source3/winbindd/wb_lookupsids.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    async lookupsids
   4    Copyright (C) Volker Lendecke 2011
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "lib/util_unixsids.h"
  23 #include "librpc/gen_ndr/ndr_winbind_c.h"
  24 #include "../libcli/security/security.h"
  25 #include "passdb/machine_sid.h"
  26 #include "lsa.h"
  27
  28 struct wb_lookupsids_domain {
  29         struct winbindd_domain *domain;
  30
  31         /*
  32          * Array of sids to be passed into wbint_LookupSids. Preallocated with
  33          * num_sids.
  34          */
  35         struct lsa_SidArray sids;
  36
  37         /*
  38          * Indexes into wb_lookupsids_state->sids and thus
  39          * wb_lookupsids_state->res_names. Preallocated with num_sids.
  40          */
  41         uint32_t *sid_indexes;
  42 };
  43
  44 struct wb_translated_name {
  45         const char *domain_name;
  46         const char *name;
  47         enum lsa_SidType type;
  48 };
  49
  50 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
  51         const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
  52         struct wb_lookupsids_domain **domains, uint32_t num_sids);
  53
  54 struct wb_lookupsids_state {
  55         struct tevent_context *ev;
  56
  57         /*
  58          * SIDs passed in
  59          */
  60         struct dom_sid *sids;
  61         uint32_t num_sids;
  62
  63         /*
  64          * The domains we're using for bulk lookup via wbint_LookupRids or
  65          * wbint_LookupSids. We expect very few domains, so we do a
  66          * talloc_realloc and rely on talloc_array_length.
  67          */
  68         struct wb_lookupsids_domain *domains;
  69         uint32_t domains_done;
  70
  71         /*
  72          * These SIDs are looked up individually via
  73          * wbint_LookupSid. Preallocated with num_sids.
  74          */
  75         uint32_t *single_sids;
  76         uint32_t num_single_sids;
  77         uint32_t single_sids_done;
  78
  79         /*
  80          * Intermediate store for wbint_LookupRids to passdb. These are
  81          * spliced into res_domains/res_names in wb_lookupsids_move_name.
  82          */
  83         struct wbint_RidArray rids;
  84         const char *domain_name;
  85         struct wbint_Principals rid_names;
  86
  87         /*
  88          * Intermediate results for wbint_LookupSids. These results are
  89          * spliced into res_domains/res_names in wb_lookupsids_move_name.
  90          */
  91         struct lsa_RefDomainList tmp_domains;
  92         struct lsa_TransNameArray tmp_names;
  93
  94         /*
  95          * Results
  96          */
  97         struct lsa_RefDomainList *res_domains;
  98         /*
  99          * Indexed as "sids" in this structure
 100          */
 101         struct lsa_TransNameArray *res_names;
 102 };
 103
 104 static bool wb_lookupsids_next(struct tevent_req *req,
 105                                struct wb_lookupsids_state *state);
 106 static void wb_lookupsids_single_done(struct tevent_req *subreq);
 107 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq);
 108 static void wb_lookupsids_done(struct tevent_req *subreq);
 109
 110 struct tevent_req *wb_lookupsids_send(TALLOC_CTX *mem_ctx,
 111                                       struct tevent_context *ev,
 112                                       struct dom_sid *sids,
 113                                       uint32_t num_sids)
 114 {
 115         struct tevent_req *req;
 116         struct wb_lookupsids_state *state;
 117         uint32_t i;
 118
 119         req = tevent_req_create(mem_ctx, &state, struct wb_lookupsids_state);
 120         if (req == NULL) {
 121                 return NULL;
 122         }
 123
 124         D_INFO("WB command lookupsids start.\nLooking up %"PRIu32" SID(s)\n",
 125                num_sids);
 126         if (CHECK_DEBUGLVL(DBGLVL_INFO)) {
 127                 for (i = 0; i < num_sids; i++) {
 128                         struct dom_sid_buf buf;
 129                         D_INFO("%"PRIu32": %s\n",
 130                                i, dom_sid_str_buf(&sids[i], &buf));
 131                 }
 132         }
 133
 134         state->ev = ev;
 135         state->sids = sids;
 136         state->num_sids = num_sids;
 137
 138         state->single_sids = talloc_zero_array(state, uint32_t, num_sids);
 139         if (tevent_req_nomem(state->single_sids, req)) {
 140                 return tevent_req_post(req, ev);
 141         }
 142
 143         state->res_domains = talloc_zero(state, struct lsa_RefDomainList);
 144         if (tevent_req_nomem(state->res_domains, req)) {
 145                 return tevent_req_post(req, ev);
 146         }
 147         state->res_domains->domains = talloc_zero_array(
 148                 state->res_domains, struct lsa_DomainInfo, num_sids);
