        &trusted_domain_name,
+                                                        LSA_FOREST_TRUST_DOMAIN_INFO,
+                                                        &old_fti, &result);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) failed %s\n",
+                                 __location__, __func__, domain->name, nt_errstr(status)));
+                        TALLOC_FREE(frame);
+                        return WERR_INTERNAL_ERROR;
+                }
+                if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_FOUND)) {
+                        DEBUG(2,("%s: no forest trust information available for domain[%s] yet.\n",
+                                  __func__, domain->name));
+                        old_fti = NULL;
+                        fetch_fti = true;
+                        result = NT_STATUS_OK;
+                }
+                if (!NT_STATUS_IS_OK(result)) {
+                        DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) returned %s\n",
+                                 __location__, __func__, domain->name, nt_errstr(result)));
+                        TALLOC_FREE(frame);
+                        return WERR_INTERNAL_ERROR;
+                }
+
+                TALLOC_FREE(old_fti);
+        }
+
+reconnect:
+        status = cm_connect_netlogon(domain, &netlogon_pipe);
+        reset_cm_connection_on_error(domain, status);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
+                status = NT_STATUS_NO_LOGON_SERVERS;
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
+                          nt_errstr(status)));
+                check_result = ntstatus_to_werror(status);
+                goto check_return;
+        }
+        check_result = WERR_OK;
+        b = netlogon_pipe->binding_handle;
+
+        if (cur_nt_hash == NULL) {
+                verify_result = WERR_NO_TRUST_LSA_SECRET;
+                goto verify_return;
+        }
+
+        if (fetch_fti) {
+                status = netlogon_creds_cli_GetForestTrustInformation(domain->conn.netlogon_creds,
+                                                                      b, frame,
+                                                                      &new_fti);
+                if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
+                        status = NT_STATUS_NOT_SUPPORTED;
+                }
+                if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
+                        new_fti = NULL;
+                        status = NT_STATUS_OK;
+                }
+                if (!NT_STATUS_IS_OK(status)) {
+                        if (!retry && dcerpc_binding_handle_is_connected(b)) {
+                                invalidate_cm_connection(domain);
+                                retry = true;
+                                goto reconnect;
+                        }
+                        DEBUG(2, ("netlogon_creds_cli_GetForestTrustInformation(%s)"
+                                  "failed: %s\n",
+                                  domain->name, nt_errstr(status)));
+                        check_result = ntstatus_to_werror(status);
+                        goto check_return;
+                }
+        }
+
+        if (new_fti != NULL) {
+                struct lsa_ForestTrustInformation old_fti = {};
+                struct lsa_ForestTrustInformation *merged_fti = NULL;
+                struct lsa_ForestTrustCollisionInfo *collision_info = NULL;
+
+                status = dsdb_trust_merge_forest_info(frame, local_tdo,
+                                                      &old_fti, new_fti,
+                                                      &merged_fti);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("%s:%s: dsdb_trust_merge_forest_info(%s) failed %s\n",
+                                 __location__, __func__,
+                                 domain->name, nt_errstr(status)));
+                        TALLOC_FREE(frame);
+                        return ntstatus_to_werror(status);
+                }
+
+                status = dcerpc_lsa_lsaRSetForestTrustInformation(local_lsa, frame,
+                                                &local_lsa_policy,
+                                                &trusted_domain_name_l,
+                                                LSA_FOREST_TRUST_DOMAIN_INFO,
+                                                merged_fti,
+                                                0, /* check_only=0 => store it! */
+                                                &collision_info,
+                                                &result);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) failed %s\n",
+                                 __location__, __func__, domain->name, nt_errstr(status)));
+                        TALLOC_FREE(frame);
+                        return WERR_INTERNAL_ERROR;
+                }
+                if (!NT_STATUS_IS_OK(result)) {
+                        DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) returned %s\n",
+                                 __location__, __func__, domain->name, nt_errstr(result)));
+                        TALLOC_FREE(frame);
+                        return ntstatus_to_werror(result);
+                }
+        }
+
+        status = netlogon_creds_cli_ServerGetTrustInfo(domain->conn.netlogon_creds,
+                                                       b, frame,
+                                                       &new_owf_password,
+                                                       &old_owf_password,
+                                                       &trust_info);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
+                status = NT_STATUS_NOT_SUPPORTED;
+        }
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
+                DEBUG(5, ("netlogon_creds_cli_ServerGetTrustInfo failed: %s\n",
+                        nt_errstr(status)));
+                verify_result = WERR_OK;
+                goto verify_return;
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                if (!retry && dcerpc_binding_handle_is_connected(b)) {
+                        invalidate_cm_connection(domain);
+                        retry = true;
+                        goto reconnect;
+                }
+                DEBUG(2, ("netlogon_creds_cli_ServerGetTrustInfo failed: %s\n",
+                        nt_errstr(status)));
+
+                if (!dcerpc_binding_handle_is_connected(b)) {
+                        check_result = ntstatus_to_werror(status);
+                        goto check_return;
+                } else {
+                        verify_result = ntstatus_to_werror(status);
+                        goto verify_return;
+                }
+        }
+
+        if (trust_info != NULL && trust_info->count >= 1) {
+                uint32_t diff = trust_info->data[0] ^ trust_attributes;
+
+                if (diff & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
+                        verify_result = WERR_DOMAIN_TRUST_INCONSISTENT;
+                        goto verify_return;
+                }
+        }
+
+        cmp_new = memcmp(new_owf_password.hash,
+                         cur_nt_hash->hash,
+                         sizeof(cur_nt_hash->hash));
+        cmp_old = memcmp(old_owf_password.hash,
+                         cur_nt_hash->hash,
+                         sizeof(cur_nt_hash->hash));
+        if (cmp_new != 0 && cmp_old != 0) {
+                DEBUG(1,("%s:Error: credentials for domain[%s/%s] doesn't match "
+                         "any password known to dcname[%s]\n",
+                         __func__, domain->name, domain->alt_name,
+                         domain->dcname));
+                verify_result = WERR_WRONG_PASSWORD;
+                goto verify_return;
+        }
+
+        if (cmp_new != 0) {
+                DEBUG(2,("%s:Warning: credentials for domain[%s/%s] only match "
+                         "against the old password known to dcname[%s]\n",
+                         __func__, domain->name, domain->alt_name,
+                         domain->dcname));
+        }
+
+        verify_result = WERR_OK;
+        goto verify_return;
+
+check_return:
+        verify_result = check_result;
+verify_return:
+        info2->flags |= NETLOGON_VERIFY_STATUS_RETURNED;
+        info2->pdc_connection_status = verify_result;
+        if (domain->dcname != NULL) {
+                info2->flags |= NETLOGON_HAS_IP;
+                info2->flags |= NETLOGON_HAS_TIMESERV;
+                info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
+                                                         domain->dcname);
+                if (info2->trusted_dc_name == NULL) {
+                        TALLOC_FREE(frame);
+                        return WERR_NOMEM;
+                }
+        } else {
+                info2->trusted_dc_name = talloc_strdup(info2, "");
+                if (info2->trusted_dc_name == NULL) {
+                        TALLOC_FREE(frame);
+                        return WERR_NOMEM;
+                }
+        }
+        info2->tc_connection_status = check_result;
+
+        if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
+                DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
+                          "pdc_connection[%s] tc_connection[%s]\n",
+                          __func__, domain->name, domain->alt_name,
+                          domain->dcname,
+                          win_errstr(info2->pdc_connection_status),
+                          win_errstr(info2->tc_connection_status)));
+        }
+
+        r->out.query->info2 = info2;
+
+        DEBUG(5, ("%s: succeeded.\n", __func__));
+        TALLOC_FREE(frame);
+        return WERR_OK;
+}
+
+static WERROR _winbind_LogonControl_CHANGE_PASSWORD(struct pipes_struct *p,
+                             struct winbindd_domain *domain,
+                             struct winbind_LogonControl *r)
+{
+        struct messaging_context *msg_ctx = winbind_messaging_context();
+        NTSTATUS status;
+        struct rpc_pipe_client *netlogon_pipe;
+        struct cli_credentials *creds = NULL;
+        struct samr_Password *cur_nt_hash = NULL;
+        struct netr_NETLOGON_INFO_1 *info1 = NULL;
+        struct dcerpc_binding_handle *b;
+        WERROR change_result = WERR_OK;
+        bool retry = false;
+
+        info1 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_1);
+        if (info1 == NULL) {
+                return WERR_NOMEM;
+        }
+
+        if (domain->internal) {
+                return WERR_NOT_SUPPORTED;
+        }
+
+        status = pdb_get_trust_credentials(domain->name,
+                                           domain->alt_name,
+                                           p->mem_ctx,
+                                           &creds);
+        if (NT_STATUS_IS_OK(status)) {
+                cur_nt_hash = cli_credentials_get_nt_hash(creds, p->mem_ctx);
+                TALLOC_FREE(creds);
+        }
+
+reconnect:
+        status = cm_connect_netlogon(domain, &netlogon_pipe);
+        reset_cm_connection_on_error(domain, status);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
+                status = NT_STATUS_NO_LOGON_SERVERS;
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(2, ("%s: domain[%s/%s] cm_connect_netlogon() returned %s\n",
+                          __func__, domain->name, domain->alt_name,
+                          nt_errstr(status)));
+                /*
+                 * Here we return a top level error!
+                 * This is different than TC_QUERY or TC_VERIFY.
+                 */
+                return ntstatus_to_werror(status);
+        }
+        b = netlogon_pipe->binding_handle;
+
+        if (cur_nt_hash == NULL) {
+                change_result = WERR_NO_TRUST_LSA_SECRET;
+                goto change_return;
+        }
+        TALLOC_FREE(cur_nt_hash);
+
+        status = trust_pw_change(domain->conn.netlogon_creds,
+                                 msg_ctx, b, domain->name,
+                                 true); /* force */
+        if (!NT_STATUS_IS_OK(status)) {
+                if (!retry && dcerpc_binding_handle_is_connected(b)) {
+                        invalidate_cm_connection(domain);
+                        retry = true;
+                        goto reconnect;
+                }
+
+                DEBUG(1, ("trust_pw_change(%s): %s\n",
+                          domain->name, nt_errstr(status)));
+
+                change_result = ntstatus_to_werror(status);
+                goto change_return;
+        }
+
+        change_result = WERR_OK;
+
+change_return:
+        info1->pdc_connection_status = change_result;
+
+        if (!W_ERROR_IS_OK(info1->pdc_connection_status)) {
+                DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
+                          "pdc_connection[%s]\n",
+                          __func__, domain->name, domain->alt_name,
+                          domain->dcname,
+                          win_errstr(info1->pdc_connection_status)));
+        }
+
+        r->out.query->info1 = info1;
+
+        DEBUG(5, ("%s: succeeded.\n", __func__));
+        return WERR_OK;
+}
+
+WERROR _winbind_LogonControl(struct pipes_struct *p,
+                             struct winbind_LogonControl *r)
+{
+        struct winbindd_domain *domain;
+
+        domain = wb_child_domain();
+        if (domain == NULL) {
+                return WERR_NO_SUCH_DOMAIN;
+        }
+
+        switch (r->in.function_code) {
+        case NETLOGON_CONTROL_REDISCOVER:
+                if (r->in.level != 2) {
+                        return WERR_INVALID_PARAMETER;
+                }
+                return _winbind_LogonControl_REDISCOVER(p, domain, r);
+        case NETLOGON_CONTROL_TC_QUERY:
+                if (r->in.level != 2) {
+                        return WERR_INVALID_PARAMETER;
+                }
+                return _winbind_LogonControl_TC_QUERY(p, domain, r);
+        case NETLOGON_CONTROL_TC_VERIFY:
+                if (r->in.level != 2) {
+                        return WERR_INVALID_PARAMETER;
+                }
+                return _winbind_LogonControl_TC_VERIFY(p, domain, r);
+        case NETLOGON_CONTROL_CHANGE_PASSWORD:
+                if (r->in.level != 1) {
+                        return WERR_INVALID_PARAMETER;
+                }
+                return _winbind_LogonControl_CHANGE_PASSWORD(p, domain, r);
+        default:
+                break;
+        }
+
+        DEBUG(4, ("%s: function_code[0x%x] not supported\n",
+                  __func__, r->in.function_code));
+        return WERR_NOT_SUPPORTED;
+}
+
+WERROR _winbind_GetForestTrustInformation(struct pipes_struct *p,
+                             struct winbind_GetForestTrustInformation *r)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        NTSTATUS status, result;
+        struct winbindd_domain *domain;
+        struct rpc_pipe_client *netlogon_pipe;
+        struct dcerpc_binding_handle *b;
+        bool retry = false;
+        struct lsa_String trusted_domain_name = {};
+        struct lsa_StringLarge trusted_domain_name_l = {};
+        union lsa_TrustedDomainInfo *tdi = NULL;
+        const struct lsa_TrustDomainInfoInfoEx *tdo = NULL;
+        struct lsa_ForestTrustInformation _old_fti = {};
+        struct lsa_ForestTrustInformation *old_fti = NULL;
+        struct lsa_ForestTrustInformation *new_fti = NULL;
+        struct lsa_ForestTrustInformation *merged_fti = NULL;
+        struct lsa_ForestTrustCollisionInfo *collision_info = NULL;
+        bool update_fti = false;
+        struct rpc_pipe_client *local_lsa_pipe;
+        struct policy_handle local_lsa_policy;
+        struct dcerpc_binding_handle *local_lsa = NULL;
+
+        domain = wb_child_domain();
+        if (domain == NULL) {
+                TALLOC_FREE(frame);
+                return WERR_NO_SUCH_DOMAIN;
+        }
+
+        /*
+         * checking for domain->internal and domain->primary
+         * makes sure we only do some work when running as DC.
+         */
+
+        if (domain->internal) {
+                TALLOC_FREE(frame);
+                return WERR_NO_SUCH_DOMAIN;
+        }
+
+        if (domain->primary) {
+                TALLOC_FREE(frame);
+                return WERR_NO_SUCH_DOMAIN;
+        }
+
+        trusted_domain_name.string = domain->name;
+        trusted_domain_name_l.string = domain->name;
+
+        status = open_internal_lsa_conn(frame, &local_lsa_pipe,
+                                        &local_lsa_policy);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("%s:%s: open_internal_lsa_conn() failed - %s\n",
+                         __location__, __func__, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return WERR_INTERNAL_ERROR;
+        }
+        local_lsa = local_lsa_pipe->binding_handle;
+
+        status = dcerpc_lsa_QueryTrustedDomainInfoByName(local_lsa, frame,
+                                                &local_lsa_policy,
+                                                &trusted_domain_name,
+                                                LSA_TRUSTED_DOMAIN_INFO_INFO_EX,
+                                                &tdi, &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) failed - %s\n",
+                         __location__, __func__, domain->name, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return WERR_INTERNAL_ERROR;
+        }
+        if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+                DEBUG(1,("%s:%s: domain[%s] not found via LSA, might be removed already.\n",
+                         __location__, __func__, domain->name));
+                TALLOC_FREE(frame);
+                return WERR_NO_SUCH_DOMAIN;
+        }
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) returned %s\n",
+                         __location__, __func__, domain->name, nt_errstr(result)));
+                TALLOC_FREE(frame);
+                return WERR_INTERNAL_ERROR;
+        }
+        if (tdi == NULL) {
+                DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName() "
+                         "returned no trusted domain information\n",
+                         __location__, __func__));
+                TALLOC_FREE(frame);
+                return WERR_INTERNAL_ERROR;
+        }
+
+        tdo = &tdi->info_ex;
+
+        if (!(tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)) {
+                DEBUG(2,("%s: tdo[%s/%s] is no forest trust attributes[0x%08X]\n",
+                         __func__, tdo->netbios_name.string,
+                         tdo->domain_name.string,
+                         (unsigned)tdo->trust_attributes));
+                TALLOC_FREE(frame);
+                return WERR_NO_SUCH_DOMAIN;
+        }
+
+        if (r->in.flags & ~DS_GFTI_UPDATE_TDO) {
+                TALLOC_FREE(frame);
+                return WERR_INVALID_FLAGS;
+        }
+
+reconnect:
+        status = cm_connect_netlogon(domain, &netlogon_pipe);
+        reset_cm_connection_on_error(domain, status);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
+                status = NT_STATUS_NO_LOGON_SERVERS;
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
+                          nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return ntstatus_to_werror(status);
+        }
+        b = netlogon_pipe->binding_handle;
+
+        status = netlogon_creds_cli_GetForestTrustInformation(domain->conn.netlogon_creds,
+                                                              b, p->mem_ctx,
+                                                              &new_fti);
+        if (!NT_STATUS_IS_OK(status)) {
+                if (!retry && dcerpc_binding_handle_is_connected(b)) {
+                        invalidate_cm_connection(domain);
+                        retry = true;
+                        goto reconnect;
+                }
+                DEBUG(2, ("netlogon_creds_cli_GetForestTrustInformation(%s) failed: %s\n",
+                          domain->name, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return ntstatus_to_werror(status);
+        }
+
+        *r->out.forest_trust_info = new_fti;
+
+        if (r->in.flags & DS_GFTI_UPDATE_TDO) {
+                update_fti = true;
+        }
+
+        status = dcerpc_lsa_lsaRQueryForestTrustInformation(local_lsa, frame,
+                                                &local_lsa_policy,
+                                                &trusted_domain_name,
+                                                LSA_FOREST_TRUST_DOMAIN_INFO,
+                                                &old_fti, &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) failed %s\n",
+                         __location__, __func__, domain->name, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return WERR_INTERNAL_ERROR;
+        }
+        if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_FOUND)) {
+                DEBUG(2,("%s: no forest trust information available for domain[%s] yet.\n",
+                          __func__, domain->name));
+                update_fti = true;
+                old_fti = &_old_fti;
+                result = NT_STATUS_OK;
+        }
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) returned %s\n",
+                         __location__, __func__, domain->name, nt_errstr(result)));
+                TALLOC_FREE(frame);
+                return WERR_INTERNAL_ERROR;
+        }
+
+        if (old_fti == NULL) {
+                DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation() "
+                         "returned success without returning forest trust information\n",
+                         __location__, __func__));
+                TALLOC_FREE(frame);
+                return WERR_INTERNAL_ERROR;
+        }
+
+        if (!update_fti) {
+                goto done;
+        }
+
+        status = dsdb_trust_merge_forest_info(frame, tdo, old_fti, new_fti,
+                                              &merged_fti);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("%s:%s: dsdb_trust_merge_forest_info(%s) failed %s\n",
+                         __location__, __func__, domain->name, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return ntstatus_to_werror(status);
+        }
+
+        status = dcerpc_lsa_lsaRSetForestTrustInformation(local_lsa, frame,
+                                                &local_lsa_policy,
+                                                &trusted_domain_name_l,
+                                                LSA_FOREST_TRUST_DOMAIN_INFO,
+                                                merged_fti,
+                                                0, /* check_only=0 => store it! */
+                                                &collision_info,
+                                                &result);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) failed %s\n",
+                         __location__, __func__, domain->name, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return WERR_INTERNAL_ERROR;
+        }
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) returned %s\n",
+                         __location__, __func__, domain->name, nt_errstr(result)));
+                TALLOC_FREE(frame);
+                return ntstatus_to_werror(result);
+        }
+
+done:
+        DEBUG(5, ("_winbind_GetForestTrustInformation succeeded\n"));
+        TALLOC_FREE(frame);
+        return WERR_OK;
+}

vendor/current/source3/winbindd/winbindd_getdcname.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_getdcname_state {

vendor/current/source3/winbindd/winbindd_getgrgid.c

@@ -125 +125 @@
         }
 
-        response->data.gr.num_gr_mem = (uint32)num_members;
+        response->data.gr.num_gr_mem = (uint32_t)num_members;
 
