r23928: Merge all "copy-info3-groups-to-sid-array" blocks to a sid_array_from_info3()

function.

Guenther
(This used to be commit 1e1e480115e37b3f4c85f979ddd800b8de0b9c57)

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 0d8c3b3f95caaaab7c779cdd6b30fafcb4e5bc0e..325b05f80f8d678bd082b63e387e8388b5f76490 100644 (file)
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -1405,8 +1405,6 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
        uid_t uid;
        gid_t gid;
 
-       size_t i;
-
        auth_serversupplied_info *result;
 
        /* 
@@ -1584,37 +1582,13 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
        result->num_sids = 0;
        result->sids = NULL;
 
-       /* and create (by appending rids) the 'domain' sids */
-       
-       for (i = 0; i < info3->num_groups2; i++) {
-               DOM_SID sid;
-               if (!sid_compose(&sid, &info3->dom_sid.sid,
-                                info3->gids[i].g_rid)) {
-                       DEBUG(3,("could not append additional group rid "
-                                "0x%x\n", info3->gids[i].g_rid));
-                       TALLOC_FREE(result);
-                       return NT_STATUS_INVALID_PARAMETER;
-               }
-               if (!add_sid_to_array(result, &sid, &result->sids,
-                                &result->num_sids)) {
-                       TALLOC_FREE(result);
-                       return NT_STATUS_NO_MEMORY;
-               }
-       }
-
-       /* Copy 'other' sids.  We need to do sid filtering here to
-          prevent possible elevation of privileges.  See:
-
-           http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
-         */
-
-       for (i = 0; i < info3->num_other_sids; i++) {
-               if (!add_sid_to_array(result, &info3->other_sids[i].sid,
+       nt_status = sid_array_from_info3(result, info3,
                                         &result->sids,
-                                        &result->num_sids)) {
-                       TALLOC_FREE(result);
-                       return NT_STATUS_NO_MEMORY;
-               }
+                                        &result->num_sids,
+                                        False);
+       if (!NT_STATUS_IS_OK(nt_status)) {
+               TALLOC_FREE(result);
+               return nt_status;
        }
 
        result->login_server = unistr2_tdup(result, 

diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c
index 9915085f5a2883a521e611394482c772a585e6ae..7c6fc9b217cdd5ed9aaea20e25c12447f7f8ced3 100644 (file)
--- a/source3/lib/util_sid.c
+++ b/source3/lib/util_sid.c
@@ -669,3 +669,68 @@ BOOL is_null_sid(const DOM_SID *sid)
        static const DOM_SID null_sid = {0};
        return sid_equal(sid, &null_sid);
 }
+
+NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
+                             const NET_USER_INFO_3 *info3,
+                             DOM_SID **user_sids,
+                             size_t *num_user_sids,
+                             BOOL include_user_group_rid)
+{
+       DOM_SID sid;
+       DOM_SID *sid_array = NULL;
+       size_t num_sids = 0;
+       int i;
+
+       if (include_user_group_rid) {
+
+               if (!sid_compose(&sid, &(info3->dom_sid.sid),
+                                info3->user_rid)
+                   || !add_sid_to_array(mem_ctx, &sid,
+                                        &sid_array, &num_sids)) {
+                       DEBUG(3,("could not add user SID from rid 0x%x\n",
+                                info3->user_rid));                     
+                       return NT_STATUS_INVALID_PARAMETER;
+               }
+
+               if (!sid_compose(&sid, &(info3->dom_sid.sid),
+                                info3->group_rid)
+                   || !add_sid_to_array(mem_ctx, &sid, 
+                                        &sid_array, &num_sids)) {
+                       DEBUG(3,("could not append additional group rid 0x%x\n",
+                                info3->group_rid));                    
+                       
+                       return NT_STATUS_INVALID_PARAMETER;
+               }
+       }
+
+       for (i = 0; i < info3->num_groups2; i++) {
+               if (!sid_compose(&sid, &(info3->dom_sid.sid),
+                                info3->gids[i].g_rid)
+                   || !add_sid_to_array(mem_ctx, &sid,
+                                        &sid_array, &num_sids)) {
+                       DEBUG(3,("could not append additional group rid 0x%x\n",
+                                info3->gids[i].g_rid));        
+                       return NT_STATUS_INVALID_PARAMETER;
+               }
+       }
+
+       /* Copy 'other' sids.  We need to do sid filtering here to
+          prevent possible elevation of privileges.  See:
+
+           http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
+         */
+
+       for (i = 0; i < info3->num_other_sids; i++) {
+               if (!add_sid_to_array(mem_ctx, &info3->other_sids[i].sid,
+                                     &sid_array, &num_sids)) {
+                       DEBUG(3, ("could not add SID to array: %s\n",
+                                 sid_string_static(&info3->other_sids[i].sid)));
+                       return NT_STATUS_NO_MEMORY;
+               }
+       }
+
+       *user_sids = sid_array;
+       *num_user_sids = num_sids;
+
+       return NT_STATUS_OK;
+}

diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c
index 7846aa0813a5bc9e999d969f040c2541f4b8705d..354e7f11019a6afbc7c0e4788fe48748e4cfd90c 100644 (file)
--- a/source3/nsswitch/winbindd_pam.c
+++ b/source3/nsswitch/winbindd_pam.c
@@ -165,49 +165,12 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
                }
        }
 
-       if (!sid_compose(&sid, &(info3->dom_sid.sid),
-                        info3->user_rid)
-           || !add_sid_to_array(mem_ctx, &sid,
-                                &token->user_sids, &token->num_sids)) {
-               DEBUG(3,("could not add user SID from rid 0x%x\n",
-                        info3->user_rid));                     
-               return NT_STATUS_INVALID_PARAMETER;
-       }
-
-       if (!sid_compose(&sid, &(info3->dom_sid.sid),
-                        info3->group_rid)
-           || !add_sid_to_array(mem_ctx, &sid, 
-                                &token->user_sids, &token->num_sids)) {
-               DEBUG(3,("could not append additional group rid 0x%x\n",
-                        info3->group_rid));                    
-               
-               return NT_STATUS_INVALID_PARAMETER;
-       }
-
-       for (i = 0; i < info3->num_groups2; i++) {
-               if (!sid_compose(&sid, &(info3->dom_sid.sid),
-                                info3->gids[i].g_rid)
-                   || !add_sid_to_array(mem_ctx, &sid,
-                                        &token->user_sids, &token->num_sids)) {
-                       DEBUG(3,("could not append additional group rid 0x%x\n",
-                                info3->gids[i].g_rid));        
-                       return NT_STATUS_INVALID_PARAMETER;
-               }
-       }
-
-       /* Copy 'other' sids.  We need to do sid filtering here to
-          prevent possible elevation of privileges.  See:
-
-           http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
-         */
-
-       for (i = 0; i < info3->num_other_sids; i++) {
-               if (!add_sid_to_array(mem_ctx, &info3->other_sids[i].sid,
-                                     &token->user_sids, &token->num_sids)) {
-                       DEBUG(3, ("could not add SID to array: %s\n",
-                                 sid_string_static(&info3->other_sids[i].sid)));
-                       return NT_STATUS_NO_MEMORY;
-               }
+       status = sid_array_from_info3(mem_ctx, info3, 
+                                     &token->user_sids, 
+                                     &token->num_sids,
+                                     True);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
        }
 
        if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),