ipa_sam.c

Bug Summary

File:	daemons/ipa-sam/ipa_sam.c
Warning:	line 3424, column 12 Access to field 'bv_val' results in a dereference of a null pointer
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ipa_sam.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I ../.. -I . -I ../../asn1 -I /usr/include/samba-4.0 -D PREFIX="/usr/local" -D BINDIR="/usr/local/bin" -D LIBDIR="/usr/local/lib" -D LIBEXECDIR="/usr/local/libexec" -D DATADIR="/usr/local/share" -D LDAPIDIR="/run" -D HAVE_LDAP -I ../../util -I /usr/include/samba-4.0 -D HAVE_IMMEDIATE_STRUCTURES=1 -I /usr/include/samba-4.0 -D _GNU_SOURCE=1 -D HAVE_IMMEDIATE_STRUCTURES=1 -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -D PIC -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/daemons/ipa-sam -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c ipa_sam.c
1#define HAVE_IMMEDIATE_STRUCTURES1 1
2#define LDAP_DEPRECATED1 1

4#include "config.h"
5#include <stdbool.h>
6#include <stdint.h>
7#include <stdio.h>
8#include <unistd.h>
9#include <sys/types.h>
10#include <pwd.h>
11#include <errno(*__errno_location ()).h>
12#include <ldap.h>
13#include <krb5/krb5.h>

15#include <talloc.h>

17#include <param.h>
18#include <ndr.h>
19#include <util/data_blob.h>
20#include <util/time.h>
21#include <util/debug.h>

23#ifndef _SAMBA_UTIL_H_
24bool_Bool trim_string(char *s, const char *front, const char *back);
25char *smb_xstrdup(const char *s);
26#endif

28#include <core/ntstatus.h>
29#include <gen_ndr/security.h>
30#include <smbldap.h>

32#include <gen_ndr/samr.h>

34#include <passdb.h>

36#include <sasl/sasl.h>
37#include <krb5/krb5.h>
38#include <sss_idmap.h>
39#include "ipa_asn1.h"
40#include "ipa_pwd.h"
41#include "ipa_mspac.h"

43/* from drsblobs.h */
44struct AuthInfoNone {
uint32_t size;/* [value(0)] */
46};

48struct AuthInfoNT4Owf {
uint32_t size;/* [value(16)] */
struct samr_Password password;
51};

53struct AuthInfoClear {
uint32_t size;
uint8_t *password;
56};

58struct AuthInfoVersion {
uint32_t size;/* [value(4)] */
uint32_t version;
61};

63union AuthInfo {
struct AuthInfoNone none;/* [case(TRUST_AUTH_TYPE_NONE)] */
struct AuthInfoNT4Owf nt4owf;/* [case(TRUST_AUTH_TYPE_NT4OWF)] */
struct AuthInfoClear clear;/* [case(TRUST_AUTH_TYPE_CLEAR)] */
struct AuthInfoVersion version;/* [case(TRUST_AUTH_TYPE_VERSION)] */
68}/* [nodiscriminant] */;

70struct AuthenticationInformation {
NTTIME LastUpdateTime;
enum lsa_TrustAuthType AuthType;
union AuthInfo AuthInfo;/* [switch_is(AuthType)] */
DATA_BLOB _pad;/* [flag(LIBNDR_FLAG_ALIGN4)] */
75}/* [public] */;

77struct AuthenticationInformationArray {
uint32_t count;
struct AuthenticationInformation *array;
80}/* [gensize,nopush,public,nopull] */;

82struct trustAuthInOutBlob {
uint32_t count;
uint32_t current_offset;/* [value((count>0)?12:0)] */
uint32_t previous_offset;/* [value((count>0)?12+ndr_size_AuthenticationInformationArray(&current,ndr->flags):0)] */
struct AuthenticationInformationArray current;/* [subcontext_size((previous_offset)-(current_offset)),subcontext(0)] */
struct AuthenticationInformationArray previous;/* [subcontext(0),flag(LIBNDR_FLAG_REMAINING)] */
88}/* [gensize,public,nopush] */;

90/* from generated idmap.h - hopefully OK */
91enum id_type {
ID_TYPE_NOT_SPECIFIED,
ID_TYPE_UID,
ID_TYPE_GID,
ID_TYPE_BOTH
96};

98struct unixid {
uint32_t id;
enum id_type type;
101}/* [public] */;

103enum ndr_err_code ndr_pull_trustAuthInOutBlob(struct ndr_pull *ndr, int ndr_flags, struct trustAuthInOutBlob *r); /*available in libndr-samba.so */
104bool_Bool sid_check_is_builtin(const struct dom_sid *sid); /* available in libpdb.so */
105/* available in libpdb.so, renamed from sid_check_is_domain() in c43505b621725c9a754f0ee98318d451b093f2ed */
106bool_Bool sid_linearize(char *outbuf, size_t len, const struct dom_sid *sid); /* available in libsmbconf.so */
107char *escape_ldap_string(TALLOC_CTX *mem_ctx, const char *s); /* available in libsmbconf.so */
108bool_Bool secrets_store(const char *key, const void *data, size_t size); /* available in libpdb.so */
109void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_id); /* available in libsmbconf.so */
110bool_Bool E_md4hash(const char *passwd, uint8_t p16[16]); /* available in libcliauth-samba4.so */

112#define LDAP_OBJ_SAMBASAMACCOUNT"ipaNTUserAttrs" "ipaNTUserAttrs"
113#define LDAP_OBJ_TRUSTED_DOMAIN"ipaNTTrustedDomain" "ipaNTTrustedDomain"
114#define LDAP_OBJ_ID_OBJECT"ipaIDobject" "ipaIDobject"
115#define LDAP_ATTRIBUTE_TRUST_SID"ipaNTTrustedDomainSID" "ipaNTTrustedDomainSID"
116#define LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier" "ipaNTSecurityIdentifier"
117#define LDAP_OBJ_GROUPMAP"ipaNTGroupAttrs" "ipaNTGroupAttrs"

119#define IPA_KEYTAB_SET_OID"2.16.840.1.113730.3.8.10.1" "2.16.840.1.113730.3.8.10.1"
120#define IPA_KEYTAB_SET_OID_OLD"2.16.840.1.113730.3.8.3.1" "2.16.840.1.113730.3.8.3.1"
121#define IPA_MAGIC_ID_STR"-1" "-1"

123#define LDAP_ATTRIBUTE_CN"cn" "cn"
124#define LDAP_ATTRIBUTE_UID"uid" "uid"
125#define LDAP_ATTRIBUTE_TRUST_TYPE"ipaNTTrustType" "ipaNTTrustType"
126#define LDAP_ATTRIBUTE_TRUST_ATTRIBUTES"ipaNTTrustAttributes" "ipaNTTrustAttributes"
127#define LDAP_ATTRIBUTE_TRUST_DIRECTION"ipaNTTrustDirection" "ipaNTTrustDirection"
128#define LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET"ipaNTTrustPosixOffset" "ipaNTTrustPosixOffset"
129#define LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE"ipaNTSupportedEncryptionTypes" "ipaNTSupportedEncryptionTypes"
130#define LDAP_ATTRIBUTE_TRUST_PARTNER"ipaNTTrustPartner" "ipaNTTrustPartner"
131#define LDAP_ATTRIBUTE_FLAT_NAME"ipaNTFlatName" "ipaNTFlatName"
132#define LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING"ipaNTTrustAuthOutgoing" "ipaNTTrustAuthOutgoing"
133#define LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING"ipaNTTrustAuthIncoming" "ipaNTTrustAuthIncoming"
134#define LDAP_ATTRIBUTE_SECURITY_IDENTIFIER"ipaNTSecurityIdentifier" "ipaNTSecurityIdentifier"
135#define LDAP_ATTRIBUTE_TRUST_FOREST_TRUST_INFO"ipaNTTrustForestTrustInfo" "ipaNTTrustForestTrustInfo"
136#define LDAP_ATTRIBUTE_FALLBACK_PRIMARY_GROUP"ipaNTFallbackPrimaryGroup" "ipaNTFallbackPrimaryGroup"
137#define LDAP_ATTRIBUTE_OBJECTCLASS"objectClass" "objectClass"
138#define LDAP_ATTRIBUTE_HOME_DRIVE"ipaNTHomeDirectoryDrive" "ipaNTHomeDirectoryDrive"
139#define LDAP_ATTRIBUTE_HOME_PATH"ipaNTHomeDirectory" "ipaNTHomeDirectory"
140#define LDAP_ATTRIBUTE_HOMEDIRECTORY"homeDirectory" "homeDirectory"
141#define LDAP_ATTRIBUTE_LOGON_SCRIPT"ipaNTLogonScript" "ipaNTLogonScript"
142#define LDAP_ATTRIBUTE_PROFILE_PATH"ipaNTProfilePath" "ipaNTProfilePath"
143#define LDAP_ATTRIBUTE_SID_BLACKLIST_INCOMING"ipaNTSIDBlacklistIncoming" "ipaNTSIDBlacklistIncoming"
144#define LDAP_ATTRIBUTE_SID_BLACKLIST_OUTGOING"ipaNTSIDBlacklistOutgoing" "ipaNTSIDBlacklistOutgoing"
145#define LDAP_ATTRIBUTE_NTHASH"ipaNTHash" "ipaNTHash"
146#define LDAP_ATTRIBUTE_UIDNUMBER"uidnumber" "uidnumber"
147#define LDAP_ATTRIBUTE_GIDNUMBER"gidnumber" "gidnumber"
148#define LDAP_ATTRIBUTE_ASSOCIATED_DOMAIN"associatedDomain" "associatedDomain"

150#define LDAP_OBJ_KRB_PRINCIPAL"krbPrincipal" "krbPrincipal"
151#define LDAP_OBJ_KRB_PRINCIPAL_AUX"krbPrincipalAux" "krbPrincipalAux"
152#define LDAP_OBJ_KRB_TICKET_POLICY_AUX"krbTicketPolicyAux" "krbTicketPolicyAux"
153#define LDAP_ATTRIBUTE_KRB_CANONICAL"krbCanonicalName" "krbCanonicalName"
154#define LDAP_ATTRIBUTE_KRB_PRINCIPAL"krbPrincipalName" "krbPrincipalName"
155#define LDAP_ATTRIBUTE_KRB_TICKET_FLAGS"krbTicketFlags" "krbTicketFlags"
156#define LDAP_ATTRIBUTE_IPAOPALLOW"ipaAllowedToPerform;read_keys" "ipaAllowedToPerform;read_keys"

158#define LDAP_OBJ_IPAOBJECT"ipaObject" "ipaObject"
159#define LDAP_OBJ_IPAHOST"ipaHost" "ipaHost"
160#define LDAP_OBJ_POSIXACCOUNT"posixAccount" "posixAccount"

162#define LDAP_OBJ_GROUPOFNAMES"groupOfNames" "groupOfNames"
163#define LDAP_OBJ_NESTEDGROUP"nestedGroup" "nestedGroup"
164#define LDAP_OBJ_IPAUSERGROUP"ipaUserGroup" "ipaUserGroup"
165#define LDAP_OBJ_POSIXGROUP"posixGroup" "posixGroup"
166#define LDAP_OBJ_DOMAINRELATED"domainRelatedObject" "domainRelatedObject"
167#define LDAP_OBJ_IPAOPALLOW"ipaAllowedOperations" "ipaAllowedOperations"

169#define LDAP_CN_REALM_DOMAINS"cn=Realm Domains,cn=ipa,cn=etc" "cn=Realm Domains,cn=ipa,cn=etc"

171#define LDAP_CN_ADTRUST_AGENTS"cn=adtrust agents,cn=sysaccounts,cn=etc" "cn=adtrust agents,cn=sysaccounts,cn=etc"
172#define LDAP_CN_ADTRUST_ADMINS"cn=trust admins,cn=groups,cn=accounts" "cn=trust admins,cn=groups,cn=accounts"

174#define HAS_KRB_PRINCIPAL(1<<0) (1<<0)
175#define HAS_KRB_PRINCIPAL_AUX(1<<1) (1<<1)
176#define HAS_IPAOBJECT(1<<2) (1<<2)
177#define HAS_IPAHOST(1<<3) (1<<3)
178#define HAS_POSIXACCOUNT(1<<4) (1<<4)
179#define HAS_GROUPOFNAMES(1<<5) (1<<5)
180#define HAS_NESTEDGROUP(1<<6) (1<<6)
181#define HAS_IPAUSERGROUP(1<<7) (1<<7)
182#define HAS_POSIXGROUP(1<<8) (1<<8)
183#define HAS_KRB_TICKET_POLICY_AUX(1<<9) (1<<9)

185/* krbTicketFlags flag to don't allow issuing any ticket, keep in decimal form for LDAP use*/
186#define IPASAM_DISALLOW_ALL_TIX64 64

188const struct dom_sid global_sid_Builtin = { 1, 1, {0,0,0,0,0,5},
			   {32,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};

191/* With Samba 4.7 ldapsam_privates structure is not public anymore.
* FreeIPA needs to use own structure */

194struct ipasam_private {
struct smbldap_state *ldap_state;
/* Former statics */
LDAPMessage *result;
LDAPMessage *entry;

const char *domain_name;
struct dom_sid domain_sid;

char *domain_dn;
char *realm;
char *base_dn;
char *trust_dn;
char *flat_name;
struct dom_sid fallback_primary_group;
char *fallback_primary_group_gid_str;
char *server_princ;
char *client_princ;
struct sss_idmap_ctx *idmap_ctx;
uint32_t supported_enctypes;
bool_Bool fips_enabled;
215};


218static NTSTATUS ipasam_get_domain_name(struct ipasam_private *ipasam_state,
		       TALLOC_CTX *mem_ctx,
		       char **domain_name);


223static void *idmap_talloc(size_t size, void *pvt)
224{
return talloc_size(pvt, size)talloc_named_const(pvt, size, "ipa_sam.c" ":" "225");
226}

228static void idmap_talloc_free(void *ptr, void *pvt)
229{
talloc_free(ptr)_talloc_free(ptr, "ipa_sam.c" ":" "230");
231}

233static void sid_copy(struct dom_sid *dst, const struct dom_sid *src)
234{
size_t c;

memset(dst, 0, sizeof(*dst));

dst->sid_rev_num = src->sid_rev_num;
dst->num_auths = src->num_auths;
memcpy(&dst->id_auth[0], &src->id_auth[0], sizeof(src->id_auth));

for (c = 0; c < src->num_auths; c++) {
dst->sub_auths[c] = src->sub_auths[c];
}
246}

248static bool_Bool sid_compose(struct dom_sid *dst, const struct dom_sid *dom_sid,
	uint32_t rid)
250{
if (dom_sid->num_auths >= 15) {
return false0;
}

sid_copy(dst, dom_sid);

dst->sub_auths[dst->num_auths++] = rid;

return true1;
260}

262static char *sid_talloc_string(struct sss_idmap_ctx *ctx, void *final_ctx, const struct dom_sid *dom_sid)
263{
enum idmap_error_code ret;
char *result = NULL((void*)0);
ret = sss_idmap_smb_sid_to_sid(ctx, discard_const(dom_sid)((void *)((uintptr_t)(dom_sid))), &result);
if (ret != IDMAP_SUCCESS) {
return NULL((void*)0);
}

return talloc_move(final_ctx, &result)(__typeof__(*(&result)))_talloc_move((final_ctx),(void *)
(&result));
272}

274static bool_Bool is_null_sid(const struct dom_sid *sid)
275{
size_t c;

if (sid->sid_rev_num != 0 || sid->num_auths != 0) {
return false0;
}

for (c = 0; c < 6; c++) {
if (sid->id_auth[c] != 0) {
	return false0;
}
}

for (c = 0; c < 15; c++) {
if (sid->sub_auths[c] != 0) {
	return false0;
}
}

return true1;
295}

297static int dom_sid_compare_domain(const struct dom_sid *sid1,
		  const struct dom_sid *sid2)
299{
size_t c;
size_t n_sub_auths;

if (sid1->sid_rev_num != sid2->sid_rev_num) {
return sid1->sid_rev_num - sid2->sid_rev_num;
}

for (c = 0; c < 6; c++) {
if (sid1->id_auth[c] != sid2->id_auth[c]) {
	return sid1->id_auth[c] - sid2->id_auth[c];
}
}

n_sub_auths = (sid1->num_auths < sid2->num_auths) ? sid1->num_auths :
					sid2->num_auths;

for (c = 0; c < n_sub_auths; c++) {
if (sid1->sub_auths[c] != sid2->sub_auths[c]) {
	return sid1->sub_auths[c] - sid2->sub_auths[c];
}
}

return 0;
323}

325static bool_Bool sid_peek_check_rid(const struct dom_sid *exp_dom_sid,
	       const struct dom_sid *sid, uint32_t *rid)
327{
if((exp_dom_sid->num_auths + 1) != sid->num_auths ||
   sid->num_auths <= 0) {
return false0;
}

if (dom_sid_compare_domain(exp_dom_sid, sid) != 0) {
return false0;
}

*rid = sid->sub_auths[sid->num_auths - 1];

return true1;
340}

342static bool_Bool strnequal(const char *s1, const char *s2, size_t n) {
if (s1 == s2) {
return true1;
}

if (s1 == NULL((void*)0) || s2 == NULL((void*)0) || n == 0) {
return false0;
}

if (strncasecmp(s1, s2, n) == 0) {
return true1;
}

return false0;
356}

358static LDAP *_smbldap_get_ldap(struct smbldap_state *state) {
359#ifdef HAVE_SMBLDAP_GET_LDAP1
return smbldap_get_ldap(state);
361#else
return state->ldap_struct;
363#endif