         /* Group membership lives at start of extra data */

vendor/current/source3/winbindd/winbindd_getgrnam.c

@@ -31 +31 @@
 };
 
-static void winbindd_getgrnam_lookupsid_done(struct tevent_req *subreq);
+static void winbindd_getgrnam_lookupname_done(struct tevent_req *subreq);
 static void winbindd_getgrnam_done(struct tevent_req *subreq);
 
@@ -82 +82 @@
                 return tevent_req_post(req, ev);
         }
-        tevent_req_set_callback(subreq, winbindd_getgrnam_lookupsid_done,
+        tevent_req_set_callback(subreq, winbindd_getgrnam_lookupname_done,
                                 req);
         return req;
 }
 
-static void winbindd_getgrnam_lookupsid_done(struct tevent_req *subreq)
+static void winbindd_getgrnam_lookupname_done(struct tevent_req *subreq)
 {
         struct tevent_req *req = tevent_req_callback_data(
@@ -102 +102 @@
         }
 
-        if ( (type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) ) {
-                DEBUG(5,("getgrnam_recv: not a group!\n"));
+        switch (type) {
+        case SID_NAME_DOM_GRP:
+        case SID_NAME_ALIAS:
+        case SID_NAME_WKN_GRP:
+        /*
+         * Also give user types a chance:
+         * These might be user sids mapped to the ID_TYPE_BOTH,
+         * and in that case we should construct a group struct.
+         */
+        case SID_NAME_USER:
+        case SID_NAME_COMPUTER:
+                break;
+        default:
                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
                 return;
@@ -160 +171 @@
         }
 
-        response->data.gr.num_gr_mem = (uint32)num_members;
+        response->data.gr.num_gr_mem = (uint32_t)num_members;
 
         /* Group membership lives at start of extra data */

vendor/current/source3/winbindd/winbindd_getgroups.c

@@ -30 +30 @@
         int num_sids;
         struct dom_sid *sids;
-        int next_sid;
         int num_gids;
         gid_t *gids;
@@ -125 +124 @@
         /*
          * Convert the group SIDs to gids. state->sids[0] contains the user
-         * sid, so start at index 1.
+         * sid. If the idmap backend uses ID_TYPE_BOTH, we might need the
+         * the id of the user sid in the list of group sids, so map the
+         * complete token.
          */
 
-        state->gids = talloc_array(state, gid_t, state->num_sids-1);
-        if (tevent_req_nomem(state->gids, req)) {
-                return;
-        }
-        state->num_gids = 0;
-        state->next_sid = 1;
-
-        subreq = wb_sid2gid_send(state, state->ev,
-                                 &state->sids[state->next_sid]);
+        subreq = wb_sids2xids_send(state, state->ev,
+                                   state->sids, state->num_sids);
         if (tevent_req_nomem(subreq, req)) {
                 return;
@@ -150 +144 @@
                 req, struct winbindd_getgroups_state);
         NTSTATUS status;
-
-        status = wb_sid2gid_recv(subreq, &state->gids[state->num_gids]);
+        struct unixid *xids;
+        int i;
+
+        xids = talloc_array(state, struct unixid, state->num_sids);
+        if (tevent_req_nomem(xids, req)) {
+                return;
+        }
+        for (i=0; i < state->num_sids; i++) {
+                xids[i].type = ID_TYPE_NOT_SPECIFIED;
+                xids[i].id = UINT32_MAX;
+        }
+
+        status = wb_sids2xids_recv(subreq, xids, state->num_sids);
         TALLOC_FREE(subreq);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) ||
+            NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED))
+        {
+                status = NT_STATUS_OK;
+        }
+        if (tevent_req_nterror(req, status)) {
+                return;
+        }
+
+        state->gids = talloc_array(state, gid_t, state->num_sids);
+        if (tevent_req_nomem(state->gids, req)) {
+                return;
+        }
+        state->num_gids = 0;
+
+        for (i=0; i < state->num_sids; i++) {
+                bool include_gid = false;
+                const char *debug_missing = NULL;
+
+                switch (xids[i].type) {
+                case ID_TYPE_NOT_SPECIFIED:
+                        debug_missing = "not specified";
+                        break;
+                case ID_TYPE_UID:
+                        if (i != 0) {
+                                debug_missing = "uid";
+                        }
+                        break;
+                case ID_TYPE_GID:
+                case ID_TYPE_BOTH:
+                        include_gid = true;
+                        break;
+                }
+
+                if (!include_gid) {
+                        if (debug_missing == NULL) {
+                                continue;
+                        }
+
+                        DEBUG(10, ("WARNING: skipping unix id (%u) for sid %s "
+                                   "from group list because the idmap type "
+                                   "is %s. "
+                                   "This might be a security problem when ACLs "
+                                   "contain DENY ACEs!\n",
+                                   (unsigned)xids[i].id,
+                                   sid_string_tos(&state->sids[i]),
+                                   debug_missing));
+                        continue;
+                }
+
+                state->gids[state->num_gids] = (gid_t)xids[i].id;
+                state->num_gids += 1;
+        }
 
         /*
-         * In case of failure, just continue with the next gid
+         * This should not fail, as it does not do any reallocation,
+         * just updating the talloc size.
          */
-        if (NT_STATUS_IS_OK(status)) {
-                state->num_gids += 1;
-        }
-        state->next_sid += 1;
-
-        if (state->next_sid >= state->num_sids) {
-                tevent_req_done(req);
-                return;
-        }
-
-        subreq = wb_sid2gid_send(state, state->ev,
-                                 &state->sids[state->next_sid]);
-        if (tevent_req_nomem(subreq, req)) {
-                return;
-        }
-        tevent_req_set_callback(subreq, winbindd_getgroups_sid2gid_done, req);
+        state->gids = talloc_realloc(state, state->gids, gid_t, state->num_gids);
+        if (tevent_req_nomem(state->gids, req)) {
+                return;
+        }
+
+        tevent_req_done(req);
 }
 

vendor/current/source3/winbindd/winbindd_group.c

@@ -69 +69 @@
         /* Group name and password */
 
-        safe_strcpy(gr->gr_name, full_group_name, sizeof(gr->gr_name) - 1);
-        safe_strcpy(gr->gr_passwd, "x", sizeof(gr->gr_passwd) - 1);
+        strlcpy(gr->gr_name, full_group_name, sizeof(gr->gr_name));
+        strlcpy(gr->gr_passwd, "x", sizeof(gr->gr_passwd));
 
         return True;

vendor/current/source3/winbindd/winbindd_list_groups.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_list_groups_domstate {

vendor/current/source3/winbindd/winbindd_list_users.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_list_users_domstate {

vendor/current/source3/winbindd/winbindd_lookuprids.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
 

vendor/current/source3/winbindd/winbindd_misc.c

@@ -23 +23 @@
 #include "includes.h"
 #include "winbindd.h"
+#include "libcli/security/dom_sid.h"
 
 #undef DBGC_CLASS
@@ -43 +44 @@
 static enum trust_type get_trust_type(struct winbindd_tdc_domain *domain)
 {
-        if (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN)   
+        if (domain->trust_attribs == LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN)
                 return EXTERNAL;
-        else if (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)
+        else if (domain->trust_attribs == LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)
                 return FOREST;
         else if (((domain->trust_flags & NETR_TRUST_FLAG_IN_FOREST) == NETR_TRUST_FLAG_IN_FOREST) &&
@@ -78 +79 @@
 static bool trust_is_transitive(struct winbindd_tdc_domain *domain)
 {
-        if ((domain->trust_attribs == NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE) ||         
-            (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) ||
-            (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL))
+        if ((domain->trust_attribs == LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE) ||
+            (domain->trust_attribs == LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) ||
+            (domain->trust_attribs == LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL))
                 return False;
         return True;
@@ -121 +122 @@
                         "%s\\%s\\%s\\%s\\%s\\%s\\%s\\%s\n",
                         d->domain_name,
-                        d->dns_name ? d->dns_name : d->domain_name,
+                        d->dns_name ? d->dns_name : "",
                         sid_string_talloc(state->mem_ctx, &d->sid),
                         get_trust_type_string(d),
@@ -172 +173 @@
 
         for (i=0; i<trusts.count; i++) {
+
+                if (trusts.array[i].sid == NULL) {
+                        continue;
+                }
+                if (dom_sid_equal(trusts.array[i].sid, &global_sid_NULL)) {
+                        continue;
+                }
+
                 extra_data = talloc_asprintf_append_buffer(
-                        extra_data, "%s\\%s\\%s\n",
-                        trusts.array[i].netbios_name,
-                        trusts.array[i].dns_name,
-                        sid_string_talloc(state->mem_ctx,
-                                          trusts.array[i].sid));
+                    extra_data, "%s\\%s\\%s\\%u\\%u\\%u\n",
+                    trusts.array[i].netbios_name, trusts.array[i].dns_name,
+                    sid_string_talloc(state->mem_ctx, trusts.array[i].sid),
+                    trusts.array[i].trust_flags,
+                    (uint32_t)trusts.array[i].trust_type,
+                    trusts.array[i].trust_attributes);
         }
 
@@ -192 +202 @@
                 extra_data = talloc_asprintf_append_buffer(
                         extra_data, "%s\\%s\\%s\n", domain->name,
-                        domain->alt_name ? domain->alt_name : domain->name,
+                        domain->alt_name != NULL ?
+                                domain->alt_name :
+                                domain->name,
                         sid_string_talloc(state->mem_ctx, &domain->sid));
         }
@@ -203 +215 @@
 
                 state->response->extra_data.data = extra_data;
-                state->response->length += extra_data_len+1;
+                state->response->length += extra_data_len;
         }
 
@@ -381 +393 @@
 void winbindd_interface_version(struct winbindd_cli_state *state)
 {
-        DEBUG(3, ("[%5lu]: request interface version\n",
-                  (unsigned long)state->pid));
+        DEBUG(3, ("[%5lu]: request interface version (version = %d)\n",
+                  (unsigned long)state->pid, WINBIND_INTERFACE_VERSION));
 
         state->response->data.interface_version = WINBIND_INTERFACE_VERSION;
@@ -405 +417 @@
                   (unsigned long)state->pid));
 
-        fstrcpy(state->response->data.netbios_name, global_myname());
+        fstrcpy(state->response->data.netbios_name, lp_netbios_name());
         request_ok(state);
 }

vendor/current/source3/winbindd/winbindd_msrpc.c

@@ -77 +77 @@
         }
 
-        status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+        status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -136 +136 @@
         }
 
-        status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+        status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -195 +195 @@
         }
 
-        status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+        status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -235 +235 @@
         enum lsa_SidType *types = NULL;
         char *full_name = NULL;
+        const char *names[1];
         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
         char *mapped_name = NULL;
@@ -255 +256 @@
                                                &mapped_name);
 
-        /* Reset the full_name pointer if we mapped anytthing */
+        /* Reset the full_name pointer if we mapped anything */
 
         if (NT_STATUS_IS_OK(name_map_status) ||
@@ -266 +267 @@
                  full_name?full_name:"", domain_name ));
 
+        names[0] = full_name;
+
         result = winbindd_lookup_names(mem_ctx, domain, 1,
-                                       (const char **)&full_name, NULL,
+                                       names, NULL,
                                        &sids, &types);
         if (!NT_STATUS_IS_OK(result))
@@ -335 +338 @@
                                     TALLOC_CTX *mem_ctx,
                                     const struct dom_sid *sid,
-                                    uint32 *rids,
+                                    uint32_t *rids,
                                     size_t num_rids,
                                     char **domain_name,
@@ -350 +353 @@
 
         if (num_rids) {
-                sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, num_rids);
+                sids = talloc_array(mem_ctx, struct dom_sid, num_rids);
                 if (sids == NULL) {
                         return NT_STATUS_NO_MEMORY;
@@ -440 +443 @@
                                                      user->base.full_name.string);
 
+                if (user_info->full_name == NULL) {
+                        /* this might fail so we don't check the return code */
+                        wcache_query_user_fullname(domain,
+                                                   mem_ctx,
+                                                   user_sid,
+                                                   &user_info->full_name);
+                }
+
                 status = NT_STATUS_OK;
                 goto done;
@@ -453 +464 @@
 
         /* no cache; hit the wire */
-        status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+        status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -513 +524 @@
 
         /* no cache; hit the wire */
-        status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+        status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -546 +557 @@
 static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
                                          TALLOC_CTX *mem_ctx,
-                                         uint32 num_sids, const struct dom_sid *sids,
-                                         uint32 *pnum_aliases,
-                                         uint32 **palias_rids)
+                                         uint32_t num_sids, const struct dom_sid *sids,
+                                         uint32_t *pnum_aliases,
+                                         uint32_t **palias_rids)
 {
         struct rpc_pipe_client *samr_pipe;
@@ -576 +587 @@
         }
 
-        status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+        status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -617 +628 @@
 {
         NTSTATUS status, result;
-        uint32 i, total_names = 0;
+        uint32_t i, total_names = 0;
         struct policy_handle dom_pol, group_pol;
-        uint32 des_access = SEC_FLAG_MAXIMUM_ALLOWED;
-        uint32 *rid_mem = NULL;
-        uint32 group_rid;
+        uint32_t des_access = SEC_FLAG_MAXIMUM_ALLOWED;
+        uint32_t *rid_mem = NULL;
+        uint32_t group_rid;
         unsigned int j, r;
         struct rpc_pipe_client *cli;
@@ -642 +653 @@
         *num_names = 0;
 
-        result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
+        result = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
         if (!NT_STATUS_IS_OK(result))
                 return result;
@@ -707 +718 @@
 #define MAX_LOOKUP_RIDS 900
 
-        *names = TALLOC_ZERO_ARRAY(mem_ctx, char *, *num_names);
-        *name_types = TALLOC_ZERO_ARRAY(mem_ctx, uint32, *num_names);
-        *sid_mem = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, *num_names);
+        *names = talloc_zero_array(mem_ctx, char *, *num_names);
+        *name_types = talloc_zero_array(mem_ctx, uint32_t, *num_names);
+        *sid_mem = talloc_zero_array(mem_ctx, struct dom_sid, *num_names);
 
         for (j=0;j<(*num_names);j++)
@@ -774 +785 @@
 #ifdef HAVE_LDAP
 
-#include <ldap.h>
-
-static int get_ldap_seq(const char *server, int port, uint32 *seq)
+#include "ads.h"
+
+static int get_ldap_seq(const char *server, struct sockaddr_storage *ss, int port, uint32_t *seq)
 {
         int ret = -1;
@@ -792 +803 @@
          */
 
-        ldp = ldap_open_with_timeout(server, port, lp_ldap_timeout());
+        ldp = ldap_open_with_timeout(server, ss, port, lp_ldap_timeout());
         if (ldp == NULL)
                 return -1;
@@ -801 +812 @@
 
         if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
-                           CONST_DISCARD(char **, attrs), 0, &to, &res))
+                           discard_const_p(char *, attrs), 0, &to, &res))
                 goto done;
 
@@ -830 +841 @@
 **********************************************************************/
 
-static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32 *seq)
+static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32_t *seq)
 {
         int ret = -1;
@@ -836 +847 @@
 
         print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
-        if ((ret = get_ldap_seq(addr, LDAP_PORT, seq)) == 0) {
+        if ((ret = get_ldap_seq(addr, &domain->dcaddr, LDAP_PORT, seq)) == 0) {
                 DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
                           "number for Domain (%s) from DC (%s)\n",
@@ -852 +863 @@
         struct rpc_pipe_client *samr_pipe;
         struct policy_handle dom_pol;
-        uint32_t seq;
+        uint32_t seq = DOM_SEQUENCE_NONE;
         TALLOC_CTX *tmp_ctx;
         NTSTATUS status;
@@ -904 +915 @@
 #endif /* HAVE_LDAP */
 
-        status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+        status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -993 +1004 @@
         }
 
-        status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
+        status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -1043 +1054 @@
         }
 
-        status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
+        status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
         if (!NT_STATUS_IS_OK(status)) {
                 goto done;
@@ -1131 +1142 @@
                  * a netlogon connection first.
                  */
-                invalidate_cm_connection(&domain->conn);
+                invalidate_cm_connection(domain);
                 domain->can_do_ncacn_ip_tcp = domain->active_directory;
                 if (!retried) {
@@ -1211 +1222 @@
                  * a netlogon connection first.
                  */
-                invalidate_cm_connection(&domain->conn);
+                invalidate_cm_connection(domain);
                 if (!retried) {
                         retried = true;

vendor/current/source3/winbindd/winbindd_ndr.c

@@ -22 +22 @@
 #include "../librpc/gen_ndr/ndr_netlogon.h"
 #include "../librpc/gen_ndr/ndr_security.h"
-#include "librpc/ndr/util.h"
+#include "../librpc/gen_ndr/ndr_lsa.h"
+#include "../librpc/ndr/libndr.h"
 
 #undef DBGC_CLASS
@@ -75 +76 @@
 #ifdef HAVE_ADS
 extern struct winbindd_methods ads_methods;
+extern struct winbindd_methods reconnect_ads_methods;
 #endif
 extern struct winbindd_methods msrpc_methods;
@@ -100 +102 @@
         } else if (r == &ads_methods) {
                 ndr_print_string(ndr, name, "ads_methods");
+        } else if (r == &reconnect_ads_methods) {
+                ndr_print_string(ndr, name, "reconnect_ads_methods");
 #endif
         } else if (r == &builtin_passdb_methods) {
@@ -134 +138 @@
         ndr_print_dom_sid(ndr, "sid", &r->sid);
         ndr_print_netr_TrustFlags(ndr, "domain_flags", r->domain_flags);
-        ndr_print_netr_TrustType(ndr, "domain_type", r->domain_type);
-        ndr_print_netr_TrustAttributes(ndr, "domain_trust_attribs", r->domain_trust_attribs);
+        ndr_print_lsa_TrustType(ndr, "domain_type", r->domain_type);
+        ndr_print_lsa_TrustAttributes(ndr, "domain_trust_attribs", r->domain_trust_attribs);
         ndr_print_bool(ndr, "initialized", r->initialized);
         ndr_print_bool(ndr, "native_mode", r->native_mode);

vendor/current/source3/winbindd/winbindd_pam.c

@@ -38 +38 @@
 #include "passdb/machine_sid.h"
 #include "auth.h"
+#include "../lib/tsocket/tsocket.h"
+#include "auth/kerberos/pac_utils.h"
+#include "auth/gensec/gensec.h"
+#include "librpc/crypto/gse_krb5.h"
+#include "lib/afs/afs_funcs.h"
 
 #undef DBGC_CLASS
@@ -52 +57 @@
 
         resp->data.auth.info3.logon_time =
-                nt_time_to_unix(info3->base.last_logon);
+                nt_time_to_unix(info3->base.logon_time);
         resp->data.auth.info3.logoff_time =
-                nt_time_to_unix(info3->base.last_logoff);
+                nt_time_to_unix(info3->base.logoff_time);
         resp->data.auth.info3.kickoff_time =
-                nt_time_to_unix(info3->base.acct_expiry);
+                nt_time_to_unix(info3->base.kickoff_time);
         resp->data.auth.info3.pass_last_set_time =
                 nt_time_to_unix(info3->base.last_password_change);
@@ -93 +98 @@
                 info3->base.logon_server.string);
         fstrcpy(resp->data.auth.info3.logon_dom,
-                info3->base.domain.string);
+                info3->base.logon_domain.string);
 
         ex = talloc_strdup(mem_ctx, "");
@@ -156 +161 @@
         const char *nt_username, *nt_domain;
 
-        nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
+        nt_domain = talloc_strdup(mem_ctx, info3->base.logon_domain.string);
         if (!nt_domain) {
                 /* If the server didn't give us one, just use the one
@@ -217 +222 @@
         }
 
