1 From a280f61d71d5ea7e2212d253b84ac5b25810b88e Mon Sep 17 00:00:00 2001
2 From: Uri Simchoni <uri@samba.org>
3 Date: Wed, 10 Feb 2016 00:26:45 +0200
4 Subject: [PATCH 1/4] winbindd: introduce add_trusted_domain_from_tdc()
6 This is purely a refactoring patch -
7 Add a routine that adds a winbindd domain object based on
8 domain trust cache entry. add_trusted_domain() becomes
9 a wrapper for this new routine.
11 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11691
13 Signed-off-by: Uri Simchoni <uri@samba.org>
14 Reviewed-by: Ralph Boehme <slow@samba.org>
16 source3/winbindd/winbindd_util.c | 76 +++++++++++++++++++++++++---------------
17 1 file changed, 48 insertions(+), 28 deletions(-)
19 diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
20 index 353722e..70a9041 100644
21 --- a/source3/winbindd/winbindd_util.c
22 +++ b/source3/winbindd/winbindd_util.c
25 #define DBGC_CLASS DBGC_WINBIND
27 +static struct winbindd_domain *
28 +add_trusted_domain_from_tdc(const struct winbindd_tdc_domain *tdc,
29 + struct winbindd_methods *methods);
31 extern struct winbindd_methods cache_methods;
34 @@ -91,11 +95,31 @@ static bool is_in_internal_domain(const struct dom_sid *sid)
36 /* Add a trusted domain to our list of domains.
37 If the domain already exists in the list,
38 - return it and don't re-initialize.
40 -static struct winbindd_domain *add_trusted_domain(const char *domain_name, const char *alt_name,
41 - struct winbindd_methods *methods,
42 - const struct dom_sid *sid)
43 + return it and don't re-initialize. */
45 +static struct winbindd_domain *
46 +add_trusted_domain(const char *domain_name, const char *alt_name,
47 + struct winbindd_methods *methods, const struct dom_sid *sid)
49 + struct winbindd_tdc_domain tdc;
53 + tdc.domain_name = domain_name;
54 + tdc.dns_name = alt_name;
56 + sid_copy(&tdc.sid, sid);
59 + return add_trusted_domain_from_tdc(&tdc, methods);
62 +/* Add a trusted domain out of a trusted domain cache
65 +static struct winbindd_domain *
66 +add_trusted_domain_from_tdc(const struct winbindd_tdc_domain *tdc,
67 + struct winbindd_methods *methods)
69 struct winbindd_domain *domain;
70 const char *alternative_name = NULL;
71 @@ -103,6 +127,12 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const
73 const char **ignored_domains, **dom;
74 int role = lp_server_role();
75 + const char *domain_name = tdc->domain_name;
76 + const struct dom_sid *sid = &tdc->sid;
78 + if (is_null_sid(sid)) {
82 ignored_domains = lp_parm_string_list(-1, "winbind", "ignore domains", NULL);
83 for (dom=ignored_domains; dom && *dom; dom++) {
84 @@ -114,8 +144,8 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const
86 /* ignore alt_name if we are not in an AD domain */
88 - if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) {
89 - alternative_name = alt_name;
90 + if (tdc->dns_name && *tdc->dns_name) {
91 + alternative_name = tdc->dns_name;
94 /* We can't call domain_list() as this function is called from
95 @@ -127,8 +157,7 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const
99 - if (alternative_name && *alternative_name)
101 + if (alternative_name) {
102 if (strequal(alternative_name, domain->name) ||
103 strequal(alternative_name, domain->alt_name))
105 @@ -136,12 +165,7 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const
111 - if (is_null_sid(sid)) {
116 if (dom_sid_equal(sid, &domain->sid)) {
119 @@ -191,11 +215,11 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const
120 domain->internal = is_internal_domain(sid);
121 domain->sequence_number = DOM_SEQUENCE_NONE;
122 domain->last_seq_check = 0;
123 - domain->initialized = False;
124 + domain->initialized = false;
125 domain->online = is_internal_domain(sid);
126 domain->check_online_timeout = 0;
