Merge branch 'v3-2-test' of ssh://git.samba.org/data/git/samba into v3-2-test

(This used to be commit 2c3ffc1c53550c8e6feeca8fc0270ef9ac1ec70a)

5 files changed, 396 insertions, 20 deletions

diff --git a/source3/nsswitch/libwbclient/wbc_pam.c b/source3/nsswitch/libwbclient/wbc_pam.c
index 2b33f55990..a0e91faaf3 100644
--- a/source3/nsswitch/libwbclient/wbc_pam.c
+++ b/source3/nsswitch/libwbclient/wbc_pam.c
@@ -138,7 +138,7 @@ static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
 
 	p = (char *)resp->extra_data.data;
 	if (!p) {
-		wbc_status = WBC_INVALID_RESPONSE;
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
 		BAIL_ON_WBC_ERROR(wbc_status);
 	}
 
@@ -149,7 +149,7 @@ static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
 		char *s = p;
 		char *e = strchr(p, '\n');
 		if (!e) {
-			wbc_status = WBC_INVALID_RESPONSE;
+			wbc_status = WBC_ERR_INVALID_RESPONSE;
 			BAIL_ON_WBC_ERROR(wbc_status);
 		}
 		e[0] = '\0';
@@ -157,7 +157,7 @@ static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
 
 		ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
 		if (ret != 2) {
-			wbc_status = WBC_INVALID_RESPONSE;
+			wbc_status = WBC_ERR_INVALID_RESPONSE;
 			BAIL_ON_WBC_ERROR(wbc_status);
 		}
 
@@ -173,7 +173,7 @@ static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
 		char *a;
 		char *e = strchr(p, '\n');
 		if (!e) {
-			wbc_status = WBC_INVALID_RESPONSE;
+			wbc_status = WBC_ERR_INVALID_RESPONSE;
 			BAIL_ON_WBC_ERROR(wbc_status);
 		}
 		e[0] = '\0';
@@ -181,7 +181,7 @@ static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
 
 		e = strchr(s, ':');
 		if (!e) {
-			wbc_status = WBC_INVALID_RESPONSE;
+			wbc_status = WBC_ERR_INVALID_RESPONSE;
 			BAIL_ON_WBC_ERROR(wbc_status);
 		}
 		e[0] = '\0';
@@ -190,7 +190,7 @@ static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
 		ret = sscanf(a, "0x%08X",
 			     &attrs);
 		if (ret != 1) {
-			wbc_status = WBC_INVALID_RESPONSE;
+			wbc_status = WBC_ERR_INVALID_RESPONSE;
 			BAIL_ON_WBC_ERROR(wbc_status);
 		}
 
@@ -419,3 +419,54 @@ done:
 
 	return wbc_status;
 }
+
+/** @brief Trigger a verification of the trust credentials of a specific domain
+ *
+ * @param *domain      The name of the domain, only NULL for the default domain is
+ *                     supported yet. Other values than NULL will result in
+ *                     WBC_ERR_NOT_IMPLEMENTED.
+ * @param error        Output details on WBC_ERR_AUTH_ERROR
+ *
+ * @return #wbcErr
+ *
+ **/
+wbcErr wbcCheckTrustCredentials(const char *domain,
+				struct wbcAuthErrorInfo **error)
+{
+	struct winbindd_request request;
+	struct winbindd_response response;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+	if (domain) {
+		/*
+		 * the current protocol doesn't support
+		 * specifying a domain
+		 */
+		wbc_status = WBC_ERR_NOT_IMPLEMENTED;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	ZERO_STRUCT(request);
+	ZERO_STRUCT(response);
+
+	/* Send request */
+
+	wbc_status = wbcRequestResponse(WINBINDD_CHECK_MACHACC,
+					&request,
+					&response);
+	if (response.data.auth.nt_status != 0) {
+		if (error) {
+			wbc_status = wbc_create_error_info(NULL,
+							   &response,
+							   error);
+			BAIL_ON_WBC_ERROR(wbc_status);
+		}
+
+		wbc_status = WBC_ERR_AUTH_ERROR;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+	return wbc_status;
+}
diff --git a/source3/nsswitch/libwbclient/wbc_sid.c b/source3/nsswitch/libwbclient/wbc_sid.c
index 6ef9f44c3b..de9b02822f 100644
--- a/source3/nsswitch/libwbclient/wbc_sid.c
+++ b/source3/nsswitch/libwbclient/wbc_sid.c
@@ -372,21 +372,21 @@ wbcErr wbcLookupRids(struct wbcDomainSid *dom_sid,
 		char *q;
 