365}

367static bool_Bool _smbldap_get_paged_results(struct smbldap_state *state) {
368#ifdef HAVE_SMBLDAP_GET_LDAP1
return smbldap_get_paged_results(state);
370#else
return state->paged_results;
372#endif
373}

375static void _smbldap_set_paged_results(struct smbldap_state *state,
	       bool_Bool paged_results) {
377#ifdef HAVE_SMBLDAP_GET_LDAP1
smbldap_set_paged_results(state, paged_results);
379#else
state->paged_results = paged_results;
381#endif
382}

384static LDAP *priv2ld(struct ipasam_private *priv)
385{
return _smbldap_get_ldap(priv->ldap_state);
387}

389/*
* get_attribute_values() returns array of all values of the attribute
* allocated over mem_ctx
*/
393static char **get_attribute_values(TALLOC_CTX *mem_ctx, LDAP *ldap_struct,
		   LDAPMessage *entry, const char *attribute, int *num_values)
395{
struct berval **values;
int count, i;
char **result = NULL((void*)0);
size_t conv_size;

if (attribute == NULL((void*)0) || entry == NULL((void*)0)) {
return NULL((void*)0);
}

values = ldap_get_values_len(ldap_struct, entry, attribute);
if (values == NULL((void*)0)) {
DEBUG(10, ("Attribute [%s] not found.\n", attribute))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "407"
, __FUNCTION__ )) && (dbgtext ("Attribute [%s] not found.\n"
, attribute)) );
return NULL((void*)0);
}

count = ldap_count_values_len(values);
if (count == 0) {
goto done;
}

result = talloc_array(mem_ctx, char *, count)(char * *)_talloc_array(mem_ctx, sizeof(char *), count, "char *"
);
if (result == NULL((void*)0)) {
goto done;
}

*num_values = count;
for (i = 0; i < count; i++) {
if (!convert_string_talloc(result, CH_UTF8, CH_UNIX,
			   values[i]->bv_val, values[i]->bv_len,
			   &result[i], &conv_size)) {
	DEBUG(10, ("Failed to convert %dth value of [%s] out of %d.\n",(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "427"
, __FUNCTION__ )) && (dbgtext ("Failed to convert %dth value of [%s] out of %d.\n"
, i, attribute, count)) )
		   i, attribute, count))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "427"
, __FUNCTION__ )) && (dbgtext ("Failed to convert %dth value of [%s] out of %d.\n"
, i, attribute, count)) );
	talloc_free(result)_talloc_free(result, "ipa_sam.c" ":" "428");
	result = NULL((void*)0);
	goto done;
}
}

434done:
ldap_value_free_len(values);
return result;
437}

439static char *get_single_attribute(TALLOC_CTX *mem_ctx, LDAP *ldap_struct,
		  LDAPMessage *entry, const char *attribute)
441{
struct berval **values;
int c;
char *result = NULL((void*)0);
size_t conv_size;

if (attribute == NULL((void*)0) || entry == NULL((void*)0)) {
return NULL((void*)0);
}

values = ldap_get_values_len(ldap_struct, entry, attribute);
if (values == NULL((void*)0)) {
DEBUG(10, ("Attribute [%s] not found.\n", attribute))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "453"
, __FUNCTION__ )) && (dbgtext ("Attribute [%s] not found.\n"
, attribute)) );
return NULL((void*)0);
}

c = ldap_count_values_len(values);
if (c != 1) {
DEBUG(10, ("Found [%d] values for attribute [%s] but expected only 1.\n",(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "460"
, __FUNCTION__ )) && (dbgtext ("Found [%d] values for attribute [%s] but expected only 1.\n"
, c, attribute)) )
	   c, attribute))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "460"
, __FUNCTION__ )) && (dbgtext ("Found [%d] values for attribute [%s] but expected only 1.\n"
, c, attribute)) );
goto done;
}

if (!convert_string_talloc(mem_ctx, CH_UTF8, CH_UNIX,
		   values[0]->bv_val, values[0]->bv_len,
		   &result, &conv_size)) {
DEBUG(10, ("Failed to convert value of [%s].\n", attribute))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "467"
, __FUNCTION__ )) && (dbgtext ("Failed to convert value of [%s].\n"
, attribute)) );
result = NULL((void*)0);
goto done;
}

472done:
ldap_value_free_len(values);
return result;
475}

477static char *get_dn(TALLOC_CTX *mem_ctx, LDAP *ld, LDAPMessage *entry)
478{
char *utf8_dn;
char *unix_dn = NULL((void*)0);
size_t conv_size;

utf8_dn = ldap_get_dn(ld, entry);
if (utf8_dn == NULL((void*)0)) {
DEBUG (10, ("ldap_get_dn failed\n"))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "485"
, __FUNCTION__ )) && (dbgtext ("ldap_get_dn failed\n"
)) );
return NULL((void*)0);
}
if (!convert_string_talloc(mem_ctx, CH_UTF8, CH_UNIX,
		   utf8_dn, strlen(utf8_dn) + 1,
		   &unix_dn, &conv_size)) {
DEBUG (10, ("Failed to convert [%s]\n", utf8_dn))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "491"
, __FUNCTION__ )) && (dbgtext ("Failed to convert [%s]\n"
, utf8_dn)) );
unix_dn = NULL((void*)0);
goto done;
}

496done:
ldap_memfree(utf8_dn);
return unix_dn;
499}

501/* Samba removed unixid_* helpers in c906153cc7af21abe508ddd30c447642327d6a5d */
502static void ipasam_unixid_from_uid(struct unixid *id, uint32_t some_uid)
503{
     if (id) {
             id->id = some_uid;
             id->type = ID_TYPE_UID;
     }
508}



512static void ipasam_unixid_from_gid(struct unixid *id, uint32_t some_gid)
513{
     if (id) {
             id->id = some_gid;
             id->type = ID_TYPE_GID;
     }
518}

520static bool_Bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
			   LDAPMessage *entry,
			   struct sss_idmap_ctx *idmap_ctx,
			   const struct dom_sid *domain_sid,
			   uint32_t *rid)
525{
char *str = NULL((void*)0);
struct dom_sid *sid = NULL((void*)0);
bool_Bool res = false0;
enum idmap_error_code err;

str = get_single_attribute(NULL((void*)0), ldap_struct, entry,
		   LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
if (str == NULL((void*)0)) {
DEBUG(10, ("Could not find SID attribute\n"))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "534"
, __FUNCTION__ )) && (dbgtext ("Could not find SID attribute\n"
)) );
res = false0;
goto done;
}

err = sss_idmap_sid_to_smb_sid(idmap_ctx, str, &sid);
if (err != IDMAP_SUCCESS) {
DEBUG(10, ("Could not convert string %s to sid\n", str))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "541"
, __FUNCTION__ )) && (dbgtext ("Could not convert string %s to sid\n"
, str)) );
res = false0;
goto done;
}

if (dom_sid_compare_domain(sid, domain_sid) != 0) {
char *debug_domain_sid = NULL((void*)0);
err = sss_idmap_smb_sid_to_sid(idmap_ctx,
			       discard_const(domain_sid)((void *)((uintptr_t)(domain_sid))),
			       &debug_domain_sid);
if (err != IDMAP_SUCCESS) {
	DEBUG(10, ("SID %s is not in expected domain.\n",(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "553"
, __FUNCTION__ )) && (dbgtext ("SID %s is not in expected domain.\n"
, str)) )
		   str))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "553"
, __FUNCTION__ )) && (dbgtext ("SID %s is not in expected domain.\n"
, str)) );
} else {
	DEBUG(10, ("SID %s is not in expected domain %s\n",(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "556"
, __FUNCTION__ )) && (dbgtext ("SID %s is not in expected domain %s\n"
, str, debug_domain_sid)) )
		   str, debug_domain_sid))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "556"
, __FUNCTION__ )) && (dbgtext ("SID %s is not in expected domain %s\n"
, str, debug_domain_sid)) );
	talloc_free(debug_domain_sid)_talloc_free(debug_domain_sid, "ipa_sam.c" ":" "557");
}
res = false0;
goto done;
}

if (sid->num_auths <= 0) {
DEBUG(10, ("Invalid num_auths in SID %s.\n", str))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "564"
, __FUNCTION__ )) && (dbgtext ("Invalid num_auths in SID %s.\n"
, str)) );
res = false0;
goto done;
}

*rid = sid->sub_auths[sid->num_auths - 1];

res = true1;
572done:
talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "573");
talloc_free(str)_talloc_free(str, "ipa_sam.c" ":" "574");
return res;
576}

578static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
		    const struct dom_sid *domain_sid,
		    int num_rids,
		    uint32_t *rids,
		    const char **names,
		    enum lsa_SidType *attrs)
584{
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "586");
LDAPMessage *msg = NULL((void*)0);
LDAPMessage *entry;
char *allsids = NULL((void*)0);
int i, rc, num_mapped;
NTSTATUS result = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
TALLOC_CTX *mem_ctx;
LDAP *ld;
bool_Bool is_builtin;

mem_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "596");
if (mem_ctx == NULL((void*)0)) {
DEBUG(0, ("talloc_new failed\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "598", __FUNCTION__
 )) && (dbgtext ("talloc_new failed\n")) );
goto done;
}

if (!sid_check_is_builtin(domain_sid) &&
    dom_sid_compare_domain(&ipasam_state->domain_sid, domain_sid) != 0) {
result = NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
goto done;
}

if (num_rids == 0) {
result = NT_STATUS_NONE_MAPPED((NTSTATUS) { 0xc0000073 });
goto done;
}

for (i=0; i<num_rids; i++)
attrs[i] = SID_NAME_UNKNOWN;

allsids = talloc_strdup(mem_ctx, "");
if (allsids == NULL((void*)0)) {
goto done;
}

for (i=0; i<num_rids; i++) {
struct dom_sid sid;
sid_compose(&sid, domain_sid, rids[i]);
allsids = talloc_asprintf_append_buffer(
	allsids, "(%s=%s)",
	LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier",
	sid_talloc_string(ipasam_state->idmap_ctx, mem_ctx, &sid));
if (allsids == NULL((void*)0)) {
	goto done;
}
}

/* First look for users */

{
char *filter;
const char *ldap_attrs[] = { "uid", LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier", NULL((void*)0) };

filter = talloc_asprintf(
	mem_ctx, ("(&(objectClass=%s)(|%s))"),
	LDAP_OBJ_SAMBASAMACCOUNT"ipaNTUserAttrs", allsids);

if (filter == NULL((void*)0)) {
	goto done;
}

rc = smbldap_search(ipasam_state->ldap_state,
		    ipasam_state->base_dn,
		    LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002), filter, ldap_attrs, 0,
		    &msg);
smbldap_talloc_autofree_ldapmsg(mem_ctx, msg);
}

if (rc != LDAP_SUCCESS0x00)
goto done;

ld = priv2ld(ipasam_state);
num_mapped = 0;

for (entry = ldap_first_entry(ld, msg);
    entry != NULL((void*)0);
    entry = ldap_next_entry(ld, entry)) {
uint32_t rid;
int rid_index;
const char *name;

if (!ldapsam_extract_rid_from_entry(ld, entry,
				    ipasam_state->idmap_ctx,
				    domain_sid,
				    &rid)) {
	DEBUG(2, ("Could not find sid from ldap entry\n"))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "671", __FUNCTION__
 )) && (dbgtext ("Could not find sid from ldap entry\n"
)) );
	continue;
}

name = get_single_attribute(names, ld, entry, "uid");
if (name == NULL((void*)0)) {
	DEBUG(2, ("Could not retrieve uid attribute\n"))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "677", __FUNCTION__
 )) && (dbgtext ("Could not retrieve uid attribute\n"
)) );
	continue;
}

for (rid_index = 0; rid_index < num_rids; rid_index++) {
	if (rid == rids[rid_index])
		break;
}

if (rid_index == num_rids) {
	DEBUG(2, ("Got a RID not asked for: %d\n", rid))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "687", __FUNCTION__
 )) && (dbgtext ("Got a RID not asked for: %d\n", rid
)) );
	continue;
}

attrs[rid_index] = SID_NAME_USER;
names[rid_index] = name;
num_mapped += 1;
}

if (num_mapped == num_rids) {
/* No need to look for groups anymore -- we're done */
result = NT_STATUS_OK((NTSTATUS) { 0x0 });
goto done;
}

/* Same game for groups */

{
char *filter;
const char *ldap_attrs[] = { "cn", "displayName",
			     LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier",
			     NULL((void*)0) };

filter = talloc_asprintf(
	mem_ctx, "(&(objectClass=%s)(|%s))",
	LDAP_OBJ_GROUPMAP"ipaNTGroupAttrs", allsids);
if (filter == NULL((void*)0)) {
	goto done;
}

rc = smbldap_search(ipasam_state->ldap_state,
		    ipasam_state->base_dn,
		    LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002), filter, ldap_attrs, 0,
		    &msg);
smbldap_talloc_autofree_ldapmsg(mem_ctx, msg);
}

if (rc != LDAP_SUCCESS0x00)
goto done;

/* ldap_struct might have changed due to a reconnect */

ld = priv2ld(ipasam_state);

/* For consistency checks, we already checked we're only domain or builtin */

is_builtin = sid_check_is_builtin(domain_sid);

for (entry = ldap_first_entry(ld, msg);
    entry != NULL((void*)0);
    entry = ldap_next_entry(ld, entry))
{
uint32_t rid;
int rid_index;
const char *attr;
enum lsa_SidType type;
const char *dn = get_dn(mem_ctx, ld, entry);

type = SID_NAME_DOM_GRP;

/* Consistency checks */
if ((is_builtin && (type != SID_NAME_ALIAS)) ||
    (!is_builtin && ((type != SID_NAME_ALIAS) &&
		     (type != SID_NAME_DOM_GRP)))) {
	DEBUG(2, ("Rejecting invalid group mapping entry %s\n", dn))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "751", __FUNCTION__
 )) && (dbgtext ("Rejecting invalid group mapping entry %s\n"
, dn)) );
}

if (!ldapsam_extract_rid_from_entry(ld, entry,
				    ipasam_state->idmap_ctx,
				    domain_sid, &rid)) {
	DEBUG(2, ("Could not find sid from ldap entry %s\n", dn))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "757", __FUNCTION__
 )) && (dbgtext ("Could not find sid from ldap entry %s\n"
, dn)) );
	continue;
}

attr = get_single_attribute(names, ld, entry, "displayName");

if (attr == NULL((void*)0)) {
	DEBUG(10, ("Could not retrieve 'displayName' attribute from %s\n",(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "765"
, __FUNCTION__ )) && (dbgtext ("Could not retrieve 'displayName' attribute from %s\n"
, dn)) )
		   dn))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "765"
, __FUNCTION__ )) && (dbgtext ("Could not retrieve 'displayName' attribute from %s\n"
, dn)) );
	attr = get_single_attribute(names, ld, entry, "cn");
}

if (attr == NULL((void*)0)) {
	DEBUG(2, ("Could not retrieve naming attribute from %s\n",(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "771", __FUNCTION__
 )) && (dbgtext ("Could not retrieve naming attribute from %s\n"
, dn)) )
		  dn))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "771", __FUNCTION__
 )) && (dbgtext ("Could not retrieve naming attribute from %s\n"
, dn)) );
	continue;
}

for (rid_index = 0; rid_index < num_rids; rid_index++) {
	if (rid == rids[rid_index])
		break;
}

if (rid_index == num_rids) {
	DEBUG(2, ("Got a RID not asked for: %d\n", rid))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "781", __FUNCTION__
 )) && (dbgtext ("Got a RID not asked for: %d\n", rid
)) );
	continue;
}

attrs[rid_index] = type;
names[rid_index] = attr;
num_mapped += 1;
}

result = NT_STATUS_NONE_MAPPED((NTSTATUS) { 0xc0000073 });

if (num_mapped > 0)
result = (num_mapped == num_rids) ?
	NT_STATUS_OK((NTSTATUS) { 0x0 }) : STATUS_SOME_UNMAPPED((NTSTATUS) { 0x107 });
done:
TALLOC_FREE(mem_ctx)do { if (mem_ctx != ((void*)0)) { _talloc_free(mem_ctx, "ipa_sam.c"
 ":" "796"); mem_ctx=((void*)0); } } while(0);
return result;
798}

