5 files changed, 78 insertions, 10 deletions

diff --git a/source3/winbindd/winbindd_ads.c b/source3/winbindd/winbindd_ads.c
index c9b2a52388..3aba824b0b 100644
--- a/source3/winbindd/winbindd_ads.c
+++ b/source3/winbindd/winbindd_ads.c
@@ -1270,12 +1270,24 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain,
 				d.domain_type = domains[i].trust_type;
 				d.domain_trust_attribs = domains[i].trust_attributes;
 			} else {
+				/* Look up the record in the cache */
+				struct winbindd_tdc_domain *parent;
+
 				DEBUG(10,("trusted_domains(ads):  Inheriting trust "
 					  "flags for domain %s\n", d.alt_name));				
+
+				parent = wcache_tdc_fetch_domain(NULL, domain->name);
+				if (parent) {
+					d.domain_flags = parent->trust_flags;
+					d.domain_type  = parent->trust_type;
+					d.domain_trust_attribs = parent->trust_attribs;
+				} else {
 				d.domain_flags = domain->domain_flags;				
 				d.domain_type  = domain->domain_type;
 				d.domain_trust_attribs = domain->domain_trust_attribs;
 			}
+				TALLOC_FREE(parent);
+			}
 
 			wcache_tdc_add_domain( &d );
 
diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index 7fb42a6dca..99e401d53f 100644
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -601,8 +601,34 @@ static bool get_dc_name_via_netlogon(const struct winbindd_domain *domain,
 
 	orig_timeout = cli_set_timeout(netlogon_pipe->cli, 35000);
 	
-	werr = rpccli_netlogon_getanydcname(netlogon_pipe, mem_ctx, our_domain->dcname,
+	if (our_domain->active_directory) {
+		struct DS_DOMAIN_CONTROLLER_INFO *domain_info = NULL;
+		
+		werr = rpccli_netlogon_dsr_getdcname(netlogon_pipe, 
+						     mem_ctx, 
+						     our_domain->dcname,
+						     domain->name,
+						     NULL,
+						     NULL,
+						     DS_RETURN_DNS_NAME,
+						     &domain_info);
+		if (W_ERROR_IS_OK(werr)) {
+			fstrcpy(tmp, domain_info->domain_controller_name);
+			if (strlen(domain->alt_name) == 0) {
+				fstrcpy(domain->alt_name, 
+					CONST_DISCARD(char*, domain_info->domain_name));
+			}
+			if (strlen(domain->forest_name) == 0) {
+				fstrcpy(domain->forest_name, 
+					CONST_DISCARD(char*, domain_info->dns_forest_name));
+			}
+		}		
+	} else {
+		
+		werr = rpccli_netlogon_getanydcname(netlogon_pipe, mem_ctx, 
+						    our_domain->dcname,
 					    domain->name, &tmp);
+	}
 
 	/* And restore our original timeout. */
 	cli_set_timeout(netlogon_pipe->cli, orig_timeout);
@@ -978,6 +1004,7 @@ static bool send_getdc_request(struct sockaddr_storage *dc_ss,
 	char *p;
 	fstring my_acct_name;
 	fstring my_mailslot;
+	size_t sid_size;
 
 	if (dc_ss->ss_family != AF_INET) {
 		return false;
@@ -1019,7 +1046,9 @@ static bool send_getdc_request(struct sockaddr_storage *dc_ss,
 	SIVAL(p, 0, 0x80);
 	p+=4;
 
-	SIVAL(p, 0, sid_size(sid));
+	sid_size = ndr_size_dom_sid(sid, 0);
+
+	SIVAL(p, 0, sid_size);
 	p+=4;
 
 	p = ALIGN4(p, outbuf);
@@ -1027,12 +1056,12 @@ static bool send_getdc_request(struct sockaddr_storage *dc_ss,
 		return false;
 	}
 
-	sid_linearize(p, sid_size(sid), sid);
-	if (sid_size(sid) + 8 > sizeof(outbuf) - PTR_DIFF(p, outbuf)) {
+	if (sid_size + 8 > sizeof(outbuf) - PTR_DIFF(p, outbuf)) {
 		return false;
 	}
+	sid_linearize(p, sizeof(outbuf) - PTR_DIFF(p, outbuf), sid);
 
-	p += sid_size(sid);
+	p += sid_size;
 
 	SIVAL(p, 0, 1);
 	SSVAL(p, 4, 0xffff);
@@ -1866,9 +1895,17 @@ no_lsarpc_ds:
 		if (dns_name)
 			fstrcpy(domain->alt_name, dns_name);
 
-		if ( forest_name )
+		/* See if we can set some domain trust flags about
+		   ourself */
+
+		if ( forest_name ) {
 			fstrcpy(domain->forest_name, forest_name);		
 
+			if (strequal(domain->forest_name, domain->alt_name)) {
+				domain->domain_flags = DS_DOMAIN_TREE_ROOT;
+			}
+		}
+
 		if (dom_sid) 
 			sid_copy(&domain->sid, dom_sid);
 	} else {
diff --git a/source3/winbindd/winbindd_group.c b/source3/winbindd/winbindd_group.c
index fbd2fee692..62e8d1c40b 100644
--- a/source3/winbindd/winbindd_group.c
+++ b/source3/winbindd/winbindd_group.c
@@ -1494,9 +1494,18 @@ void winbindd_getgroups(struct winbindd_cli_state *state)
 		s->username = talloc_strdup( state->mem_ctx, state->request.data.username );
 	}
 	
-	/* Get info for the domain */
+	/* Get info for the domain (either by short domain name or 
+	   DNS name in the case of a UPN) */
 
 	s->domain = find_domain_from_name_noinit(s->domname);
+	if (!s->domain) {
+		char *p = strchr(s->username, '@');
+		
+		if (p) {
+			s->domain = find_domain_from_name_noinit(p+1);			
+		}
+		
+	}
 
 	if (s->domain == NULL) {
 		DEBUG(7, ("could not find domain entry for domain %s\n", 
diff --git a/source3/winbindd/winbindd_rpc.c b/source3/winbindd/winbindd_rpc.c
index ffb47692cb..f5e1226447 100644
--- a/source3/winbindd/winbindd_rpc.c
+++ b/source3/winbindd/winbindd_rpc.c
@@ -456,6 +456,12 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
 		return NT_STATUS_OK;
 	}
 	
+	if ( !winbindd_can_contact_domain( domain ) ) {
+		DEBUG(10,("query_user: No incoming trust for domain %s\n",
+			  domain->name));
+		return NT_STATUS_OK;
+	}
+	
 	/* no cache; hit the wire */
 		
 	result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index 70468b6bcd..cc12d4b7ea 100644
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -500,9 +500,13 @@ void rescan_trusted_domains( void )
 	    ((now-last_trustdom_scan) < WINBINDD_RESCAN_FREQ) )
 		return;
 		
-	/* clear the TRUSTDOM cache first */
-
-	wcache_tdc_clear();
+	/* I use to clear the cache here and start over but that
+	   caused problems in child processes that needed the
+	   trust dom list early on.  Removing it means we
+	   could have some trusted domains listed that have been
+	   removed from our primary domain's DC until a full
+	   restart.  This should be ok since I think this is what
+	   Windows does as well. */
 
 	/* this will only add new domains we didn't already know about
 	   in the domain_list()*/