From ac39ba3389114a28f0aece5b1a6339dfcf25e1c6 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 6 Jan 2014 15:15:37 -0800 Subject: [PATCH 1/2] s3: winbindd: Move the logic of whether to set 'domain->primary' into add_trusted_domain(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=10358 Signed-off-by: Jeremy Allison Reviewed-by: Volker Lendecke (cherry picked from commit cfa6a36467f5679a88e49419e8af32b724c242bd) --- source3/winbindd/winbindd_util.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c index 6e13ca8..16c1d05 100644 --- a/source3/winbindd/winbindd_util.c +++ b/source3/winbindd/winbindd_util.c @@ -99,6 +99,7 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const char *idmap_config_option; const char *param; const char **ignored_domains, **dom; + int role = lp_server_role(); ignored_domains = lp_parm_string_list(-1, "winbind", "ignore domains", NULL); for (dom=ignored_domains; dom && *dom; dom++) { @@ -192,6 +193,15 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const sid_copy(&domain->sid, sid); } + /* Is this our primary domain ? */ + if (strequal(domain_name, get_global_sam_name()) && + (role != ROLE_DOMAIN_MEMBER)) { + domain->primary = true; + } else if (strequal(domain_name, lp_workgroup()) && + (role == ROLE_DOMAIN_MEMBER)) { + domain->primary = true; + } + /* Link to domain list */ DLIST_ADD_END(_domain_list, domain, struct winbindd_domain *); @@ -620,9 +630,6 @@ bool init_domain_list(void) domain = add_trusted_domain(get_global_sam_name(), NULL, &cache_methods, get_global_sam_sid()); if (domain) { - if ( role != ROLE_DOMAIN_MEMBER ) { - domain->primary = True; - } setup_domain_child(domain); } @@ -639,7 +646,6 @@ bool init_domain_list(void) domain = add_trusted_domain( lp_workgroup(), lp_realm(), &cache_methods, &our_sid); if (domain) { - domain->primary = True; setup_domain_child(domain); /* Even in the parent winbindd we'll need to -- 1.8.5.1 From 53a6a9eb30d997469c74c545a033fcdd41b4a848 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 6 Jan 2014 15:22:59 -0800 Subject: [PATCH 2/2] s3: winbindd: Move calling setup_domain_child() into add_trusted_domain(). Ensure it only gets called when a new domain is allocated and added to the list. This should fix problems with the previous logic where setup_domain_child() was called in places where an existing domain was returned. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10358 Signed-off-by: Jeremy Allison Reviewed-by: Volker Lendecke Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Wed Jan 8 20:46:55 CET 2014 on sn-devel-104 (cherry picked from commit ca931e460460ffe46735f98b31db47220772d566) --- source3/winbindd/winbindd_util.c | 59 +++++++++++++++------------------------- 1 file changed, 22 insertions(+), 37 deletions(-) diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c index 16c1d05..2621722 100644 --- a/source3/winbindd/winbindd_util.c +++ b/source3/winbindd/winbindd_util.c @@ -89,7 +89,10 @@ static bool is_in_internal_domain(const struct dom_sid *sid) } -/* Add a trusted domain to our list of domains */ +/* Add a trusted domain to our list of domains. + If the domain already exists in the list, + return it and don't re-initialize. */ + static struct winbindd_domain *add_trusted_domain(const char *domain_name, const char *alt_name, struct winbindd_methods *methods, const struct dom_sid *sid) @@ -147,7 +150,10 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const if (domain != NULL) { /* - * We found a match. Possibly update the SID + * We found a match on domain->name or + * domain->alt_name. Possibly update the SID + * if the stored SID was the NULL SID + * and return the matching entry. */ if ((sid != NULL) && dom_sid_equal(&domain->sid, &global_sid_NULL)) { @@ -238,6 +244,8 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const done: + setup_domain_child(domain); + DEBUG(2,("Added domain %s %s %s\n", domain->name, domain->alt_name, &domain->sid?sid_string_dbg(&domain->sid):"")); @@ -311,7 +319,6 @@ static void trustdom_list_done(struct tevent_req *req) while ((p != NULL) && (*p != '\0')) { char *q, *sidstr, *alt_name; struct dom_sid sid; - struct winbindd_domain *domain; char *alternate_name = NULL; alt_name = strchr(p, '\\'); @@ -346,23 +353,15 @@ static void trustdom_list_done(struct tevent_req *req) if ( !strequal( alt_name, "(null)" ) ) alternate_name = alt_name; - /* If we have an existing domain structure, calling - add_trusted_domain() will update the SID if - necessary. This is important because we need the - SID for sibling domains */ - - if ( find_domain_from_name_noinit(p) != NULL ) { - domain = add_trusted_domain(p, alternate_name, - &cache_methods, - &sid); - } else { - domain = add_trusted_domain(p, alternate_name, - &cache_methods, - &sid); - if (domain) { - setup_domain_child(domain); - } - } + /* + * We always call add_trusted_domain() cause on an existing + * domain structure, it will update the SID if necessary. + * This is important because we need the SID for sibling + * domains. + */ + (void)add_trusted_domain(p, alternate_name, + &cache_methods, + &sid); p=q; if (p != NULL) p += 1; @@ -436,9 +435,6 @@ static void rescan_forest_root_trusts( void ) dom_list[i].dns_name, &cache_methods, &dom_list[i].sid ); - if (d != NULL) { - setup_domain_child(d); - } } if (d == NULL) { @@ -508,9 +504,6 @@ static void rescan_forest_trusts( void ) dom_list[i].dns_name, &cache_methods, &dom_list[i].sid ); - if (d != NULL) { - setup_domain_child(d); - } } if (d == NULL) { @@ -611,7 +604,6 @@ enum winbindd_result winbindd_dual_init_connection(struct winbindd_domain *domai /* Look up global info for the winbind daemon */ bool init_domain_list(void) { - struct winbindd_domain *domain; int role = lp_server_role(); /* Free existing list */ @@ -619,23 +611,18 @@ bool init_domain_list(void) /* BUILTIN domain */ - domain = add_trusted_domain("BUILTIN", NULL, &cache_methods, + (void)add_trusted_domain("BUILTIN", NULL, &cache_methods, &global_sid_Builtin); - if (domain) { - setup_domain_child(domain); - } /* Local SAM */ - domain = add_trusted_domain(get_global_sam_name(), NULL, + (void)add_trusted_domain(get_global_sam_name(), NULL, &cache_methods, get_global_sam_sid()); - if (domain) { - setup_domain_child(domain); - } /* Add ourselves as the first entry. */ if ( role == ROLE_DOMAIN_MEMBER ) { + struct winbindd_domain *domain; struct dom_sid our_sid; if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid)) { @@ -646,8 +633,6 @@ bool init_domain_list(void) domain = add_trusted_domain( lp_workgroup(), lp_realm(), &cache_methods, &our_sid); if (domain) { - setup_domain_child(domain); - /* Even in the parent winbindd we'll need to talk to the DC, so try and see if we can contact it. Theoretically this isn't neccessary -- 1.8.5.1