127 domain->dc_probe_pid = (pid_t)-1;
130 sid_copy(&domain->sid, sid);
133 @@ -246,9 +270,9 @@ done:
135 setup_domain_child(domain);
137 - DEBUG(2,("Added domain %s %s %s\n",
138 - domain->name, domain->alt_name,
139 - &domain->sid?sid_string_dbg(&domain->sid):""));
141 + ("Added domain %s %s %s\n", domain->name, domain->alt_name,
142 + !is_null_sid(&domain->sid) ? sid_string_dbg(&domain->sid) : ""));
146 @@ -432,10 +456,8 @@ static void rescan_forest_root_trusts( void )
147 d = find_domain_from_name_noinit( dom_list[i].domain_name );
150 - (void)add_trusted_domain( dom_list[i].domain_name,
151 - dom_list[i].dns_name,
154 + d = add_trusted_domain_from_tdc(&dom_list[i],
159 @@ -501,10 +523,8 @@ static void rescan_forest_trusts( void )
163 - (void)add_trusted_domain( dom_list[i].domain_name,
164 - dom_list[i].dns_name,
167 + d = add_trusted_domain_from_tdc(&dom_list[i],
176 From 153f173eea81ffa1caa4768589a08bb20a6a1950 Mon Sep 17 00:00:00 2001
177 From: Stefan Metzmacher <metze@samba.org>
178 Date: Tue, 23 Dec 2014 09:43:03 +0000
179 Subject: [PATCH 2/4] s3:winbindd: mark our primary as active_directory if
182 Signed-off-by: Stefan Metzmacher <metze@samba.org>
183 Reviewed-by: Guenther Deschner <gd@samba.org>
185 source3/winbindd/winbindd_util.c | 6 ++++++
186 1 file changed, 6 insertions(+)
188 diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
189 index 70a9041..700076a 100644
190 --- a/source3/winbindd/winbindd_util.c
191 +++ b/source3/winbindd/winbindd_util.c
192 @@ -232,6 +232,12 @@ add_trusted_domain_from_tdc(const struct winbindd_tdc_domain *tdc,
193 domain->primary = true;
196 + if (domain->primary) {
197 + if (lp_security() == SEC_ADS) {
198 + domain->active_directory = true;
202 /* Link to domain list */
203 DLIST_ADD_END(_domain_list, domain, struct winbindd_domain *);
209 From 5d741ee3d1dafbb32c106fed817840892b69598d Mon Sep 17 00:00:00 2001
210 From: Uri Simchoni <uri@samba.org>
211 Date: Wed, 10 Feb 2016 00:32:23 +0200
212 Subject: [PATCH 3/4] winbindd: initialize foreign domain as AD based on trust
214 Based on trust parameters, initialize the active_directory
215 member of domain object to true.
217 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11691
219 Signed-off-by: Uri Simchoni <uri@samba.org>
220 Reviewed-by: Ralph Boehme <slow@samba.org>
222 source3/winbindd/winbindd_util.c | 7 +++++++
223 1 file changed, 7 insertions(+)
225 diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
226 index 700076a..aaa9ee8 100644
227 --- a/source3/winbindd/winbindd_util.c
228 +++ b/source3/winbindd/winbindd_util.c
229 @@ -222,6 +222,9 @@ add_trusted_domain_from_tdc(const struct winbindd_tdc_domain *tdc,
231 sid_copy(&domain->sid, sid);
233 + domain->domain_flags = tdc->trust_flags;
234 + domain->domain_type = tdc->trust_type;
235 + domain->domain_trust_attribs = tdc->trust_attribs;
237 /* Is this our primary domain ? */
238 if (strequal(domain_name, get_global_sam_name()) &&
239 @@ -236,6 +239,10 @@ add_trusted_domain_from_tdc(const struct winbindd_tdc_domain *tdc,
240 if (lp_security() == SEC_ADS) {
241 domain->active_directory = true;
243 + } else if (!domain->internal) {
244 + if (domain->domain_type == LSA_TRUST_TYPE_UPLEVEL) {
245 + domain->active_directory = true;
249 /* Link to domain list */
254 From a8ac7dcae2e3b00362ea9d91b5ef7f149bc734a0 Mon Sep 17 00:00:00 2001
255 From: Uri Simchoni <uri@samba.org>
256 Date: Wed, 10 Feb 2016 00:38:11 +0200
257 Subject: [PATCH 4/4] winbindd: return trust parameters when listing trusts
259 Content-Type: text/plain; charset=UTF-8
260 Content-Transfer-Encoding: 8bit
262 When asking a child domain process to list trusts on that domain,
263 return (along with trust domain names and SID) the trust properties -
264 flags, type, and attributes.
