git.samba.org / ira / wip.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
s3-lsa: allow to lookup BUILTIN\ in lsa_LookupNames.
[ira/wip.git] / source3 / passdb / lookup_sid.c
diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c
index b9a67f208e88c30f7e648bfe806f5b2d60b3e37e..1fcd94c059dd22204a6363bfcccb472a5880d55f 100644 (file)
--- a/source3/passdb/lookup_sid.c
+++ b/source3/passdb/lookup_sid.c
@@ -86,6 +86,14 @@ bool lookup_name(TALLOC_CTX *mem_ctx,
        if ((flags & LOOKUP_NAME_BUILTIN) &&
            strequal(domain, builtin_domain_name()))
        {
+               if (strlen(name) == 0) {
+                       /* Swap domain and name */
+                       tmp = name; name = domain; domain = tmp;
+                       sid_copy(&sid, &global_sid_Builtin);
+                       type = SID_NAME_DOMAIN;
+                       goto ok;
+               }
+
                /* Explicit request for a name in BUILTIN */
                if (lookup_builtin_name(name, &rid)) {
                        sid_copy(&sid, &global_sid_Builtin);
@@ -106,7 +114,8 @@ bool lookup_name(TALLOC_CTX *mem_ctx,
                        goto ok;
        }
 
-       if (!(flags & LOOKUP_NAME_EXPLICIT) && strequal(domain, unix_users_domain_name())) {
+       if (((flags & LOOKUP_NAME_NO_NSS) == 0)
+           && strequal(domain, unix_users_domain_name())) {
                if (lookup_unix_user_name(name, &sid)) {
                        type = SID_NAME_USER;
                        goto ok;
@@ -115,7 +124,8 @@ bool lookup_name(TALLOC_CTX *mem_ctx,
                return false;
        }
 
-       if (!(flags & LOOKUP_NAME_EXPLICIT) && strequal(domain, unix_groups_domain_name())) {
+       if (((flags & LOOKUP_NAME_NO_NSS) == 0)
+           && strequal(domain, unix_groups_domain_name())) {
                if (lookup_unix_group_name(name, &sid)) {
                        type = SID_NAME_DOM_GRP;
                        goto ok;
@@ -280,13 +290,15 @@ bool lookup_name(TALLOC_CTX *mem_ctx,
        /* 11. Ok, windows would end here. Samba has two more options:
                Unmapped users and unmapped groups */
 
-       if (!(flags & LOOKUP_NAME_EXPLICIT) && lookup_unix_user_name(name, &sid)) {
+       if (((flags & LOOKUP_NAME_NO_NSS) == 0)
+           && lookup_unix_user_name(name, &sid)) {
                domain = talloc_strdup(tmp_ctx, unix_users_domain_name());
                type = SID_NAME_USER;
                goto ok;
        }
 
-       if (!(flags & LOOKUP_NAME_EXPLICIT) && lookup_unix_group_name(name, &sid)) {
+       if (((flags & LOOKUP_NAME_NO_NSS) == 0)
+           && lookup_unix_group_name(name, &sid)) {
                domain = talloc_strdup(tmp_ctx, unix_groups_domain_name());
                type = SID_NAME_DOM_GRP;
                goto ok;
@@ -468,12 +480,15 @@ static bool lookup_rids(TALLOC_CTX *mem_ctx, const DOM_SID *domain_sid,
                   sid_string_dbg(domain_sid)));
 
        if (num_rids) {
-               *names = TALLOC_ARRAY(mem_ctx, const char *, num_rids);
+               *names = TALLOC_ZERO_ARRAY(mem_ctx, const char *, num_rids);
                *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
 
                if ((*names == NULL) || (*types == NULL)) {
                        return false;
                }
+
+               for (i = 0; i < num_rids; i++)
+                       (*types)[i] = SID_NAME_UNKNOWN;
        } else {
                *names = NULL;
                *types = NULL;
@@ -804,7 +819,7 @@ NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
                } else {
                        /* This is a normal SID with rid component */
                        if (!sid_split_rid(&sid, &rid)) {
-                               result = NT_STATUS_INVALID_PARAMETER;
+                               result = NT_STATUS_INVALID_SID;
                                goto fail;
                        }
                }
@@ -1014,7 +1029,7 @@ static bool fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid)
 
        memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
        SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
-       SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, 0));
+       SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, NULL, 0));
 
        return true;
 }
@@ -1028,7 +1043,7 @@ static bool fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
        DATA_BLOB cache_value;
 
        if (!memcache_lookup(NULL, SID_UID_CACHE,
-                            data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
+                            data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
                             &cache_value)) {
                return false;
        }
@@ -1046,11 +1061,11 @@ static bool fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
 void store_uid_sid_cache(const DOM_SID *psid, uid_t uid)
 {
        memcache_add(NULL, SID_UID_CACHE,
-                    data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
+                    data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
                     data_blob_const(&uid, sizeof(uid)));
        memcache_add(NULL, UID_SID_CACHE,
                     data_blob_const(&uid, sizeof(uid)),
-                    data_blob_const(psid, ndr_size_dom_sid(psid, 0)));
+                    data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)));
 }
 