 		if (*p == '\0') {
-			wbc_status = WBC_INVALID_RESPONSE;
+			wbc_status = WBC_ERR_INVALID_RESPONSE;
 			BAIL_ON_WBC_ERROR(wbc_status);
 		}
 
 		(*types)[i] = (enum wbcSidType)strtoul(p, &q, 10);
 
 		if (*q != ' ') {
-			wbc_status = WBC_INVALID_RESPONSE;
+			wbc_status = WBC_ERR_INVALID_RESPONSE;
 			BAIL_ON_WBC_ERROR(wbc_status);
 		}
 
 		p = q+1;
 
 		if ((q = strchr(p, '\n')) == NULL) {
-			wbc_status = WBC_INVALID_RESPONSE;
+			wbc_status = WBC_ERR_INVALID_RESPONSE;
 			BAIL_ON_WBC_ERROR(wbc_status);
 		}
 
@@ -399,7 +399,7 @@ wbcErr wbcLookupRids(struct wbcDomainSid *dom_sid,
 	}
 
 	if (*p != '\0') {
-		wbc_status = WBC_INVALID_RESPONSE;
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
 		BAIL_ON_WBC_ERROR(wbc_status);
 	}
 
@@ -471,7 +471,7 @@ wbcErr wbcLookupUserSids(const struct wbcDomainSid *user_sid,
 
 	if (response.data.num_entries &&
 	    !response.extra_data.data) {
-		wbc_status = WBC_INVALID_RESPONSE;
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
 		BAIL_ON_WBC_ERROR(wbc_status);
 	}
 
diff --git a/source3/nsswitch/libwbclient/wbc_util.c b/source3/nsswitch/libwbclient/wbc_util.c
index 7bdae91544..a1b6626bd3 100644
--- a/source3/nsswitch/libwbclient/wbc_util.c
+++ b/source3/nsswitch/libwbclient/wbc_util.c
@@ -3,7 +3,7 @@
 
    Winbind client API
 
-   Copyright (C) Gerald (Jerry) Carter 2007
+   Copyright (C) Gerald (Jerry) Carter 2007-2008
 
 
    This library is free software; you can redistribute it and/or
@@ -170,11 +170,11 @@ wbcErr wbcDomainInfo(const char *domain, struct wbcDomainInfo **dinfo)
 	BAIL_ON_WBC_ERROR(wbc_status);
 
 	if (response.data.domain_info.native_mode)
-		info->flags |= WBC_DOMINFO_NATIVE;
+		info->domain_flags |= WBC_DOMINFO_NATIVE;
 	if (response.data.domain_info.active_directory)
-		info->flags |= WBC_DOMINFO_AD;
+		info->domain_flags |= WBC_DOMINFO_AD;
 	if (response.data.domain_info.primary)
-		info->flags |= WBC_DOMINFO_PRIMARY;
+		info->domain_flags |= WBC_DOMINFO_PRIMARY;
 
 	*dinfo = info;
 
