goto done;
}
- status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+ status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
goto done;
}
- status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+ status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
goto done;
}
- status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+ status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
name_map_status = normalize_name_unmap(mem_ctx, full_name,
&mapped_name);
- /* Reset the full_name pointer if we mapped anytthing */
+ /* Reset the full_name pointer if we mapped anything */
if (NT_STATUS_IS_OK(name_map_status) ||
NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
{
struct rpc_pipe_client *samr_pipe;
struct policy_handle dom_pol;
- struct netr_SamInfo3 *user = NULL;
+ struct netr_SamInfo3 *user;
TALLOC_CTX *tmp_ctx;
NTSTATUS status;
}
/* try netsamlogon cache first */
- if (winbindd_use_cache()) {
- user = netsamlogon_cache_get(tmp_ctx, user_sid);
- }
+ user = netsamlogon_cache_get(tmp_ctx, user_sid);
if (user != NULL) {
DEBUG(5,("msrpc_query_user: Cache lookup succeeded for %s\n",
sid_string_dbg(user_sid)));
}
/* no cache; hit the wire */
- status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+ status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
}
/* no cache; hit the wire */
- status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+ status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
goto done;
}
- status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+ status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
*num_names = 0;
- result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
+ result = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
if (!NT_STATUS_IS_OK(result))
return result;
/* Copy result into array. The talloc system will take
care of freeing the temporary arrays later on. */
- if (tmp_names.count != tmp_types.count) {
- return NT_STATUS_UNSUCCESSFUL;
+ if (tmp_names.count != num_lookup_rids) {
+ return NT_STATUS_INVALID_NETWORK_RESPONSE;
+ }
+ if (tmp_types.count != num_lookup_rids) {
+ return NT_STATUS_INVALID_NETWORK_RESPONSE;
}
for (r=0; r<tmp_names.count; r++) {
if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
continue;
}
+ if (total_names >= *num_names) {
+ break;
+ }
(*names)[total_names] = fill_domain_username_talloc(
mem_ctx, domain->name,
tmp_names.names[r].string, true);
#ifdef HAVE_LDAP
-#include <ldap.h>
+#include "ads.h"
static int get_ldap_seq(const char *server, struct sockaddr_storage *ss, int port, uint32 *seq)
{
}
#endif /* HAVE_LDAP */
- status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
+ status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
}
status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
- if (!NT_STATUS_IS_OK(status))
- return status;
+ if (!NT_STATUS_IS_OK(status)) {
+ goto done;
+ }
status = rpc_trusted_domains(tmp_ctx,
lsa_pipe,
return NT_STATUS_NOT_SUPPORTED;
}
- status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
+ status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
return NT_STATUS_NOT_SUPPORTED;
}
- status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
+ status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
return status;
}
-typedef NTSTATUS (*lookup_sids_fn_t)(struct dcerpc_binding_handle *h,
- TALLOC_CTX *mem_ctx,
- struct policy_handle *pol,
- int num_sids,
- const struct dom_sid *sids,
- char ***pdomains,
- char ***pnames,
- enum lsa_SidType **ptypes,
- NTSTATUS *result);
-
NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
struct winbindd_domain *domain,
uint32_t num_sids,
struct dcerpc_binding_handle *b = NULL;
struct policy_handle lsa_policy;
unsigned int orig_timeout;
- lookup_sids_fn_t lookup_sids_fn = dcerpc_lsa_lookup_sids;
-
- if (domain->can_do_ncacn_ip_tcp) {
- status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
- if (NT_STATUS_IS_OK(status)) {
- lookup_sids_fn = dcerpc_lsa_lookup_sids3;
- goto lookup;
- }
- domain->can_do_ncacn_ip_tcp = false;
- }
- status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
+ bool use_lookupsids3 = false;
+ bool retried = false;
+ connect:
+ status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- lookup:
b = cli->binding_handle;
+ if (cli->transport->transport == NCACN_IP_TCP) {
+ use_lookupsids3 = true;
+ }
+
/*
* This call can take a long time
* allow the server to time out.
*/
orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
- status = lookup_sids_fn(b,
- mem_ctx,
- &lsa_policy,
- num_sids,
- sids,
- domains,
- names,
- types,
- &result);
+ status = dcerpc_lsa_lookup_sids_generic(b,
+ mem_ctx,
+ &lsa_policy,
+ num_sids,
+ sids,
+ domains,
+ names,
+ types,
+ use_lookupsids3,
+ &result);
/* And restore our original timeout. */
dcerpc_binding_handle_set_timeout(b, orig_timeout);
if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
- NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
+ NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
+ NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
/*
* This can happen if the schannel key is not
* valid anymore, we need to invalidate the
* a netlogon connection first.
*/
invalidate_cm_connection(&domain->conn);
+ domain->can_do_ncacn_ip_tcp = domain->active_directory;
+ if (!retried) {
+ retried = true;
+ goto connect;
+ }
status = NT_STATUS_ACCESS_DENIED;
}
return NT_STATUS_OK;
}
-typedef NTSTATUS (*lookup_names_fn_t)(struct dcerpc_binding_handle *h,
- TALLOC_CTX *mem_ctx,
- struct policy_handle *pol,
- uint32_t num_names,
- const char **names,
- const char ***dom_names,
- enum lsa_LookupNamesLevel level,
- struct dom_sid **sids,
- enum lsa_SidType **types,
- NTSTATUS *result);
-
static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
struct winbindd_domain *domain,
uint32_t num_names,
struct dcerpc_binding_handle *b = NULL;
struct policy_handle lsa_policy;
unsigned int orig_timeout = 0;
- lookup_names_fn_t lookup_names_fn = dcerpc_lsa_lookup_names;
-
- if (domain->can_do_ncacn_ip_tcp) {
- status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
- if (NT_STATUS_IS_OK(status)) {
- lookup_names_fn = dcerpc_lsa_lookup_names4;
- goto lookup;
- }
- domain->can_do_ncacn_ip_tcp = false;
- }
- status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
+ bool use_lookupnames4 = false;
+ bool retried = false;
+ connect:
+ status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- lookup:
b = cli->binding_handle;
+ if (cli->transport->transport == NCACN_IP_TCP) {
+ use_lookupnames4 = true;
+ }
+
/*
* This call can take a long time
* allow the server to time out.
*/
orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
- status = lookup_names_fn(b,
- mem_ctx,
- &lsa_policy,
- num_names,
- (const char **) names,
- domains,
- 1,
- sids,
- types,
- &result);
+ status = dcerpc_lsa_lookup_names_generic(b,
+ mem_ctx,
+ &lsa_policy,
+ num_names,
+ (const char **) names,
+ domains,
+ 1,
+ sids,
+ types,
+ use_lookupnames4,
+ &result);
/* And restore our original timeout. */
dcerpc_binding_handle_set_timeout(b, orig_timeout);
if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
- NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
+ NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
+ NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
/*
* This can happen if the schannel key is not
* valid anymore, we need to invalidate the
* a netlogon connection first.
*/
invalidate_cm_connection(&domain->conn);
+ if (!retried) {
+ retried = true;
+ goto connect;
+ }
status = NT_STATUS_ACCESS_DENIED;
}