 149         if (tevent_req_nomem(state->res_domains->domains, req)) {
 150                 return tevent_req_post(req, ev);
 151         }
 152
 153         state->res_names = talloc_zero(state, struct lsa_TransNameArray);
 154         if (tevent_req_nomem(state->res_names, req)) {
 155                 return tevent_req_post(req, ev);
 156         }
 157         state->res_names->names = talloc_zero_array(
 158                 state->res_names, struct lsa_TranslatedName, num_sids);
 159         if (tevent_req_nomem(state->res_names->names, req)) {
 160                 return tevent_req_post(req, ev);
 161         }
 162
 163         if (num_sids == 0) {
 164                 tevent_req_done(req);
 165                 return tevent_req_post(req, ev);
 166         }
 167
 168         for (i=0; i<num_sids; i++) {
 169                 struct wb_lookupsids_domain *d;
 170
 171                 d = wb_lookupsids_get_domain(&sids[i], state, &state->domains,
 172                                              num_sids);
 173                 if (d != NULL) {
 174                         d->sids.sids[d->sids.num_sids].sid = &sids[i];
 175                         d->sid_indexes[d->sids.num_sids] = i;
 176                         d->sids.num_sids += 1;
 177                 } else {
 178                         state->single_sids[state->num_single_sids] = i;
 179                         state->num_single_sids += 1;
 180                 }
 181         }
 182
 183         if (!wb_lookupsids_next(req, state)) {
 184                 return tevent_req_post(req, ev);
 185         }
 186         return req;
 187 }
 188
 189 static bool wb_lookupsids_next(struct tevent_req *req,
 190                                struct wb_lookupsids_state *state)
 191 {
 192         struct tevent_req *subreq;
 193
 194         if (state->domains_done < talloc_array_length(state->domains)) {
 195                 struct wb_lookupsids_domain *d;
 196                 uint32_t i;
 197
 198                 d = &state->domains[state->domains_done];
 199
 200                 if (d->domain->internal) {
 201                         /*
 202                          * This is only our local SAM,
 203                          * see wb_lookupsids_bulk() and
 204                          * wb_lookupsids_get_domain().
 205                          */
 206                         state->rids.num_rids = d->sids.num_sids;
 207                         state->rids.rids = talloc_array(state, uint32_t,
 208                                                         state->rids.num_rids);
 209                         if (tevent_req_nomem(state->rids.rids, req)) {
 210                                 return false;
 211                         }
 212                         for (i=0; i<state->rids.num_rids; i++) {
 213                                 sid_peek_rid(d->sids.sids[i].sid,
 214                                              &state->rids.rids[i]);
 215                         }
 216                         subreq = dcerpc_wbint_LookupRids_send(
 217                                 state, state->ev, dom_child_handle(d->domain),
 218                                 &d->domain->sid, &state->rids, &state->domain_name,
 219                                 &state->rid_names);
 220                         if (tevent_req_nomem(subreq, req)) {
 221                                 return false;
 222                         }
 223                         tevent_req_set_callback(
 224                                 subreq, wb_lookupsids_lookuprids_done, req);
 225                         return true;
 226                 }
 227
 228                 subreq = dcerpc_wbint_LookupSids_send(
 229                         state, state->ev, dom_child_handle(d->domain),
 230                         &d->sids, &state->tmp_domains,  &state->tmp_names);
 231                 if (tevent_req_nomem(subreq, req)) {
 232                         return false;
 233                 }
 234                 tevent_req_set_callback(subreq, wb_lookupsids_done, req);
 235                 return true;
 236         }
 237
 238         if (state->single_sids_done < state->num_single_sids) {
 239                 uint32_t sid_idx;
 240                 const struct dom_sid *sid;
 241
 242                 sid_idx = state->single_sids[state->single_sids_done];
 243                 sid = &state->sids[sid_idx];
 244
 245                 subreq = wb_lookupsid_send(state, state->ev, sid);
 246                 if (tevent_req_nomem(subreq, req)) {
 247                         return false;
 248                 }
 249                 tevent_req_set_callback(subreq, wb_lookupsids_single_done,
 250                                         req);
 251                 return true;
 252         }
 253
 254         tevent_req_done(req);
 255         return false;
 256 }
 257
 258 /*
 259  * Decide whether to do bulk lookupsids. We have optimizations for
 260  * passdb via lookuprids and to remote DCs via lookupsids.