@@ -187,3 +187,295 @@ wbcErr wbcDomainInfo(const char *domain, struct wbcDomainInfo **dinfo)
 
 	return wbc_status;
 }
+
+
+/** @brief Resolve a NetbiosName via WINS
+ *
+ * @param name         Name to resolve
+ * @param *ip          Pointer to the ip address string
+ *
+ * @return #wbcErr
+ *
+ **/
+wbcErr wbcResolveWinsByName(const char *name, char **ip)
+{
+	struct winbindd_request request;
+	struct winbindd_response response;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	char *ipaddr;
+
+	ZERO_STRUCT(request);
+	ZERO_STRUCT(response);
+
+	/* Send request */
+
+	strncpy(request.data.winsreq, name,
+		sizeof(request.data.winsreq)-1);
+
+	wbc_status = wbcRequestResponse(WINBINDD_WINS_BYNAME,
+					&request,
+					&response);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	/* Display response */
+
+	ipaddr = talloc_strdup(NULL, response.data.winsresp);
+	BAIL_ON_PTR_ERROR(ipaddr, wbc_status);
+
+	*ip = ipaddr;
+	wbc_status = WBC_ERR_SUCCESS;
+
+ done:
+	return wbc_status;
+}
+
+/** @brief Resolve an IP address via WINS into a NetbiosName
+ *
+ * @param ip          The ip address string
+ * @param *name       Pointer to the name
+ *
+ * @return #wbcErr
+ *
+ **/
+wbcErr wbcResolveWinsByIP(const char *ip, char **name)
+{
+	struct winbindd_request request;
+	struct winbindd_response response;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	char *name_str;
+
+	ZERO_STRUCT(request);
+	ZERO_STRUCT(response);
+
+	/* Send request */
+
+	strncpy(request.data.winsreq, ip,
+		sizeof(request.data.winsreq)-1);
+
+	wbc_status = wbcRequestResponse(WINBINDD_WINS_BYIP,
+					&request,
+					&response);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	/* Display response */
+
+	name_str = talloc_strdup(NULL, response.data.winsresp);
+	BAIL_ON_PTR_ERROR(name_str, wbc_status);
+
+	*name = name_str;
+	wbc_status = WBC_ERR_SUCCESS;
+
+ done:
+	return wbc_status;
+}
+
+/**
+ */
+
+static wbcErr process_domain_info_string(TALLOC_CTX *ctx, 
+					 struct wbcDomainInfo *info,
+					 char *info_string)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	char *r = NULL;
+	char *s = NULL;
+
+	if (!info || !info_string) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	r = info_string;
+
+	/* Short Name */
+	if ((s = strchr(r, '\\')) == NULL) {
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	*s = '\0';
+	s++;
+
+	info->short_name = talloc_strdup(ctx, r);
+	BAIL_ON_PTR_ERROR(info->short_name, wbc_status);
+
+
+	/* DNS Name */
+	r = s;
+	if ((s = strchr(r, '\\')) == NULL) {
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	*s = '\0';
+	s++;
+
+	info->dns_name = talloc_strdup(ctx, r);
+	BAIL_ON_PTR_ERROR(info->dns_name, wbc_status);
+
+	/* SID */
+	r = s;
+	if ((s = strchr(r, '\\')) == NULL) {
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	*s = '\0';
+	s++;
+
+	wbc_status = wbcStringToSid(r, &info->sid);
+	BAIL_ON_WBC_ERROR(wbc_status);
+	
+	/* Trust type */
+	r = s;
+	if ((s = strchr(r, '\\')) == NULL) {
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	*s = '\0';
+	s++;
+
+	if (strcmp(r, "None") == 0) {
+		info->trust_type = WBC_DOMINFO_TRUSTTYPE_NONE;
+	} else if (strcmp(r, "External") == 0) {
+		info->trust_type = WBC_DOMINFO_TRUSTTYPE_EXTERNAL;
+	} else if (strcmp(r, "Forest") == 0) {
+		info->trust_type = WBC_DOMINFO_TRUSTTYPE_FOREST;
+	} else if (strcmp(r, "In Forest") == 0) {
+		info->trust_type = WBC_DOMINFO_TRUSTTYPE_IN_FOREST;
+	} else {
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	/* Transitive */
+	r = s;
+	if ((s = strchr(r, '\\')) == NULL) {
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	*s = '\0';
+	s++;
+
+	if (strcmp(r, "Yes") == 0) {
+		info->trust_flags |= WBC_DOMINFO_TRUST_TRANSITIVE;		
+	}
+	
+	/* Incoming */
+	r = s;
+	if ((s = strchr(r, '\\')) == NULL) {
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	*s = '\0';
+	s++;
+
+	if (strcmp(r, "Yes") == 0) {