-        strlower_m(afsname);
+        if (!strlower_m(afsname)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         DEBUG(10, ("Generating token for user %s\n", afsname));
@@ -271 +278 @@
         if (!group_sid || !group_sid[0]) {
                 /* NO sid supplied, all users may access */
+                TALLOC_FREE(frame);
                 return NT_STATUS_OK;
         }
@@ -386 +394 @@
                 p->password_properties;
         r->data.auth.policy.expire      =
-                nt_time_to_unix_abs((NTTIME *)&(p->max_password_age));
+                nt_time_to_unix_abs((const NTTIME *)&(p->max_password_age));
         r->data.auth.policy.min_passwordage =
-                nt_time_to_unix_abs((NTTIME *)&(p->min_password_age));
+                nt_time_to_unix_abs((const NTTIME *)&(p->min_password_age));
 }
 
@@ -422 +430 @@
 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
                                                          TALLOC_CTX *mem_ctx,
-                                                         uint16 *lockout_threshold)
+                                                         uint16_t *lockout_threshold)
 {
         struct winbindd_methods *methods;
@@ -444 +452 @@
 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
                                    TALLOC_CTX *mem_ctx,
-                                   uint32 *password_properties)
+                                   uint32_t *password_properties)
 {
         struct winbindd_methods *methods;
@@ -485 +493 @@
                         gen_cc = talloc_asprintf(
                                 mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
+                }
+                if (strequal(type, "KEYRING")) {
+                        gen_cc = talloc_asprintf(
+                                mem_ctx, "KEYRING:persistent:%d", uid);
+                }
+
+                if (strnequal(type, "FILE:/", 6) ||
+                    strnequal(type, "WRFILE:/", 8) ||
+                    strnequal(type, "DIR:/", 5)) {
+
+                        /* we allow only one "%u" substitution */
+
+                        char *p;
+
+                        p = strchr(type, '%');
+                        if (p != NULL) {
+
+                                p++;
+
+                                if (p != NULL && *p == 'u' && strchr(p, '%') == NULL) {
+                                        char uid_str[sizeof("18446744073709551615")];
+
+                                        snprintf(uid_str, sizeof(uid_str), "%u", uid);
+
+                                        gen_cc = talloc_string_sub2(mem_ctx,
+                                                        type,
+                                                        "%u",
+                                                        uid_str,
+                                                        /* remove_unsafe_characters */
+                                                        false,
+                                                        /* replace_once */
+                                                        true,
+                                                        /* allow_trailing_dollar */
+                                                        false);
+                                }
+                        }
                 }
         }
@@ -547 +591 @@
         const char *user_ccache_file;
         struct PAC_LOGON_INFO *logon_info = NULL;
+        struct PAC_DATA *pac_data = NULL;
+        struct PAC_DATA_CTR *pac_data_ctr = NULL;
+        const char *local_service;
+        int i;
+        struct netr_SamInfo3 *info3_copy = NULL;
 
         *info3 = NULL;
+
+        if (domain->alt_name == NULL) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         /* 1st step:
@@ -580 +633 @@
         parse_domain_user(user, name_domain, name_user);
 
-        realm = domain->alt_name;
-        strupper_m(realm);
+        realm = talloc_strdup(mem_ctx, domain->alt_name);
+        if (realm == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!strupper_m(realm)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         principal_s = talloc_asprintf(mem_ctx, "%s@%s", name_user, realm);
@@ -592 +651 @@
                 return NT_STATUS_NO_MEMORY;
         }
+
+        local_service = talloc_asprintf(mem_ctx, "%s$@%s",
+                                        lp_netbios_name(), lp_realm());
+        if (local_service == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
 
         /* if this is a user ccache, we need to act as the user to let the krb5
@@ -614 +680 @@
                                      WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
                                      NULL,
-                                     &logon_info);
+                                     local_service,
+                                     &pac_data_ctr);
         if (user_ccache_file != NULL) {
                 gain_root_privilege();
@@ -625 +692 @@
         }
 
-        *info3 = &logon_info->info3;
+        if (pac_data_ctr == NULL) {
+                goto failed;
+        }
+
+        pac_data = pac_data_ctr->pac_data;
+        if (pac_data == NULL) {
+                goto failed;
+        }
+
+        for (i=0; i < pac_data->num_buffers; i++) {
+
+                if (pac_data->buffers[i].type != PAC_TYPE_LOGON_INFO) {
+                        continue;
+                }
+
+                logon_info = pac_data->buffers[i].info->logon_info.info;
+                if (!logon_info) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                break;
+        }
+
+        if (logon_info == NULL) {
+                DEBUG(10,("Missing logon_info in ticket of %s\n",
+                        principal_s));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
                 principal_s));
+
+        result = create_info3_from_pac_logon_info(mem_ctx, logon_info, &info3_copy);
+        if (!NT_STATUS_IS_OK(result)) {
+                goto failed;
+        }
 
         /* if we had a user's ccache then return that string for the pam
@@ -665 +764 @@
 
         }
-
+        *info3 = info3_copy;
         return NT_STATUS_OK;
 
@@ -727 +826 @@
 ****************************************************************/
 
-static NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
-                                 struct winbindd_response *resp,
-                                 uint32_t request_flags,
-                                 struct netr_SamInfo3 *info3,
-                                 const char *name_domain,
-                                 const char *name_user)
+NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
+                          struct winbindd_response *resp,
+                          uint32_t request_flags,
+                          struct netr_SamInfo3 *info3,
+                          const char *name_domain,
+                          const char *name_user)
 {
         NTSTATUS result;
@@ -798 +897 @@
 {
         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
-        uint16 max_allowed_bad_attempts;
+        uint16_t max_allowed_bad_attempts;
         fstring name_domain, name_user;
         struct dom_sid sid;
         enum lsa_SidType type;
         uchar new_nt_pass[NT_HASH_LEN];
-        const uint8 *cached_nt_pass;
-        const uint8 *cached_salt;
+        const uint8_t *cached_nt_pass;
+        const uint8_t *cached_salt;
         struct netr_SamInfo3 *my_info3;
         time_t kickoff_time, must_change_time;
@@ -904 +1003 @@
                 }
 
-                kickoff_time = nt_time_to_unix(my_info3->base.acct_expiry);
+                kickoff_time = nt_time_to_unix(my_info3->base.kickoff_time);
                 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
                         return NT_STATUS_ACCOUNT_EXPIRED;
@@ -920 +1019 @@
                 if ((state->request->flags & WBFLAG_PAM_KRB5) &&
                     ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
-                    ((tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL) ||
+                    ((tdc_domain->trust_type & LSA_TRUST_TYPE_UPLEVEL) ||
                     /* used to cope with the case winbindd starting without network. */
                     !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
@@ -930 +1029 @@
                         const char *service = NULL;
                         const char *user_ccache_file;
+
+                        if (domain->alt_name == NULL) {
+                                return NT_STATUS_INVALID_PARAMETER;
+                        }
 
                         uid = get_uid_from_request(state->request);
@@ -945 +1048 @@
                         }
 
-                        realm = domain->alt_name;
-                        strupper_m(realm);
+                        realm = talloc_strdup(state->mem_ctx, domain->alt_name);
+                        if (realm == NULL) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        if (!strupper_m(realm)) {
+                                return NT_STATUS_INVALID_PARAMETER;
+                        }
 
                         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
@@ -968 +1077 @@
                                                             state->request->data.auth.user,
                                                             state->request->data.auth.pass,
-                                                            domain->alt_name,
+                                                            realm,
                                                             uid,
                                                             time(NULL),
@@ -987 +1096 @@
                  * offline?) see auth/auth_sam.c:sam_account_ok for details */
 
-                unix_to_nt_time(&my_info3->base.last_logon, time(NULL));
+                unix_to_nt_time(&my_info3->base.logon_time, time(NULL));
                 my_info3->base.bad_password_count = 0;
 
@@ -1026 +1135 @@
         if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
 
-                uint32 password_properties;
+                uint32_t password_properties;
 
                 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
@@ -1100 +1209 @@
 
         if (!contact_domain->initialized) {
-                init_dc_connection(contact_domain);
+                init_dc_connection(contact_domain, false);
         }
 
@@ -1120 +1229 @@
 
 static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
+                                          uint32_t logon_parameters,
                                           const char *domain, const char *user,
                                           const DATA_BLOB *challenge,
@@ -1126 +1236 @@
                                           struct netr_SamInfo3 **pinfo3)
 {
+        struct auth_context *auth_context;
+        struct auth_serversupplied_info *server_info;
         struct auth_usersupplied_info *user_info = NULL;
+        struct tsocket_address *local;
+        struct netr_SamInfo3 *info3;
         NTSTATUS status;
-
-        status = make_user_info(&user_info, user, user, domain, domain,
-                                global_myname(), lm_resp, nt_resp, NULL, NULL,
+        int rc;
+        TALLOC_CTX *frame = talloc_stackframe();
+
+        rc = tsocket_address_inet_from_strings(frame,
+                                               "ip",
+                                               "127.0.0.1",
+                                               0,
+                                               &local);
+        if (rc < 0) {
+                TALLOC_FREE(frame);
+                return NT_STATUS_NO_MEMORY;
+        }
+        status = make_user_info(frame, &user_info, user, user, domain, domain,
+                                lp_netbios_name(), local, lm_resp, nt_resp, NULL, NULL,
                                 NULL, AUTH_PASSWORD_RESPONSE);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
+                TALLOC_FREE(frame);
                 return status;
         }
+
+        user_info->logon_parameters = logon_parameters;
 
         /* We don't want any more mapping of the username */
         user_info->mapped_state = True;
 
-        status = check_sam_security_info3(challenge, talloc_tos(), user_info,
-                                          pinfo3);
-        free_user_info(&user_info);
+        /* We don't want to come back to winbindd or to do PAM account checks */
+        user_info->flags |= USER_INFO_LOCAL_SAM_ONLY | USER_INFO_INFO3_AND_NO_AUTHZ;
+
+        status = make_auth_context_fixed(frame, &auth_context, challenge->data);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Failed to test authentication with check_sam_security_info3: %s\n", nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        status = auth_check_ntlm_password(mem_ctx,
+                                          auth_context,
+                                          user_info,
+                                          &server_info);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
+        if (info3 == NULL) {
+                TALLOC_FREE(frame);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        status = serverinfo_to_SamInfo3(server_info, info3);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(frame);
+                TALLOC_FREE(info3);
+                DEBUG(0, ("serverinfo_to_SamInfo3 failed: %s\n",
+                          nt_errstr(status)));
+                return status;
+        }
+
+        *pinfo3 = info3;
         DEBUG(10, ("Authenticaticating user %s\\%s returned %s\n", domain,
                    user, nt_errstr(status)));
+        TALLOC_FREE(frame);
         return status;
 }
@@ -1151 +1314 @@
                                             TALLOC_CTX *mem_ctx,
                                             uint32_t logon_parameters,
-                                            const char *server,
                                             const char *username,
+                                            const char *password,
                                             const char *domainname,
                                             const char *workstation,
@@ -1158 +1321 @@
                                             DATA_BLOB lm_response,
                                             DATA_BLOB nt_response,
+                                            bool interactive,
                                             struct netr_SamInfo3 **info3)
 {
@@ -1167 +1331 @@
         do {
                 struct rpc_pipe_client *netlogon_pipe;
-                const struct pipe_auth_data *auth;
-                uint32_t neg_flags = 0;
+                uint8_t authoritative = 0;
+                uint32_t flags = 0;
 
                 ZERO_STRUCTP(info3);
@@ -1185 +1349 @@
                                           "particular call, forcing the close "
                                           "of this connection\n"));
-                                invalidate_cm_connection(&domain->conn);
+                                invalidate_cm_connection(domain);
                         }
 
@@ -1216 +1380 @@
                 }
                 netr_attempts = 0;
-
-                auth = netlogon_pipe->auth;
-                if (netlogon_pipe->dc) {
-                        neg_flags = netlogon_pipe->dc->negotiate_flags;
-                }
-
-                /* It is really important to try SamLogonEx here,
-                 * because in a clustered environment, we want to use
-                 * one machine account from multiple physical
-                 * computers.
-                 *
-                 * With a normal SamLogon call, we must keep the
-                 * credentials chain updated and intact between all
-                 * users of the machine account (which would imply
-                 * cross-node communication for every NTLM logon).
-                 *
-                 * (The credentials chain is not per NETLOGON pipe
-                 * connection, but globally on the server/client pair
-                 * by machine name).
-                 *
-                 * When using SamLogonEx, the credentials are not
-                 * supplied, but the session key is implied by the
-                 * wrapping SamLogon context.
-                 *
-                 *  -- abartlet 21 April 2008
-                 *
-                 * It's also important to use NetlogonValidationSamInfo4 (6),
-                 * because it relies on the rpc transport encryption
-                 * and avoids using the global netlogon schannel
-                 * session key to en/decrypt secret information
-                 * like the user_session_key for network logons.
-                 *
-                 * [MS-APDS] 3.1.5.2 NTLM Network Logon
-                 * says NETLOGON_NEG_CROSS_FOREST_TRUSTS and
-                 * NETLOGON_NEG_AUTHENTICATED_RPC set together
-                 * are the indication that the server supports
-                 * NetlogonValidationSamInfo4 (6). And it must only
-                 * be used if "SealSecureChannel" is used.
-                 *
-                 * -- metze 4 February 2011
-                 */
-
-                if (auth == NULL) {
-                        domain->can_do_validation6 = false;
-                } else if (auth->auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
-                        domain->can_do_validation6 = false;
-                } else if (auth->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
-                        domain->can_do_validation6 = false;
-                } else if (!(neg_flags & NETLOGON_NEG_CROSS_FOREST_TRUSTS)) {
-                        domain->can_do_validation6 = false;
-                } else if (!(neg_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
-                        domain->can_do_validation6 = false;
-                }
-
-                if (domain->can_do_samlogon_ex && domain->can_do_validation6) {
-                        result = rpccli_netlogon_sam_network_logon_ex(
-                                        netlogon_pipe,
-                                        mem_ctx,
-                                        logon_parameters,
-                                        server,         /* server name */
-                                        username,       /* user name */
-                                        domainname,     /* target domain */
-                                        workstation,    /* workstation */
-                                        chal,
-                                        6,
-                                        lm_response,
-                                        nt_response,
-                                        info3);
+                if (domain->conn.netlogon_creds == NULL) {
+                        DBG_NOTICE("No security credentials available for "
+                                  "domain [%s]\n", domainname);
+                        result = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+                } else if (interactive && username != NULL && password != NULL) {
+                        result = rpccli_netlogon_password_logon(domain->conn.netlogon_creds,
+                                                                netlogon_pipe->binding_handle,
+                                                                mem_ctx,
+                                                                logon_parameters,
+                                                                domainname,
+                                                                username,
+                                                                password,
+                                                                workstation,
+                                                                NetlogonInteractiveInformation,
+                                                                info3);
                 } else {
-                        result = rpccli_netlogon_sam_network_logon(
-                                        netlogon_pipe,
-                                        mem_ctx,
-                                        logon_parameters,
-                                        server,         /* server name */
-                                        username,       /* user name */
-                                        domainname,     /* target domain */
-                                        workstation,    /* workstation */
-                                        chal,
-                                        domain->can_do_validation6 ? 6 : 3,
-                                        lm_response,
-                                        nt_response,
-                                        info3);
-                }
-
-                if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
-
-                        /*
-                         * It's likely that the server also does not support
-                         * validation level 6
-                         */
-                        domain->can_do_validation6 = false;
-
-                        if (domain->can_do_samlogon_ex) {
-                                DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
-                                          "retrying with NetSamLogon\n"));
-                                domain->can_do_samlogon_ex = false;
-                                retry = true;
-                                continue;
-                        }
-
-
-                        /* Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
-                         * (no Ex). This happens against old Samba
-                         * DCs. Drop the connection.
-                         */
-                        invalidate_cm_connection(&domain->conn);
-                        result = NT_STATUS_LOGON_FAILURE;
-                        break;
-                }
-
-                if (domain->can_do_validation6 &&
-                    (NT_STATUS_EQUAL(result, NT_STATUS_INVALID_INFO_CLASS) ||
-                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_PARAMETER) ||
-                     NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL))) {
-                        DEBUG(3,("Got a DC that can not do validation level 6, "
-                                  "retrying with level 3\n"));
-                        domain->can_do_validation6 = false;
-                        retry = true;
-                        continue;
+                        result = rpccli_netlogon_network_logon(domain->conn.netlogon_creds,
+                                                        netlogon_pipe->binding_handle,
+                                                        mem_ctx,
+                                                        logon_parameters,
+                                                        username,
+                                                        domainname,
+                                                        workstation,
+                                                        chal,
+                                                        lm_response,
+                                                        nt_response,
+                                                        &authoritative,
+                                                        &flags,
+                                                        info3);
                 }
 
@@ -1358 +1432 @@
 
                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
-                        DEBUG(3,("winbind_samlogon_retry_loop: sam_logon returned "
-                                 "ACCESS_DENIED.  Maybe the trust account "
+                        DEBUG(1,("winbind_samlogon_retry_loop: sam_logon returned "
+                                 "ACCESS_DENIED.  Maybe the DC has Restrict "
+                                 "NTLM set or the trust account "
                                 "password was changed and we didn't know it. "
                                  "Killing connections to domain %s\n",
                                 domainname));
-                        invalidate_cm_connection(&domain->conn);
+                        invalidate_cm_connection(domain);
                         retry = true;
+                }
+
+                if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
+                        /*
+                         * Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
+                         * (no Ex). This happens against old Samba
+                         * DCs, if LogonSamLogonEx() fails with an error
+                         * e.g. NT_STATUS_NO_SUCH_USER or NT_STATUS_WRONG_PASSWORD.
+                         *
+                         * The server will log something like this:
+                         * api_net_sam_logon_ex: Failed to marshall NET_R_SAM_LOGON_EX.
+                         *
+                         * This sets the whole connection into a fault_state mode
+                         * and all following request get NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE.
+                         *
+                         * This also happens to our retry with LogonSamLogonWithFlags()
+                         * and LogonSamLogon().
+                         *
+                         * In order to recover from this situation, we need to
+                         * drop the connection.
+                         */
+                        invalidate_cm_connection(domain);
+                        result = NT_STATUS_LOGON_FAILURE;
+                        break;
                 }
 
@@ -1374 +1473 @@
                                 "Killing connections to domain %s\n",
                         domainname));
-                invalidate_cm_connection(&domain->conn);
+                invalidate_cm_connection(domain);
         }
         return result;
@@ -1417 +1516 @@
                 */
                 names_blob = NTLMv2_generate_names_blob(
-                        mem_ctx, global_myname(), lp_workgroup());
+                        mem_ctx, lp_netbios_name(), lp_workgroup());
 
                 if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain,
@@ -1442 +1541 @@
 
                 result = winbindd_dual_auth_passdb(
-                        mem_ctx, name_domain, name_user,
+                        mem_ctx, 0, name_domain, name_user,
                         &chal_blob, &lm_resp, &nt_resp, info3);
-                goto done;
+
+                /* 
+                 * We need to try the remote NETLOGON server if this is NOT_IMPLEMENTED 
+                 */
+                if (!NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
+                        goto done;
+                }
         }
 
@@ -1452 +1557 @@
                                              mem_ctx,
                                              0,
-                                             domain->dcname,
                                              name_user,
+                                             pass,
                                              name_domain,
-                                             global_myname(),
+                                             lp_netbios_name(),
                                              chal,
                                              lm_resp,
                                              nt_resp,
+                                             true, /* interactive */
                                              &my_info3);
         if (!NT_STATUS_IS_OK(result)) {
@@ -1475 +1581 @@
                 union samr_UserInfo *info = NULL;
                 NTSTATUS status_tmp, result_tmp;
-                uint32 acct_flags;
+                uint32_t acct_flags;
                 struct dcerpc_binding_handle *b;
 
