Fix bug 6097

[ira/wip.git] / source3 / passdb / lookup_sid.c

diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c
index 3861c8e229c9314263285ebada7e50ffe5658faa..a5c2d503662da13ea85d4445f7d7a144be577844 100644 (file)
--- a/source3/passdb/lookup_sid.c
+++ b/source3/passdb/lookup_sid.c
@@ -746,7 +746,7 @@ NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
        }
 
        dom_infos = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_dom_info,
-                                     MAX_REF_DOMAINS);
+                                     LSA_REF_DOMAIN_LIST_MULTIPLIER);
        if (dom_infos == NULL) {
                result = NT_STATUS_NO_MEMORY;
                goto fail;
@@ -804,7 +804,7 @@ NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
                } else {
                        /* This is a normal SID with rid component */
                        if (!sid_split_rid(&sid, &rid)) {
-                               result = NT_STATUS_INVALID_PARAMETER;
+                               result = NT_STATUS_INVALID_SID;
                                goto fail;
                        }
                }
@@ -816,7 +816,7 @@ NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
                        continue;
                }
 
-               for (j=0; j<MAX_REF_DOMAINS; j++) {
+               for (j=0; j<LSA_REF_DOMAIN_LIST_MULTIPLIER; j++) {
                        if (!dom_infos[j].valid) {
                                break;
                        }
@@ -825,7 +825,7 @@ NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
                        }
                }
 
-               if (j == MAX_REF_DOMAINS) {
+               if (j == LSA_REF_DOMAIN_LIST_MULTIPLIER) {
                        /* TODO: What's the right error message here? */
                        result = NT_STATUS_NONE_MAPPED;
                        goto fail;
@@ -869,7 +869,7 @@ NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
 
        /* Iterate over the domains found */
 
-       for (i=0; i<MAX_REF_DOMAINS; i++) {
+       for (i=0; i<LSA_REF_DOMAIN_LIST_MULTIPLIER; i++) {
                uint32_t *rids;
                const char *domain_name = NULL;
                const char **names;
@@ -1014,7 +1014,7 @@ static bool fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid)
 
        memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
        SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
-       SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, 0));
+       SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, NULL, 0));
 
        return true;
 }
@@ -1028,7 +1028,7 @@ static bool fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
        DATA_BLOB cache_value;
 
        if (!memcache_lookup(NULL, SID_UID_CACHE,
-                            data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
+                            data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
                             &cache_value)) {
                return false;
        }
@@ -1046,11 +1046,11 @@ static bool fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
 void store_uid_sid_cache(const DOM_SID *psid, uid_t uid)
 {
        memcache_add(NULL, SID_UID_CACHE,
-                    data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
+                    data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
                     data_blob_const(&uid, sizeof(uid)));
        memcache_add(NULL, UID_SID_CACHE,
                     data_blob_const(&uid, sizeof(uid)),
-                    data_blob_const(psid, ndr_size_dom_sid(psid, 0)));
+                    data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)));
 }
 
 /*****************************************************************
@@ -1069,7 +1069,7 @@ static bool fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid)
 
        memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
        SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
-       SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, 0));
+       SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, NULL, 0));
 
        return true;
 }
@@ -1083,7 +1083,7 @@ static bool fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
        DATA_BLOB cache_value;
 
        if (!memcache_lookup(NULL, SID_UID_CACHE,
-                            data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
+                            data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
                             &cache_value)) {
                return false;
        }
@@ -1101,11 +1101,11 @@ static bool fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
 void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
 {
        memcache_add(NULL, SID_GID_CACHE,
-                    data_blob_const(psid, ndr_size_dom_sid(psid, 0)),
+                    data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
                     data_blob_const(&gid, sizeof(gid)));
        memcache_add(NULL, GID_SID_CACHE,
                     data_blob_const(&gid, sizeof(gid)),
-                    data_blob_const(psid, ndr_size_dom_sid(psid, 0)));
+                    data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)));
 }
 
 /*****************************************************************
@@ -1308,13 +1308,20 @@ void uid_to_sid(DOM_SID *psid, uid_t uid)
        if (!ret || expired) {
                /* Not in cache. Ask winbindd. */
                if (!winbind_uid_to_sid(psid, uid)) {
-                       if (!winbind_ping()) {
-                               legacy_uid_to_sid(psid, uid);
-                               return;
-                       }
+                       /*
+                        * We shouldn't return the NULL SID
+                        * here if winbind was running and
+                        * couldn't map, as winbind will have
+                        * added a negative entry that will
+                        * cause us to go though the
+                        * legacy_uid_to_sid()
+                        * function anyway in the case above
+                        * the next time we ask.
+                        */
+                       DEBUG(5, ("uid_to_sid: winbind failed to find a sid "
+                                 "for uid %u\n", uid));
 
-                       DEBUG(5, ("uid_to_sid: winbind failed to find a sid for uid %u\n",
-                               uid));
+                       legacy_uid_to_sid(psid, uid);
                        return;
                }
        }
@@ -1354,13 +1361,20 @@ void gid_to_sid(DOM_SID *psid, gid_t gid)
        if (!ret || expired) {
                /* Not in cache. Ask winbindd. */
                if (!winbind_gid_to_sid(psid, gid)) {
-                       if (!winbind_ping()) {
-                               legacy_gid_to_sid(psid, gid);
-                               return;
-                       }
+                       /*
+                        * We shouldn't return the NULL SID
+                        * here if winbind was running and
+                        * couldn't map, as winbind will have
+                        * added a negative entry that will
+                        * cause us to go though the
+                        * legacy_gid_to_sid()
+                        * function anyway in the case above
+                        * the next time we ask.
+                        */
+                       DEBUG(5, ("gid_to_sid: winbind failed to find a sid "
+                                 "for gid %u\n", gid));
 
-                       DEBUG(5, ("gid_to_sid: winbind failed to find a sid for gid %u\n",
-                               gid));
+                       legacy_gid_to_sid(psid, gid);
                        return;
                }
        }