266 Use those attributes to initialize domain object.
268 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11691
270 Signed-off-by: Uri Simchoni <uri@samba.org>
271 Reviewed-by: Ralph Boehme <slow@samba.org>
273 Autobuild-User(master): Ralph Böhme <slow@samba.org>
274 Autobuild-Date(master): Tue Feb 23 22:02:16 CET 2016 on sn-devel-144
276 source3/winbindd/winbindd_misc.c | 11 +++---
277 source3/winbindd/winbindd_util.c | 82 +++++++++++++++++++++++++++++-----------
278 2 files changed, 65 insertions(+), 28 deletions(-)
280 diff --git a/source3/winbindd/winbindd_misc.c b/source3/winbindd/winbindd_misc.c
281 index 7d25167..5335ad9 100644
282 --- a/source3/winbindd/winbindd_misc.c
283 +++ b/source3/winbindd/winbindd_misc.c
284 @@ -172,11 +172,12 @@ enum winbindd_result winbindd_dual_list_trusted_domains(struct winbindd_domain *
286 for (i=0; i<trusts.count; i++) {
287 extra_data = talloc_asprintf_append_buffer(
288 - extra_data, "%s\\%s\\%s\n",
289 - trusts.array[i].netbios_name,
290 - trusts.array[i].dns_name,
291 - sid_string_talloc(state->mem_ctx,
292 - trusts.array[i].sid));
293 + extra_data, "%s\\%s\\%s\\%u\\%u\\%u\n",
294 + trusts.array[i].netbios_name, trusts.array[i].dns_name,
295 + sid_string_talloc(state->mem_ctx, trusts.array[i].sid),
296 + trusts.array[i].trust_flags,
297 + (uint32_t)trusts.array[i].trust_type,
298 + trusts.array[i].trust_attributes);
301 /* add our primary domain */
302 diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
303 index aaa9ee8..b99fac4 100644
304 --- a/source3/winbindd/winbindd_util.c
305 +++ b/source3/winbindd/winbindd_util.c
306 @@ -343,6 +343,8 @@ static void trustdom_list_done(struct tevent_req *req)
307 struct winbindd_response *response;
310 + struct winbindd_tdc_domain trust_params = {0};
311 + ptrdiff_t extra_len;
313 res = wb_domain_request_recv(req, state, &response, &err);
314 if ((res == -1) || (response->result != WINBINDD_OK)) {
315 @@ -351,17 +353,27 @@ static void trustdom_list_done(struct tevent_req *req)
319 + if (response->length < sizeof(struct winbindd_response)) {
320 + DEBUG(0, ("ill-formed trustdom response - short length\n"));
321 + TALLOC_FREE(state);
325 + extra_len = response->length - sizeof(struct winbindd_response);
327 p = (char *)response->extra_data.data;
329 - while ((p != NULL) && (*p != '\0')) {
330 + while ((p - (char *)response->extra_data.data) < extra_len) {
331 char *q, *sidstr, *alt_name;
332 - struct dom_sid sid;
333 - struct winbindd_domain *domain;
334 - char *alternate_name = NULL;
336 + DEBUG(10, ("parsing response line '%s'\n", p));
338 + ZERO_STRUCT(trust_params);
339 + trust_params.domain_name = p;
341 alt_name = strchr(p, '\\');
342 if (alt_name == NULL) {
343 - DEBUG(0, ("Got invalid trustdom response\n"));
344 + DEBUG(10, ("Got invalid trustdom response\n"));
348 @@ -370,39 +382,63 @@ static void trustdom_list_done(struct tevent_req *req)
350 sidstr = strchr(alt_name, '\\');
351 if (sidstr == NULL) {
352 - DEBUG(0, ("Got invalid trustdom response\n"));
353 + DEBUG(10, ("Got invalid trustdom response\n"));
360 - q = strchr(sidstr, '\n');
363 + /* use the real alt_name if we have one, else pass in NULL */
364 + if (!strequal(alt_name, "(null)")) {
365 + trust_params.dns_name = alt_name;
368 + q = strtok(sidstr, "\\");
370 + DEBUG(10, ("Got invalid trustdom response\n"));
374 + if (!string_to_sid(&trust_params.sid, sidstr)) {
375 + DEBUG(0, ("Got invalid trustdom response\n"));
379 - if (!string_to_sid(&sid, sidstr)) {
380 + q = strtok(NULL, "\\");
382 DEBUG(0, ("Got invalid trustdom response\n"));
386 - /* use the real alt_name if we have one, else pass in NULL */
387 + trust_params.trust_flags = (uint32_t)strtoul(q, NULL, 10);
389 - if ( !strequal( alt_name, "(null)" ) )
390 - alternate_name = alt_name;
391 + q = strtok(NULL, "\\");
393 + DEBUG(0, ("Got invalid trustdom response\n"));
397 + trust_params.trust_type = (uint32_t)strtoul(q, NULL, 10);
399 - /* If we have an existing domain structure, calling
400 - add_trusted_domain() will update the SID if
401 - necessary. This is important because we need the
402 - SID for sibling domains */
403 + q = strtok(NULL, "\n");
405 + DEBUG(10, ("Got invalid trustdom response\n"));
409 - (void)add_trusted_domain(p, alternate_name,
412 + trust_params.trust_attribs = (uint32_t)strtoul(q, NULL, 10);
415 + * We always call add_trusted_domain() cause on an existing
416 + * domain structure, it will update the SID if necessary.
417 + * This is important because we need the SID for sibling
420 + (void)add_trusted_domain_from_tdc(&trust_params,
426 + p = q + strlen(q) + 1;