-                status_tmp = cm_connect_sam(domain, mem_ctx,
+                status_tmp = cm_connect_sam(domain, mem_ctx, false,
                                             &samr_pipe, &samr_domain_handle);
 
@@ -1586 +1692 @@
                         *lp_winbind_separator(),
                         name_user );
-                safe_strcpy( state->request->data.auth.user, domain_user,
-                             sizeof(state->request->data.auth.user)-1 );
+                strlcpy( state->request->data.auth.user, domain_user,
+                             sizeof(state->request->data.auth.user));
         }
 
@@ -1601 +1707 @@
 
                         winbindd_flush_negative_conn_cache(domain);
-                        result = init_dc_connection(domain);
+                        result = init_dc_connection(domain, false);
                 }
         }
@@ -1724 +1830 @@
                             info3->base.rid);
 
+                if (info3->base.full_name.string == NULL) {
+                        struct netr_SamInfo3 *cached_info3;
+
+                        cached_info3 = netsamlogon_cache_get(state->mem_ctx,
+                                                             &user_sid);
+                        if (cached_info3 != NULL &&
+                            cached_info3->base.full_name.string != NULL) {
+                                info3->base.full_name.string =
+                                        talloc_strdup(info3,
+                                                      cached_info3->base.full_name.string);
+                        } else {
+
+                                /* this might fail so we don't check the return code */
+                                wcache_query_user_fullname(domain,
+                                                info3,
+                                                &user_sid,
+                                                &info3->base.full_name.string);
+                        }
+                }
+
                 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
                                            &user_sid);
@@ -1807 +1933 @@
 
         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
+}
+
+NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain,
+                               TALLOC_CTX *mem_ctx,
+                               uint32_t logon_parameters,
+                               const char *name_user,
+                               const char *name_domain,
+                               const char *workstation,
+                               const uint8_t chal[8],
+                               DATA_BLOB lm_response,
+                               DATA_BLOB nt_response,
+                               struct netr_SamInfo3 **info3)
+{
+        NTSTATUS result;
+
+        if (strequal(name_domain, get_global_sam_name())) {
+                DATA_BLOB chal_blob = data_blob_const(
+                        chal, 8);
+
+                result = winbindd_dual_auth_passdb(
+                        mem_ctx,
+                        logon_parameters,
+                        name_domain, name_user,
+                        &chal_blob, &lm_response, &nt_response, info3);
+
+                /* 
+                 * We need to try the remote NETLOGON server if this is NOT_IMPLEMENTED 
+                 */
+                if (!NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
+                        goto process_result;
+                }
+        }
+
+        result = winbind_samlogon_retry_loop(domain,
+                                             mem_ctx,
+                                             logon_parameters,
+                                             name_user,
+                                             NULL, /* password */
+                                             name_domain,
+                                             /* Bug #3248 - found by Stefan Burkei. */
+                                             workstation, /* We carefully set this above so use it... */
+                                             chal,
+                                             lm_response,
+                                             nt_response,
+                                             false, /* interactive */
+                                             info3);
+        if (!NT_STATUS_IS_OK(result)) {
+                goto done;
+        }
+
+process_result:
+
+        if (NT_STATUS_IS_OK(result)) {
+                struct dom_sid user_sid;
+
+                sid_compose(&user_sid, (*info3)->base.domain_sid,
+                            (*info3)->base.rid);
+
+                if ((*info3)->base.full_name.string == NULL) {
+                        struct netr_SamInfo3 *cached_info3;
+
+                        cached_info3 = netsamlogon_cache_get(mem_ctx,
+                                                             &user_sid);
+                        if (cached_info3 != NULL &&
+                            cached_info3->base.full_name.string != NULL) {
+                                (*info3)->base.full_name.string =
+                                        talloc_strdup(*info3,
+                                                      cached_info3->base.full_name.string);
+                        } else {
+
+                                /* this might fail so we don't check the return code */
+                                wcache_query_user_fullname(domain,
+                                                *info3,
+                                                &user_sid,
+                                                &(*info3)->base.full_name.string);
+                        }
+                }
+
+                wcache_invalidate_samlogon(find_domain_from_name(name_domain),
+                                           &user_sid);
+                netsamlogon_cache_store(name_user, *info3);
+        }
+
+done:
+
+        /* give us a more useful (more correct?) error code */
+        if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
+            (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
+                result = NT_STATUS_NO_LOGON_SERVERS;
+        }
+
+        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
+              ("NTLM CRAP authentication for user [%s]\\[%s] returned %s\n",
+               name_domain,
+               name_user,
+               nt_errstr(result)));
+
+        return result;
 }
 
@@ -1859 +2083 @@
         }
 
-        if (strequal(name_domain, get_global_sam_name())) {
-                DATA_BLOB chal_blob = data_blob_const(
-                        state->request->data.auth_crap.chal,
-                        sizeof(state->request->data.auth_crap.chal));
-
-                result = winbindd_dual_auth_passdb(
-                        state->mem_ctx, name_domain, name_user,
-                        &chal_blob, &lm_resp, &nt_resp, &info3);
-                goto process_result;
-        }
-
-        result = winbind_samlogon_retry_loop(domain,
-                                             state->mem_ctx,
-                                             state->request->data.auth_crap.logon_parameters,
-                                             domain->dcname,
-                                             name_user,
-                                             name_domain,
-                                             /* Bug #3248 - found by Stefan Burkei. */
-                                             workstation, /* We carefully set this above so use it... */
-                                             state->request->data.auth_crap.chal,
-                                             lm_resp,
-                                             nt_resp,
-                                             &info3);
+        result = winbind_dual_SamLogon(domain,
+                                       state->mem_ctx,
+                                       state->request->data.auth_crap.logon_parameters,
+                                       name_user,
+                                       name_domain,
+                                       /* Bug #3248 - found by Stefan Burkei. */
+                                       workstation, /* We carefully set this above so use it... */
+                                       state->request->data.auth_crap.chal,
+                                       lm_resp,
+                                       nt_resp,
+                                       &info3);
         if (!NT_STATUS_IS_OK(result)) {
                 goto done;
         }
 
-process_result:
-
         if (NT_STATUS_IS_OK(result)) {
-                struct dom_sid user_sid;
-
-                sid_compose(&user_sid, info3->base.domain_sid,
-                            info3->base.rid);
-                wcache_invalidate_samlogon(find_domain_from_name(name_domain),
-                                           &user_sid);
-                netsamlogon_cache_store(name_user, info3);
-
                 /* Check if the user is in the right group */
 
@@ -1920 +2122 @@
 done:
 
-        /* give us a more useful (more correct?) error code */
-        if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
-            (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
-                result = NT_STATUS_NO_LOGON_SERVERS;
-        }
-
         if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
                 result = nt_status_squash(result);
@@ -1931 +2127 @@
 
         set_auth_errors(state->response, result);
-
-        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
-              ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
-               name_domain,
-               name_user,
-               state->response->data.auth.nt_status_string,
-               state->response->data.auth.pam_error));
 
         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
@@ -1975 +2164 @@
         /* Get sam handle */
 
-        result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
+        result = cm_connect_sam(contact_domain, state->mem_ctx, true, &cli,
                                 &dom_pol);
         if (!NT_STATUS_IS_OK(result)) {
@@ -2214 +2403 @@
 
         if (!*domain && lp_winbind_use_default_domain()) {
-                fstrcpy(domain,(char *)lp_workgroup());
+                fstrcpy(domain,lp_workgroup());
         }
 
@@ -2242 +2431 @@
                         state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
         } else {
-                new_lm_password.length = 0;
-                old_lm_hash_enc.length = 0;
+                new_lm_password = data_blob_null;
+                old_lm_hash_enc = data_blob_null;
         }
 
         /* Get sam handle */
 
-        result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
+        result = cm_connect_sam(contact_domain, state->mem_ctx, true, &cli, &dom_pol);
         if (!NT_STATUS_IS_OK(result)) {
                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
@@ -2283 +2472 @@
         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
+
+#ifdef HAVE_KRB5
+static NTSTATUS extract_pac_vrfy_sigs(TALLOC_CTX *mem_ctx, DATA_BLOB pac_blob,
+                                      struct PAC_LOGON_INFO **logon_info)
+{
+        krb5_context krbctx = NULL;
+        krb5_error_code k5ret;
+        krb5_keytab keytab;
+        krb5_kt_cursor cursor;
+        krb5_keytab_entry entry;
+        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+
+        ZERO_STRUCT(entry);
+        ZERO_STRUCT(cursor);
+
+        k5ret = krb5_init_context(&krbctx);
+        if (k5ret) {
+                DEBUG(1, ("Failed to initialize kerberos context: %s\n",
+                          error_message(k5ret)));
+                status = krb5_to_nt_status(k5ret);
+                goto out;
+        }
+
+        k5ret =  gse_krb5_get_server_keytab(krbctx, &keytab);
+        if (k5ret) {
+                DEBUG(1, ("Failed to get keytab: %s\n",
+                          error_message(k5ret)));
+                status = krb5_to_nt_status(k5ret);
+                goto out_free;
+        }
+
+        k5ret = krb5_kt_start_seq_get(krbctx, keytab, &cursor);
+        if (k5ret) {
+                DEBUG(1, ("Failed to start seq: %s\n",
+                          error_message(k5ret)));
+                status = krb5_to_nt_status(k5ret);
+                goto out_keytab;
+        }
+
+        k5ret = krb5_kt_next_entry(krbctx, keytab, &entry, &cursor);
+        while (k5ret == 0) {
+                status = kerberos_pac_logon_info(mem_ctx, pac_blob,
+                                                 krbctx, NULL,
+                                                 KRB5_KT_KEY(&entry), NULL, 0,
+                                                 logon_info);
+                if (NT_STATUS_IS_OK(status)) {
+                        break;
+                }
+                k5ret = smb_krb5_kt_free_entry(krbctx, &entry);
+                k5ret = krb5_kt_next_entry(krbctx, keytab, &entry, &cursor);
+        }
+
+        k5ret = krb5_kt_end_seq_get(krbctx, keytab, &cursor);
+        if (k5ret) {
+                DEBUG(1, ("Failed to end seq: %s\n",
+                          error_message(k5ret)));
+        }
+out_keytab:
+        k5ret = krb5_kt_close(krbctx, keytab);
+        if (k5ret) {
+                DEBUG(1, ("Failed to close keytab: %s\n",
+                          error_message(k5ret)));
+        }
+out_free:
+        krb5_free_context(krbctx);
+out:
+        return status;
+}
+
+NTSTATUS winbindd_pam_auth_pac_send(struct winbindd_cli_state *state,
+                                    struct netr_SamInfo3 **info3)
+{
+        struct winbindd_request *req = state->request;
+        DATA_BLOB pac_blob;
+        struct PAC_LOGON_INFO *logon_info = NULL;
+        struct netr_SamInfo3 *info3_copy = NULL;
+        NTSTATUS result;
+
+        pac_blob = data_blob_const(req->extra_data.data, req->extra_len);
+        result = extract_pac_vrfy_sigs(state->mem_ctx, pac_blob, &logon_info);
+        if (!NT_STATUS_IS_OK(result) &&
+            !NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
+                DEBUG(1, ("Error during PAC signature verification: %s\n",
+                          nt_errstr(result)));
+                return result;
+        }
+
+        if (logon_info) {
+                /* Signature verification succeeded, trust the PAC */
+                result = create_info3_from_pac_logon_info(state->mem_ctx,
+                                                        logon_info,
+                                                        &info3_copy);
+                if (!NT_STATUS_IS_OK(result)) {
+                        return result;
+                }
+                netsamlogon_cache_store(NULL, info3_copy);
+
+        } else {
+                /* Try without signature verification */
+                result = kerberos_pac_logon_info(state->mem_ctx, pac_blob, NULL,
+                                                 NULL, NULL, NULL, 0,
+                                                 &logon_info);
+                if (!NT_STATUS_IS_OK(result)) {
+                        DEBUG(10, ("Could not extract PAC: %s\n",
+                                   nt_errstr(result)));
+                        return result;
+                }
+                if (logon_info) {
+                        /*
+                         * Don't strictly need to copy here,
+                         * but it makes it explicit we're
+                         * returning a copy talloc'ed off
+                         * the state->mem_ctx.
+                         */
+                        info3_copy = copy_netr_SamInfo3(state->mem_ctx,
+                                        &logon_info->info3);
+                        if (info3_copy == NULL) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                }
+        }
+
+        *info3 = info3_copy;
+
+        return NT_STATUS_OK;
+}
+#else /* HAVE_KRB5 */
+NTSTATUS winbindd_pam_auth_pac_send(struct winbindd_cli_state *state,
+                                    struct netr_SamInfo3 **info3)
+{
+        return NT_STATUS_NO_SUCH_USER;
+}
+#endif /* HAVE_KRB5 */

vendor/current/source3/winbindd/winbindd_pam_auth_crap.c

@@ -23 +23 @@
 struct winbindd_pam_auth_crap_state {
         struct winbindd_response *response;
+        struct netr_SamInfo3 *info3;
+        uint32_t flags;
 };
 
@@ -41 +43 @@
         if (req == NULL) {
                 return NULL;
+        }
+
+        if (request->flags & WBFLAG_PAM_AUTH_PAC) {
+                NTSTATUS status;
+
+                state->flags = request->flags;
+                status = winbindd_pam_auth_pac_send(cli, &state->info3);
+                if (NT_STATUS_IS_OK(status)) {
+                        /* Defer filling out response to recv */
+                        tevent_req_done(req);
+                } else {
+                        tevent_req_nterror(req, status);
+                }
+
+                return tevent_req_post(req, ev);
         }
 
@@ -75 +92 @@
 
         if (request->data.auth_crap.workstation[0] == '\0') {
-                fstrcpy(request->data.auth_crap.workstation, global_myname());
+                fstrcpy(request->data.auth_crap.workstation, lp_netbios_name());
         }
 
@@ -115 +132 @@
                 return status;
         }
+
+        if (state->flags & WBFLAG_PAM_AUTH_PAC) {
+                return append_auth_data(response, response, state->flags,
+                                        state->info3, NULL, NULL);
+        }
+
         *response = *state->response;
         response->result = WINBINDD_PENDING;

vendor/current/source3/winbindd/winbindd_pam_logoff.c

@@ -38 +38 @@
         fstring name_domain, user;
         uid_t caller_uid;
+        gid_t caller_gid;
         int res;
 
@@ -72 +73 @@
         caller_uid = (uid_t)-1;
 
-        res = sys_getpeereid(cli->sock, &caller_uid);
+        res = getpeereid(cli->sock, &caller_uid, &caller_gid);
         if (res != 0) {
                 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",

vendor/current/source3/winbindd/winbindd_ping_dc.c

@@ -20 +20 @@
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 
 struct winbindd_ping_dc_state {
-        uint8_t dummy;
+        const char *dcname;
+        NTSTATUS result;
 };
 
@@ -47 +48 @@
                 domain = find_our_domain();
         } else {
-                domain = find_domain_from_name(request->domain_name);
+                domain = find_domain_from_name_noinit(request->domain_name);
         }
         if (domain == NULL) {
@@ -54 +55 @@
         }
         if (domain->internal) {
+                const char *d = lp_dnsdomain();
+                const char *n = lp_netbios_name();
+
                 /*
                  * Internal domains are passdb based, we can always
                  * contact them.
                  */
+
+                if (d != NULL) {
+                        char *h;
+                        h = strlower_talloc(mem_ctx, n);
+                        if (tevent_req_nomem(h, req)) {
+                                return tevent_req_post(req, ev);
+                        }
+
+                        state->dcname = talloc_asprintf(state, "%s.%s", h, d);
+                        if (tevent_req_nomem(state->dcname, req)) {
+                                return tevent_req_post(req, ev);
+                        }
+                } else {
+                        state->dcname = talloc_strdup(state, n);
+                        if (tevent_req_nomem(state->dcname, req)) {
+                                return tevent_req_post(req, ev);
+                        }
+                }
+
                 tevent_req_done(req);
                 return tevent_req_post(req, ev);
         }
 
-        subreq = dcerpc_wbint_PingDc_send(state, ev, dom_child_handle(domain));
+        subreq = dcerpc_wbint_PingDc_send(state, ev, dom_child_handle(domain),
+                                          &state->dcname);
         if (tevent_req_nomem(subreq, req)) {
                 return tevent_req_post(req, ev);
@@ -79 +103 @@
 
         status = dcerpc_wbint_PingDc_recv(subreq, state, &result);
+        state->result = result;
         if (any_nt_status_not_ok(status, result, &status)) {
                 tevent_req_nterror(req, status);
@@ -89 +114 @@
                                struct winbindd_response *presp)
 {
+        struct winbindd_ping_dc_state *state = tevent_req_data(
+                req, struct winbindd_ping_dc_state);
+
+        if (!NT_STATUS_IS_OK(state->result)) {
+                set_auth_errors(presp, state->result);
+        }
+
+        if (state->dcname) {
+                presp->extra_data.data = talloc_strdup(presp, state->dcname);
+                presp->length += strlen((char *)presp->extra_data.data) + 1;
+        }
+
         return tevent_req_simple_recv_ntstatus(req);
 }

vendor/current/source3/winbindd/winbindd_proto.h

@@ -24 +24 @@
 #define _WINBINDD_PROTO_H_
 
+#include "ads.h"
+
 /* The following definitions come from winbindd/winbindd.c  */
 struct messaging_context *winbind_messaging_context(void);
+struct imessaging_context *winbind_imessaging_context(void);
 void request_error(struct winbindd_cli_state *state);
 void request_ok(struct winbindd_cli_state *state);
 bool winbindd_setup_sig_term_handler(bool parent);
+bool winbindd_setup_stdin_handler(bool parent, bool foreground);
 bool winbindd_setup_sig_hup_handler(const char *lfile);
 bool winbindd_use_idmap_cache(void);
 bool winbindd_use_cache(void);
-void winbindd_register_handlers(void);
-const char *get_winbind_pipe_dir(void);
 char *get_winbind_priv_pipe_dir(void);
-int main(int argc, char **argv, char **envp);
+struct tevent_context *winbind_event_context(void);
 
 /* The following definitions come from winbindd/winbindd_ads.c  */
@@ -56 +58 @@
 /* The following definitions come from winbindd/winbindd_cache.c  */
 
-struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status);
 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const struct dom_sid *sid);
 NTSTATUS wcache_get_creds(struct winbindd_domain *domain, 
                           TALLOC_CTX *mem_ctx, 
                           const struct dom_sid *sid,
-                          const uint8 **cached_nt_pass,
-                          const uint8 **cached_salt);
+                          const uint8_t **cached_nt_pass,
+                          const uint8_t **cached_salt);
 NTSTATUS wcache_save_creds(struct winbindd_domain *domain, 
                            const struct dom_sid *sid,
-                           const uint8 nt_pass[NT_HASH_LEN]);
+                           const uint8_t nt_pass[NT_HASH_LEN]);
 void wcache_invalidate_samlogon(struct winbindd_domain *domain, 
                                 const struct dom_sid *user_sid);
@@ -73 +74 @@
 bool initialize_winbindd_cache(void);
 void close_winbindd_cache(void);
-NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
-                            const struct dom_sid *sid,
-                            TALLOC_CTX *mem_ctx,
-                            char **domain_name,
-                            char **name,
-                            enum lsa_SidType *type);
 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
@@ -104 +99 @@
                            const struct dom_sid *user_sid,
                            struct wbint_userinfo *info);
+NTSTATUS wcache_query_user_fullname(struct winbindd_domain *domain,
+                                    TALLOC_CTX *mem_ctx,
+                                    const struct dom_sid *user_sid,
+                                    const char **full_name);
 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
                                    TALLOC_CTX *mem_ctx,
-                                   uint32 num_sids, const struct dom_sid *sids,
-                                   uint32 *pnum_aliases, uint32 **paliases);
+                                   uint32_t num_sids, const struct dom_sid *sids,
+                                   uint32_t *pnum_aliases, uint32_t **paliases);
 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
                                   TALLOC_CTX *mem_ctx,
@@ -164 +163 @@
 void set_domain_offline(struct winbindd_domain *domain);
 void set_domain_online_request(struct winbindd_domain *domain);
-void invalidate_cm_connection(struct winbindd_cm_conn *conn);
+
+struct ndr_interface_table;
+NTSTATUS wb_open_internal_pipe(TALLOC_CTX *mem_ctx,
+                               const struct ndr_interface_table *table,
+                               struct rpc_pipe_client **ret_pipe);
+void invalidate_cm_connection(struct winbindd_domain *domain);
 void close_conns_after_fork(void);
-NTSTATUS init_dc_connection(struct winbindd_domain *domain);
+NTSTATUS init_dc_connection(struct winbindd_domain *domain, bool need_rw_dc);
 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
+                        bool need_rw_dc,
                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle);
 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
                         struct rpc_pipe_client **cli, struct policy_handle *lsa_policy);
-NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
-                            TALLOC_CTX *mem_ctx,
-                            struct rpc_pipe_client **cli);
 NTSTATUS cm_connect_lsat(struct winbindd_domain *domain,
                          TALLOC_CTX *mem_ctx,
@@ -218 +220 @@
                             const struct dom_sid *sid,
                             struct netr_SamInfo3 **info3,
-                            const uint8 *cached_nt_pass[NT_HASH_LEN],
-                            const uint8 *cred_salt[NT_HASH_LEN]);
+                            const uint8_t *cached_nt_pass[NT_HASH_LEN],
+                            const uint8_t *cred_salt[NT_HASH_LEN]);
 NTSTATUS winbindd_store_creds(struct winbindd_domain *domain,
                               const char *user, 
@@ -327 +329 @@
 void init_idmap_child(void);
 struct winbindd_child *idmap_child(void);
-struct idmap_domain *idmap_find_domain(const char *domname);
+struct idmap_domain *idmap_find_domain_with_sid(const char *domname,
+                                                const struct dom_sid *sid);
+bool domain_has_idmap_config(const char *domname);
 
 /* The following definitions come from winbindd/winbindd_locator.c  */
@@ -367 +371 @@
 
 bool check_request_flags(uint32_t flags);
+NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
+                          struct winbindd_response *resp,
+                          uint32_t request_flags,
+                          struct netr_SamInfo3 *info3,
+                          const char *name_domain,
+                          const char *name_user);
 uid_t get_uid_from_request(struct winbindd_request *request);
 struct winbindd_domain *find_auth_domain(uint8_t flags,
@@ -379 +389 @@
                                               struct winbindd_cli_state *state) ;
 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state);
+NTSTATUS winbindd_pam_auth_pac_send(struct winbindd_cli_state *state,
+                                    struct netr_SamInfo3 **info3);
+
+NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain,
+                               TALLOC_CTX *mem_ctx,
+                               uint32_t logon_parameters,
+                               const char *name_user,
+                               const char *name_domain,
+                               const char *workstation,
+                               const uint8_t chal[8],
+                               DATA_BLOB lm_response,
+                               DATA_BLOB nt_response,
+                               struct netr_SamInfo3 **info3);
 
 /* The following definitions come from winbindd/winbindd_util.c  */
 
 struct winbindd_domain *domain_list(void);
+struct winbindd_domain *wb_next_domain(struct winbindd_domain *domain);
 bool domain_is_forest_root(const struct winbindd_domain *domain);
 void rescan_trusted_domains(struct tevent_context *ev, struct tevent_timer *te,
@@ -408 +432 @@
                                   bool can_assume);
 struct winbindd_cli_state *winbindd_client_list(void);
+struct winbindd_cli_state *winbindd_client_list_tail(void);
+struct winbindd_cli_state *
+winbindd_client_list_prev(struct winbindd_cli_state *cli);
 void winbindd_add_client(struct winbindd_cli_state *cli);
 void winbindd_remove_client(struct winbindd_cli_state *cli);
+void winbindd_promote_client(struct winbindd_cli_state *cli);
 int winbindd_num_clients(void);
 NTSTATUS lookup_usergroups_cached(struct winbindd_domain *domain,
                                   TALLOC_CTX *mem_ctx,
                                   const struct dom_sid *user_sid,
-                                  uint32 *p_num_groups, struct dom_sid **user_sids);
+                                  uint32_t *p_num_groups, struct dom_sid **user_sids);
 
 NTSTATUS normalize_name_map(TALLOC_CTX *mem_ctx,
@@ -445 +473 @@
 /* The following definitions come from winbindd/winbindd_wins.c  */
 
-void winbindd_wins_byip(struct winbindd_cli_state *state);
 void winbindd_wins_byname(struct winbindd_cli_state *state);
 
@@ -498 +525 @@
                                   struct winbindd_response *response);
 
-struct tevent_req *wb_sid2uid_send(TALLOC_CTX *mem_ctx,
-                                   struct tevent_context *ev,
-                                   const struct dom_sid *sid);
-NTSTATUS wb_sid2uid_recv(struct tevent_req *req, uid_t *uid);
-
 struct tevent_req *winbindd_sid_to_uid_send(TALLOC_CTX *mem_ctx,
                                             struct tevent_context *ev,
@@ -509 +531 @@
 NTSTATUS winbindd_sid_to_uid_recv(struct tevent_req *req,
                                   struct winbindd_response *response);
-
-struct tevent_req *wb_sid2gid_send(TALLOC_CTX *mem_ctx,
-                                   struct tevent_context *ev,
-                                   const struct dom_sid *sid);
-NTSTATUS wb_sid2gid_recv(struct tevent_req *req, gid_t *gid);
 
 struct tevent_req *winbindd_sid_to_gid_send(TALLOC_CTX *mem_ctx,
@@ -655 +672 @@
 NTSTATUS wb_group_members_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
                                struct talloc_dict **members);
+NTSTATUS add_wbint_Principal_to_dict(TALLOC_CTX *mem_ctx,
+                                     struct dom_sid *sid,
+                                     const char **name,
+                                     enum lsa_SidType type,
+                                     struct talloc_dict *dict);
 
 struct tevent_req *wb_getgrsid_send(TALLOC_CTX *mem_ctx,
@@ -698 +720 @@
                                  int *num_users,
                                  struct wbint_userinfo **users);
+
+struct tevent_req *wb_query_group_list_send(TALLOC_CTX *mem_ctx,
+                                            struct tevent_context *ev,
+                                            struct winbindd_domain *domain);
+NTSTATUS wb_query_group_list_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
+                                  int *num_users,
+                                  struct wbint_Principal **groups);
+
 
 struct tevent_req *wb_fill_pwent_send(TALLOC_CTX *mem_ctx,
@@ -864 +894 @@
                             struct lsa_TransNameArray **names);
 
+struct tevent_req *wb_sids2xids_send(TALLOC_CTX *mem_ctx,
+                                     struct tevent_context *ev,
+                                     const struct dom_sid *sids,
+                                     const uint32_t num_sids);
+NTSTATUS wb_sids2xids_recv(struct tevent_req *req,
+                           struct unixid xids[], uint32_t num_xids);
 struct tevent_req *winbindd_sids_to_xids_send(TALLOC_CTX *mem_ctx,
                                               struct tevent_context *ev,
@@ -870 +906 @@
 NTSTATUS winbindd_sids_to_xids_recv(struct tevent_req *req,
                                     struct winbindd_response *response);
+struct tevent_req *winbindd_wins_byip_send(TALLOC_CTX *mem_ctx,
+                                           struct tevent_context *ev,
+                                           struct winbindd_cli_state *cli,
+                                           struct winbindd_request *request);
+NTSTATUS winbindd_wins_byip_recv(struct tevent_req *req,
+                                 struct winbindd_response *presp);
+struct tevent_req *winbindd_wins_byname_send(TALLOC_CTX *mem_ctx,
+                                             struct tevent_context *ev,
+                                             struct winbindd_cli_state *cli,
+                                             struct winbindd_request *request);
+NTSTATUS winbindd_wins_byname_recv(struct tevent_req *req,
+                                   struct winbindd_response *presp);
 
 
@@ -878 +926 @@
                                  struct rpc_pipe_client **samr_pipe,
                                  struct policy_handle *samr_domain_hnd);
+NTSTATUS open_internal_lsa_conn(TALLOC_CTX *mem_ctx,
+                                struct rpc_pipe_client **lsa_pipe,
+                                struct policy_handle *lsa_hnd);
+
+/* The following definitions come from winbindd/winbindd_ads.c  */
+ADS_STATUS ads_idmap_cached_connection(ADS_STRUCT **adsp, const char *dom_name);
+
+/* The following definitions come from winbindd/winbindd_irpc.c  */
+NTSTATUS wb_irpc_register(void);
+
+/* The following definitions come from winbindd/winbindd_reconnect.c  */
+bool reconnect_need_retry(NTSTATUS status, struct winbindd_domain *domain);
 
 #endif /*  _WINBINDD_PROTO_H_  */

vendor/current/source3/winbindd/winbindd_reconnect.c

@@ -28 +28 @@
 extern struct winbindd_methods msrpc_methods;
 
-static bool reconnect_need_retry(NTSTATUS status)
+bool reconnect_need_retry(NTSTATUS status, struct winbindd_domain *domain)
 {
         if (NT_STATUS_IS_OK(status)) {
@@ -68 +68 @@
         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY)) {
                 return false;
+        }
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR)) {
+                /*
+                 * RPC call sent on expired session, needs
+                 * reauthentication.
+                 */
+                invalidate_cm_connection(domain);
         }
 
@@ -76 +84 @@
 static NTSTATUS query_user_list(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries, 
+                                uint32_t *num_entries,
                                 struct wbint_userinfo **info)
 {
@@ -84 +92 @@
                                                num_entries, info);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.query_user_list(domain, mem_ctx,
                                                        num_entries, info);
@@ -93 +101 @@
 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries, 
+                                uint32_t *num_entries,
                                 struct wb_acct_info **info)
 {
@@ -101 +109 @@
                                                num_entries, info);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.enum_dom_groups(domain, mem_ctx,
                                                        num_entries, info);
@@ -111 +119 @@
 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
                                   TALLOC_CTX *mem_ctx,
-                                  uint32 *num_entries, 
+                                  uint32_t *num_entries,
                                   struct wb_acct_info **info)
 {
@@ -119 +127 @@
                                                  num_entries, info);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.enum_local_groups(domain, mem_ctx,
                                                          num_entries, info);
@@ -140 +148 @@
                                            flags, sid, type);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.name_to_sid(domain, mem_ctx,
                                                    domain_name, name, flags,
@@ -163 +171 @@
                                            domain_name, name, type);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.sid_to_name(domain, mem_ctx, sid,
                                                    domain_name, name, type);
@@ -173 +181 @@
                               TALLOC_CTX *mem_ctx,
                               const struct dom_sid *sid,
-                              uint32 *rids,
+                              uint32_t *rids,
                               size_t num_rids,
                               char **domain_name,
@@ -184 +192 @@
                                              rids, num_rids,
                                              domain_name, names, types);
-        if (reconnect_need_retry(result)) {
+        if (reconnect_need_retry(result, domain)) {
                 result = msrpc_methods.rids_to_names(domain, mem_ctx, sid,
                                                      rids, num_rids,
@@ -205 +213 @@
                                           user_info);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.query_user(domain, mem_ctx, user_sid,
                                                   user_info);
@@ -216 +224 @@
                                   TALLOC_CTX *mem_ctx,
                                   const struct dom_sid *user_sid,
-                                  uint32 *num_groups, struct dom_sid **user_gids)
+                                  uint32_t *num_groups, struct dom_sid **user_gids)
 {
         NTSTATUS result;
@@ -224 +232 @@
                                                  user_gids);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.lookup_usergroups(domain, mem_ctx,
                                                          user_sid, num_groups,
@@ -234 +242 @@
 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
                                    TALLOC_CTX *mem_ctx,
-                                   uint32 num_sids, const struct dom_sid *sids,
-                                   uint32 *num_aliases, uint32 **alias_rids)
+                                   uint32_t num_sids, const struct dom_sid *sids,
+                                   uint32_t *num_aliases, uint32_t **alias_rids)
 {
         NTSTATUS result;
@@ -244 +252 @@
                                                   alias_rids);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.lookup_useraliases(domain, mem_ctx,
                                                           num_sids, sids,
@@ -258 +266 @@
                                 const struct dom_sid *group_sid,
                                 enum lsa_SidType type,
-                                uint32 *num_names,
+                                uint32_t *num_names,
                                 struct dom_sid **sid_mem, char ***names,
-                                uint32 **name_types)
+                                uint32_t **name_types)
 {
         NTSTATUS result;
@@ -269 +277 @@
                                                name_types);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.lookup_groupmem(domain, mem_ctx,
                                                        group_sid, type,
@@ -280 +288 @@
 
 /* find the sequence number for a domain */
-static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
+static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32_t *seq)
 {
         NTSTATUS result;
@@ -286 +294 @@
         result = msrpc_methods.sequence_number(domain, seq);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.sequence_number(domain, seq);
 
@@ -301 +309 @@
         result = msrpc_methods.lockout_policy(domain, mem_ctx, policy);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.lockout_policy(domain, mem_ctx, policy);
 
@@ -316 +324 @@
         result = msrpc_methods.password_policy(domain, mem_ctx, policy);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.password_policy(domain, mem_ctx, policy);
         
@@ -331 +339 @@
         result = msrpc_methods.trusted_domains(domain, mem_ctx, trusts);
 
-        if (reconnect_need_retry(result))
+        if (reconnect_need_retry(result, domain))
                 result = msrpc_methods.trusted_domains(domain, mem_ctx,
                                                        trusts);

vendor/current/source3/winbindd/winbindd_rpc.c

@@ -90 +90 @@
                 num_info += num_dom_users;
 
-                info = TALLOC_REALLOC_ARRAY(mem_ctx,
+                info = talloc_realloc(mem_ctx,
                                             info,
                                             struct wbint_userinfo,
@@ -121 +121 @@
                         dst->homedir = NULL;
                         dst->shell = NULL;
-
+                        dst->primary_gid = (gid_t)-1;
                         sid_compose(&dst->user_sid, domain_sid, rid);
 
@@ -182 +182 @@
                 }
 
-                info = TALLOC_REALLOC_ARRAY(mem_ctx,
+                info = talloc_realloc(mem_ctx,
                                             info,
                                             struct wb_acct_info,
@@ -191 +191 @@
 
                 for (g = 0; g < count; g++) {
-                        fstrcpy(info[num_info + g].acct_name,
+                        struct wb_acct_info *i = &info[num_info + g];
+
+                        fstrcpy(i->acct_name,
                                 sam_array->entries[g].name.string);
-
-                        info[num_info + g].rid = sam_array->entries[g].idx;
+                        fstrcpy(i->acct_desc, "");
+                        i->rid = sam_array->entries[g].idx;
                 }
 
@@ -242 +244 @@
                 }
 
-                info = TALLOC_REALLOC_ARRAY(mem_ctx,
+                info = talloc_realloc(mem_ctx,
                                             info,
                                             struct wb_acct_info,
@@ -251 +253 @@
 
                 for (g = 0; g < count; g++) {
-                        fstrcpy(info[num_info + g].acct_name,
+                        struct wb_acct_info *i = &info[num_info + g];
+
+                        fstrcpy(i->acct_name,
                                 sam_array->entries[g].name.string);
-                        info[num_info + g].rid = sam_array->entries[g].idx;
+                        fstrcpy(i->acct_desc, "");
+                        i->rid = sam_array->entries[g].idx;
                 }
 
@@ -278 +283 @@
         struct dom_sid *sids = NULL;
         char *full_name = NULL;
+        const char *names[1];
         char *mapped_name = NULL;
         NTSTATUS status;
@@ -302 +308 @@
         DEBUG(3,("name_to_sid: %s for domain %s\n",
                  full_name ? full_name : "", domain_name ));
+
+        names[0] = full_name;
 
         /*
@@ -311 +319 @@
                                          lsa_policy,
                                          1, /* num_names */
-                                         (const char **) &full_name,
+                                         names,
                                          NULL, /* domains */
                                          1, /* level */
@@ -363 +371 @@
         map_status = normalize_name_map(mem_ctx,
                                         domain,
-                                        *pname,
+                                        names[0],
                                         &mapped_name);
         if (NT_STATUS_IS_OK(map_status) ||
@@ -372 +380 @@
                 *pname = talloc_strdup(mem_ctx, names[0]);
         }
-        if (*pname == NULL) {
+        if ((names[0] != NULL) && (*pname == NULL)) {
                 return NT_STATUS_NO_MEMORY;
         }
@@ -405 +413 @@
 
         if (num_rids > 0) {
-                sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, num_rids);
+                sids = talloc_array(mem_ctx, struct dom_sid, num_rids);
                 if (sids == NULL) {
                         return NT_STATUS_NO_MEMORY;
@@ -527 +535 @@
                                         info->info21.full_name.string);
         if ((info->info21.full_name.string != NULL) &&
-            (user_info->acct_name == NULL))
+            (user_info->full_name == NULL))
         {
                 return NT_STATUS_NO_MEMORY;
@@ -581 +589 @@
                                               &rid_array,
                                               &result);
-        num_groups = rid_array->count;
-
         {
                 NTSTATUS _result;
@@ -591 +597 @@
                 return status;
         }
-        if (!NT_STATUS_IS_OK(result) || num_groups == 0) {
+        if (!NT_STATUS_IS_OK(result)) {
                 return result;
         }
 
-        user_grpsids = TALLOC_ARRAY(mem_ctx, struct dom_sid, num_groups);
+        num_groups = rid_array->count;
+
+        user_grpsids = talloc_array(mem_ctx, struct dom_sid, num_groups);
         if (user_grpsids == NULL) {
                 status = NT_STATUS_NO_MEMORY;
@@ -645 +653 @@
 
                 if (num_query_sids) {
-                        sid_array.sids = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_SidPtr, num_query_sids);
+                        sid_array.sids = talloc_zero_array(mem_ctx, struct lsa_SidPtr, num_query_sids);
                         if (sid_array.sids == NULL) {
                                 return NT_STATUS_NO_MEMORY;
@@ -840 +848 @@
          */
         if (num_names > 0) {
-                names = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_names);
-                name_types = TALLOC_ZERO_ARRAY(mem_ctx, uint32_t, num_names);
-                sid_mem = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, num_names);
+                names = talloc_zero_array(mem_ctx, char *, num_names);
+                name_types = talloc_zero_array(mem_ctx, uint32_t, num_names);
+                sid_mem = talloc_zero_array(mem_ctx, struct dom_sid, num_names);
                 if (names == NULL || name_types == NULL || sid_mem == NULL) {
                         return NT_STATUS_NO_MEMORY;
@@ -979 +987 @@
         do {
                 struct lsa_DomainList dom_list;
-                uint32_t start_idx;
+                struct lsa_DomainListEx dom_list_ex;
+                bool has_ex = false;
                 uint32_t i;
 