800static bool_Bool ldapsam_sid_to_id(struct pdb_methods *methods,
	      const struct dom_sid *sid,
	      struct unixid *id)
803{
struct ipasam_private *priv =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "805");
char *filter;
const char *attrs[] = { "objectClass", "gidNumber", "uidNumber",
		NULL((void*)0) };
LDAPMessage *result = NULL((void*)0);
LDAPMessage *entry = NULL((void*)0);
bool_Bool ret = false0;
char *value;
struct berval **values;
size_t c;
int rc;

TALLOC_CTX *mem_ctx;

mem_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "819");
if (mem_ctx == NULL((void*)0)) {
DEBUG(0, ("talloc_new failed\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "821", __FUNCTION__
 )) && (dbgtext ("talloc_new failed\n")) );
return false0;
}

filter = talloc_asprintf(mem_ctx,
		 "(&(%s=%s)"
		 "(|(objectClass=%s)(objectClass=%s)))",
		 LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier",
		 sid_talloc_string(priv->idmap_ctx, mem_ctx, sid),
		 LDAP_OBJ_GROUPMAP"ipaNTGroupAttrs", LDAP_OBJ_SAMBASAMACCOUNT"ipaNTUserAttrs");
if (filter == NULL((void*)0)) {
DEBUG(5, ("talloc_asprintf failed\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "832", __FUNCTION__
 )) && (dbgtext ("talloc_asprintf failed\n")) );
goto done;
}

rc = smbldap_search_suffix(priv->ldap_state, filter,
		   attrs, &result);
if (rc != LDAP_SUCCESS0x00) {
goto done;
}
smbldap_talloc_autofree_ldapmsg(mem_ctx, result);

if (ldap_count_entries(priv2ld(priv), result) != 1) {
DEBUG(10, ("Got %d entries, expected one\n",(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "845"
, __FUNCTION__ )) && (dbgtext ("Got %d entries, expected one\n"
, ldap_count_entries(priv2ld(priv), result))) )
	   ldap_count_entries(priv2ld(priv), result)))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "845"
, __FUNCTION__ )) && (dbgtext ("Got %d entries, expected one\n"
, ldap_count_entries(priv2ld(priv), result))) );
goto done;
}

entry = ldap_first_entry(priv2ld(priv), result);

values = ldap_get_values_len(priv2ld(priv), entry, "objectClass");
if (values == NULL((void*)0)) {
DEBUG(10, ("Cannot find any objectclasses.\n"))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "853"
, __FUNCTION__ )) && (dbgtext ("Cannot find any objectclasses.\n"
)) );
goto done;
}

for (c = 0; values[c] != NULL((void*)0); c++) {
if (strncasecmp(LDAP_OBJ_GROUPMAP"ipaNTGroupAttrs", values[c]->bv_val,
				   values[c]->bv_len) == 0) {
	break;
}
}

if (values[c] != NULL((void*)0)) {
const char *gid_str;
/* It's a group */

gid_str = get_single_attribute(mem_ctx, priv2ld(priv), entry,
			       "gidNumber");
if (gid_str == NULL((void*)0)) {
	DEBUG(1, ("%s has no gidNumber\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "872", __FUNCTION__
 )) && (dbgtext ("%s has no gidNumber\n", get_dn(mem_ctx
, priv2ld(priv), entry))) )
		  get_dn(mem_ctx, priv2ld(priv), entry)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "872", __FUNCTION__
 )) && (dbgtext ("%s has no gidNumber\n", get_dn(mem_ctx
, priv2ld(priv), entry))) );
	goto done;
}

ipasam_unixid_from_gid(id, strtoul(gid_str, NULL((void*)0), 10));

idmap_cache_set_sid2unixid(sid, id);

ret = true1;
goto done;
}

/* It must be a user */

value = get_single_attribute(mem_ctx, priv2ld(priv), entry,
		     "uidNumber");
if (value == NULL((void*)0)) {
DEBUG(1, ("Could not find uidNumber in %s\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "890", __FUNCTION__
 )) && (dbgtext ("Could not find uidNumber in %s\n", get_dn
(mem_ctx, priv2ld(priv), entry))) )
	  get_dn(mem_ctx, priv2ld(priv), entry)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "890", __FUNCTION__
 )) && (dbgtext ("Could not find uidNumber in %s\n", get_dn
(mem_ctx, priv2ld(priv), entry))) );
goto done;
}

ipasam_unixid_from_uid(id, strtoul(value, NULL((void*)0), 10));

idmap_cache_set_sid2unixid(sid, id);

ret = true1;
done:

TALLOC_FREE(mem_ctx)do { if (mem_ctx != ((void*)0)) { _talloc_free(mem_ctx, "ipa_sam.c"
 ":" "901"); mem_ctx=((void*)0); } } while(0);
return ret;
903}

905static bool_Bool ipasam_uid_to_sid(struct pdb_methods *methods, uid_t uid,
	       struct dom_sid *sid)
907{
struct ipasam_private *priv =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "909");
char *filter;
const char *attrs[] = { LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier", NULL((void*)0) };
LDAPMessage *result = NULL((void*)0);
LDAPMessage *entry = NULL((void*)0);
bool_Bool ret = false0;
char *user_sid_string;
struct dom_sid *user_sid = NULL((void*)0);
int rc;
enum idmap_error_code err;
struct unixid id;

TALLOC_CTX *tmp_ctx = talloc_new(priv)talloc_named_const(priv, 0, "talloc_new: " "ipa_sam.c" ":" "921"
);
if (tmp_ctx == NULL((void*)0)) {
goto done;
}

/* Fast fail if we get a request for uidNumber=0 because it currently
* will never exist in the directory
* Saves an expensive LDAP call of which failure will never be cached
*/
if (uid == 0) {
DEBUG(3, ("ERROR: Received request for uid %u, "(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "933", __FUNCTION__
 )) && (dbgtext ("ERROR: Received request for uid %u, "
 "fast failing as it will never exist\n", (unsigned int)uid))
 )
	  "fast failing as it will never exist\n",(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "933", __FUNCTION__
 )) && (dbgtext ("ERROR: Received request for uid %u, "
 "fast failing as it will never exist\n", (unsigned int)uid))
 )
	  (unsigned int)uid))(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "933", __FUNCTION__
 )) && (dbgtext ("ERROR: Received request for uid %u, "
 "fast failing as it will never exist\n", (unsigned int)uid))
 );
goto done;
}

filter = talloc_asprintf(tmp_ctx,
		 "(&(uidNumber=%u)"
		 "(objectClass=%s)"
		 "(objectClass=%s))",
		 (unsigned int)uid,
		 LDAP_OBJ_POSIXACCOUNT"posixAccount",
		 LDAP_OBJ_SAMBASAMACCOUNT"ipaNTUserAttrs");
if (filter == NULL((void*)0)) {
DEBUG(3, ("talloc_asprintf failed\n"))(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "945", __FUNCTION__
 )) && (dbgtext ("talloc_asprintf failed\n")) );
goto done;
}

rc = smbldap_search_suffix(priv->ldap_state, filter, attrs, &result);
if (rc != LDAP_SUCCESS0x00) {
goto done;
}
smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);

if (ldap_count_entries(priv2ld(priv), result) != 1) {
DEBUG(3, ("ERROR: Got %d entries for uid %u, expected one\n",(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "958", __FUNCTION__
 )) && (dbgtext ("ERROR: Got %d entries for uid %u, expected one\n"
, ldap_count_entries(priv2ld(priv), result), (unsigned int)uid
)) )
	   ldap_count_entries(priv2ld(priv), result),(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "958", __FUNCTION__
 )) && (dbgtext ("ERROR: Got %d entries for uid %u, expected one\n"
, ldap_count_entries(priv2ld(priv), result), (unsigned int)uid
)) )
	   (unsigned int)uid))(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "958", __FUNCTION__
 )) && (dbgtext ("ERROR: Got %d entries for uid %u, expected one\n"
, ldap_count_entries(priv2ld(priv), result), (unsigned int)uid
)) );
goto done;
}

entry = ldap_first_entry(priv2ld(priv), result);

user_sid_string = get_single_attribute(tmp_ctx, priv2ld(priv), entry,
			       LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
if (user_sid_string == NULL((void*)0)) {
DEBUG(1, ("Could not find SID in object '%s'\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "968", __FUNCTION__
 )) && (dbgtext ("Could not find SID in object '%s'\n"
, get_dn(tmp_ctx, priv2ld(priv), entry))) )
	  get_dn(tmp_ctx, priv2ld(priv), entry)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "968", __FUNCTION__
 )) && (dbgtext ("Could not find SID in object '%s'\n"
, get_dn(tmp_ctx, priv2ld(priv), entry))) );
goto done;
}

err = sss_idmap_sid_to_smb_sid(priv->idmap_ctx,
		       user_sid_string, &user_sid);
if (err != IDMAP_SUCCESS) {
DEBUG(3, ("Error creating sid structure for sid '%s'\n",(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "976", __FUNCTION__
 )) && (dbgtext ("Error creating sid structure for sid '%s'\n"
, user_sid_string)) )
	  user_sid_string))(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "976", __FUNCTION__
 )) && (dbgtext ("Error creating sid structure for sid '%s'\n"
, user_sid_string)) );
goto done;
}

sid_copy(sid, user_sid);

ipasam_unixid_from_uid(&id, uid);

idmap_cache_set_sid2unixid(sid, &id);

ret = true1;

988done:
talloc_free(user_sid)_talloc_free(user_sid, "ipa_sam.c" ":" "989");
TALLOC_FREE(tmp_ctx)do { if (tmp_ctx != ((void*)0)) { _talloc_free(tmp_ctx, "ipa_sam.c"
 ":" "990"); tmp_ctx=((void*)0); } } while(0);
return ret;
992}

994static bool_Bool ipasam_gid_to_sid(struct pdb_methods *methods, gid_t gid,
	       struct dom_sid *sid)
996{
struct ipasam_private *priv =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "998");
char *filter;
const char *attrs[] = { LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier", LDAP_ATTRIBUTE_OBJECTCLASS"objectClass", NULL((void*)0) };
LDAPMessage *result = NULL((void*)0);
LDAPMessage *entry = NULL((void*)0);
bool_Bool ret = false0;
char *group_sid_string = NULL((void*)0);
struct dom_sid *group_sid = NULL((void*)0);
struct berval **values;
size_t c;
int rc;
enum idmap_error_code err;
struct unixid id;

TALLOC_CTX *tmp_ctx = talloc_new(priv)talloc_named_const(priv, 0, "talloc_new: " "ipa_sam.c" ":" "1012"
);
if (tmp_ctx == NULL((void*)0)) {
goto done;
}

filter = talloc_asprintf(tmp_ctx,
		 "(|(&(gidNumber=%u)"
		     "(objectClass=%s))"
		   "(&(uidNumber=%u)"
		     "(objectClass=%s)"
		     "(objectClass=%s)))",
		 (unsigned int)gid,
		 LDAP_OBJ_GROUPMAP"ipaNTGroupAttrs",
		 (unsigned int)gid,
		 LDAP_OBJ_POSIXACCOUNT"posixAccount",
		 LDAP_OBJ_SAMBASAMACCOUNT"ipaNTUserAttrs");
if (filter == NULL((void*)0)) {
DEBUG(3, ("talloc_asprintf failed\n"))(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "1029", __FUNCTION__
 )) && (dbgtext ("talloc_asprintf failed\n")) );
goto done;
}

rc = smbldap_search_suffix(priv->ldap_state, filter, attrs, &result);
if (rc != LDAP_SUCCESS0x00) {
goto done;
}
smbldap_talloc_autofree_ldapmsg(tmp_ctx, result);

if (ldap_count_entries(priv2ld(priv), result) == 0) {
DEBUG(3, ("ERROR: Got %d entries for gid %u, expected at least one\n",(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "1042", __FUNCTION__
 )) && (dbgtext ("ERROR: Got %d entries for gid %u, expected at least one\n"
, ldap_count_entries(priv2ld(priv), result), (unsigned int)gid
)) )
	   ldap_count_entries(priv2ld(priv), result),(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "1042", __FUNCTION__
 )) && (dbgtext ("ERROR: Got %d entries for gid %u, expected at least one\n"
, ldap_count_entries(priv2ld(priv), result), (unsigned int)gid
)) )
	   (unsigned int)gid))(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "1042", __FUNCTION__
 )) && (dbgtext ("ERROR: Got %d entries for gid %u, expected at least one\n"
, ldap_count_entries(priv2ld(priv), result), (unsigned int)gid
)) );
goto done;
}

for (entry = ldap_first_entry(priv2ld(priv), result);
 entry != NULL((void*)0);
 entry = ldap_next_entry(priv2ld(priv), entry)) {

values = ldap_get_values_len(priv2ld(priv), entry, "objectClass");
if (values == NULL((void*)0)) {
	DEBUG(10, ("Cannot find any objectclasses.\n"))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "1052"
, __FUNCTION__ )) && (dbgtext ("Cannot find any objectclasses.\n"
)) );
	goto done;
}

for (c = 0; values[c] != NULL((void*)0); c++) {
	if (strncasecmp(LDAP_OBJ_GROUPMAP"ipaNTGroupAttrs", values[c]->bv_val,
					   values[c]->bv_len) == 0) {
		goto found;
	}
}

}

1065found:
/* If we didn't find a group we found a user - so this is a primary group
* For user private group, use fallback group */
if (entry == NULL((void*)0)) {

DEBUG(10, ("Did not find user private group %u, "(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "1071"
, __FUNCTION__ )) && (dbgtext ("Did not find user private group %u, "
 "returning fallback group.\n", (unsigned int)gid)) )
	   "returning fallback group.\n", (unsigned int)gid))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "1071"
, __FUNCTION__ )) && (dbgtext ("Did not find user private group %u, "
 "returning fallback group.\n", (unsigned int)gid)) );

sid_copy(sid,
	 &priv->fallback_primary_group);
ret = true1;
goto done;

}

group_sid_string = get_single_attribute(tmp_ctx, priv2ld(priv), entry,
				LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
if (group_sid_string == NULL((void*)0)) {
DEBUG(1, ("Could not find SID in object '%s'\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1084", __FUNCTION__
 )) && (dbgtext ("Could not find SID in object '%s'\n"
, get_dn(tmp_ctx, priv2ld(priv), entry))) )
	  get_dn(tmp_ctx, priv2ld(priv), entry)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1084", __FUNCTION__
 )) && (dbgtext ("Could not find SID in object '%s'\n"
, get_dn(tmp_ctx, priv2ld(priv), entry))) );
goto done;
}

err = sss_idmap_sid_to_smb_sid(priv->idmap_ctx,
		       group_sid_string, &group_sid);
if (err != IDMAP_SUCCESS) {
DEBUG(3, ("Error creating sid structure for sid '%s'\n",(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "1092", __FUNCTION__
 )) && (dbgtext ("Error creating sid structure for sid '%s'\n"
, group_sid_string)) )
	  group_sid_string))(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "1092", __FUNCTION__
 )) && (dbgtext ("Error creating sid structure for sid '%s'\n"
, group_sid_string)) );
goto done;
}

sid_copy(sid, group_sid);

ipasam_unixid_from_gid(&id, gid);

idmap_cache_set_sid2unixid(sid, &id);

ret = true1;

1104done:
talloc_free(group_sid)_talloc_free(group_sid, "ipa_sam.c" ":" "1105");
TALLOC_FREE(tmp_ctx)do { if (tmp_ctx != ((void*)0)) { _talloc_free(tmp_ctx, "ipa_sam.c"
 ":" "1106"); tmp_ctx=((void*)0); } } while(0);
return ret;
1108}

1110#if PASSDB_INTERFACE_VERSION25 >= 24
1111/* Since version 24, uid_to_sid() and gid_to_sid() were removed in favor of id_to_sid() */
1112static bool_Bool ipasam_id_to_sid(struct pdb_methods *methods, struct unixid *id, struct dom_sid *sid)
1113{
bool_Bool result = false0;

if (id->type != ID_TYPE_GID) {
result = ipasam_uid_to_sid(methods, id->id, sid);
}
if (!result && id->type != ID_TYPE_UID) {
result = ipasam_gid_to_sid(methods, id->id, sid);
}

return result;
1124}
1125#endif

1127static char *get_ldap_filter(TALLOC_CTX *mem_ctx, const char *username)
1128{
char *escaped = NULL((void*)0);
char *result = NULL((void*)0);

escaped = escape_ldap_string(mem_ctx, username);
if (escaped == NULL((void*)0)) {
return NULL((void*)0);
}

result = talloc_asprintf(mem_ctx, "(&(uid=%s)(objectclass=%s))",
			  escaped, LDAP_OBJ_SAMBASAMACCOUNT"ipaNTUserAttrs");