 261  */
 262
 263 static bool wb_lookupsids_bulk(const struct dom_sid *sid)
 264 {
 265         struct dom_sid_buf sidbuf;
 266
 267         if (sid->num_auths != 5) {
 268                 /*
 269                  * Only do "S-1-5-21-x-y-z-rid" domains via bulk
 270                  * lookup
 271                  */
 272                 DBG_DEBUG("No bulk setup for SID %s with %"PRIi8" subauths\n",
 273                           dom_sid_str_buf(sid, &sidbuf),
 274                           sid->num_auths);
 275                 return false;
 276         }
 277
 278         if (sid_check_is_in_our_sam(sid)) {
 279                 /*
 280                  * Passdb lookup via lookuprids
 281                  */
 282                 DBG_DEBUG("%s is in our domain\n",
 283                           dom_sid_str_buf(sid, &sidbuf));
 284                 return true;
 285         }
 286
 287         if (IS_DC) {
 288                 /*
 289                  * Bulk lookups to trusted DCs
 290                  */
 291                 return (find_domain_from_sid_noinit(sid) != NULL);
 292         }
 293
 294         if (lp_server_role() != ROLE_DOMAIN_MEMBER) {
 295                 /*
 296                  * Don't do bulk lookups as standalone, the only bulk
 297                  * lookup left is for domain members.
 298                  */
 299                 return false;
 300         }
 301
 302         if (sid_check_is_in_unix_groups(sid) ||
 303             sid_check_is_unix_groups(sid) ||
 304             sid_check_is_in_unix_users(sid) ||
 305             sid_check_is_unix_users(sid) ||
 306             sid_check_is_in_builtin(sid) ||
 307             sid_check_is_builtin(sid) ||
 308             sid_check_is_wellknown_domain(sid, NULL) ||
 309             sid_check_is_in_wellknown_domain(sid))
 310         {
 311                 /*
 312                  * These are locally done piece by piece anyway, no
 313                  * need for bulk optimizations.
 314                  */
 315                 return false;
 316         }
 317
 318         /*
 319          * All other SIDs are sent to the DC we're connected to as
 320          * member via a single lsa_lookupsids call.
 321          */
 322         return true;
 323 }
 324
 325 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
 326         const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
 327         struct wb_lookupsids_domain **pdomains, uint32_t num_sids)
 328 {
 329         struct wb_lookupsids_domain *domains, *domain;
 330         struct winbindd_domain *wb_domain;
 331         uint32_t i, num_domains;
 332
 333         if (!wb_lookupsids_bulk(sid)) {
 334                 D_DEBUG("wb_lookupsids_bulk() is FALSE\n");
 335                 return NULL;
 336         }
 337         D_DEBUG("wb_lookupsids_bulk() is TRUE\n");
 338
 339         domains = *pdomains;
 340         num_domains = talloc_array_length(domains);
 341
 342         wb_domain = find_lookup_domain_from_sid(sid);
 343         if (wb_domain == NULL) {
 344                 return NULL;
 345         }
 346
 347         D_DEBUG("Searching %"PRIu32" domain(s) for domain '%s'\n",
 348                 num_domains, wb_domain->name);
 349         for (i=0; i<num_domains; i++) {
 350                 if (domains[i].domain != wb_domain) {
 351                         continue;
 352                 }
 353
 354                 if (!domains[i].domain->internal) {
 355                         /*
 356                          * If it's not our local sam,
 357                          * we can re-use the domain without
 358                          * checking the sid.