@@ -986 +995 @@
                  * called in the main function.
                  */
-                status = dcerpc_lsa_EnumTrustDom(b,
-                                                 mem_ctx,
-                                                 lsa_policy,
-                                                 &enum_ctx,
-                                                 &dom_list,
-                                                 (uint32_t) -1,
-                                                 &result);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return status;
-                }
-                if (!NT_STATUS_IS_OK(result)) {
-                        if (!NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
-                                return result;
+                status = dcerpc_lsa_EnumTrustedDomainsEx(b,
+                                                         mem_ctx,
+                                                         lsa_policy,
+                                                         &enum_ctx,
+                                                         &dom_list_ex,
+                                                         (uint32_t) -1,
+                                                         &result);
+                if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_ERR(result) &&
+                    dom_list_ex.count > 0) {
+                        count += dom_list_ex.count;
+                        has_ex = true;
+                } else {
+                        status = dcerpc_lsa_EnumTrustDom(b,
+                                                         mem_ctx,
+                                                         lsa_policy,
+                                                         &enum_ctx,
+                                                         &dom_list,
+                                                         (uint32_t) -1,
+                                                         &result);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
                         }
-                }
-
-                start_idx = count;
-                count += dom_list.count;
+                        if (!NT_STATUS_IS_OK(result)) {
+                                if (!NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
+                                        return result;
+                                }
+                        }
+
+                        count += dom_list.count;
+                }
 
                 array = talloc_realloc(mem_ctx,
@@ -1013 +1034 @@
                 }
 
-                for (i = 0; i < dom_list.count; i++) {
+                for (i = 0; i < count; i++) {
                         struct netr_DomainTrust *trust = &array[i];
                         struct dom_sid *sid;
 
                         ZERO_STRUCTP(trust);
-
-                        trust->netbios_name = talloc_move(array,
-                                                          &dom_list.domains[i].name.string);
-                        trust->dns_name = NULL;
 
                         sid = talloc(array, struct dom_sid);
@@ -1027 +1044 @@
                                 return NT_STATUS_NO_MEMORY;
                         }
-                        sid_copy(sid, dom_list.domains[i].sid);
+
+                        if (has_ex) {
+                                trust->netbios_name = talloc_move(array,
+                                                                  &dom_list_ex.domains[i].netbios_name.string);
+                                trust->dns_name = talloc_move(array,
+                                                              &dom_list_ex.domains[i].domain_name.string);
+                                if (dom_list_ex.domains[i].sid == NULL) {
+                                        DEBUG(0, ("Trusted Domain %s has no SID, aborting!\n", trust->dns_name));
+                                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                                }
+                                sid_copy(sid, dom_list_ex.domains[i].sid);
+                        } else {
+                                trust->netbios_name = talloc_move(array,
+                                                                  &dom_list.domains[i].name.string);
+                                trust->dns_name = NULL;
+
+                                if (dom_list.domains[i].sid == NULL) {
+                                        DEBUG(0, ("Trusted Domain %s has no SID, aborting!\n", trust->netbios_name));
+                                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                                }
+
+                                sid_copy(sid, dom_list.domains[i].sid);
+                        }
+
                         trust->sid = sid;
                 }
@@ -1047 +1087 @@
         struct lsa_TransNameArray2 lsa_names2;
         struct lsa_TransNameArray *names = *pnames;
-        uint32_t i, count;
+        uint32_t i, count = 0;
         NTSTATUS status, result;
 

vendor/current/source3/winbindd/winbindd_samr.c

@@ -40 +40 @@
 #define DBGC_CLASS DBGC_WINBIND
 
-static NTSTATUS open_internal_samr_pipe(TALLOC_CTX *mem_ctx,
-                                        struct rpc_pipe_client **samr_pipe)
-{
-        struct rpc_pipe_client *cli = NULL;
-        struct auth_serversupplied_info *session_info = NULL;
-        NTSTATUS status;
-
-        if (session_info == NULL) {
-                status = make_session_info_system(mem_ctx, &session_info);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(0, ("open_samr_pipe: Could not create auth_serversupplied_info: %s\n",
-                                  nt_errstr(status)));
-                        return status;
-                }
-        }
-
-        /* create a samr connection */
-        status = rpc_pipe_open_interface(mem_ctx,
-                                        &ndr_table_samr.syntax_id,
-                                        session_info,
-                                        NULL,
-                                        winbind_messaging_context(),
-                                        &cli);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("open_samr_pipe: Could not connect to samr_pipe: %s\n",
-                          nt_errstr(status)));
-                return status;
-        }
-
-        if (samr_pipe) {
-                *samr_pipe = cli;
-        }
-
-        return NT_STATUS_OK;
-}
-
 NTSTATUS open_internal_samr_conn(TALLOC_CTX *mem_ctx,
                                  struct winbindd_domain *domain,
@@ -85 +49 @@
         struct dcerpc_binding_handle *b;
 
-        status = open_internal_samr_pipe(mem_ctx, samr_pipe);
+        status = wb_open_internal_pipe(mem_ctx, &ndr_table_samr, samr_pipe);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -117 +81 @@
 }
 
-static NTSTATUS open_internal_lsa_pipe(TALLOC_CTX *mem_ctx,
-                                       struct rpc_pipe_client **lsa_pipe)
-{
-        struct rpc_pipe_client *cli = NULL;
-        struct auth_serversupplied_info *session_info = NULL;
+NTSTATUS open_internal_lsa_conn(TALLOC_CTX *mem_ctx,
+                                struct rpc_pipe_client **lsa_pipe,
+                                struct policy_handle *lsa_hnd)
+{
         NTSTATUS status;
 
-        if (session_info == NULL) {
-                status = make_session_info_system(mem_ctx, &session_info);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(0, ("open_lsa_pipe: Could not create auth_serversupplied_info: %s\n",
-                                  nt_errstr(status)));
-                        return status;
-                }
-        }
-
-        /* create a lsa connection */
-        status = rpc_pipe_open_interface(mem_ctx,
-                                        &ndr_table_lsarpc.syntax_id,
-                                        session_info,
-                                        NULL,
-                                        winbind_messaging_context(),
-                                        &cli);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("open_lsa_pipe: Could not connect to lsa_pipe: %s\n",
-                          nt_errstr(status)));
-                return status;
-        }
-
-        if (lsa_pipe) {
-                *lsa_pipe = cli;
-        }
-
-        return NT_STATUS_OK;
-}
-
-static NTSTATUS open_internal_lsa_conn(TALLOC_CTX *mem_ctx,
-                                       struct rpc_pipe_client **lsa_pipe,
-                                       struct policy_handle *lsa_hnd)
-{
-        NTSTATUS status;
-
-        status = open_internal_lsa_pipe(mem_ctx, lsa_pipe);
+        status = wb_open_internal_pipe(mem_ctx, &ndr_table_lsarpc, lsa_pipe);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -314 +242 @@
 
         /* Paranoia check */
-        if (!sid_check_is_in_our_domain(user_sid)) {
+        if (!sid_check_is_in_our_sam(user_sid)) {
                 return NT_STATUS_NO_SUCH_USER;
         }
 
-        if (user_info) {
-                user_info->homedir = NULL;
-                user_info->shell = NULL;
-                user_info->primary_gid = (gid_t) -1;
-        }
+        user_info->homedir = NULL;
+        user_info->shell = NULL;
+        user_info->primary_gid = (gid_t) -1;
 
         tmp_ctx = talloc_stackframe();
@@ -441 +367 @@
 
         if (pnum_names) {
-                pnum_names = 0;
+                *pnum_names = 0;
         }
 
@@ -500 +426 @@
 static NTSTATUS builtin_enum_dom_groups(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries,
+                                uint32_t *num_entries,
                                 struct wb_acct_info **info)
 {
@@ -512 +438 @@
 static NTSTATUS builtin_query_user_list(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries,
+                                uint32_t *num_entries,
                                 struct wbint_userinfo **info)
 {
@@ -687 +613 @@
         /* Paranoia check */
         if (!sid_check_is_in_builtin(sid) &&
-            !sid_check_is_in_our_domain(sid) &&
+            !sid_check_is_builtin(sid) &&
+            !sid_check_is_in_our_sam(sid) &&
+            !sid_check_is_our_sam(sid) &&
             !sid_check_is_in_unix_users(sid) &&
             !sid_check_is_unix_users(sid) &&
@@ -743 +671 @@
                                   TALLOC_CTX *mem_ctx,
                                   const struct dom_sid *domain_sid,
-                                  uint32 *rids,
+                                  uint32_t *rids,
                                   size_t num_rids,
                                   char **pdomain_name,
@@ -764 +692 @@
         /* Paranoia check */
         if (!sid_check_is_builtin(domain_sid) &&
-            !sid_check_is_domain(domain_sid) &&
+            !sid_check_is_our_sam(domain_sid) &&
             !sid_check_is_unix_users(domain_sid) &&
             !sid_check_is_unix_groups(domain_sid) &&
@@ -850 +778 @@
                                              mem_ctx,
                                              &dom_pol,
-                                             12,
+                                             DomainLockoutInformation,
                                              &info,
                                              &result);
@@ -902 +830 @@
                                              mem_ctx,
                                              &dom_pol,
-                                             1,
+                                             DomainPasswordInformation,
                                              &info,
                                              &result);
@@ -1056 +984 @@
         struct rpc_pipe_client *samr_pipe;
         struct policy_handle dom_pol;
-        uint32_t seq;
+        uint32_t seq = DOM_SEQUENCE_NONE;
         TALLOC_CTX *tmp_ctx;
         NTSTATUS status, result;

vendor/current/source3/winbindd/winbindd_sid_to_gid.c

@@ -55 +55 @@
         }
 
-        subreq = wb_sid2gid_send(state, ev, &state->sid);
+        subreq = wb_sids2xids_send(state, ev, &state->sid, 1);
         if (tevent_req_nomem(subreq, req)) {
                 return tevent_req_post(req, ev);
@@ -70 +70 @@
                 req, struct winbindd_sid_to_gid_state);
         NTSTATUS status;
+        struct unixid xids[1];
 
-        status = wb_sid2gid_recv(subreq, &state->gid);
+        status = wb_sids2xids_recv(subreq, xids, ARRAY_SIZE(xids));
         TALLOC_FREE(subreq);
         if (tevent_req_nterror(req, status)) {
                 return;
         }
+
+        /*
+         * We are filtering further down in sids2xids, but that filtering
+         * depends on the actual type of the sid handed in (as determined
+         * by lookupsids). Here we need to filter for the type of object
+         * actually requested, in this case gid.
+         */
+        if (!(xids[0].type == ID_TYPE_GID || xids[0].type == ID_TYPE_BOTH)) {
+                tevent_req_nterror(req, NT_STATUS_NONE_MAPPED);
+                return;
+        }
+
+        state->gid = (gid_t)xids[0].id;
         tevent_req_done(req);
 }

vendor/current/source3/winbindd/winbindd_sid_to_uid.c

@@ -55 +55 @@
         }
 
-        subreq = wb_sid2uid_send(state, ev, &state->sid);
+        subreq = wb_sids2xids_send(state, ev, &state->sid, 1);
         if (tevent_req_nomem(subreq, req)) {
                 return tevent_req_post(req, ev);
@@ -70 +70 @@
                 req, struct winbindd_sid_to_uid_state);
         NTSTATUS status;
+        struct unixid xids[1];
 
-        status = wb_sid2uid_recv(subreq, &state->uid);
+        status = wb_sids2xids_recv(subreq, xids, ARRAY_SIZE(xids));
         TALLOC_FREE(subreq);
         if (tevent_req_nterror(req, status)) {
                 return;
         }
+
+        /*
+         * We are filtering further down in sids2xids, but that filtering
+         * depends on the actual type of the sid handed in (as determined
+         * by lookupsids). Here we need to filter for the type of object
+         * actually requested, in this case uid.
+         */
+        if (!(xids[0].type == ID_TYPE_UID || xids[0].type == ID_TYPE_BOTH)) {
+                tevent_req_nterror(req, NT_STATUS_NONE_MAPPED);
+                return;
+        }
+
+        state->uid = (uid_t)xids[0].id;
         tevent_req_done(req);
 }

vendor/current/source3/winbindd/winbindd_sids_to_xids.c

@@ -3 +3 @@
    async implementation of WINBINDD_SIDS_TO_XIDS
    Copyright (C) Volker Lendecke 2011
+   Copyright (C) Michael Adam 2012
 
    This program is free software; you can redistribute it and/or modify
@@ -21 +22 @@
 #include "winbindd.h"
 #include "../libcli/security/security.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
-#include "idmap_cache.h"
+
 
 struct winbindd_sids_to_xids_state {
@@ -28 +28 @@
         struct dom_sid *sids;
         uint32_t num_sids;
-
-        struct id_map *cached;
-
-        struct dom_sid *non_cached;
-        uint32_t num_non_cached;
-
-        struct lsa_RefDomainList *domains;
-        struct lsa_TransNameArray *names;
-
-        struct wbint_TransIDArray ids;
+        struct unixid *xids;
 };
 
-static bool winbindd_sids_to_xids_in_cache(struct dom_sid *sid,
-                                           struct id_map *map);
-static void winbindd_sids_to_xids_lookupsids_done(struct tevent_req *subreq);
 static void winbindd_sids_to_xids_done(struct tevent_req *subreq);
 
@@ -52 +40 @@
         struct tevent_req *req, *subreq;
         struct winbindd_sids_to_xids_state *state;
-        uint32_t i;
 
         req = tevent_req_create(mem_ctx, &state,
@@ -81 +68 @@
         DEBUG(10, ("num_sids: %d\n", (int)state->num_sids));
 
-        state->cached = TALLOC_ZERO_ARRAY(state, struct id_map,
-                                          state->num_sids);
-        if (tevent_req_nomem(state->cached, req)) {
-                return tevent_req_post(req, ev);
-        }
-        state->non_cached = TALLOC_ARRAY(state, struct dom_sid,
-                                         state->num_sids);
-        if (tevent_req_nomem(state->non_cached, req)) {
+        subreq = wb_sids2xids_send(state, ev, state->sids, state->num_sids);
+        if (tevent_req_nomem(subreq, req)) {
                 return tevent_req_post(req, ev);
         }
 
-        for (i=0; i<state->num_sids; i++) {
-
-                DEBUG(10, ("SID %d: %s\n", (int)i,
-                           sid_string_dbg(&state->sids[i])));
-
-                if (winbindd_sids_to_xids_in_cache(&state->sids[i],
-                                                   &state->cached[i])) {
-                        continue;
-                }
-                sid_copy(&state->non_cached[state->num_non_cached],
-                         &state->sids[i]);
-                state->num_non_cached += 1;
-        }
-
-        if (state->num_non_cached == 0) {
-                tevent_req_done(req);
-                return tevent_req_post(req, ev);
-        }
-
-        subreq = wb_lookupsids_send(state, ev, state->non_cached,
-                                    state->num_non_cached);
-        if (tevent_req_nomem(subreq, req)) {
-                return tevent_req_post(req, ev);
-        }
-        tevent_req_set_callback(subreq, winbindd_sids_to_xids_lookupsids_done,
-                                req);
+        tevent_req_set_callback(subreq, winbindd_sids_to_xids_done, req);
         return req;
-}
-
-static bool winbindd_sids_to_xids_in_cache(struct dom_sid *sid,
-                                           struct id_map *map)
-{
-        bool is_online = is_domain_online(find_our_domain());
-        gid_t gid = (gid_t)-1;
-        bool gid_expired = false;
-        bool gid_cached = false;
-        bool gid_negative = false;
-        uid_t uid = (uid_t)-1;
-        bool uid_expired = false;
-        bool uid_cached = false;
-        bool uid_negative = false;
-
-        if (!winbindd_use_idmap_cache()) {
-                return false;
-        }
-
-        /*
-         * SIDS_TO_XIDS is primarily used to resolve the user's group
-         * sids. So we check groups before users.
-         */
-        gid_cached = idmap_cache_find_sid2gid(sid, &gid, &gid_expired);
-        if (!is_online) {
-                gid_expired = false;
-        }
-        if (gid_cached && !gid_expired) {
-                if (gid != (gid_t)-1) {
-                        map->sid = sid;
-                        map->xid.id = gid;
-                        map->xid.type = ID_TYPE_GID;
-                        map->status = ID_MAPPED;
-                        return true;
-                }
-                gid_negative = true;
-        }
-        uid_cached = idmap_cache_find_sid2uid(sid, &uid, &uid_expired);
-        if (!is_online) {
-                uid_expired = false;
-        }
-        if (uid_cached && !uid_expired) {
-                if (uid != (uid_t)-1) {
-                        map->sid = sid;
-                        map->xid.id = uid;
-                        map->xid.type = ID_TYPE_UID;
-                        map->status = ID_MAPPED;
-                        return true;
-                }
-                uid_negative = true;
-        }
-
-        /*
-         * Here we know that we only have negative
-         * or no entries.
-         *
-         * All valid cases already returned to the caller.
-         */
-
-        if (gid_negative && uid_negative) {
-                map->sid = sid;
-                map->xid.id = UINT32_MAX;
-                map->xid.type = ID_TYPE_NOT_SPECIFIED;
-                map->status = ID_MAPPED;
-                return true;
-        }
-
-        if (gid_negative) {
-                map->sid = sid;
-                map->xid.id = gid; /* this is (gid_t)-1 */
-                map->xid.type = ID_TYPE_GID;
-                map->status = ID_MAPPED;
-                return true;
-        }
-
-        if (uid_negative) {
-                map->sid = sid;
-                map->xid.id = uid; /* this is (uid_t)-1 */
-                map->xid.type = ID_TYPE_UID;
-                map->status = ID_MAPPED;
-                return true;
-        }
-
-        return false;
-}
-
-static void winbindd_sids_to_xids_lookupsids_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(
-                subreq, struct tevent_req);
-        struct winbindd_sids_to_xids_state *state = tevent_req_data(
-                req, struct winbindd_sids_to_xids_state);
-        struct winbindd_child *child;
-        NTSTATUS status;
-        int i;
-
-        status = wb_lookupsids_recv(subreq, state, &state->domains,
-                                    &state->names);
-        TALLOC_FREE(subreq);
-        if (tevent_req_nterror(req, status)) {
-                return;
-        }
-
-        state->ids.num_ids = state->num_non_cached;
-        state->ids.ids = TALLOC_ARRAY(state, struct wbint_TransID,
-                                      state->num_non_cached);
-        if (tevent_req_nomem(state->ids.ids, req)) {
-                return;
-        }
-
-        for (i=0; i<state->num_non_cached; i++) {
-                struct lsa_TranslatedName *n = &state->names->names[i];
-                struct wbint_TransID *t = &state->ids.ids[i];
-
-                switch (n->sid_type) {
-                case SID_NAME_USER:
-                case SID_NAME_COMPUTER:
-                        t->type = WBC_ID_TYPE_UID;
-                        break;
-                case SID_NAME_DOM_GRP:
-                case SID_NAME_ALIAS:
-                case SID_NAME_WKN_GRP:
-                        t->type = WBC_ID_TYPE_GID;
-                        break;
-                default:
-                        t->type = WBC_ID_TYPE_NOT_SPECIFIED;
-                        break;
-                };
-                t->domain_index = n->sid_index;
-                sid_peek_rid(&state->non_cached[i], &t->rid);
-                t->unix_id = (uint64_t)-1;
-        }
-
-        child = idmap_child();
-
-        subreq = dcerpc_wbint_Sids2UnixIDs_send(
-                state, state->ev, child->binding_handle, state->domains,
-                &state->ids);
-        if (tevent_req_nomem(subreq, req)) {
-                return;
-        }
-        tevent_req_set_callback(subreq, winbindd_sids_to_xids_done, req);
 }
 
@@ -269 +83 @@
         struct winbindd_sids_to_xids_state *state = tevent_req_data(
                 req, struct winbindd_sids_to_xids_state);
-        NTSTATUS status, result;
+        NTSTATUS status;
 