TALLOC_FREE(escaped)do { if (escaped != ((void*)0)) { _talloc_free(escaped, "ipa_sam.c"
 ":" "1140"); escaped=((void*)0); } } while(0);

return result;
1143}

1145static const char **talloc_attrs(TALLOC_CTX *mem_ctx, ...)
1146{
int i, num = 0;
va_list ap;
const char **result;

va_start(ap, mem_ctx)__builtin_va_start(ap, mem_ctx);
while (va_arg(ap, const char *)__builtin_va_arg(ap, const char *) != NULL((void*)0))
num += 1;
va_end(ap)__builtin_va_end(ap);

if ((result = talloc_array(mem_ctx, const char *, num+1)(const char * *)_talloc_array(mem_ctx, sizeof(const char *), num
+1, "const char *")) == NULL((void*)0)) {
return NULL((void*)0);
}

va_start(ap, mem_ctx)__builtin_va_start(ap, mem_ctx);
for (i=0; i<num; i++) {
result[i] = talloc_strdup(result, va_arg(ap, const char*)__builtin_va_arg(ap, const char*));
if (result[i] == NULL((void*)0)) {
	talloc_free(result)_talloc_free(result, "ipa_sam.c" ":" "1164");
	va_end(ap)__builtin_va_end(ap);
	return NULL((void*)0);
}
}
va_end(ap)__builtin_va_end(ap);

result[num] = NULL((void*)0);
return result;
1173}


1176struct ldap_search_state {
struct smbldap_state *connection;

uint32_t acct_flags;
uint16_t group_type;

const char *base;
int scope;
const char *filter;
const char **attrs;
int attrsonly;
void *pagedresults_cookie;
struct sss_idmap_ctx *idmap_ctx;
const struct dom_sid *dom_sid;

LDAPMessage *entries, *current_entry;
bool_Bool (*ldap2displayentry)(struct ldap_search_state *state,
		  TALLOC_CTX *mem_ctx,
		  LDAP *ld, LDAPMessage *entry,
		  struct samr_displayentry *result);
1196};

1198static bool_Bool ipasam_search_firstpage(struct pdb_search *search)
1199{
struct ldap_search_state *state =
talloc_get_type_abort(search->private_data, struct ldap_search_state)(struct ldap_search_state *)_talloc_get_type_abort(search->
private_data, "struct ldap_search_state", "ipa_sam.c" ":" "1201"
);
LDAP *ld;
int rc = LDAP_OPERATIONS_ERROR0x01;

state->entries = NULL((void*)0);

if (_smbldap_get_paged_results(state->connection)) {
rc = smbldap_search_paged(state->connection, state->base,
			  state->scope, state->filter,
			  state->attrs, state->attrsonly,
			  LDAP_PAGE_SIZE1000, &state->entries,
			  &state->pagedresults_cookie);
}

if ((rc != LDAP_SUCCESS0x00) || (state->entries == NULL((void*)0))) {

if (state->entries != NULL((void*)0)) {
	/* Left over from unsuccessful paged attempt */
	ldap_msgfree(state->entries);
	state->entries = NULL((void*)0);
}

rc = smbldap_search(state->connection, state->base,
		    state->scope, state->filter, state->attrs,
		    state->attrsonly, &state->entries);

if ((rc != LDAP_SUCCESS0x00) || (state->entries == NULL((void*)0)))
	return false0;

/* Ok, the server was lying. It told us it could do paged
 * searches when it could not. */
_smbldap_set_paged_results(state->connection, false0);
}

      ld = _smbldap_get_ldap(state->connection);
      if ( ld == NULL((void*)0)) {
              DEBUG(5, ("Don't have an LDAP connection right after a "(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1238", __FUNCTION__
 )) && (dbgtext ("Don't have an LDAP connection right after a "
 "search\n")) )
	  "search\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1238", __FUNCTION__
 )) && (dbgtext ("Don't have an LDAP connection right after a "
 "search\n")) );
              return false0;
      }
      state->current_entry = ldap_first_entry(ld, state->entries);

return true1;
1244}

1246static bool_Bool ipasam_search_nextpage(struct pdb_search *search)
1247{
struct ldap_search_state *state =
talloc_get_type_abort(search->private_data, struct ldap_search_state)(struct ldap_search_state *)_talloc_get_type_abort(search->
private_data, "struct ldap_search_state", "ipa_sam.c" ":" "1249"
);
LDAP *ld;
int rc;

if (!_smbldap_get_paged_results(state->connection)) {
/* There is no next page when there are no paged results */
return false0;
}

rc = smbldap_search_paged(state->connection, state->base,
		  state->scope, state->filter, state->attrs,
		  state->attrsonly, LDAP_PAGE_SIZE1000,
		  &state->entries,
		  &state->pagedresults_cookie);

if ((rc != LDAP_SUCCESS0x00) || (state->entries == NULL((void*)0)))
return false0;

      ld = _smbldap_get_ldap(state->connection);
      if ( ld == NULL((void*)0)) {
              DEBUG(5, ("Don't have an LDAP connection right after a "(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1270", __FUNCTION__
 )) && (dbgtext ("Don't have an LDAP connection right after a "
 "search\n")) )
	  "search\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1270", __FUNCTION__
 )) && (dbgtext ("Don't have an LDAP connection right after a "
 "search\n")) );
              return false0;
      }
state->current_entry = ldap_first_entry(ld,
				state->entries);

if (state->current_entry == NULL((void*)0)) {
ldap_msgfree(state->entries);
state->entries = NULL((void*)0);
return false0;
}

return true1;
1283}

1285static bool_Bool ipasam_search_next_entry(struct pdb_search *search,
		      struct samr_displayentry *entry)
1287{
struct ldap_search_state *state =
talloc_get_type_abort(search->private_data, struct ldap_search_state)(struct ldap_search_state *)_talloc_get_type_abort(search->
private_data, "struct ldap_search_state", "ipa_sam.c" ":" "1289"
);
bool_Bool result;
LDAP *ld;

retry:
if ((state->entries == NULL((void*)0)) && (state->pagedresults_cookie == NULL((void*)0)))
return false0;

if ((state->entries == NULL((void*)0)) &&
   !ipasam_search_nextpage(search))
    return false0;

if (state->current_entry == NULL((void*)0)) {
return false0;
}

      ld = _smbldap_get_ldap(state->connection);
      if ( ld == NULL((void*)0)) {
              DEBUG(5, ("Don't have an LDAP connection right after a "(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1308", __FUNCTION__
 )) && (dbgtext ("Don't have an LDAP connection right after a "
 "search\n")) )
	  "search\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1308", __FUNCTION__
 )) && (dbgtext ("Don't have an LDAP connection right after a "
 "search\n")) );
              return false0;
      }
result = state->ldap2displayentry(state, search,
			  ld,
			  state->current_entry, entry);

if (!result) {
char *dn;
dn = ldap_get_dn(ld, state->current_entry);
DEBUG(5, ("Skipping entry %s\n", dn != NULL ? dn : "<NULL>"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1318", __FUNCTION__
 )) && (dbgtext ("Skipping entry %s\n", dn != ((void*
)0) ? dn : "<NULL>")) );
if (dn != NULL((void*)0)) ldap_memfree(dn);
}

state->current_entry = ldap_next_entry(ld,
			       state->current_entry);

if (state->current_entry == NULL((void*)0)) {
ldap_msgfree(state->entries);
state->entries = NULL((void*)0);
}

if (!result) goto retry;

return true1;
1333}

1335static void ipasam_search_end(struct pdb_search *search)
1336{
struct ldap_search_state *state =
talloc_get_type_abort(search->private_data, struct ldap_search_state)(struct ldap_search_state *)_talloc_get_type_abort(search->
private_data, "struct ldap_search_state", "ipa_sam.c" ":" "1338"
);
int rc;

if (state->pagedresults_cookie == NULL((void*)0))
return;

if (state->entries != NULL((void*)0))
ldap_msgfree(state->entries);

state->entries = NULL((void*)0);
state->current_entry = NULL((void*)0);

if (!_smbldap_get_paged_results(state->connection))
return;

/* Tell the LDAP server we're not interested in the rest anymore. */

rc = smbldap_search_paged(state->connection, state->base, state->scope,
		  state->filter, state->attrs,
		  state->attrsonly, 0, &state->entries,
		  &state->pagedresults_cookie);

if (rc != LDAP_SUCCESS0x00)
DEBUG(5, ("Could not end search properly\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1361", __FUNCTION__
 )) && (dbgtext ("Could not end search properly\n")) );

1363}

1365static bool_Bool ldapuser2displayentry(struct ldap_search_state *state,
		  TALLOC_CTX *mem_ctx,
		  LDAP *ld, LDAPMessage *entry,
		  struct samr_displayentry *result)
1369{
char **vals;
size_t converted_size;
struct dom_sid *sid = NULL((void*)0);
enum idmap_error_code err;
bool_Bool res;

1376/* FIXME: SB try to figure out which flags to set instead of hardcode them */
result->acct_flags = 66048;
result->account_name = "";
result->fullname = "";
result->description = "";

vals = ldap_get_values(ld, entry, "uid");
if ((vals == NULL((void*)0)) || (vals[0] == NULL((void*)0))) {
DEBUG(5, ("\"uid\" not found\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1384", __FUNCTION__
 )) && (dbgtext ("\"uid\" not found\n")) );
return false0;
}
if (!pull_utf8_talloc(mem_ctx,
	      discard_const_p(char *, &result->account_name)((char * *)((void *)((uintptr_t)(&result->account_name
)))),
	      vals[0], &converted_size))
{
DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1392", __FUNCTION__
 )) && (dbgtext ("ldapuser2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) )
	 strerror(errno)))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1392", __FUNCTION__
 )) && (dbgtext ("ldapuser2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) );
}

ldap_value_free(vals);

vals = ldap_get_values(ld, entry, "displayName");
if ((vals == NULL((void*)0)) || (vals[0] == NULL((void*)0)))
DEBUG(8, ("\"displayName\" not found\n"))(void)( ((8) <= 1000) && (debuglevel_get_class(0) >=
 (8)) && (dbghdrclass( 8, 0, "ipa_sam.c" ":" "1399", __FUNCTION__
 )) && (dbgtext ("\"displayName\" not found\n")) );
else if (!pull_utf8_talloc(mem_ctx,
		   discard_const_p(char *, &result->fullname)((char * *)((void *)((uintptr_t)(&result->fullname)))),
		   vals[0], &converted_size))
{
DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1405", __FUNCTION__
 )) && (dbgtext ("ldapuser2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) )
	 strerror(errno)))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1405", __FUNCTION__
 )) && (dbgtext ("ldapuser2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) );
}

ldap_value_free(vals);

vals = ldap_get_values(ld, entry, "description");
if ((vals == NULL((void*)0)) || (vals[0] == NULL((void*)0)))
DEBUG(8, ("\"description\" not found\n"))(void)( ((8) <= 1000) && (debuglevel_get_class(0) >=
 (8)) && (dbghdrclass( 8, 0, "ipa_sam.c" ":" "1412", __FUNCTION__
 )) && (dbgtext ("\"description\" not found\n")) );
else if (!pull_utf8_talloc(mem_ctx,
		   discard_const_p(char *, &result->description)((char * *)((void *)((uintptr_t)(&result->description)
))),
		   vals[0], &converted_size))
{
DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1418", __FUNCTION__
 )) && (dbgtext ("ldapuser2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) )
	 strerror(errno)))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1418", __FUNCTION__
 )) && (dbgtext ("ldapuser2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) );
}

ldap_value_free(vals);

if ((result->account_name == NULL((void*)0)) ||
   (result->fullname == NULL((void*)0)) ||
   (result->description == NULL((void*)0))) {
DEBUG(0, ("talloc failed\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1426", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
return false0;
}

vals = ldap_get_values(ld, entry, LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
if ((vals == NULL((void*)0)) || (vals[0] == NULL((void*)0))) {
DEBUG(0, ("\"objectSid\" not found\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1432", __FUNCTION__
 )) && (dbgtext ("\"objectSid\" not found\n")) );
return false0;
}

err = sss_idmap_sid_to_smb_sid(state->idmap_ctx, vals[0], &sid);
if (err != IDMAP_SUCCESS) {
DEBUG(0, ("Could not convert %s to SID\n", vals[0]))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1438", __FUNCTION__
 )) && (dbgtext ("Could not convert %s to SID\n", vals
[0])) );
ldap_value_free(vals);
return false0;
}
ldap_value_free(vals);

res = sid_peek_check_rid(state->dom_sid, sid, &result->rid);
talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "1445");
if (!res) {
DEBUG(0, ("sid does not belong to our domain\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1447", __FUNCTION__
 )) && (dbgtext ("sid does not belong to our domain\n"
)) );
return false0;
}

return true1;
1452}

1454static bool_Bool ipasam_search_users(struct pdb_methods *methods,
		 struct pdb_search *search,
		 uint32_t acct_flags)
1457{
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "1459");
struct ldap_search_state *state;

state = talloc(search, struct ldap_search_state)(struct ldap_search_state *)talloc_named_const(search, sizeof
(struct ldap_search_state), "struct ldap_search_state");
if (state == NULL((void*)0)) {
DEBUG(0, ("talloc failed\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1464", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
return false0;
}

state->connection = ipasam_state->ldap_state;

state->base = talloc_strdup(search, ipasam_state->base_dn);

state->acct_flags = acct_flags;
state->scope = LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002);
state->filter = get_ldap_filter(search, "*");
state->attrs = talloc_attrs(search, "uid", LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier",
		    "displayName", "description",
		    NULL((void*)0));
state->attrsonly = 0;
state->pagedresults_cookie = NULL((void*)0);
state->entries = NULL((void*)0);
state->idmap_ctx = ipasam_state->idmap_ctx;
state->dom_sid = &ipasam_state->domain_sid;
state->ldap2displayentry = ldapuser2displayentry;

if ((state->filter == NULL((void*)0)) || (state->attrs == NULL((void*)0))) {
DEBUG(0, ("talloc failed\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1486", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
return false0;
}

search->private_data = state;
search->next_entry = ipasam_search_next_entry;
search->search_end = ipasam_search_end;

return ipasam_search_firstpage(search);
1495}

1497static bool_Bool ldapgroup2displayentry(struct ldap_search_state *state,
		   TALLOC_CTX *mem_ctx,
		   LDAP *ld, LDAPMessage *entry,
		   struct samr_displayentry *result)
1501{
char **vals = NULL((void*)0);
size_t converted_size;
struct dom_sid *sid = NULL((void*)0);
uint16_t group_type;
enum idmap_error_code err;

result->account_name = "";
result->fullname = "";
result->description = "";

group_type = SID_NAME_DOM_GRP;

if ((state->group_type != 0) &&
   ((state->group_type != group_type))) {
ldap_value_free(vals);
return false0;
}

ldap_value_free(vals);

/* display name is the NT group name */

vals = ldap_get_values(ld, entry, "displayName");
if ((vals == NULL((void*)0)) || (vals[0] == NULL((void*)0))) {
DEBUG(8, ("\"displayName\" not found\n"))(void)( ((8) <= 1000) && (debuglevel_get_class(0) >=
 (8)) && (dbghdrclass( 8, 0, "ipa_sam.c" ":" "1526", __FUNCTION__
 )) && (dbgtext ("\"displayName\" not found\n")) );