 359                          *
 360                          * Note the wb_lookupsids_bulk() above
 361                          * already catched special SIDs,
 362                          * e.g. the unix and builtin domains.
 363                          */
 364                         return &domains[i];
 365                 }
 366
 367                 if (dom_sid_compare_domain(sid, &domains[i].domain->sid) == 0) {
 368                         /*
 369                          * If it's out local sam we can also use it.
 370                          */
 371                         return &domains[i];
 372                 }
 373
 374                 /*
 375                  * I'm not sure if this can be triggered,
 376                  * as wb_lookupsids_bulk() should also catch this,
 377                  * but we need to make sure that we don't use
 378                  * wbint_LookupRids() without a SID match.
 379                  */
 380                 return NULL;
 381         }
 382
 383         domains = talloc_realloc(
 384                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains+1);
 385         if (domains == NULL) {
 386                 return NULL;
 387         }
 388         *pdomains = domains;
 389
 390         domain = &domains[num_domains];
 391         domain->domain = wb_domain;
 392
 393         domain->sids.sids = talloc_zero_array(domains, struct lsa_SidPtr, num_sids);
 394         if (domains->sids.sids == NULL) {
 395                 goto fail;
 396         }
 397         domain->sids.num_sids = 0;
 398
 399         domain->sid_indexes = talloc_zero_array(domains, uint32_t, num_sids);
 400         if (domain->sid_indexes == NULL) {
 401                 TALLOC_FREE(domain->sids.sids);
 402                 goto fail;
 403         }
 404         return domain;
 405
 406 fail:
 407         /*
 408          * Realloc to the state it was in before
 409          */
 410         *pdomains = talloc_realloc(
 411                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains);
 412         return NULL;
 413 }
 414
 415 static bool wb_lookupsids_find_dom_idx(struct lsa_DomainInfo *domain,
 416                                        struct lsa_RefDomainList *list,
 417                                        uint32_t *idx)
 418 {
 419         uint32_t i;
 420         struct lsa_DomainInfo *new_domain;
 421
 422         for (i=0; i<list->count; i++) {
 423                 if (dom_sid_equal(domain->sid, list->domains[i].sid)) {
 424                         *idx = i;
 425                         return true;
 426                 }
 427         }
 428
 429         new_domain = &list->domains[list->count];
 430
 431         new_domain->name.string = talloc_strdup(
 432                 list->domains, domain->name.string);
 433         if (new_domain->name.string == NULL) {
 434                 return false;
 435         }
 436
 437         new_domain->sid = dom_sid_dup(list->domains, domain->sid);
 438         if (new_domain->sid == NULL) {
 439                 return false;
 440         }
 441
 442         *idx = list->count;
 443         list->count += 1;
 444         return true;
 445 }
 446
 447 static bool wb_lookupsids_move_name(struct lsa_RefDomainList *src_domains,
 448                                     struct lsa_TranslatedName *src_name,
 449                                     struct lsa_RefDomainList *dst_domains,
 450                                     struct lsa_TransNameArray *dst_names,
 451                                     uint32_t dst_name_index)
 452 {
 453         struct lsa_TranslatedName *dst_name;
 454         struct lsa_DomainInfo *src_domain;
 455         uint32_t src_domain_index;
 456         uint32_t dst_domain_index = UINT32_MAX;
 457         bool ok;
 458
 459         src_domain_index = src_name->sid_index;
 460         if ((src_domain_index != UINT32_MAX) && (src_domains != NULL)) {
 461                 if (src_domain_index >= src_domains->count) {
 462                         return false;
 463                 }
 464                 src_domain = &src_domains->domains[src_domain_index];
 465
 466                 ok = wb_lookupsids_find_dom_idx(src_domain,
 467                                                 dst_domains,
 468                                                 &dst_domain_index);
 469                 if (!ok) {
 470                         return false;
 471                 }
 472         }
 473
 474         dst_name = &dst_names->names[dst_name_index];
 475
 476         dst_name->sid_type = src_name->sid_type;
 477         dst_name->name.string = talloc_move(dst_names->names,
 478                                             &src_name->name.string);
 479         dst_name->sid_index = dst_domain_index;
 480         dst_names->count += 1;
 481
 482         return true;
 483 }
 484
 485 static void wb_lookupsids_done(struct tevent_req *subreq)
 486 {
 487         struct tevent_req *req = tevent_req_callback_data(
 488                 subreq, struct tevent_req);
 489         struct wb_lookupsids_state *state = tevent_req_data(
 490                 req, struct wb_lookupsids_state);
 491         struct wb_lookupsids_domain *d;
 492         uint32_t i;
 493
 494         NTSTATUS status, result;
 495
 496         status = dcerpc_wbint_LookupSids_recv(subreq, state, &result);
 497         TALLOC_FREE(subreq);
 498         if (tevent_req_nterror(req, status)) {
 499                 return;
 500         }
 501         if (NT_STATUS_LOOKUP_ERR(result)) {
 502                 tevent_req_nterror(req, result);
 503                 return;
 504         }
 505
 506         /*
 507          * Look at the individual states in the translated names.