+		info->trust_flags |= WBC_DOMINFO_TRUST_INCOMING;		
+	}
+
+	/* Outgoing */
+	r = s;
+	if (r == NULL) {
+		wbc_status = WBC_ERR_INVALID_RESPONSE;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	if (strcmp(r, "Yes") == 0) {
+		info->trust_flags |= WBC_DOMINFO_TRUST_OUTGOING;		
+	}
+
+	wbc_status = WBC_ERR_SUCCESS;
+
+ done:
+	return wbc_status;
+}
+
+/** @brief Enumerate the domain trusts known by Winbind
+ *
+ * @param **domains     Pointer to the allocated domain list array
+ * @param *num_domains  Pointer to number of domains returned
+ *
+ * @return #wbcErr
+ *
+ **/
+wbcErr wbcListTrusts(struct wbcDomainInfo **domains, size_t *num_domains)
+{
+	struct winbindd_response response;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	char *p = NULL;
+	char *q = NULL;
+	char *extra_data = NULL;	
+	int count = 0;	
+	struct wbcDomainInfo *d_list = NULL;
+	int i = 0;
+	
+	*domains = NULL;
+	*num_domains = 0;
+	
+	ZERO_STRUCT(response);
+
+	/* Send request */
+
+	wbc_status = wbcRequestResponse(WINBINDD_LIST_TRUSTDOM,
+					NULL,
+					&response);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	/* Decode the response */
+
+	p = (char *)response.extra_data.data;
+
+	if (strlen(p) == 0) {
+		/* We should always at least get back our 
+		   own SAM domain */
+		
+		wbc_status = WBC_ERR_DOMAIN_NOT_FOUND;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	/* Count number of domains */
+
+	count = 0;	
+	while (p) {
+		count++;
+
+		if ((q = strchr(p, '\n')) != NULL)
+			q++;
+		p = q;		
+	}
+
+	d_list = talloc_array(NULL, struct wbcDomainInfo, count);
+	BAIL_ON_PTR_ERROR(d_list, wbc_status);
+
+	extra_data = strdup((char*)response.extra_data.data);
+	BAIL_ON_PTR_ERROR(extra_data, wbc_status);
+
+	p = extra_data;	
+
+	/* Outer loop processes the list of domain information */
+
+	for (i=0; i<count && p; i++) {
+		char *next = strchr(p, '\n');
+		
+		if (next) {
+			*next = '\0';
+			next++;
+		}
+
+		wbc_status = process_domain_info_string(d_list, &d_list[i], p);
+		BAIL_ON_WBC_ERROR(wbc_status);
+
+		p = next;
+	}
+
+	*domains = d_list;	
+	*num_domains = i;	
+	
+ done:
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		if (d_list)
+			talloc_free(d_list);
+		if (extra_data)
+			free(extra_data);
+	}
+
+	return wbc_status;
+}
diff --git a/source3/nsswitch/libwbclient/wbclient.c b/source3/nsswitch/libwbclient/wbclient.c
index b52c6b01e4..9383fd5406 100644
--- a/source3/nsswitch/libwbclient/wbclient.c
+++ b/source3/nsswitch/libwbclient/wbclient.c
@@ -106,8 +106,8 @@ const char *wbcErrorString(wbcErr error)
 		return "WBC_ERR_WINBIND_NOT_AVAILABLE";
 	case WBC_ERR_DOMAIN_NOT_FOUND:
 		return "WBC_ERR_DOMAIN_NOT_FOUND";
-	case WBC_INVALID_RESPONSE:
-		return "WBC_INVALID_RESPONSE";
+	case WBC_ERR_INVALID_RESPONSE:
+		return "WBC_ERR_INVALID_RESPONSE";
 	case WBC_ERR_NSS_ERROR:
 		return "WBC_ERR_NSS_ERROR";
 	case WBC_ERR_AUTH_ERROR:
diff --git a/source3/nsswitch/libwbclient/wbclient.h b/source3/nsswitch/libwbclient/wbclient.h
index 4e7e5aff25..d73ea297a3 100644
--- a/source3/nsswitch/libwbclient/wbclient.h
+++ b/source3/nsswitch/libwbclient/wbclient.h
@@ -40,7 +40,7 @@ enum _wbcErrType {
 	WBC_ERR_INVALID_PARAM,  /**< An Invalid parameter was supplied **/
 	WBC_ERR_WINBIND_NOT_AVAILABLE,   /**< Winbind daemon is not available **/
 	WBC_ERR_DOMAIN_NOT_FOUND,        /**< Domain is not trusted or cannot be found **/
-	WBC_INVALID_RESPONSE,        /**< Winbind returned an invalid response **/
+	WBC_ERR_INVALID_RESPONSE,        /**< Winbind returned an invalid response **/
 	WBC_ERR_NSS_ERROR,            /**< NSS_STATUS error **/
 	WBC_ERR_AUTH_ERROR        /**< Authentication failed **/
 };
@@ -128,15 +128,32 @@ struct wbcDomainInfo {
 	char *short_name;
 	char *dns_name;
 	struct wbcDomainSid sid;
-	uint32_t flags;
+	uint32_t domain_flags;
+	uint32_t trust_flags;
+	uint32_t trust_type;
 };
 