/* fallback to the 'cn' attribute */
vals = ldap_get_values(ld, entry, "cn");
if ((vals == NULL((void*)0)) || (vals[0] == NULL((void*)0))) {
	DEBUG(5, ("\"cn\" not found\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "1531", __FUNCTION__
 )) && (dbgtext ("\"cn\" not found\n")) );
	return false0;
}
if (!pull_utf8_talloc(mem_ctx,
		      discard_const_p(char *,((char * *)((void *)((uintptr_t)(&result->account_name
))))
				    &result->account_name)((char * *)((void *)((uintptr_t)(&result->account_name
)))),
		      vals[0], &converted_size))
{
	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc "(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1540", __FUNCTION__
 )) && (dbgtext ("ldapgroup2displayentry: pull_utf8_talloc "
 "failed: %s", strerror((*__errno_location ())))) )
		  "failed: %s", strerror(errno)))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1540", __FUNCTION__
 )) && (dbgtext ("ldapgroup2displayentry: pull_utf8_talloc "
 "failed: %s", strerror((*__errno_location ())))) );
}
}
else if (!pull_utf8_talloc(mem_ctx,
		   discard_const_p(char *,((char * *)((void *)((uintptr_t)(&result->account_name
))))
				 &result->account_name)((char * *)((void *)((uintptr_t)(&result->account_name
)))),
		   vals[0], &converted_size))
{
DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc failed: %s",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1549", __FUNCTION__
 )) && (dbgtext ("ldapgroup2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) )
	  strerror(errno)))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1549", __FUNCTION__
 )) && (dbgtext ("ldapgroup2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) );
}

ldap_value_free(vals);

vals = ldap_get_values(ld, entry, "description");
if ((vals == NULL((void*)0)) || (vals[0] == NULL((void*)0)))
DEBUG(8, ("\"description\" not found\n"))(void)( ((8) <= 1000) && (debuglevel_get_class(0) >=
 (8)) && (dbghdrclass( 8, 0, "ipa_sam.c" ":" "1556", __FUNCTION__
 )) && (dbgtext ("\"description\" not found\n")) );
else if (!pull_utf8_talloc(mem_ctx,
		   discard_const_p(char *, &result->description)((char * *)((void *)((uintptr_t)(&result->description)
))),
		   vals[0], &converted_size))
{
DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc failed: %s",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1562", __FUNCTION__
 )) && (dbgtext ("ldapgroup2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) )
	  strerror(errno)))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1562", __FUNCTION__
 )) && (dbgtext ("ldapgroup2displayentry: pull_utf8_talloc failed: %s"
, strerror((*__errno_location ())))) );
}
ldap_value_free(vals);

if ((result->account_name == NULL((void*)0)) ||
   (result->fullname == NULL((void*)0)) ||
   (result->description == NULL((void*)0))) {
DEBUG(0, ("talloc failed\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1569", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
return false0;
}

vals = ldap_get_values(ld, entry, LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
if ((vals == NULL((void*)0)) || (vals[0] == NULL((void*)0))) {
DEBUG(0, ("\"objectSid\" not found\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1575", __FUNCTION__
 )) && (dbgtext ("\"objectSid\" not found\n")) );
if (vals != NULL((void*)0)) {
	ldap_value_free(vals);
}
return false0;
}

err = sss_idmap_sid_to_smb_sid(state->idmap_ctx, vals[0], &sid);
if (err != IDMAP_SUCCESS) {
DEBUG(0, ("Could not convert %s to SID\n", vals[0]))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1584", __FUNCTION__
 )) && (dbgtext ("Could not convert %s to SID\n", vals
[0])) );
ldap_value_free(vals);
return false0;
}

ldap_value_free(vals);

switch (group_type) {
case SID_NAME_DOM_GRP:
case SID_NAME_ALIAS:

	if (!sid_peek_check_rid(state->dom_sid, sid, &result->rid) &&
	    !sid_peek_check_rid(&global_sid_Builtin, sid, &result->rid))
	{
		talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "1598");
		DEBUG(0, ("SID is not in our domain\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1599", __FUNCTION__
 )) && (dbgtext ("SID is not in our domain\n")) );
		return false0;
	}
	break;

default:
	DEBUG(0,("unknown group type: %d\n", group_type))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1605", __FUNCTION__
 )) && (dbgtext ("unknown group type: %d\n", group_type
)) );
	talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "1606");
	return false0;
}
talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "1609");

result->acct_flags = 0;

return true1;
1614}

1616static bool_Bool ipasam_search_grouptype(struct pdb_methods *methods,
		     struct pdb_search *search,
		     const struct dom_sid *sid,
		     enum lsa_SidType type)
1620{
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "1622");
struct ldap_search_state *state;

state = talloc(search, struct ldap_search_state)(struct ldap_search_state *)talloc_named_const(search, sizeof
(struct ldap_search_state), "struct ldap_search_state");
if (state == NULL((void*)0)) {
DEBUG(0, ("talloc failed\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1627", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
return false0;
}

state->base = talloc_strdup(search, ipasam_state->base_dn);
state->connection = ipasam_state->ldap_state;
state->scope = LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002);
state->filter =	talloc_asprintf(search, "(&(objectclass=%s)(%s=%s*))",
			LDAP_OBJ_GROUPMAP"ipaNTGroupAttrs", LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier",
			sid_talloc_string(
				ipasam_state->idmap_ctx,
				search, sid));
state->attrs = talloc_attrs(search, "cn", LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier",
		    "displayName", "description",
		     NULL((void*)0));
state->attrsonly = 0;
state->pagedresults_cookie = NULL((void*)0);
state->entries = NULL((void*)0);
state->group_type = type;
state->idmap_ctx = ipasam_state->idmap_ctx;
state->dom_sid = &ipasam_state->domain_sid;
state->ldap2displayentry = ldapgroup2displayentry;

if ((state->filter == NULL((void*)0)) || (state->attrs == NULL((void*)0))) {
DEBUG(0, ("talloc failed\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1651", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
return false0;
}

search->private_data = state;
search->next_entry = ipasam_search_next_entry;
search->search_end = ipasam_search_end;

return ipasam_search_firstpage(search);
1660}

1662static bool_Bool ipasam_search_groups(struct pdb_methods *methods,
		  struct pdb_search *search)
1664{
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "1666");

return ipasam_search_grouptype(methods, search,
			&ipasam_state->domain_sid,
                                      SID_NAME_DOM_GRP);
1671}

1673static bool_Bool ipasam_search_aliases(struct pdb_methods *methods,
		   struct pdb_search *search,
		   const struct dom_sid *sid)
1676{
return ipasam_search_grouptype(methods, search,
		       sid, SID_NAME_ALIAS);
1679}

1681static char *trusted_domain_dn(TALLOC_CTX *mem_ctx,
	       struct ipasam_private *ipasam_state,
	       const char *domain)
1684{
return talloc_asprintf(mem_ctx, "%s=%s,%s",
	       LDAP_ATTRIBUTE_CN"cn", domain,
	       ipasam_state->trust_dn);
1688}

1690static NTSTATUS ipasam_get_objectclasses(struct ipasam_private *ipasam_state,
			 const char *dn, LDAPMessage *entry,
			 uint32_t *has_objectclass)
1693{
struct berval **bervals;
size_t c;

bervals = ldap_get_values_len(priv2ld(ipasam_state), entry,
			LDAP_ATTRIBUTE_OBJECTCLASS"objectClass");
if (bervals == NULL((void*)0)) {
DEBUG(0, ("Entry [%s] does not have any objectclasses.\n", dn))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "1700", __FUNCTION__
 )) && (dbgtext ("Entry [%s] does not have any objectclasses.\n"
, dn)) );
return NT_STATUS_INTERNAL_DB_CORRUPTION((NTSTATUS) { 0xc00000e4 });
}

*has_objectclass = 0;
for (c = 0; bervals[c] != NULL((void*)0); c++) {
if (strnequal(bervals[c]->bv_val, LDAP_OBJ_KRB_PRINCIPAL"krbPrincipal", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_KRB_PRINCIPAL(1<<0);
} else if (strnequal(bervals[c]->bv_val,
	   LDAP_OBJ_KRB_PRINCIPAL_AUX"krbPrincipalAux", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_KRB_PRINCIPAL_AUX(1<<1);
} else if (strnequal(bervals[c]->bv_val, LDAP_OBJ_IPAOBJECT"ipaObject", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_IPAOBJECT(1<<2);
} else if (strnequal(bervals[c]->bv_val, LDAP_OBJ_IPAHOST"ipaHost", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_IPAHOST(1<<3);
} else if (strnequal(bervals[c]->bv_val, LDAP_OBJ_POSIXACCOUNT"posixAccount", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_POSIXACCOUNT(1<<4);
} else if (strnequal(bervals[c]->bv_val, LDAP_OBJ_GROUPOFNAMES"groupOfNames", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_GROUPOFNAMES(1<<5);
} else if (strnequal(bervals[c]->bv_val, LDAP_OBJ_NESTEDGROUP"nestedGroup", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_NESTEDGROUP(1<<6);
} else if (strnequal(bervals[c]->bv_val, LDAP_OBJ_IPAUSERGROUP"ipaUserGroup", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_IPAUSERGROUP(1<<7);
} else if (strnequal(bervals[c]->bv_val, LDAP_OBJ_POSIXGROUP"posixGroup", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_POSIXGROUP(1<<8);
} else if (strnequal(bervals[c]->bv_val, LDAP_OBJ_KRB_TICKET_POLICY_AUX"krbTicketPolicyAux", bervals[c]->bv_len)) {
	*has_objectclass |= HAS_KRB_TICKET_POLICY_AUX(1<<9);
}
}
ldap_value_free_len(bervals);

return NT_STATUS_OK((NTSTATUS) { 0x0 });
1732}

1734static bool_Bool search_krb_princ(struct ipasam_private *ipasam_state,
	     TALLOC_CTX *mem_ctx,
	     const char *princ, const char *base_dn,
	     LDAPMessage **entry)
1738{
int rc;
LDAPMessage *result = NULL((void*)0);
uint32_t num_result;
char *filter;

filter = talloc_asprintf(mem_ctx, "%s=%s",
		 LDAP_ATTRIBUTE_KRB_PRINCIPAL"krbPrincipalName", princ);
if (filter == NULL((void*)0)) {
return false0;
}

rc = smbldap_search(ipasam_state->ldap_state, base_dn,
	    LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002), filter, NULL((void*)0), 0, &result);

if (result != NULL((void*)0)) {
smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
}

if (rc == LDAP_NO_SUCH_OBJECT0x20) {
*entry = NULL((void*)0);
return true1;
}

if (rc != LDAP_SUCCESS0x00) {
return false0;
}

num_result = ldap_count_entries(priv2ld(ipasam_state), result);

if (num_result > 1) {
DEBUG(1, ("search_krb_princ: more than one object found "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1770", __FUNCTION__
 )) && (dbgtext ("search_krb_princ: more than one object found "
 "with filter '%s'?!\n", filter)) )
	  "with filter '%s'?!\n", filter))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1770", __FUNCTION__
 )) && (dbgtext ("search_krb_princ: more than one object found "
 "with filter '%s'?!\n", filter)) );
return false0;
}

if (num_result == 0) {
DEBUG(1, ("get_trusted_domain_int: no object found "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1776", __FUNCTION__
 )) && (dbgtext ("get_trusted_domain_int: no object found "
 "with filter '%s'.\n", filter)) )
	  "with filter '%s'.\n", filter))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1776", __FUNCTION__
 )) && (dbgtext ("get_trusted_domain_int: no object found "
 "with filter '%s'.\n", filter)) );
*entry = NULL((void*)0);
} else {
*entry = ldap_first_entry(priv2ld(ipasam_state), result);
}

return true1;
1783}

1785/* Please keep ENCTYPE_ARCFOUR_HMAC the last in the list
* of the default encryption types so that we can exclude
* it when running in a FIPS mode where it is not allowed
*/
1789#define DEF_ENCTYPE_NUM3 3
1790long default_enctypes[DEF_ENCTYPE_NUM3] = {
  ENCTYPE_AES256_CTS_HMAC_SHA1_960x0012,
  ENCTYPE_AES128_CTS_HMAC_SHA1_960x0011,
  ENCTYPE_ARCFOUR_HMAC0x0017
1794};

1796static int set_cross_realm_pw(struct ipasam_private *ipasam_state,
	      const char *princ,
	      const char *pwd)
1799{
int ret;
      size_t buflen;
      void *buffer = NULL((void*)0);
struct berval reqdata = { 0 };
struct berval *retdata = NULL((void*)0);
      char *retoid;
int enctypes_num = DEF_ENCTYPE_NUM3;

      if (ipasam_state->fips_enabled) {
DEBUG(1, ("FIPS mode enabled: TDO account credentials will not have RC4-HMAC!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1809", __FUNCTION__
 )) && (dbgtext ("FIPS mode enabled: TDO account credentials will not have RC4-HMAC!\n"
)) );
              enctypes_num = DEF_ENCTYPE_NUM3 - 1;
      }
      ret = ipaasn1_enc_getkt(true1, princ, pwd,
                              default_enctypes, enctypes_num,
                              &buffer, &buflen);
      if (!ret) goto done;

      reqdata.bv_len = buflen;
      reqdata.bv_val = buffer;

ret = smbldap_extended_operation(ipasam_state->ldap_state,
			 KEYTAB_GET_OID"2.16.840.1.113730.3.8.10.5", &reqdata, NULL((void*)0), NULL((void*)0),
			 &retoid, &retdata);
if (ret != LDAP_SUCCESS0x00) {
DEBUG(1, ("smbldap_extended_operation failed!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1824", __FUNCTION__
 )) && (dbgtext ("smbldap_extended_operation failed!\n"
)) );
goto done;
}

/* So far we do not care about the result */
ldap_memfree(retoid);
if (retdata != NULL((void*)0)) {
ber_bvfree(retdata);
}

ret = 0;
1835done:
      free(buffer);
return ret;
1838}

1840#define KRB_PRINC_CREATE_DEFAULT0x00000000            0x00000000
1841#define KRB_PRINC_CREATE_DISABLED0x00000001           0x00000001
1842#define KRB_PRINC_CREATE_AGENT_PERMISSION0x00000002   0x00000002


1845static bool_Bool set_krb_princ(struct ipasam_private *ipasam_state,
	  TALLOC_CTX *mem_ctx,
	  const char *princ, const char *alias,
	  const char *pwd,
	  const char *base_dn,
	  uint32_t   create_flags)
1851{
LDAPMessage *entry = NULL((void*)0);
LDAPMod **mods = NULL((void*)0);
char *dn = NULL((void*)0);
int ret;
uint32_t has_objectclass = 0;
NTSTATUS status;

if (!search_krb_princ(ipasam_state, mem_ctx, princ, base_dn, &entry)) {
return false0;
}

if (entry) {
dn = get_dn(mem_ctx, priv2ld(ipasam_state), entry);
if (!dn) {
	return false0;
}

status = ipasam_get_objectclasses(ipasam_state, dn, entry,
				  &has_objectclass);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
	return false0;
}
} else {
dn = talloc_asprintf(mem_ctx, "%s=%s,%s",
		     LDAP_ATTRIBUTE_KRB_PRINCIPAL"krbPrincipalName", princ,
		     base_dn);
if (!dn) {
	return false0;
}
}

if (!(has_objectclass & HAS_KRB_PRINCIPAL(1<<0))) {
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
		LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
		LDAP_OBJ_KRB_PRINCIPAL"krbPrincipal");
}

if (!(has_objectclass & HAS_KRB_PRINCIPAL_AUX(1<<1))) {
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
		LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
		LDAP_OBJ_KRB_PRINCIPAL_AUX"krbPrincipalAux");
}

if (!(has_objectclass & HAS_KRB_TICKET_POLICY_AUX(1<<9))) {
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
		LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
		LDAP_OBJ_KRB_TICKET_POLICY_AUX"krbTicketPolicyAux");
}

smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
	 LDAP_ATTRIBUTE_KRB_CANONICAL"krbCanonicalName", princ);
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
	 LDAP_ATTRIBUTE_KRB_PRINCIPAL"krbPrincipalName", princ);
if (alias) {
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
		LDAP_ATTRIBUTE_KRB_PRINCIPAL"krbPrincipalName", alias);
}

if ((create_flags & KRB_PRINC_CREATE_DISABLED0x00000001)) {
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
		LDAP_ATTRIBUTE_KRB_TICKET_FLAGS"krbTicketFlags",
		__TALLOC_STRING_LINE2__(IPASAM_DISALLOW_ALL_TIX)"64");
}

if ((create_flags & KRB_PRINC_CREATE_AGENT_PERMISSION0x00000002)) {
char *agent_dn = NULL((void*)0);
agent_dn = talloc_asprintf(mem_ctx, LDAP_CN_ADTRUST_AGENTS"cn=adtrust agents,cn=sysaccounts,cn=etc"",%s", ipasam_state->base_dn);
if (agent_dn == NULL((void*)0)) {
	DEBUG(1, ("error configuring cross realm principal data!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1920", __FUNCTION__
 )) && (dbgtext ("error configuring cross realm principal data!\n"
)) );
	return false0;
}
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
		LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
		LDAP_OBJ_IPAOPALLOW"ipaAllowedOperations");
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
		LDAP_ATTRIBUTE_IPAOPALLOW"ipaAllowedToPerform;read_keys",
		agent_dn);
agent_dn = talloc_asprintf(mem_ctx, LDAP_CN_ADTRUST_ADMINS"cn=trust admins,cn=groups,cn=accounts"",%s", ipasam_state->base_dn);
if (agent_dn == NULL((void*)0)) {
	DEBUG(1, ("error configuring cross realm principal data for trust admins!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1931", __FUNCTION__
 )) && (dbgtext ("error configuring cross realm principal data for trust admins!\n"
)) );
	return false0;
}
smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000),
		LDAP_ATTRIBUTE_IPAOPALLOW"ipaAllowedToPerform;read_keys",
		agent_dn);
}

if (entry == NULL((void*)0)) {
ret = smbldap_add(ipasam_state->ldap_state, dn, mods);
} else {
ret = smbldap_modify(ipasam_state->ldap_state, dn, mods);
}
if (ret != LDAP_SUCCESS0x00) {
DEBUG(1, ("error writing cross realm principal data!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1945", __FUNCTION__
 )) && (dbgtext ("error writing cross realm principal data!\n"
)) );
return false0;
}

ret = set_cross_realm_pw(ipasam_state, princ, pwd);
if (ret != 0) {
DEBUG(1, ("set_cross_realm_pw failed.\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "1951", __FUNCTION__
 )) && (dbgtext ("set_cross_realm_pw failed.\n")) );
return false0;
}

return true1;
1956}

1958static bool_Bool del_krb_princ(struct ipasam_private *ipasam_state,
	  TALLOC_CTX *mem_ctx,
	  const char *princ, const char *base_dn)
1961{
LDAPMessage *entry = NULL((void*)0);
char *dn = NULL((void*)0);
int ret;

if (!search_krb_princ(ipasam_state, mem_ctx, princ, base_dn, &entry)) {
return false0;
}

if (entry) {
dn = get_dn(mem_ctx, priv2ld(ipasam_state), entry);
if (!dn) {
	return false0;
}

ret = smbldap_delete(ipasam_state->ldap_state, dn);
if (ret != LDAP_SUCCESS0x00) {
	return false0;
}
}

return true1;
1983}

1985enum princ_mod {
SET_PRINC,
DEL_PRINC
1988};