 508          */
 509
 510         d = &state->domains[state->domains_done];
 511
 512         for (i=0; i<state->tmp_names.count; i++) {
 513                 uint32_t res_sid_index = d->sid_indexes[i];
 514
 515                 if (!wb_lookupsids_move_name(
 516                             &state->tmp_domains, &state->tmp_names.names[i],
 517                             state->res_domains, state->res_names,
 518                             res_sid_index)) {
 519                         tevent_req_oom(req);
 520                         return;
 521                 }
 522         }
 523         state->domains_done += 1;
 524         wb_lookupsids_next(req, state);
 525 }
 526
 527 static void wb_lookupsids_single_done(struct tevent_req *subreq)
 528 {
 529         struct tevent_req *req = tevent_req_callback_data(
 530                 subreq, struct tevent_req);
 531         struct wb_lookupsids_state *state = tevent_req_data(
 532                 req, struct wb_lookupsids_state);
 533         const char *domain_name = NULL;
 534         const char *name = NULL;
 535         enum lsa_SidType type = SID_NAME_UNKNOWN;
 536         uint32_t res_sid_index;
 537         uint32_t src_rid;
 538
 539         struct dom_sid src_domain_sid;
 540         struct lsa_DomainInfo src_domain;
 541         struct lsa_RefDomainList src_domains;
 542         struct lsa_RefDomainList *psrc_domains = NULL;
 543         struct lsa_TranslatedName src_name;
 544
 545         uint32_t domain_idx = UINT32_MAX;
 546         NTSTATUS status;
 547         bool ok;
 548
 549         status = wb_lookupsid_recv(subreq, talloc_tos(), &type,
 550                                    &domain_name, &name);
 551         TALLOC_FREE(subreq);
 552         if (NT_STATUS_LOOKUP_ERR(status)) {
 553                 tevent_req_nterror(req, status);
 554                 return;
 555         }
 556
 557         res_sid_index = state->single_sids[state->single_sids_done];
 558
 559         if ((domain_name != NULL) && (domain_name[0] != '\0')) {
 560                 /*
 561                  * Build structs with the domain name for
 562                  * wb_lookupsids_move_name(). If we didn't get a name, we will
 563                  * pass NULL and UINT32_MAX.