-        status = dcerpc_wbint_Sids2UnixIDs_recv(subreq, state, &result);
+        state->xids = talloc_zero_array(state, struct unixid, state->num_sids);
+        if (tevent_req_nomem(state->xids, req)) {
+                return;
+        }
+
+        status = wb_sids2xids_recv(subreq, state->xids, state->num_sids);
         TALLOC_FREE(subreq);
-        if (any_nt_status_not_ok(status, result, &status)) {
-                tevent_req_nterror(req, status);
+        if (tevent_req_nterror(req, status)) {
                 return;
         }
@@ -286 +104 @@
                 req, struct winbindd_sids_to_xids_state);
         NTSTATUS status;
-        char *result;
-        uint32_t i, num_non_cached;
+        char *result = NULL;
+        uint32_t i;
 
         if (tevent_req_is_nterror(req, &status)) {
-                DEBUG(5, ("wb_sids_to_xids failed: %s\n", nt_errstr(status)));
+                DEBUG(5, ("Could not convert sids: %s\n", nt_errstr(status)));
                 return status;
         }
@@ -299 +117 @@
         }
 
-        num_non_cached = 0;
+        for (i=0; i<state->num_sids; i++) {
+                char type = '\0';
+                bool found = true;
+                struct unixid xid;
 
-        for (i=0; i<state->num_sids; i++) {
-                char type;
-                uint32_t unix_id = UINT32_MAX;
-                bool found = true;
+                xid = state->xids[i];
 
-                if (state->cached[i].sid != NULL) {
-                        unix_id = state->cached[i].xid.id;
-
-                        switch (state->cached[i].xid.type) {
-                        case ID_TYPE_UID:
-                                type = 'U';
-                                break;
-                        case ID_TYPE_GID:
-                                type = 'G';
-                                break;
-                        default:
-                                found = false;
-                                break;
-                        }
-                } else {
-                        unix_id = state->ids.ids[num_non_cached].unix_id;
-
-                        switch(state->ids.ids[num_non_cached].type) {
-                        case WBC_ID_TYPE_UID:
-                                type = 'U';
-                                idmap_cache_set_sid2uid(
-                                        &state->non_cached[num_non_cached],
-                                        unix_id);
-                                break;
-                        case WBC_ID_TYPE_GID:
-                                type = 'G';
-                                idmap_cache_set_sid2gid(
-                                        &state->non_cached[num_non_cached],
-                                        unix_id);
-                                break;
-                        default:
-                                found = false;
-                                break;
-                        }
-                        num_non_cached += 1;
+                switch (xid.type) {
+                case ID_TYPE_UID:
+                        type = 'U';
+                        break;
+                case ID_TYPE_GID:
+                        type = 'G';
+                        break;
+                case ID_TYPE_BOTH:
+                        type = 'B';
+                        break;
+                default:
+                        found = false;
+                        break;
                 }
 
-                if (unix_id == UINT32_MAX) {
+                if (xid.id == UINT32_MAX) {
                         found = false;
                 }
@@ -350 +146 @@
                         result = talloc_asprintf_append_buffer(
                                 result, "%c%lu\n", type,
-                                (unsigned long)unix_id);
+                                (unsigned long)xid.id);
                 } else {
                         result = talloc_asprintf_append_buffer(result, "\n");
@@ -361 +157 @@
         response->extra_data.data = result;
         response->length += talloc_get_size(result);
+
         return NT_STATUS_OK;
 }

vendor/current/source3/winbindd/winbindd_util.c

@@ -27 +27 @@
 #include "../libcli/auth/pam_errors.h"
 #include "passdb/machine_sid.h"
+#include "passdb.h"
+#include "source4/lib/messaging/messaging.h"
+#include "librpc/gen_ndr/ndr_lsa.h"
+#include "auth/credentials/credentials.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
 
+static struct winbindd_domain *
+add_trusted_domain_from_tdc(const struct winbindd_tdc_domain *tdc,
+                            struct winbindd_methods *methods);
+
 extern struct winbindd_methods cache_methods;
 
 /**
- * @file winbindd_util.cq
+ * @file winbindd_util.c
  *
  * Winbind daemon for NT domain authentication nss module.
@@ -68 +76 @@
 
                 DLIST_REMOVE(_domain_list, domain);
-                SAFE_FREE(domain);
+                TALLOC_FREE(domain);
                 domain = next;
         }
+}
+
+/**
+ * Iterator for winbindd's domain list.
+ * To be used (e.g.) in tevent based loops.
+ */
+struct winbindd_domain *wb_next_domain(struct winbindd_domain *domain)
+{
+        if (domain == NULL) {
+                domain = domain_list();
+        } else {
+                domain = domain->next;
+        }
+
+        if ((domain != NULL) &&
+            (lp_server_role() != ROLE_ACTIVE_DIRECTORY_DC) &&
+            sid_check_is_our_sam(&domain->sid))
+        {
+                domain = domain->next;
+        }
+
+        return domain;
 }
 
@@ -78 +108 @@
                 return False;
 
-        return (sid_check_is_domain(sid) || sid_check_is_builtin(sid));
+        return (sid_check_is_our_sam(sid) || sid_check_is_builtin(sid));
 }
 
@@ -86 +116 @@
                 return False;
 
-        return (sid_check_is_in_our_domain(sid) || sid_check_is_in_builtin(sid));
-}
-
-
-/* Add a trusted domain to our list of domains */
-static struct winbindd_domain *add_trusted_domain(const char *domain_name, const char *alt_name,
-                                                  struct winbindd_methods *methods,
-                                                  const struct dom_sid *sid)
+        return (sid_check_is_in_our_sam(sid) || sid_check_is_in_builtin(sid));
+}
+
+
+/* Add a trusted domain to our list of domains.
+   If the domain already exists in the list,
+   return it and don't re-initialize.  */
+
+static struct winbindd_domain *
+add_trusted_domain(const char *domain_name, const char *alt_name,
+                   struct winbindd_methods *methods, const struct dom_sid *sid)
+{
+        struct winbindd_tdc_domain tdc;
+
+        ZERO_STRUCT(tdc);
+
+        tdc.domain_name = domain_name;
+        tdc.dns_name = alt_name;
+        if (sid) {
+                sid_copy(&tdc.sid, sid);
+        }
+
+        return add_trusted_domain_from_tdc(&tdc, methods);
+}
+
+/* Add a trusted domain out of a trusted domain cache
+   entry
+*/
+static struct winbindd_domain *
+add_trusted_domain_from_tdc(const struct winbindd_tdc_domain *tdc,
+                            struct winbindd_methods *methods)
 {
         struct winbindd_domain *domain;
         const char *alternative_name = NULL;
-        char *idmap_config_option;
-        const char *param;
         const char **ignored_domains, **dom;
+        int role = lp_server_role();
+        const char *domain_name = tdc->domain_name;
+        const struct dom_sid *sid = &tdc->sid;
+
+        if (is_null_sid(sid)) {
+                sid = NULL;
+        }
 
         ignored_domains = lp_parm_string_list(-1, "winbind", "ignore domains", NULL);
@@ -109 +167 @@
         }
 
-        /* ignore alt_name if we are not in an AD domain */
-
-        if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) {
-                alternative_name = alt_name;
+        /* use alt_name if available to allow DNS lookups */
+
+        if (tdc->dns_name && *tdc->dns_name) {
+                alternative_name = tdc->dns_name;
         }
 
@@ -124 +182 @@
                 }
 
-                if (alternative_name && *alternative_name)
-                {
+                if (alternative_name) {
                         if (strequal(alternative_name, domain->name) ||
                             strequal(alternative_name, domain->alt_name))
@@ -133 +190 @@
                 }
 
-                if (sid)
-                {
-                        if (is_null_sid(sid)) {
-                                continue;
-                        }
-
+                if (sid != NULL) {
                         if (dom_sid_equal(sid, &domain->sid)) {
                                 break;
@@ -147 +199 @@
         if (domain != NULL) {
                 /*
-                 * We found a match. Possibly update the SID
+                 * We found a match on domain->name or
+                 * domain->alt_name. Possibly update the SID
+                 * if the stored SID was the NULL SID
+                 * and return the matching entry.
                  */
                 if ((sid != NULL)
@@ -157 +212 @@
 
         /* Create new domain entry */
-
-        if ((domain = SMB_MALLOC_P(struct winbindd_domain)) == NULL)
+        domain = talloc_zero(NULL, struct winbindd_domain);
+        if (domain == NULL) {
                 return NULL;
-
-        /* Fill in fields */
-
-        ZERO_STRUCTP(domain);
-
-        domain->children = SMB_MALLOC_ARRAY(
-                struct winbindd_child, lp_winbind_max_domain_connections());
+        }
+
+        domain->children = talloc_zero_array(domain,
+                                             struct winbindd_child,
+                                             lp_winbind_max_domain_connections());
         if (domain->children == NULL) {
-                SAFE_FREE(domain);
+                TALLOC_FREE(domain);
                 return NULL;
         }
-        memset(domain->children, 0,
-               sizeof(struct winbindd_child)
-               * lp_winbind_max_domain_connections());
-
-        fstrcpy(domain->name, domain_name);
+
+        domain->name = talloc_strdup(domain, domain_name);
+        if (domain->name == NULL) {
+                TALLOC_FREE(domain);
+                return NULL;
+        }
+
         if (alternative_name) {
-                fstrcpy(domain->alt_name, alternative_name);
+                domain->alt_name = talloc_strdup(domain, alternative_name);
+                if (domain->alt_name == NULL) {
+                        TALLOC_FREE(domain);
+                        return NULL;
+                }
         }
 
@@ -185 +244 @@
         domain->sequence_number = DOM_SEQUENCE_NONE;
         domain->last_seq_check = 0;
-        domain->initialized = False;
+        domain->initialized = false;
         domain->online = is_internal_domain(sid);
         domain->check_online_timeout = 0;
         domain->dc_probe_pid = (pid_t)-1;
-        if (sid) {
+        if (sid != NULL) {
                 sid_copy(&domain->sid, sid);
         }
+        domain->domain_flags = tdc->trust_flags;
+        domain->domain_type = tdc->trust_type;
+        domain->domain_trust_attribs = tdc->trust_attribs;
+
+        /* Is this our primary domain ? */
+        if (strequal(domain_name, get_global_sam_name()) &&
+                        (role != ROLE_DOMAIN_MEMBER)) {
+                domain->primary = true;
+        } else if (strequal(domain_name, lp_workgroup()) &&
+                        (role == ROLE_DOMAIN_MEMBER)) {
+                domain->primary = true;
+        }
+
+        if (domain->primary) {
+                if (role == ROLE_ACTIVE_DIRECTORY_DC) {
+                        domain->active_directory = true;
+                }
+                if (lp_security() == SEC_ADS) {
+                        domain->active_directory = true;
+                }
+        } else if (!domain->internal) {
+                if (domain->domain_type == LSA_TRUST_TYPE_UPLEVEL) {
+                        domain->active_directory = true;
+                }
+        }
 
         /* Link to domain list */
-        DLIST_ADD_END(_domain_list, domain, struct winbindd_domain *);
+        DLIST_ADD_END(_domain_list, domain);
 
         wcache_tdc_add_domain( domain );
 
-        idmap_config_option = talloc_asprintf(talloc_tos(), "idmap config %s",
-                                              domain->name);
-        if (idmap_config_option == NULL) {
-                DEBUG(0, ("talloc failed, not looking for idmap config\n"));
-                goto done;
-        }
-
-        param = lp_parm_const_string(-1, idmap_config_option, "range", NULL);
-
-        DEBUG(10, ("%s : range = %s\n", idmap_config_option,
-                   param ? param : "not defined"));
-
-        if (param != NULL) {
-                unsigned low_id, high_id;
-                if (sscanf(param, "%u - %u", &low_id, &high_id) != 2) {
-                        DEBUG(1, ("invalid range syntax in %s: %s\n",
-                                  idmap_config_option, param));
-                        goto done;
-                }
-                if (low_id > high_id) {
-                        DEBUG(1, ("invalid range in %s: %s\n",
-                                  idmap_config_option, param));
-                        goto done;
-                }
-                domain->have_idmap_config = true;
-                domain->id_range_low = low_id;
-                domain->id_range_high = high_id;
-        }
-
-done:
-
-        DEBUG(2,("Added domain %s %s %s\n",
-                 domain->name, domain->alt_name,
-                 &domain->sid?sid_string_dbg(&domain->sid):""));
+        setup_domain_child(domain);
+
+        DEBUG(2,
+              ("Added domain %s %s %s\n", domain->name, domain->alt_name,
+               !is_null_sid(&domain->sid) ? sid_string_dbg(&domain->sid) : ""));
 
         return domain;
@@ -262 +317 @@
         struct tevent_req *req;
 
-        state = TALLOC_ZERO_P(NULL, struct trustdom_state);
+        state = talloc_zero(NULL, struct trustdom_state);
         if (state == NULL) {
                 DEBUG(0, ("talloc failed\n"));
@@ -289 +344 @@
         int res, err;
         char *p;
+        struct winbindd_tdc_domain trust_params = {0};
+        ptrdiff_t extra_len;
 
         res = wb_domain_request_recv(req, state, &response, &err);
         if ((res == -1) || (response->result != WINBINDD_OK)) {
-                DEBUG(1, ("Could not receive trustdoms\n"));
+                DBG_WARNING("Could not receive trustdoms\n");
                 TALLOC_FREE(state);
                 return;
         }
 
+        if (response->length < sizeof(struct winbindd_response)) {
+                DBG_ERR("ill-formed trustdom response - short length\n");
+                TALLOC_FREE(state);
+                return;
+        }
+
+        extra_len = response->length - sizeof(struct winbindd_response);
+
         p = (char *)response->extra_data.data;
 
-        while ((p != NULL) && (*p != '\0')) {
+        while ((p - (char *)response->extra_data.data) < extra_len) {
                 char *q, *sidstr, *alt_name;
-                struct dom_sid sid;
-                struct winbindd_domain *domain;
-                char *alternate_name = NULL;
+
+                DBG_DEBUG("parsing response line '%s'\n", p);
+
+                ZERO_STRUCT(trust_params);
+                trust_params.domain_name = p;
 
                 alt_name = strchr(p, '\\');
                 if (alt_name == NULL) {
+                        DBG_ERR("Got invalid trustdom response\n");
+                        break;
+                }
+
+                *alt_name = '\0';
+                alt_name += 1;
+
+                sidstr = strchr(alt_name, '\\');
+                if (sidstr == NULL) {
+                        DBG_ERR("Got invalid trustdom response\n");
+                        break;
+                }
+
+                *sidstr = '\0';
+                sidstr += 1;
+
+                /* use the real alt_name if we have one, else pass in NULL */
+                if (!strequal(alt_name, "(null)")) {
+                        trust_params.dns_name = alt_name;
+                }
+
+                q = strtok(sidstr, "\\");
+                if (q == NULL) {
+                        DBG_ERR("Got invalid trustdom response\n");
+                        break;
+                }
+
+                if (!string_to_sid(&trust_params.sid, sidstr)) {
                         DEBUG(0, ("Got invalid trustdom response\n"));
                         break;
                 }
 
-                *alt_name = '\0';
-                alt_name += 1;
-
-                sidstr = strchr(alt_name, '\\');
-                if (sidstr == NULL) {
-                        DEBUG(0, ("Got invalid trustdom response\n"));
+                q = strtok(NULL, "\\");
+                if (q == NULL) {
+                        DBG_ERR("Got invalid trustdom response\n");
                         break;
                 }
 
-                *sidstr = '\0';
-                sidstr += 1;
-
-                q = strchr(sidstr, '\n');
-                if (q != NULL)
-                        *q = '\0';
-
-                if (!string_to_sid(&sid, sidstr)) {
-                        DEBUG(0, ("Got invalid trustdom response\n"));
+                trust_params.trust_flags = (uint32_t)strtoul(q, NULL, 10);
+
+                q = strtok(NULL, "\\");
+                if (q == NULL) {
+                        DBG_ERR("Got invalid trustdom response\n");
                         break;
                 }
 
-                /* use the real alt_name if we have one, else pass in NULL */
-
-                if ( !strequal( alt_name, "(null)" ) )
-                        alternate_name = alt_name;
-
-                /* If we have an existing domain structure, calling
-                   add_trusted_domain() will update the SID if
-                   necessary.  This is important because we need the
-                   SID for sibling domains */
-
-                if ( find_domain_from_name_noinit(p) != NULL ) {
-                        domain = add_trusted_domain(p, alternate_name,
-                                                    &cache_methods,
-                                                    &sid);
-                } else {
-                        domain = add_trusted_domain(p, alternate_name,
-                                                    &cache_methods,
-                                                    &sid);
-                        if (domain) {
-                                setup_domain_child(domain);
-                        }
-                }
-                p=q;
-                if (p != NULL)
-                        p += 1;
+                trust_params.trust_type = (uint32_t)strtoul(q, NULL, 10);
+
+                q = strtok(NULL, "\n");
+                if (q == NULL) {
+                        DBG_ERR("Got invalid trustdom response\n");
+                        break;
+                }
+
+                trust_params.trust_attribs = (uint32_t)strtoul(q, NULL, 10);
+
+                /*
+                 * We always call add_trusted_domain() cause on an existing
+                 * domain structure, it will update the SID if necessary.
+                 * This is important because we need the SID for sibling
+                 * domains.
+                 */
+                (void)add_trusted_domain_from_tdc(&trust_params,
+                                                  &cache_methods);
+
+                p = q + strlen(q) + 1;
         }
 
@@ -423 +506 @@
 
                 if ( !d ) {
-                        d = add_trusted_domain( dom_list[i].domain_name,
-                                                dom_list[i].dns_name,
-                                                &cache_methods,
-                                                &dom_list[i].sid );
-                        if (d != NULL) {
-                                setup_domain_child(d);
-                        }
+                        d = add_trusted_domain_from_tdc(&dom_list[i],
+                                                        &cache_methods);
                 }
 
@@ -476 +554 @@
 
         for ( i=0; i<num_trusts; i++ ) {
-                uint32 flags   = dom_list[i].trust_flags;
-                uint32 type    = dom_list[i].trust_type;
-                uint32 attribs = dom_list[i].trust_attribs;
+                uint32_t flags   = dom_list[i].trust_flags;
+                uint32_t type    = dom_list[i].trust_type;
+                uint32_t attribs = dom_list[i].trust_attribs;
 
                 d = find_domain_from_name_noinit( dom_list[i].domain_name );
@@ -488 +566 @@
 
                 if ( (flags & NETR_TRUST_FLAG_INBOUND) &&
-                     (type == NETR_TRUST_TYPE_UPLEVEL) &&
-                     (attribs == NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) )
+                     (type == LSA_TRUST_TYPE_UPLEVEL) &&
+                     (attribs == LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) )
                 {
                         /* add the trusted domain if we don't know
@@ -495 +573 @@
 
                         if ( !d ) {
-                                d = add_trusted_domain( dom_list[i].domain_name,
-                                                        dom_list[i].dns_name,
-                                                        &cache_methods,
-                                                        &dom_list[i].sid );
-                                if (d != NULL) {
-                                        setup_domain_child(d);
-                                }
+                                d = add_trusted_domain_from_tdc(&dom_list[i],
+                                                                &cache_methods);
                         }
 