1990static bool_Bool handle_cross_realm_princs(struct ipasam_private *ipasam_state,
		      const char *domain, const char *flat_name,
		      const char *pwd_incoming,
		      const char *pwd_outgoing,
		      uint32_t trust_direction,
		      enum princ_mod mod)
1996{
char *trusted_dn;
char *princ_l;
char *princ_r;
char *princ_r_tdo, *princ_l_tdo;
char *remote_realm;
bool_Bool ok;
      int failed = 0;
TALLOC_CTX *tmp_ctx;
const char *r_tdo_alias, *l_tdo_alias;

tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "2007");
if (tmp_ctx == NULL((void*)0)) {
return false0;
}

remote_realm = talloc_strdup_upper(tmp_ctx, domain);
if (remote_realm == NULL((void*)0)) {
ok = false0;
goto done;
}

trusted_dn = trusted_domain_dn(tmp_ctx, ipasam_state, domain);

princ_l = talloc_asprintf(tmp_ctx, "krbtgt/%s@%s",
		  remote_realm, ipasam_state->realm);
princ_l_tdo = talloc_asprintf(tmp_ctx, "%s$@%s",
		      flat_name, ipasam_state->realm);
l_tdo_alias = talloc_asprintf(tmp_ctx, "krbtgt/%s@%s",
		      flat_name, ipasam_state->realm);

princ_r = talloc_asprintf(tmp_ctx, "krbtgt/%s@%s",
		  ipasam_state->realm, remote_realm);
princ_r_tdo = talloc_asprintf(tmp_ctx, "%s$@%s",
		      ipasam_state->flat_name, remote_realm);

r_tdo_alias = talloc_asprintf(tmp_ctx, "krbtgt/%s@%s",
	ipasam_state->flat_name, remote_realm);

if (trusted_dn == NULL((void*)0) || princ_l == NULL((void*)0) || princ_l_tdo == NULL((void*)0) ||
l_tdo_alias == NULL((void*)0) || princ_r == NULL((void*)0) || princ_r_tdo == NULL((void*)0) ||
r_tdo_alias == NULL((void*)0)) {
ok = false0;
goto done;
}

switch (mod) {
case SET_PRINC:
	/* We must use two sets by two principals here because
	 * they are used for different needs and must have
	 * different salts */

	failed = 0;
	/* INBOUND TRUST */
	if ((trust_direction & LSA_TRUST_DIRECTION_INBOUND( 0x00000001 )) != 0) {
		/* First: krbtgt/<OUR REALM>@<REMOTE REALM>, enabled by default
		 * in case of the inboud trust */
		failed += !set_krb_princ(ipasam_state, tmp_ctx, princ_r, NULL((void*)0),
					 pwd_outgoing, trusted_dn,
					 KRB_PRINC_CREATE_DEFAULT0x00000000);

		/* Second: krbtgt/<OUR FLATNAME>@<REMOTE REALM>
		 * is only used for SSSD to be able to talk to
		 * AD DCs but it has to have canonical name set
		 * to krbtgt/<OUR FLATNAME> and alias it to
		 * <OUR FLATNAME$> because it is the salt used
		 * by AD DCs when using this principal,
		 * otherwise authentication will fail.
		 *
		 * *disable* use of this principal on our side as it is
		 * only used to retrieve trusted domain credentials by
		 * AD Trust Agents across the IPA topology */
		failed += !set_krb_princ(ipasam_state, tmp_ctx,
					 r_tdo_alias, princ_r_tdo,
					 pwd_incoming, trusted_dn,
					 (KRB_PRINC_CREATE_DISABLED0x00000001 |
					  KRB_PRINC_CREATE_AGENT_PERMISSION0x00000002));

                       ok = (failed == 0);
		if (!ok) {
			goto done;
		}
	}

	failed = 0;
	/* OUTBOUND TRUST */
	if ((trust_direction & LSA_TRUST_DIRECTION_OUTBOUND( 0x00000002 )) != 0) {
		/* First: krbtgt/<REMOTE REALM>@<OUR REALM>, enabled by default */
		failed += !set_krb_princ(ipasam_state, tmp_ctx,
					 princ_l, NULL((void*)0),
					 pwd_outgoing, trusted_dn,
					 KRB_PRINC_CREATE_DEFAULT0x00000000);

		/* Second: <REMOTE FLAT NAME>$@<OUR REALM>, enabled by default
		 * as it is used for a remote DC to authenticate against IPA Samba
		 *
		 * A local account for the outbound trust must have
		 * POSIX and SMB identities associated with our domain but we associate
		 * them with the trust domain object itself */
		failed += !set_krb_princ(ipasam_state, tmp_ctx,
					 princ_l_tdo, l_tdo_alias,
					 pwd_incoming, trusted_dn,
					 KRB_PRINC_CREATE_DEFAULT0x00000000);

                       ok = (failed == 0);
		if (!ok) {
			goto done;
		}
	}
	break;
case DEL_PRINC:
	failed = 0;
	if ((trust_direction & LSA_TRUST_DIRECTION_INBOUND( 0x00000001 )) != 0) {
		failed += !del_krb_princ(ipasam_state, tmp_ctx, princ_r, trusted_dn);
		failed += !del_krb_princ(ipasam_state, tmp_ctx, princ_r_tdo, trusted_dn);

                       ok = (failed == 0);
		if (!ok) {
			goto done;
		}
	}

	failed = 0;
	if ((trust_direction & LSA_TRUST_DIRECTION_OUTBOUND( 0x00000002 )) != 0) {
		failed += !del_krb_princ(ipasam_state, tmp_ctx, princ_l, trusted_dn);
		failed += !del_krb_princ(ipasam_state, tmp_ctx, princ_l_tdo, trusted_dn);

                       ok = (failed == 0);
		if (!ok) {
			goto done;
		}
	}
	break;
default:
	DEBUG(1, ("unknown operation.\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2130", __FUNCTION__
 )) && (dbgtext ("unknown operation.\n")) );
	ok = false0;
	goto done;
}

ok = true1;
2136done:
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "2137");
return ok;
2139}

2141static bool_Bool set_cross_realm_princs(struct ipasam_private *ipasam_state,
		   const char *domain, const char* flat_name,
		   const char *pwd_incoming, const char *pwd_outgoing,
		   uint32_t trust_direction)
2145{
return handle_cross_realm_princs(ipasam_state, domain, flat_name,
			 pwd_incoming,
			 pwd_outgoing,
			 trust_direction, SET_PRINC);
2150}

2152static bool_Bool del_cross_realm_princs(struct ipasam_private *ipasam_state,
		   const char *domain, const char *flat_name)
2154{
uint32_t trust_direction = LSA_TRUST_DIRECTION_INBOUND( 0x00000001 ) | LSA_TRUST_DIRECTION_OUTBOUND( 0x00000002 );
return handle_cross_realm_princs(ipasam_state, domain, flat_name,
			 NULL((void*)0), NULL((void*)0), trust_direction, DEL_PRINC);
2158}

2160static bool_Bool get_trusted_domain_int(struct ipasam_private *ipasam_state,
		   TALLOC_CTX *mem_ctx,
		   const char *filter, LDAPMessage **entry)
2163{
int rc;
LDAPMessage *result = NULL((void*)0);
uint32_t num_result;

rc = smbldap_search(ipasam_state->ldap_state,
	    ipasam_state->trust_dn,
	    LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002), filter, NULL((void*)0), 0, &result);

if (result != NULL((void*)0)) {
smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
}

if (rc == LDAP_NO_SUCH_OBJECT0x20) {
*entry = NULL((void*)0);
return true1;
}

if (rc != LDAP_SUCCESS0x00) {
return false0;
}

num_result = ldap_count_entries(priv2ld(ipasam_state), result);

if (num_result > 1) {
DEBUG(1, ("get_trusted_domain_int: more than one "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2190", __FUNCTION__
 )) && (dbgtext ("get_trusted_domain_int: more than one "
 "%s object with filter '%s'?!\n", "ipaNTTrustedDomain", filter
)) )
	  "%s object with filter '%s'?!\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2190", __FUNCTION__
 )) && (dbgtext ("get_trusted_domain_int: more than one "
 "%s object with filter '%s'?!\n", "ipaNTTrustedDomain", filter
)) )
	  LDAP_OBJ_TRUSTED_DOMAIN, filter))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2190", __FUNCTION__
 )) && (dbgtext ("get_trusted_domain_int: more than one "
 "%s object with filter '%s'?!\n", "ipaNTTrustedDomain", filter
)) );
return false0;
}

if (num_result == 0) {
DEBUG(1, ("get_trusted_domain_int: no "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2197", __FUNCTION__
 )) && (dbgtext ("get_trusted_domain_int: no " "%s object with filter '%s'.\n"
, "ipaNTTrustedDomain", filter)) )
	  "%s object with filter '%s'.\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2197", __FUNCTION__
 )) && (dbgtext ("get_trusted_domain_int: no " "%s object with filter '%s'.\n"
, "ipaNTTrustedDomain", filter)) )
	  LDAP_OBJ_TRUSTED_DOMAIN, filter))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2197", __FUNCTION__
 )) && (dbgtext ("get_trusted_domain_int: no " "%s object with filter '%s'.\n"
, "ipaNTTrustedDomain", filter)) );
*entry = NULL((void*)0);
} else {
*entry = ldap_first_entry(priv2ld(ipasam_state), result);
}

return true1;
2204}

2206static bool_Bool get_trusted_domain_by_name_int(struct ipasam_private *ipasam_state,
			  TALLOC_CTX *mem_ctx,
			  const char *domain,
			  LDAPMessage **entry)
2210{
char *filter = NULL((void*)0);
bool_Bool ok;

filter = talloc_asprintf(mem_ctx,
		 "(&(objectClass=%s)(|(%s=%s)(%s=%s)(cn=%s)))",
		 LDAP_OBJ_TRUSTED_DOMAIN"ipaNTTrustedDomain",
		 LDAP_ATTRIBUTE_FLAT_NAME"ipaNTFlatName", domain,
		 LDAP_ATTRIBUTE_TRUST_PARTNER"ipaNTTrustPartner", domain, domain);
if (filter == NULL((void*)0)) {
return false0;
}

ok = get_trusted_domain_int(ipasam_state, mem_ctx, filter, entry);
talloc_free(filter)_talloc_free(filter, "ipa_sam.c" ":" "2224");

return ok;
2227}

2229static bool_Bool get_trusted_domain_by_sid_int(struct ipasam_private *ipasam_state,
			   TALLOC_CTX *mem_ctx,
			   const char *sid, LDAPMessage **entry)
2232{
char *filter = NULL((void*)0);
bool_Bool ok;

filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(%s=%s))",
		 LDAP_OBJ_TRUSTED_DOMAIN"ipaNTTrustedDomain",
		 LDAP_ATTRIBUTE_TRUST_SID"ipaNTTrustedDomainSID", sid);
if (filter == NULL((void*)0)) {
return false0;
}

ok = get_trusted_domain_int(ipasam_state, mem_ctx, filter, entry);
talloc_free(filter)_talloc_free(filter, "ipa_sam.c" ":" "2244");

return ok;
2247}

2249static bool_Bool get_uint32_t_from_ldap_msg(struct ipasam_private *ipasam_state,
		       LDAPMessage *entry,
		       const char *attr,
		       uint32_t *val)
2253{
char *dummy;
long int l;
char *endptr;

dummy = get_single_attribute(NULL((void*)0), priv2ld(ipasam_state), entry, attr);
if (dummy == NULL((void*)0)) {
DEBUG(9, ("Attribute %s not present.\n", attr))(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2260", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", attr)
) );
*val = 0;
return true1;
}

l = strtoul(dummy, &endptr, 10);

if (l < 0 || l > UINT32_MAX(4294967295U) || *endptr != '\0') {
TALLOC_FREE(dummy)do { if (dummy != ((void*)0)) { _talloc_free(dummy, "ipa_sam.c"
 ":" "2268"); dummy=((void*)0); } } while(0);
return false0;
}
TALLOC_FREE(dummy)do { if (dummy != ((void*)0)) { _talloc_free(dummy, "ipa_sam.c"
 ":" "2271"); dummy=((void*)0); } } while(0);

*val = l;

return true1;
2276}

2278static bool_Bool fill_pdb_trusted_domain(TALLOC_CTX *mem_ctx,
		    struct ipasam_private *ipasam_state,
		    LDAPMessage *entry,
		    struct pdb_trusted_domain **_td)
2282{
char *dummy;
bool_Bool res;
struct pdb_trusted_domain *td;
struct dom_sid *sid = NULL((void*)0);
enum idmap_error_code err;

if (entry == NULL((void*)0)) {
return false0;
}

td = talloc_zero(mem_ctx, struct pdb_trusted_domain)(struct pdb_trusted_domain *)_talloc_zero(mem_ctx, sizeof(struct
 pdb_trusted_domain), "struct pdb_trusted_domain");
if (td == NULL((void*)0)) {
return false0;
}

/* All attributes are MAY */

dummy = get_single_attribute(NULL((void*)0), priv2ld(ipasam_state), entry,
		     LDAP_ATTRIBUTE_TRUST_SID"ipaNTTrustedDomainSID");
if (dummy == NULL((void*)0)) {
DEBUG(9, ("Attribute %s not present.\n",(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2304", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTTrustedDomainSID"
)) )
	  LDAP_ATTRIBUTE_TRUST_SID))(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2304", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTTrustedDomainSID"
)) );
} else {
err = sss_idmap_sid_to_smb_sid(ipasam_state->idmap_ctx,
			       dummy, &sid);
TALLOC_FREE(dummy)do { if (dummy != ((void*)0)) { _talloc_free(dummy, "ipa_sam.c"
 ":" "2308"); dummy=((void*)0); } } while(0);
if (err != IDMAP_SUCCESS) {
	return false0;
}
sid_copy(&td->security_identifier, sid);
talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "2313");
}

if (!smbldap_talloc_single_blob(td, priv2ld(ipasam_state), entry,
			LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING"ipaNTTrustAuthIncoming",
			&td->trust_auth_incoming)) {
DEBUG(9, ("Failed to set incoming auth info.\n"))(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2319", __FUNCTION__
 )) && (dbgtext ("Failed to set incoming auth info.\n"
)) );
}


if (!smbldap_talloc_single_blob(td, priv2ld(ipasam_state), entry,
			LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING"ipaNTTrustAuthOutgoing",
			&td->trust_auth_outgoing)) {
DEBUG(9, ("Failed to set outgoing auth info.\n"))(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2326", __FUNCTION__
 )) && (dbgtext ("Failed to set outgoing auth info.\n"
)) );
}

td->netbios_name = get_single_attribute(td, priv2ld(ipasam_state), entry,
				LDAP_ATTRIBUTE_FLAT_NAME"ipaNTFlatName");
if (td->netbios_name == NULL((void*)0)) {
DEBUG(9, ("Attribute %s not present.\n",(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2333", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTFlatName"
)) )
	  LDAP_ATTRIBUTE_FLAT_NAME))(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2333", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTFlatName"
)) );
}

td->domain_name = get_single_attribute(td, priv2ld(ipasam_state), entry,
			       LDAP_ATTRIBUTE_TRUST_PARTNER"ipaNTTrustPartner");
if (td->domain_name == NULL((void*)0)) {
DEBUG(9, ("Attribute %s not present.\n",(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2340", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTTrustPartner"
)) )
	  LDAP_ATTRIBUTE_TRUST_PARTNER))(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2340", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTTrustPartner"
)) );
}

res = get_uint32_t_from_ldap_msg(ipasam_state, entry,
			 LDAP_ATTRIBUTE_TRUST_DIRECTION"ipaNTTrustDirection",
			 &td->trust_direction);
if (!res) {
return false0;
}
if (td->trust_direction == 0) {
/* attribute wasn't present, set default value */
td->trust_direction = LSA_TRUST_DIRECTION_INBOUND( 0x00000001 ) | LSA_TRUST_DIRECTION_OUTBOUND( 0x00000002 );
}

res = get_uint32_t_from_ldap_msg(ipasam_state, entry,
			 LDAP_ATTRIBUTE_TRUST_ATTRIBUTES"ipaNTTrustAttributes",
			 &td->trust_attributes);
if (!res) {
return false0;
}
if (td->trust_attributes == 0) {
/* attribute wasn't present, set default value */
td->trust_attributes = LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE( 0x00000008 );
}

res = get_uint32_t_from_ldap_msg(ipasam_state, entry,
			 LDAP_ATTRIBUTE_TRUST_TYPE"ipaNTTrustType",
			 &td->trust_type);
if (!res) {
return false0;
}
if (td->trust_type == 0) {
/* attribute wasn't present, set default value */
td->trust_type = LSA_TRUST_TYPE_UPLEVEL;
}

td->trust_posix_offset = talloc_zero(td, uint32_t)(uint32_t *)_talloc_zero(td, sizeof(uint32_t), "uint32_t");
if (td->trust_posix_offset == NULL((void*)0)) {
return false0;
}
res = get_uint32_t_from_ldap_msg(ipasam_state, entry,
			 LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET"ipaNTTrustPosixOffset",
			 td->trust_posix_offset);
if (!res) {
return false0;
}

td->supported_enc_type = talloc_zero(td, uint32_t)(uint32_t *)_talloc_zero(td, sizeof(uint32_t), "uint32_t");
if (td->supported_enc_type == NULL((void*)0)) {
return false0;
}
res = get_uint32_t_from_ldap_msg(ipasam_state, entry,
			 LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE"ipaNTSupportedEncryptionTypes",
			 td->supported_enc_type);
if (!res) {
return false0;
}
if (*td->supported_enc_type == 0) {
*td->supported_enc_type = ipasam_state->supported_enctypes;
}

if (!smbldap_talloc_single_blob(td, priv2ld(ipasam_state), entry,
			LDAP_ATTRIBUTE_TRUST_FOREST_TRUST_INFO"ipaNTTrustForestTrustInfo",
			&td->trust_forest_trust_info)) {
DEBUG(9, ("Failed to set forest trust info.\n"))(void)( ((9) <= 1000) && (debuglevel_get_class(0) >=
 (9)) && (dbghdrclass( 9, 0, "ipa_sam.c" ":" "2404", __FUNCTION__
 )) && (dbgtext ("Failed to set forest trust info.\n"
)) );
}