 564                  */
 565
 566                 sid_copy(&src_domain_sid, &state->sids[res_sid_index]);
 567                 if (type != SID_NAME_DOMAIN) {
 568                         sid_split_rid(&src_domain_sid, &src_rid);
 569                 }
 570
 571                 src_domain.name.string = domain_name;
 572                 src_domain.sid = &src_domain_sid;
 573
 574                 src_domains.count = 1;
 575                 src_domains.domains = &src_domain;
 576                 psrc_domains = &src_domains;
 577
 578                 domain_idx = 0;
 579         }
 580
 581         src_name.sid_type = type;
 582         src_name.name.string = name;
 583         src_name.sid_index = domain_idx;
 584
 585         ok = wb_lookupsids_move_name(psrc_domains,
 586                                      &src_name,
 587                                      state->res_domains,
 588                                      state->res_names,
 589                                      res_sid_index);
 590         if (!ok) {
 591                 tevent_req_oom(req);
 592                 return;
 593         }
 594         state->single_sids_done += 1;
 595         wb_lookupsids_next(req, state);
 596 }
 597
 598 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq)
 599 {
 600         struct tevent_req *req = tevent_req_callback_data(
 601                 subreq, struct tevent_req);
 602         struct wb_lookupsids_state *state = tevent_req_data(
 603                 req, struct wb_lookupsids_state);
 604         struct dom_sid src_domain_sid;
 605         struct lsa_DomainInfo src_domain;
 606         struct lsa_RefDomainList src_domains;
 607         NTSTATUS status, result;
 608         struct wb_lookupsids_domain *d;
 609         uint32_t i;
 610
 611         status = dcerpc_wbint_LookupRids_recv(subreq, state, &result);
 612         TALLOC_FREE(subreq);
 613         if (tevent_req_nterror(req, status)) {
 614                 return;
 615         }
 616         if (NT_STATUS_LOOKUP_ERR(result)) {
 617                 tevent_req_nterror(req, result);
 618                 return;
 619         }
 620
 621         /*
 622          * Look at the individual states in the translated names.
 623          */
 624
 625         d = &state->domains[state->domains_done];
 626
 627         sid_copy(&src_domain_sid, get_global_sam_sid());
 628         src_domain.name.string = get_global_sam_name();
 629         src_domain.sid = &src_domain_sid;
 630         src_domains.count = 1;
 631         src_domains.domains = &src_domain;
 632
 633         for (i=0; i<state->rid_names.num_principals; i++) {
 634                 struct lsa_TranslatedName src_name;
 635                 uint32_t res_sid_index;
 636
 637                 /*
 638                  * Fake up structs for wb_lookupsids_move_name
 639                  */
 640                 res_sid_index = d->sid_indexes[i];
 641
 642                 src_name.sid_type = state->rid_names.principals[i].type;
 643                 src_name.name.string = state->rid_names.principals[i].name;
 644                 src_name.sid_index = 0;
 645
 646                 if (!wb_lookupsids_move_name(
 647                             &src_domains, &src_name,
 648                             state->res_domains, state->res_names,
 649                             res_sid_index)) {
 650                         tevent_req_oom(req);
 651                         return;
 652                 }
 653         }
 654
 655         state->domains_done += 1;
 656         wb_lookupsids_next(req, state);
 657 }
 658
 659 NTSTATUS wb_lookupsids_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 660                             struct lsa_RefDomainList **domains,
 661                             struct lsa_TransNameArray **names)
 662 {
 663         struct wb_lookupsids_state *state = tevent_req_data(
 664                 req, struct wb_lookupsids_state);
 665         NTSTATUS status;
 666
 667         D_INFO("WB command lookupsids end.\n");
 668         if (tevent_req_is_nterror(req, &status)) {
 669                 D_WARNING("Failed with %s.\n", nt_errstr(status));
 670                 return status;
 671         }
 672
 673         /*
 674          * The returned names need to match the given sids,
 675          * if not we have a bug in the code!
 676          */
 677         if (state->res_names->count != state->num_sids) {
 678                 D_WARNING("Got %"PRIu32" returned name(s), but expected %"PRIu32"!\n",
 679                           state->res_names->count, state->num_sids);
 680                 return NT_STATUS_INTERNAL_ERROR;
 681         }
 682
 683         /*
 684          * Not strictly needed, but it might make debugging in the callers
 685          * easier in future, if the talloc_array_length() returns the
 686          * expected result...
 687          */
 688         state->res_domains->domains = talloc_realloc(state->res_domains,
 689                                                      state->res_domains->domains,
 690                                                      struct lsa_DomainInfo,
 691                                                      state->res_domains->count);
 692
 693         *domains = talloc_move(mem_ctx, &state->res_domains);
 694         *names = talloc_move(mem_ctx, &state->res_names);
 695         D_INFO("Returning %"PRIu32" domain(s) and %"PRIu32" name(s).\n",
 696                (*domains)->count,
 697                (*names)->count);
 698         return NT_STATUS_OK;
 699 }