 /*****************************************************************
@@ -1069,7 +1084,7 @@ static bool fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid)
 
        memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
        SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
-       SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, 0));
+       SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, NULL, 0));
 
        return true;
 }
@@ -1082,8 +1097,8 @@ static bool fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
 {
        DATA_BLOB cache_value;
 
-       if (!memcache_lookup(NULL, SID_UID_CACHE,
-                            data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
+       if (!memcache_lookup(NULL, SID_GID_CACHE,
+                            data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
                             &cache_value)) {
                return false;
        }
@@ -1101,11 +1116,11 @@ static bool fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
 void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
 {
        memcache_add(NULL, SID_GID_CACHE,
-                    data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
+                    data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
                     data_blob_const(&gid, sizeof(gid)));
        memcache_add(NULL, GID_SID_CACHE,
                     data_blob_const(&gid, sizeof(gid)),
-                    data_blob_const(psid, ndr_size_dom_sid(psid, 0)));
+                    data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)));
 }
 
 /*****************************************************************
@@ -1308,13 +1323,20 @@ void uid_to_sid(DOM_SID *psid, uid_t uid)
        if (!ret || expired) {
                /* Not in cache. Ask winbindd. */
                if (!winbind_uid_to_sid(psid, uid)) {
-                       if (!winbind_ping()) {
-                               legacy_uid_to_sid(psid, uid);
-                               return;
-                       }
+                       /*
+                        * We shouldn't return the NULL SID
+                        * here if winbind was running and
+                        * couldn't map, as winbind will have
+                        * added a negative entry that will
+                        * cause us to go though the
+                        * legacy_uid_to_sid()
+                        * function anyway in the case above
+                        * the next time we ask.
+                        */
+                       DEBUG(5, ("uid_to_sid: winbind failed to find a sid "
+                                 "for uid %u\n", (unsigned int)uid));
 
-                       DEBUG(5, ("uid_to_sid: winbind failed to find a sid for uid %u\n",
-                               uid));
+                       legacy_uid_to_sid(psid, uid);
                        return;
                }
        }
@@ -1354,13 +1376,20 @@ void gid_to_sid(DOM_SID *psid, gid_t gid)
        if (!ret || expired) {
                /* Not in cache. Ask winbindd. */
                if (!winbind_gid_to_sid(psid, gid)) {
-                       if (!winbind_ping()) {
-                               legacy_gid_to_sid(psid, gid);
-                               return;
-                       }
+                       /*
+                        * We shouldn't return the NULL SID
+                        * here if winbind was running and
+                        * couldn't map, as winbind will have
+                        * added a negative entry that will
+                        * cause us to go though the
+                        * legacy_gid_to_sid()
+                        * function anyway in the case above
+                        * the next time we ask.
+                        */
+                       DEBUG(5, ("gid_to_sid: winbind failed to find a sid "
+                                 "for gid %u\n", (unsigned int)gid));
 
-                       DEBUG(5, ("gid_to_sid: winbind failed to find a sid for gid %u\n",
-                               gid));
+                       legacy_gid_to_sid(psid, gid);
                        return;
                }
        }
@@ -1416,13 +1445,10 @@ bool sid_to_uid(const DOM_SID *psid, uid_t *puid)
        if (!ret || expired) {
                /* Not in cache. Ask winbindd. */
                if (!winbind_sid_to_uid(puid, psid)) {
-                       if (!winbind_ping()) {
-                               return legacy_sid_to_uid(psid, puid);
-                       }
-
                        DEBUG(5, ("winbind failed to find a uid for sid %s\n",
                                  sid_string_dbg(psid)));
-                       return false;
+                       /* winbind failed. do legacy */
+                       return legacy_sid_to_uid(psid, puid);
                }
        }
 
@@ -1483,13 +1509,11 @@ bool sid_to_gid(const DOM_SID *psid, gid_t *pgid)
                 * (Idmap will check it is a valid SID and of the right type) */
 
                if ( !winbind_sid_to_gid(pgid, psid) ) {
-                       if (!winbind_ping()) {
-                               return legacy_sid_to_gid(psid, pgid);
-                       }
 
                        DEBUG(10,("winbind failed to find a gid for sid %s\n",
                                  sid_string_dbg(psid)));
-                       return false;
+                       /* winbind failed. do legacy */
+                       return legacy_sid_to_gid(psid, pgid);
                }
        }
 
Unnamed repository; edit this file 'description' to name the repository.