*_td = td;

return true1;
2410}

2412static NTSTATUS ipasam_get_trusted_domain(struct pdb_methods *methods,
			  TALLOC_CTX *mem_ctx,
			  const char *domain,
			  struct pdb_trusted_domain **td)
2416{
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "2418");
LDAPMessage *entry = NULL((void*)0);

DEBUG(10, ("ipasam_get_trusted_domain called for domain %s\n", domain))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "2421"
, __FUNCTION__ )) && (dbgtext ("ipasam_get_trusted_domain called for domain %s\n"
, domain)) );

if (!get_trusted_domain_by_name_int(ipasam_state, mem_ctx, domain,
			    &entry)) {
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}
if (entry == NULL((void*)0)) {
DEBUG(5, ("ipasam_get_trusted_domain: no such trusted domain: "(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "2429", __FUNCTION__
 )) && (dbgtext ("ipasam_get_trusted_domain: no such trusted domain: "
 "%s\n", domain)) )
	  "%s\n", domain))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "2429", __FUNCTION__
 )) && (dbgtext ("ipasam_get_trusted_domain: no such trusted domain: "
 "%s\n", domain)) );
return NT_STATUS_NO_SUCH_DOMAIN((NTSTATUS) { 0xc00000df });
}

if (!fill_pdb_trusted_domain(mem_ctx, ipasam_state, entry, td)) {
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

return NT_STATUS_OK((NTSTATUS) { 0x0 });
2438}

2440static NTSTATUS ipasam_get_trusted_domain_by_sid(struct pdb_methods *methods,
				 TALLOC_CTX *mem_ctx,
				 struct dom_sid *sid,
				 struct pdb_trusted_domain **td)
2444{
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "2446");
LDAPMessage *entry = NULL((void*)0);
char *sid_str;
bool_Bool ok;

sid_str = sid_talloc_string(ipasam_state->idmap_ctx, mem_ctx, sid);
if (sid_str == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

DEBUG(10, ("ipasam_get_trusted_domain_by_sid called for sid %s\n",(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "2457"
, __FUNCTION__ )) && (dbgtext ("ipasam_get_trusted_domain_by_sid called for sid %s\n"
, sid_str)) )
   sid_str))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "2457"
, __FUNCTION__ )) && (dbgtext ("ipasam_get_trusted_domain_by_sid called for sid %s\n"
, sid_str)) );

ok = get_trusted_domain_by_sid_int(ipasam_state, mem_ctx, sid_str,
			   &entry);
talloc_free(sid_str)_talloc_free(sid_str, "ipa_sam.c" ":" "2461");
if (!ok) {
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}
if (entry == NULL((void*)0)) {
DEBUG(5, ("ipasam_get_trusted_domain_by_sid: no trusted domain "(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "2467", __FUNCTION__
 )) && (dbgtext ("ipasam_get_trusted_domain_by_sid: no trusted domain "
 "with sid: %s\n", sid_str)) )
	  "with sid: %s\n", sid_str))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "2467", __FUNCTION__
 )) && (dbgtext ("ipasam_get_trusted_domain_by_sid: no trusted domain "
 "with sid: %s\n", sid_str)) );
return NT_STATUS_NO_SUCH_DOMAIN((NTSTATUS) { 0xc00000df });
}

ok = fill_pdb_trusted_domain(mem_ctx, ipasam_state, entry, td);
if (!ok) {
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

return NT_STATUS_OK((NTSTATUS) { 0x0 });
2477}

2479static bool_Bool smbldap_make_mod_uint32_t(LDAP *ldap_struct, LDAPMessage *entry,
		      LDAPMod ***mods, const char *attribute,
		      const uint32_t val)
2482{
char *dummy;

dummy = talloc_asprintf(NULL((void*)0), "%lu", (unsigned long) val);
if (dummy == NULL((void*)0)) {
return false0;
}
smbldap_make_mod(ldap_struct, entry, mods, attribute, dummy);
TALLOC_FREE(dummy)do { if (dummy != ((void*)0)) { _talloc_free(dummy, "ipa_sam.c"
 ":" "2490"); dummy=((void*)0); } } while(0);

return true1;
2493}

2495static NTSTATUS get_trust_pwd(TALLOC_CTX *mem_ctx, const DATA_BLOB *auth_blob,
	      char **pwd, NTTIME *last_update)
2497{
NTSTATUS status;
struct trustAuthInOutBlob iopw;
enum ndr_err_code ndr_err;
TALLOC_CTX *tmp_ctx;
char *trustpw;
size_t converted_size;

tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "2505");
if (tmp_ctx == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

ndr_err = ndr_pull_struct_blob(auth_blob, tmp_ctx, &iopw,
	(ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)(ndr_err == NDR_ERR_SUCCESS)) {
status = NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
goto done;
}

if (iopw.count != 0 && iopw.current.count != 0 &&
   iopw.current.array[0].AuthType == TRUST_AUTH_TYPE_CLEAR) {
if (pwd != NULL((void*)0)) {
	if (!convert_string_talloc(tmp_ctx, CH_UTF16, CH_UNIX,
		iopw.current.array[0].AuthInfo.clear.password,
		iopw.current.array[0].AuthInfo.clear.size,
		&trustpw, &converted_size)) {

		status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
		goto done;
	}

	*pwd = talloc_strndup(mem_ctx, trustpw, converted_size);
	if (*pwd == NULL((void*)0)) {
		status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
		goto done;
	}
}

if (last_update != NULL((void*)0)) {
	*last_update = iopw.current.array[0].LastUpdateTime;
}
} else {
status = NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
goto done;
}

status = NT_STATUS_OK((NTSTATUS) { 0x0 });

2546done:
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "2547");
return status;
2549}

2551static NTSTATUS ipasam_set_trusted_domain(struct pdb_methods *methods,
			  const char* domain,
			  const struct pdb_trusted_domain *td)
2554{
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "2556");
LDAPMessage *entry = NULL((void*)0);
LDAPMod **mods;
bool_Bool res;
char *trusted_dn = NULL((void*)0);
int ret, i, count;
NTSTATUS status;
TALLOC_CTX *tmp_ctx;
char *trustpw_incoming, *trustpw_outgoing;
char *sid, *tda_name;
char **in_blacklist = NULL((void*)0);
char **out_blacklist = NULL((void*)0);
uint32_t enctypes, trust_offset;

DEBUG(10, ("ipasam_set_trusted_domain called for domain %s\n", domain))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "2570"
, __FUNCTION__ )) && (dbgtext ("ipasam_set_trusted_domain called for domain %s\n"
, domain)) );

tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "2572");
if (tmp_ctx == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

res = get_trusted_domain_by_name_int(ipasam_state, tmp_ctx, domain,
			     &entry);
if (!res) {
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

mods = NULL((void*)0);
if (entry == NULL((void*)0)) {
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods, "objectClass",
		 LDAP_OBJ_TRUSTED_DOMAIN"ipaNTTrustedDomain");
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods, "objectClass",
		 LDAP_OBJ_ID_OBJECT"ipaIDobject");
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods, "objectClass",
		 LDAP_OBJ_POSIXACCOUNT"posixAccount");
}

if (entry != NULL((void*)0)) {
sid = get_single_attribute(tmp_ctx, priv2ld(ipasam_state), entry,
			   LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
}
if (entry == NULL((void*)0) || sid == NULL((void*)0)) {
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
		 LDAP_ATTRIBUTE_UIDNUMBER"uidnumber", IPA_MAGIC_ID_STR"-1");
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
                 LDAP_ATTRIBUTE_GIDNUMBER"gidnumber",
		 ipasam_state->fallback_primary_group_gid_str);
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
                 LDAP_ATTRIBUTE_HOMEDIRECTORY"homeDirectory",
		 "/dev/null");
}

if (td->netbios_name != NULL((void*)0)) {
tda_name = talloc_asprintf(tmp_ctx, "%s$", td->netbios_name);
if (!tda_name) {
	status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
	goto done;
}
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
		 LDAP_ATTRIBUTE_FLAT_NAME"ipaNTFlatName",
		 td->netbios_name);
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
		 LDAP_ATTRIBUTE_UID"uid",
		 tda_name);
}

if (td->domain_name != NULL((void*)0)) {
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
		 LDAP_ATTRIBUTE_TRUST_PARTNER"ipaNTTrustPartner",
		 td->domain_name);
}

if (!is_null_sid(&td->security_identifier)) {
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
		 LDAP_ATTRIBUTE_TRUST_SID"ipaNTTrustedDomainSID",
		 sid_talloc_string(ipasam_state->idmap_ctx,
				   tmp_ctx, &td->security_identifier));
}

if (td->trust_type != 0) {
res = smbldap_make_mod_uint32_t(priv2ld(ipasam_state), entry,
				&mods, LDAP_ATTRIBUTE_TRUST_TYPE"ipaNTTrustType",
				td->trust_type);
if (!res) {
	status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
	goto done;
}
}

if (td->trust_attributes != 0) {
res = smbldap_make_mod_uint32_t(priv2ld(ipasam_state), entry,
				&mods,
				LDAP_ATTRIBUTE_TRUST_ATTRIBUTES"ipaNTTrustAttributes",
				td->trust_attributes);
if (!res) {
	status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
	goto done;
}
}

if (td->trust_direction != 0) {
res = smbldap_make_mod_uint32_t(priv2ld(ipasam_state), entry,
				&mods,
				LDAP_ATTRIBUTE_TRUST_DIRECTION"ipaNTTrustDirection",
				td->trust_direction);
if (!res) {
	status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
	goto done;
}
}

trust_offset = 0;
if (td->trust_posix_offset != NULL((void*)0)) {
trust_offset = *td->trust_posix_offset;
}

res = smbldap_make_mod_uint32_t(priv2ld(ipasam_state), entry,
			&mods,
			LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET"ipaNTTrustPosixOffset",
			trust_offset);
if (!res) {
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

enctypes = ipasam_state->supported_enctypes;
if (td->supported_enc_type != NULL((void*)0)) {
enctypes = *td->supported_enc_type;
}

res = smbldap_make_mod_uint32_t(priv2ld(ipasam_state), entry,
			&mods,
			LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE"ipaNTSupportedEncryptionTypes",
			enctypes);
if (!res) {
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

if (td->trust_auth_outgoing.data != NULL((void*)0)) {
smbldap_make_mod_blob(priv2ld(ipasam_state), entry, &mods,
		      LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING"ipaNTTrustAuthOutgoing",
		      &td->trust_auth_outgoing);
}

if (td->trust_auth_incoming.data != NULL((void*)0)) {
smbldap_make_mod_blob(priv2ld(ipasam_state), entry, &mods,
		      LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING"ipaNTTrustAuthIncoming",
		      &td->trust_auth_incoming);
}

if (td->trust_forest_trust_info.data != NULL((void*)0)) {
smbldap_make_mod_blob(priv2ld(ipasam_state), entry, &mods,
		      LDAP_ATTRIBUTE_TRUST_FOREST_TRUST_INFO"ipaNTTrustForestTrustInfo",
		      &td->trust_forest_trust_info);
}


/* Only add default blacklists for incoming and outgoing SIDs but don't modify existing ones */
in_blacklist = get_attribute_values(tmp_ctx, priv2ld(ipasam_state), entry,
				LDAP_ATTRIBUTE_SID_BLACKLIST_INCOMING"ipaNTSIDBlacklistIncoming", &count);
out_blacklist = get_attribute_values(tmp_ctx, priv2ld(ipasam_state), entry,
				LDAP_ATTRIBUTE_SID_BLACKLIST_OUTGOING"ipaNTSIDBlacklistOutgoing", &count);

for (i = 0; ipa_mspac_well_known_sids[i]; i++) {
if (in_blacklist == NULL((void*)0)) {
	smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
			      LDAP_ATTRIBUTE_SID_BLACKLIST_INCOMING"ipaNTSIDBlacklistIncoming",
			      ipa_mspac_well_known_sids[i]);
}
if (out_blacklist == NULL((void*)0)) {
	smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
			      LDAP_ATTRIBUTE_SID_BLACKLIST_OUTGOING"ipaNTSIDBlacklistOutgoing",
			      ipa_mspac_well_known_sids[i]);
}
}

smbldap_talloc_autofree_ldapmod(tmp_ctx, mods);

if (mods != NULL((void*)0)) {
trusted_dn = trusted_domain_dn(tmp_ctx, ipasam_state, domain);
if (trusted_dn == NULL((void*)0)) {
	status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
	goto done;
}

if (entry == NULL((void*)0)) {
	ret = smbldap_add(ipasam_state->ldap_state, trusted_dn, mods);
} else {
	ret = smbldap_modify(ipasam_state->ldap_state, trusted_dn, mods);
}
if (ret != LDAP_SUCCESS0x00) {
	DEBUG(1, ("error writing trusted domain data!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2749", __FUNCTION__
 )) && (dbgtext ("error writing trusted domain data!\n"
)) );
	status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
	goto done;
}
}

if (entry == NULL((void*)0)) { /* FIXME: allow password updates here */
status = get_trust_pwd(tmp_ctx, &td->trust_auth_incoming,
		       &trustpw_incoming, NULL((void*)0));
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
	goto done;
}
status = get_trust_pwd(tmp_ctx, &td->trust_auth_outgoing,
		       &trustpw_outgoing, NULL((void*)0));
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
	goto done;
}
res = set_cross_realm_princs(ipasam_state, td->domain_name, td->netbios_name,
			     trustpw_incoming, trustpw_outgoing,
			     td->trust_direction);
{
	/* Replace memset() use by an explicit loop to avoid
	 * both compile time and link time optimisations.
	 * We could have used memset_s() from C++11 but it is
	 * currently not implemented by GCC or glibc.
	 */
	volatile char *p = (void *) trustpw_incoming;
	volatile char *q = (void *) trustpw_outgoing;
	size_t plen = strlen(trustpw_incoming);
	size_t qlen = strlen(trustpw_outgoing);

	while (plen--) {
		*p++ = '\0';
	}

	while (qlen--) {
		*q++ = '\0';
	}
}

if (!res) {
	DEBUG(1, ("error writing cross realm principals!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2790", __FUNCTION__
 )) && (dbgtext ("error writing cross realm principals!\n"
)) );
	status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
	goto done;
}
}

status = NT_STATUS_OK((NTSTATUS) { 0x0 });
2797done:
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "2798");
return status;
2800}

2802static int delete_subtree(struct ipasam_private *ipasam_state, char* dn)
2803{
LDAP *state = priv2ld(ipasam_state);
int rc;
char *filter = NULL((void*)0);
int scope = LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002);
LDAPMessage *result = NULL((void*)0);
LDAPMessage *entry = NULL((void*)0);
char *entry_dn = NULL((void*)0);