-/* wbcDomainInfo->flags */
+/* wbcDomainInfo->domain_flags */
 
+#define WBC_DOMINFO_UNKNOWN           0x00000000
 #define WBC_DOMINFO_NATIVE            0x00000001
 #define WBC_DOMINFO_AD                0x00000002
 #define WBC_DOMINFO_PRIMARY           0x00000004
 
+/* wbcDomainInfo->trust_flags */
+
+#define WBC_DOMINFO_TRUST_TRANSITIVE  0x00000001
+#define WBC_DOMINFO_TRUST_INCOMING    0x00000002
+#define WBC_DOMINFO_TRUST_OUTGOING    0x00000004
+
+/* wbcDomainInfo->trust_type */
+
+#define WBC_DOMINFO_TRUSTTYPE_NONE       0x00000000
+#define WBC_DOMINFO_TRUSTTYPE_FOREST     0x00000001
+#define WBC_DOMINFO_TRUSTTYPE_IN_FOREST  0x00000002
+#define WBC_DOMINFO_TRUSTTYPE_EXTERNAL   0x00000003
+
+
 /**
  * @brief Auth User Parameters
  **/
@@ -390,6 +407,10 @@ wbcErr wbcGetGroups(const char *account,
 wbcErr wbcDomainInfo(const char *domain,
 		     struct wbcDomainInfo **info);
 
+wbcErr wbcListTrusts(struct wbcDomainInfo **domains, 
+		     size_t *num_domains);
+
+
 /*
  * Athenticate functions
  */
@@ -401,4 +422,16 @@ wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
 			     struct wbcAuthUserInfo **info,
 			     struct wbcAuthErrorInfo **error);
 
+/*
+ * Resolve functions
+ */
+wbcErr wbcResolveWinsByName(const char *name, char **ip);
+wbcErr wbcResolveWinsByIP(const char *ip, char **name);
+
+/*
+ * Trusted domain functions
+ */
+wbcErr wbcCheckTrustCredentials(const char *domain,
+				struct wbcAuthErrorInfo **error);
+
 #endif      /* _WBCLIENT_H */