@@ -569 +642 @@
         }
 
-        if (domain->internal) {
-                domain->initialized = true;
-        } else {
-                init_dc_connection(domain);
-        }
+        init_dc_connection(domain, false);
 
         if (!domain->initialized) {
@@ -599 +668 @@
 }
 
+static void wb_imsg_new_trusted_domain(struct imessaging_context *msg,
+                                       void *private_data,
+                                       uint32_t msg_type,
+                                       struct server_id server_id,
+                                       DATA_BLOB *data)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct lsa_TrustDomainInfoInfoEx info;
+        enum ndr_err_code ndr_err;
+        struct winbindd_domain *d = NULL;
+
+        DEBUG(5, ("wb_imsg_new_trusted_domain\n"));
+
+        if (data == NULL) {
+                TALLOC_FREE(frame);
+                return;
+        }
+
+        ndr_err = ndr_pull_struct_blob_all(data, frame, &info,
+                        (ndr_pull_flags_fn_t)ndr_pull_lsa_TrustDomainInfoInfoEx);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                TALLOC_FREE(frame);
+                return;
+        }
+
+        d = find_domain_from_name_noinit(info.netbios_name.string);
+        if (d != NULL) {
+                TALLOC_FREE(frame);
+                return;
+        }
+
+        d = add_trusted_domain(info.netbios_name.string,
+                               info.domain_name.string,
+                               &cache_methods,
+                               info.sid);
+        if (d == NULL) {
+                TALLOC_FREE(frame);
+                return;
+        }
+
+        if (d->internal) {
+                TALLOC_FREE(frame);
+                return;
+        }
+
+        if (d->primary) {
+                TALLOC_FREE(frame);
+                return;
+        }
+
+        if (info.trust_direction & LSA_TRUST_DIRECTION_INBOUND) {
+                d->domain_flags |= NETR_TRUST_FLAG_INBOUND;
+        }
+        if (info.trust_direction & LSA_TRUST_DIRECTION_OUTBOUND) {
+                d->domain_flags |= NETR_TRUST_FLAG_OUTBOUND;
+        }
+        if (info.trust_attributes & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST) {
+                d->domain_flags |= NETR_TRUST_FLAG_IN_FOREST;
+        }
+        d->domain_type = info.trust_type;
+        d->domain_trust_attribs = info.trust_attributes;
+
+        TALLOC_FREE(frame);
+}
+
+/*
+ * We did not get the secret when we queried secrets.tdb, so read it
+ * from secrets.tdb and re-sync the databases
+ */
+static bool migrate_secrets_tdb_to_ldb(struct winbindd_domain *domain)
+{
+        bool ok;
+        struct cli_credentials *creds;
+        NTSTATUS can_migrate = pdb_get_trust_credentials(domain->name,
+                                                         NULL, domain, &creds);
+        if (!NT_STATUS_IS_OK(can_migrate)) {
+                DEBUG(0, ("Failed to fetch our own, local AD domain join "
+                        "password for winbindd's internal use, both from "
+                        "secrets.tdb and secrets.ldb: %s\n",
+                        nt_errstr(can_migrate)));
+                return false;
+        }
+
+        /*
+         * NOTE: It is very unlikely we end up here if there is an
+         * oldpass, because a new password is created at
+         * classicupgrade, so this is not a concern.
+         */
+        ok = secrets_store_machine_pw_sync(cli_credentials_get_password(creds),
+                   NULL /* oldpass */,
+                   cli_credentials_get_domain(creds),
+                   cli_credentials_get_realm(creds),
+                   cli_credentials_get_salt_principal(creds),
+                   0, /* Supported enc types, unused */
+                   &domain->sid,
+                   cli_credentials_get_password_last_changed_time(creds),
+                   cli_credentials_get_secure_channel_type(creds),
+                   false /* do_delete: Do not delete */);
+        TALLOC_FREE(creds);
+        if (ok == false) {
+                DEBUG(0, ("Failed to write our our own, "
+                          "local AD domain join password for "
+                          "winbindd's internal use into secrets.tdb\n"));
+                return false;
+        }
+        return true;
+}
+
 /* Look up global info for the winbind daemon */
 bool init_domain_list(void)
 {
-        struct winbindd_domain *domain;
         int role = lp_server_role();
+        NTSTATUS status;
 
         /* Free existing list */
@@ -610 +787 @@
         /* BUILTIN domain */
 
-        domain = add_trusted_domain("BUILTIN", NULL, &cache_methods,
+        (void)add_trusted_domain("BUILTIN", NULL, &cache_methods,
                                     &global_sid_Builtin);
-        if (domain) {
-                setup_domain_child(domain);
-        }
 
         /* Local SAM */
 
-        domain = add_trusted_domain(get_global_sam_name(), NULL,
-                                    &cache_methods, get_global_sam_sid());
-        if (domain) {
-                if ( role != ROLE_DOMAIN_MEMBER ) {
-                        domain->primary = True;
-                }
-                setup_domain_child(domain);
-        }
-
+        if ( role == ROLE_ACTIVE_DIRECTORY_DC ) {
+                struct winbindd_domain *domain;
+                enum netr_SchannelType sec_chan_type;
+                const char *account_name;
+                struct samr_Password current_nt_hash;
+                struct pdb_domain_info *pdb_domain_info;
+                bool ok;
+
+                pdb_domain_info = pdb_get_domain_info(talloc_tos());
+                if (pdb_domain_info == NULL) {
+                        DEBUG(0, ("Failed to fetch our own, local AD "
+                                "domain info from sam.ldb\n"));
+                        return false;
+                }
+                domain = add_trusted_domain(pdb_domain_info->name,
+                                        pdb_domain_info->dns_domain,
+                                        &cache_methods,
+                                        &pdb_domain_info->sid);
+                TALLOC_FREE(pdb_domain_info);
+                if (domain == NULL) {
+                        DEBUG(0, ("Failed to add our own, local AD "
+                                "domain to winbindd's internal list\n"));
+                        return false;
+                }
+
+                /*
+                 * We need to call this to find out if we are an RODC
+                 */
+                ok = get_trust_pw_hash(domain->name,
+                                       current_nt_hash.hash,
+                                       &account_name,
+                                       &sec_chan_type);
+                if (!ok) {
+                        /*
+                         * If get_trust_pw_hash() fails, then try and
+                         * fetch the password from the more recent of
+                         * secrets.{ldb,tdb} using the
+                         * pdb_get_trust_credentials()
+                         */
+                        ok = migrate_secrets_tdb_to_ldb(domain);
+
+                        if (ok == false) {
+                                DEBUG(0, ("Failed to migrate our own, "
+                                          "local AD domain join password for "
+                                          "winbindd's internal use into "
+                                          "secrets.tdb\n"));
+                                return false;
+                        }
+                        ok = get_trust_pw_hash(domain->name,
+                                               current_nt_hash.hash,
+                                               &account_name,
+                                               &sec_chan_type);
+                        if (ok == false) {
+                                DEBUG(0, ("Failed to find our our own, just "
+                                          "written local AD domain join "
+                                          "password for winbindd's internal "
+                                          "use in secrets.tdb\n"));
+                                return false;
+                        }
+                }
+                if (sec_chan_type == SEC_CHAN_RODC) {
+                        domain->rodc = true;
+                }
+
+        } else {
+                (void)add_trusted_domain(get_global_sam_name(), NULL,
+                                         &cache_methods, get_global_sam_sid());
+        }
         /* Add ourselves as the first entry. */
 
         if ( role == ROLE_DOMAIN_MEMBER ) {
+                struct winbindd_domain *domain;
                 struct dom_sid our_sid;
 
@@ -640 +874 @@
                                              &cache_methods, &our_sid);
                 if (domain) {
-                        domain->primary = True;
-                        setup_domain_child(domain);
-
                         /* Even in the parent winbindd we'll need to
                            talk to the DC, so try and see if we can
@@ -651 +882 @@
                         set_domain_online_request(domain);
                 }
+        }
+
+        status = imessaging_register(winbind_imessaging_context(), NULL,
+                                     MSG_WINBIND_NEW_TRUSTED_DOMAIN,
+                                     wb_imsg_new_trusted_domain);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("imessaging_register(MSG_WINBIND_NEW_TRUSTED_DOMAIN) - %s\n",
+                          nt_errstr(status)));
+                return false;
         }
 
@@ -676 +916 @@
         for (domain = domain_list(); domain != NULL; domain = domain->next) {
                 if (strequal(domain_name, domain->name) ||
-                    (domain->alt_name[0] &&
+                    (domain->alt_name != NULL &&
                      strequal(domain_name, domain->alt_name))) {
                         return domain;
@@ -697 +937 @@
 
         if (!domain->initialized)
-                init_dc_connection(domain);
+                init_dc_connection(domain, false);
 
         return domain;
@@ -732 +972 @@
 
         if (!domain->initialized)
-                init_dc_connection(domain);
+                init_dc_connection(domain, false);
 
         return domain;
@@ -756 +996 @@
         struct winbindd_domain *ours = find_our_domain();
 
-        if (ours->forest_name[0] == '\0') {
+        if (ours->forest_name == NULL) {
                 return NULL;
         }
@@ -878 +1118 @@
         }
 
-        strupper_m(domain);
-
-        return True;
+        return strupper_m(domain);
 }
 
@@ -927 +1165 @@
     username is then unqualified in unix
 
+    On an AD DC we always fill DOMAIN\\USERNAME.
+
     We always canonicalize as UPPERCASE DOMAIN, lowercase username.
 */
@@ -933 +1173 @@
         fstring tmp_user;
 
+        if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
+                can_assume = false;
+        }
+
         fstrcpy(tmp_user, user);
-        strlower_m(tmp_user);
+        (void)strlower_m(tmp_user);
 
         if (can_assume && assume_domain(domain)) {
@@ -956 +1200 @@
         char *tmp_user, *name;
 
+        if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
+                can_assume = false;
+        }
+
         tmp_user = talloc_strdup(mem_ctx, user);
-        strlower_m(tmp_user);
+        if (!strlower_m(tmp_user)) {
+                TALLOC_FREE(tmp_user);
+                return NULL;
+        }
 
         if (can_assume && assume_domain(domain)) {
@@ -986 +1237 @@
 }
 
+/* Return list-tail of all connected clients */
+
+struct winbindd_cli_state *winbindd_client_list_tail(void)
+{
+        return DLIST_TAIL(_client_list);
+}
+
+/* Return previous (read:newer) client in list */
+
+struct winbindd_cli_state *
+winbindd_client_list_prev(struct winbindd_cli_state *cli)
+{
+        return DLIST_PREV(cli);
+}
+
 /* Add a connection to the list */
 
 void winbindd_add_client(struct winbindd_cli_state *cli)
 {
+        cli->last_access = time(NULL);
         DLIST_ADD(_client_list, cli);
         _num_clients++;
@@ -1000 +1267 @@
         DLIST_REMOVE(_client_list, cli);
         _num_clients--;
+}
+
+/* Move a client to head or list */
+
+void winbindd_promote_client(struct winbindd_cli_state *cli)
+{
+        cli->last_access = time(NULL);
+        DLIST_PROMOTE(_client_list, cli);
 }
 
@@ -1180 +1455 @@
 
         if (domain->primary) {
-                return true;
+                ret = true;
+                goto done;
         }
 
@@ -1188 +1464 @@
                 DEBUG(10,("winbindd_can_contact_domain: %s not found in cache\n",
                           domain->name));
-                return false;
+                ret = false;
+                goto done;
         }
 
@@ -1358 +1635 @@
 }
 
+/**
+ * Parse an char array into a list of sids.
+ *
+ * The input sidstr should consist of 0-terminated strings
+ * representing sids, separated by newline characters '\n'.
+ * The list is terminated by an empty string, i.e.
+ * character '\0' directly following a character '\n'
+ * (or '\0' right at the start of sidstr).
+ */
 bool parse_sidlist(TALLOC_CTX *mem_ctx, const char *sidstr,
                    struct dom_sid **sids, uint32_t *num_sids)

vendor/current/source3/winbindd/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
 
-IDMAP_AD_SRC = '''idmap_ad.c'''
-IDMAP_RID_SRC = '''idmap_rid.c'''
-IDMAP_PASSDB_SRC = '''idmap_passdb.c'''
-IDMAP_LDAP_SRC = '''idmap_ldap.c'''
-IDMAP_NSS_SRC = '''idmap_nss.c'''
-IDMAP_TDB_SRC = '''idmap_tdb.c'''
-IDMAP_TDB2_SRC = '''idmap_tdb2.c'''
+bld.SAMBA3_LIBRARY('idmap',
+                   source='idmap.c idmap_util.c',
+                   deps='samba-util pdb',
+                   allow_undefined_symbols=True,
+                   private_library=True)
 
-IDMAP_HASH_SRC = '''idmap_hash/idmap_hash.c
-                    idmap_hash/mapfile.c'''
+bld.SAMBA3_SUBSYSTEM('IDMAP_RW',
+                     source='idmap_rw.c',
+                     deps='samba-util')
 
-IDMAP_ADEX_SRC = '''idmap_adex/idmap_adex.c
-                    idmap_adex/cell_util.c
-                    idmap_adex/likewise_cell.c
-                    idmap_adex/provider_unified.c
-                    idmap_adex/gc_util.c
-                    idmap_adex/domain_util.c'''
-IDMAP_AUTORID_SRC = '''idmap_autorid.c'''
-
-IDMAP_RW_SRC = 'idmap_rw.c'
-IDMAP_SRC = 'idmap.c idmap_util.c ${IDMAP_RW_SRC}'
-
-bld.SAMBA3_SUBSYSTEM('idmap',
-                    source=IDMAP_SRC,
-                    vars=locals())
-
-bld.SAMBA3_SUBSYSTEM('IDMAP_ADEX',
-                    source=IDMAP_ADEX_SRC,
-                    vars=locals(),
-                    enabled=bld.env.HAVE_LDAP)
+bld.SAMBA3_SUBSYSTEM('IDMAP_TDB_COMMON',
+                     source='idmap_tdb_common.c',
+                     deps='tdb IDMAP_RW')
 
 bld.SAMBA3_SUBSYSTEM('IDMAP_HASH',
-                    source=IDMAP_HASH_SRC,
-                    vars=locals())
+                    source='idmap_hash/idmap_hash.c idmap_hash/mapfile.c',
+                    deps='samba-util krb5samba',
+                    enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_hash'))
 
 bld.SAMBA3_SUBSYSTEM('IDMAP_AD',
-                    source=IDMAP_AD_SRC,
-                    vars=locals(),
-                    enabled=bld.env.HAVE_LDAP)
+                    source='idmap_ad.c',
+                    deps='ads nss_info',
+                    enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad'))
 
 bld.SAMBA3_MODULE('idmap_ad',
                  subsystem='idmap',
+                 allow_undefined_symbols=True,
                  source='',
                  deps='IDMAP_AD',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_ad'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad' and bld.env.HAVE_LDAP))
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad'))
+
+bld.SAMBA3_MODULE('idmap_rfc2307',
+                 subsystem='idmap',
+                 allow_undefined_symbols=True,
+                 source='idmap_rfc2307.c',
+                 init_function='',
+                 deps='ads',
+                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_rfc2307'),
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_rfc2307'))
 
 bld.SAMBA3_MODULE('idmap_rid',
                  subsystem='idmap',
-                 source=IDMAP_RID_SRC,
+                 allow_undefined_symbols=True,
+                 source='idmap_rid.c',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_rid'),
@@ -58 +53 @@
 bld.SAMBA3_MODULE('idmap_passdb',
                  subsystem='idmap',
-                 source=IDMAP_PASSDB_SRC,
+                 source='idmap_passdb.c',
+                 deps='samba-util samba-passdb',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_passdb'),
@@ -65 +61 @@
 bld.SAMBA3_MODULE('idmap_ldap',
                  subsystem='idmap',
-                 source=IDMAP_LDAP_SRC,
+                 source='idmap_ldap.c',
+                 deps='smbldap smbldaphelper pdb IDMAP_RW',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_ldap'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ldap') and bld.env.HAVE_LDAP)
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ldap') and bld.CONFIG_SET("HAVE_LDAP"),
+                 allow_undefined_symbols=True)
 
 bld.SAMBA3_MODULE('idmap_nss',
                  subsystem='idmap',
-                 source=IDMAP_NSS_SRC,
+                 source='idmap_nss.c',
+                 deps='samba-util',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_nss'),
@@ -79 +78 @@
 bld.SAMBA3_MODULE('idmap_tdb',
                  subsystem='idmap',
-                 source=IDMAP_TDB_SRC,
+                 source='idmap_tdb.c',
+                 deps='samba-util tdb IDMAP_TDB_COMMON',
                  init_function='',
+                 allow_undefined_symbols=True,
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_tdb'),
                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_tdb'))
@@ -86 +87 @@
 bld.SAMBA3_MODULE('idmap_tdb2',
                  subsystem='idmap',
-                 source=IDMAP_TDB2_SRC,
+                 source='idmap_tdb2.c',
+                 deps='samba-util tdb IDMAP_TDB_COMMON',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_tdb2'),
@@ -95 +97 @@
                  source='',
                  deps='IDMAP_HASH',
+                 allow_undefined_symbols=True,
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_hash'),
                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_hash'))
 
-bld.SAMBA3_MODULE('idmap_adex',
-                 subsystem='idmap',
-                 source='',
-                 deps='IDMAP_ADEX',
-                 init_function='',
-                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_adex'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_adex') and bld.env.HAVE_LDAP)
+bld.SAMBA3_SUBSYSTEM('IDMAP_AUTORID_TDB',
+                     source='idmap_autorid_tdb.c',
+                     deps='tdb')
 
 bld.SAMBA3_MODULE('idmap_autorid',
                  subsystem='idmap',
-                 source=IDMAP_AUTORID_SRC,
+                 source='idmap_autorid.c',
+                 deps='samba-util tdb IDMAP_TDB_COMMON IDMAP_AUTORID_TDB',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_autorid'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_autorid'))
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_autorid'),
+                 allow_undefined_symbols=True)
 
-
-NSS_INFO_TEMPLATE_SRC = 'nss_info_template.c'
-NSS_INFO_SRC = 'nss_info.c'
-
-bld.SAMBA3_SUBSYSTEM('nss_info',
-                    source=NSS_INFO_SRC,
-                    vars=locals())
+bld.SAMBA3_LIBRARY('nss_info',
+                   source='nss_info.c',
+                   deps='samba-util param',
+                   private_library=True)
 
 bld.SAMBA3_MODULE('nss_info_template',
                  subsystem='nss_info',
-                 source=NSS_INFO_TEMPLATE_SRC,
+                 source='nss_info_template.c',
+                 deps='samba-util krb5samba',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('nss_info_template'),
                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('nss_info_template'))
-
-bld.SAMBA3_MODULE('nss_info_adex',
-                 subsystem='nss_info',
-                 source='',
-                 deps='IDMAP_ADEX',
-                 init_function='',
-                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_adex'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_adex') and bld.env.HAVE_LDAP)
 
 bld.SAMBA3_MODULE('nss_info_hash',
@@ -141 +132 @@
                  source='',
                  deps='IDMAP_HASH',
+                 allow_undefined_symbols=True,
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_hash'),
@@ -149 +141 @@
                  source='',
                  deps='IDMAP_AD',
+                 allow_undefined_symbols=True,
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_ad'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad') and bld.env.HAVE_LDAP)
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad'))
 
 bld.SAMBA3_MODULE('nss_info_sfu20',
@@ -157 +150 @@
                  source='',
                  deps='IDMAP_AD',
+                 allow_undefined_symbols=True,
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_ad'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad') and bld.env.HAVE_LDAP)
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad'))
 
 bld.SAMBA3_MODULE('nss_info_sfu',
@@ -165 +159 @@
                  source='',
                  deps='IDMAP_AD',
+                 allow_undefined_symbols=True,
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_ad'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad') and bld.env.HAVE_LDAP)
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_ad') and bld.CONFIG_SET("HAVE_LDAP"))
+
+bld.SAMBA3_MODULE('idmap_script',
+                 subsystem='idmap',
+                 allow_undefined_symbols=True,
+                 source='idmap_script.c',
+                 init_function='',
+                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('idmap_script'),
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('idmap_script'))