/* use 'dn' for a temporary talloc context */
filter = talloc_asprintf(dn, "(objectClass=*)");
if (filter == NULL((void*)0)) {
return LDAP_NO_MEMORY(-10);
}

rc = smbldap_search(ipasam_state->ldap_state, dn, scope, filter, NULL((void*)0), 0, &result);
TALLOC_FREE(filter)do { if (filter != ((void*)0)) { _talloc_free(filter, "ipa_sam.c"
 ":" "2819"); filter=((void*)0); } } while(0);

if (rc != LDAP_SUCCESS0x00) {
return rc;
}

if (result == NULL((void*)0)) {
return LDAP_NO_MEMORY(-10);
}

smbldap_talloc_autofree_ldapmsg(dn, result);

for (entry = ldap_first_entry(state, result);
    entry != NULL((void*)0);
    entry = ldap_next_entry(state, entry)) {
entry_dn = get_dn(dn, state, entry);
/* remove child entries */
if ((entry_dn != NULL((void*)0)) && (strcmp(entry_dn, dn) != 0)) {
	rc = smbldap_delete(ipasam_state->ldap_state, entry_dn);
	if (rc != LDAP_SUCCESS0x00) {
		return rc;
	}
}
}
rc = smbldap_delete(ipasam_state->ldap_state, dn);

/* caller will destroy dn */
return rc;
2847}

2849static NTSTATUS ipasam_del_trusted_domain(struct pdb_methods *methods,
			   const char *domain)
2851{
int ret;
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "2854");
LDAPMessage *entry = NULL((void*)0);
char *dn;
const char *domain_name, *flat_name;
TALLOC_CTX *tmp_ctx;
NTSTATUS status;

tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "2861");
if (tmp_ctx == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

if (!get_trusted_domain_by_name_int(ipasam_state, tmp_ctx, domain,
			    &entry)) {
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

if (entry == NULL((void*)0)) {
DEBUG(5, ("ipasam_del_trusted_domain: no such trusted domain: "(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "2874", __FUNCTION__
 )) && (dbgtext ("ipasam_del_trusted_domain: no such trusted domain: "
 "%s\n", domain)) )
	  "%s\n", domain))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "2874", __FUNCTION__
 )) && (dbgtext ("ipasam_del_trusted_domain: no such trusted domain: "
 "%s\n", domain)) );
status = NT_STATUS_NO_SUCH_DOMAIN((NTSTATUS) { 0xc00000df });
goto done;
}

dn = get_dn(tmp_ctx, priv2ld(ipasam_state), entry);
if (dn == NULL((void*)0)) {
DEBUG(0,("ipasam_del_trusted_domain: Out of memory!\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "2881", __FUNCTION__
 )) && (dbgtext ("ipasam_del_trusted_domain: Out of memory!\n"
)) );
status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
goto done;
}

domain_name = get_single_attribute(tmp_ctx, priv2ld(ipasam_state), entry,
			   LDAP_ATTRIBUTE_TRUST_PARTNER"ipaNTTrustPartner");
if (domain_name == NULL((void*)0)) {
DEBUG(1, ("Attribute %s not present.\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2890", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTTrustPartner"
)) )
	  LDAP_ATTRIBUTE_TRUST_PARTNER))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2890", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTTrustPartner"
)) );
status = NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
goto done;
}

flat_name = get_single_attribute(tmp_ctx, priv2ld(ipasam_state), entry,
			 LDAP_ATTRIBUTE_FLAT_NAME"ipaNTFlatName");
if (flat_name == NULL((void*)0)) {
DEBUG(1, ("Attribute %s not present.\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2899", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTFlatName"
)) )
	  LDAP_ATTRIBUTE_FLAT_NAME))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2899", __FUNCTION__
 )) && (dbgtext ("Attribute %s not present.\n", "ipaNTFlatName"
)) );
status = NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
goto done;
}


if (!del_cross_realm_princs(ipasam_state, domain_name, flat_name)) {
DEBUG(1, ("error deleting cross realm principals!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2906", __FUNCTION__
 )) && (dbgtext ("error deleting cross realm principals!\n"
)) );
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

ret = smbldap_delete(ipasam_state->ldap_state, dn);
if (ret == LDAP_NOT_ALLOWED_ON_NONLEAF0x42) {
/* delete_subtree will use 'dn' as temporary context too */
ret = delete_subtree(ipasam_state, dn);
}

if (ret != LDAP_SUCCESS0x00) {
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

status = NT_STATUS_OK((NTSTATUS) { 0x0 });
2923done:
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "2924");
return status;
2926}

2928static NTSTATUS ipasam_enum_trusted_domains(struct pdb_methods *methods,
			    TALLOC_CTX *mem_ctx,
			    uint32_t *num_domains,
			    struct pdb_trusted_domain ***domains)
2932{
int rc;
struct ipasam_private *ipasam_state =
talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "2935");
char *filter = NULL((void*)0);
int scope = LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002);
LDAPMessage *result = NULL((void*)0);
LDAPMessage *entry = NULL((void*)0);
struct pdb_trusted_domain **tmp;

filter = talloc_asprintf(mem_ctx, "(objectClass=%s)",
		 LDAP_OBJ_TRUSTED_DOMAIN"ipaNTTrustedDomain");
if (filter == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

rc = smbldap_search(ipasam_state->ldap_state,
	    ipasam_state->trust_dn,
	    scope, filter, NULL((void*)0), 0, &result);
TALLOC_FREE(filter)do { if (filter != ((void*)0)) { _talloc_free(filter, "ipa_sam.c"
 ":" "2951"); filter=((void*)0); } } while(0);

if (result != NULL((void*)0)) {
smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
}

if (rc == LDAP_NO_SUCH_OBJECT0x20) {
*num_domains = 0;
*domains = NULL((void*)0);
return NT_STATUS_OK((NTSTATUS) { 0x0 });
}

if (rc != LDAP_SUCCESS0x00) {
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

*num_domains = 0;
if (!(*domains = talloc_array(mem_ctx, struct pdb_trusted_domain *, 1)(struct pdb_trusted_domain * *)_talloc_array(mem_ctx, sizeof(
struct pdb_trusted_domain *), 1, "struct pdb_trusted_domain *"
))) {
DEBUG(1, ("talloc failed\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "2969", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

for (entry = ldap_first_entry(priv2ld(ipasam_state), result);
    entry != NULL((void*)0);
    entry = ldap_next_entry(priv2ld(ipasam_state), entry))
{
struct pdb_trusted_domain *dom_info;

if (!fill_pdb_trusted_domain(*domains, ipasam_state, entry,
			     &dom_info)) {
	talloc_free(*domains)_talloc_free(*domains, "ipa_sam.c" ":" "2981");
	return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

tmp = talloc_realloc(*domains, *domains,(struct pdb_trusted_domain * *)_talloc_realloc_array(*domains
, *domains, sizeof(struct pdb_trusted_domain *), (*(num_domains
))+1, "struct pdb_trusted_domain *")
                     struct pdb_trusted_domain *,(struct pdb_trusted_domain * *)_talloc_realloc_array(*domains
, *domains, sizeof(struct pdb_trusted_domain *), (*(num_domains
))+1, "struct pdb_trusted_domain *")
                     (*(num_domains))+1)(struct pdb_trusted_domain * *)_talloc_realloc_array(*domains
, *domains, sizeof(struct pdb_trusted_domain *), (*(num_domains
))+1, "struct pdb_trusted_domain *");
if (tmp == NULL((void*)0)) {
	talloc_free(*domains)_talloc_free(*domains, "ipa_sam.c" ":" "2989");
	return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}
*domains = tmp;
(*(domains))[*(num_domains)] = dom_info;
(*(num_domains)) += 1;
}

DEBUG(5, ("ipasam_enum_trusted_domains: got %d domains\n", *num_domains))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "2997", __FUNCTION__
 )) && (dbgtext ("ipasam_enum_trusted_domains: got %d domains\n"
, *num_domains)) );
return NT_STATUS_OK((NTSTATUS) { 0x0 });
2999}

3001static NTSTATUS ipasam_enum_trusteddoms(struct pdb_methods *methods,
			 TALLOC_CTX *mem_ctx,
			 uint32_t *num_domains,
			 struct trustdom_info ***domains)
3005{
NTSTATUS status;
struct pdb_trusted_domain **td;
int i;

status = ipasam_enum_trusted_domains(methods, mem_ctx,
			     num_domains, &td);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
return status;
}

if (*num_domains == 0) {
return NT_STATUS_OK((NTSTATUS) { 0x0 });
}

if (!(*domains = talloc_array(mem_ctx, struct trustdom_info *,(struct trustdom_info * *)_talloc_array(mem_ctx, sizeof(struct
 trustdom_info *), *num_domains, "struct trustdom_info *")
		      *num_domains)(struct trustdom_info * *)_talloc_array(mem_ctx, sizeof(struct
 trustdom_info *), *num_domains, "struct trustdom_info *"))) {
DEBUG(1, ("talloc failed\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3022", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
goto fail;
}

for (i = 0; i < *num_domains; i++) {
struct trustdom_info *dom_info;

dom_info = talloc(*domains, struct trustdom_info)(struct trustdom_info *)talloc_named_const(*domains, sizeof(struct
 trustdom_info), "struct trustdom_info");
if (dom_info == NULL((void*)0)) {
	DEBUG(1, ("talloc failed\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3031", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
	goto fail;
}

dom_info->name = talloc_steal(mem_ctx, td[i]->netbios_name)({ __typeof__(td[i]->netbios_name) __talloc_steal_ret = (__typeof__
(td[i]->netbios_name))_talloc_steal_loc((mem_ctx),(td[i]->
netbios_name), "ipa_sam.c" ":" "3035"); __talloc_steal_ret; }
);
sid_copy(&dom_info->sid, &td[i]->security_identifier);

(*domains)[i] = dom_info;
}

return NT_STATUS_OK((NTSTATUS) { 0x0 });

3043fail:
talloc_free(td)_talloc_free(td, "ipa_sam.c" ":" "3044");
talloc_free(*domains)_talloc_free(*domains, "ipa_sam.c" ":" "3045");

return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
3048}

3050static uint32_t pdb_ipasam_capabilities(struct pdb_methods *methods)
3051{
return PDB_CAP_STORE_RIDS0x0001 | PDB_CAP_ADS0x0002 | PDB_CAP_TRUSTED_DOMAINS_EX0x0004;
3053}

3055static bool_Bool init_sam_from_td(struct samu *user, struct pdb_trusted_domain *td,
	     LDAPMessage *entry,
	     struct ipasam_private *ipasam_state)
3058{
NTSTATUS status;
struct dom_sid *u_sid;
struct dom_sid *g_sid;
char *name;
char *trustpw = NULL((void*)0);
uint8_t nt_key[16];
bool_Bool res;
char *sid_str;
enum idmap_error_code err;

if (!pdb_set_acct_ctrl(user, ACB_DOMTRUST( 0x00000040 ) | ACB_TRUSTED_FOR_DELEGATION( 0x00002000 ),
	      PDB_SET)) {
return false0;
}

if (!pdb_set_domain(user, ipasam_state->domain_name, PDB_DEFAULT)) {
return false0;
}

name = talloc_asprintf(user, "%s$", td->netbios_name);
if (name == NULL((void*)0)) {
return false0;
}

if (!pdb_set_username(user, name, PDB_SET)) {
return false0;
}

if (!pdb_set_nt_username(user, name, PDB_SET)) {
return false0;
}

sid_str = get_single_attribute(user, priv2ld(ipasam_state), entry,
		       LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
if (sid_str == NULL((void*)0)) {
DEBUG(5, ("Missing SID for trusted domain object.\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3094", __FUNCTION__
 )) && (dbgtext ("Missing SID for trusted domain object.\n"
)) );
return false0;
}

err = sss_idmap_sid_to_smb_sid(ipasam_state->idmap_ctx,
		       sid_str, &u_sid);
if (err != IDMAP_SUCCESS) {
DEBUG(10, ("Could not convert string %s to sid.\n", sid_str))(void)( ((10) <= 1000) && (debuglevel_get_class(0)
 >= (10)) && (dbghdrclass( 10, 0, "ipa_sam.c" ":" "3101"
, __FUNCTION__ )) && (dbgtext ("Could not convert string %s to sid.\n"
, sid_str)) );
talloc_free(sid_str)_talloc_free(sid_str, "ipa_sam.c" ":" "3102");
return false0;
}
talloc_free(sid_str)_talloc_free(sid_str, "ipa_sam.c" ":" "3105");

if (!pdb_set_user_sid(user, u_sid, PDB_SET)) {
talloc_free(u_sid)_talloc_free(u_sid, "ipa_sam.c" ":" "3108");
return false0;
}
talloc_free(u_sid)_talloc_free(u_sid, "ipa_sam.c" ":" "3111");

g_sid = &ipasam_state->fallback_primary_group;
if (!pdb_set_group_sid(user, g_sid, PDB_SET)) {
return false0;
}

status = get_trust_pwd(user, &td->trust_auth_incoming, &trustpw, NULL((void*)0));
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
return false0;
}

if (!E_md4hash(trustpw, nt_key)) {
res = false0;
goto done;
}

if (!pdb_set_nt_passwd(user, nt_key, PDB_SET)) {
res = false0;
goto done;
}

res = true1;
3134done:
if (trustpw != NULL((void*)0)) {
memset(trustpw, 0, strlen(trustpw));
talloc_free(trustpw)_talloc_free(trustpw, "ipa_sam.c" ":" "3137");
}

return res;
3141}

3143static bool_Bool ipasam_nthash_retrieve(struct ipasam_private *ipasam_state,
		       TALLOC_CTX *mem_ctx,
		       char *entry_dn,
		       DATA_BLOB *nthash)
3147{
int ret;
bool_Bool retval;
LDAPMessage *result;
LDAPMessage *entry = NULL((void*)0);
int count;
struct smbldap_state *ldap_state = ipasam_state->ldap_state;
const char *attr_list[] = {
			LDAP_ATTRIBUTE_NTHASH"ipaNTHash",
			NULL((void*)0)
		  };

ret = smbldap_search(ldap_state, entry_dn,
	     LDAP_SCOPE_BASE((ber_int_t) 0x0000), "(objectclass=*)", attr_list, 0,
	     &result);
if (ret != LDAP_SUCCESS0x00) {
DEBUG(1, ("Failed to get NT hash: %s\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3164", __FUNCTION__
 )) && (dbgtext ("Failed to get NT hash: %s\n", ldap_err2string
 (ret))) )
	  ldap_err2string (ret)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3164", __FUNCTION__
 )) && (dbgtext ("Failed to get NT hash: %s\n", ldap_err2string
 (ret))) );
return false0;
}

count = ldap_count_entries(priv2ld(ipasam_state), result);

if (count != 1) {
DEBUG(1, ("Unexpected number of results [%d] for NT hash "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3172", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for NT hash "
 "of the single entry search.\n", count)) )
	  "of the single entry search.\n", count))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3172", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for NT hash "
 "of the single entry search.\n", count)) );
ldap_msgfree(result);
return false0;
}

entry = ldap_first_entry(priv2ld(ipasam_state), result);
if (entry == NULL((void*)0)) {
DEBUG(0, ("Could not get entry\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3179", __FUNCTION__
 )) && (dbgtext ("Could not get entry\n")) );
ldap_msgfree(result);
return false0;
}

retval = smbldap_talloc_single_blob(mem_ctx,
			priv2ld(ipasam_state),
			entry, LDAP_ATTRIBUTE_NTHASH"ipaNTHash",
			nthash);
ldap_msgfree(result);
return retval;
3190}

3192static bool_Bool ipasam_nthash_regen(struct ipasam_private *ipasam_state,
		TALLOC_CTX *mem_ctx,
		char * entry_dn)
3195{
LDAPMod **mods = NULL((void*)0);
int ret;

smbldap_set_mod(&mods, LDAP_MOD_ADD(0x0000), LDAP_ATTRIBUTE_NTHASH"ipaNTHash", "MagicRegen");
smbldap_talloc_autofree_ldapmod(mem_ctx, mods);

ret = smbldap_modify(ipasam_state->ldap_state, entry_dn, mods);
if (ret != LDAP_SUCCESS0x00) {
DEBUG(5, ("ipasam: attempt to regen ipaNTHash failed\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3204", __FUNCTION__
 )) && (dbgtext ("ipasam: attempt to regen ipaNTHash failed\n"
)) );
}
return (ret == LDAP_SUCCESS0x00);
3207}

3209static int ipasam_get_sid_by_gid(struct ipasam_private *ipasam_state,
		 uint32_t gid,
		 struct dom_sid *_sid)
3212{
int ret;
char *filter;
TALLOC_CTX *tmp_ctx;
LDAPMessage *entry = NULL((void*)0);
LDAPMessage *result = NULL((void*)0);
char *sid_str = NULL((void*)0);
struct dom_sid *sid = NULL((void*)0);
int count;
enum idmap_error_code err;
struct unixid id;

tmp_ctx = talloc_init("ipasam_get_sid_by_gid");
if (tmp_ctx == NULL((void*)0)) {
return ENOMEM12;
}

filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)(%s=%s)(%s=%lu))",
			  LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
			  LDAP_OBJ_POSIXGROUP"posixGroup",
			  LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
			  LDAP_OBJ_GROUPMAP"ipaNTGroupAttrs",
			  LDAP_ATTRIBUTE_GIDNUMBER"gidnumber",
			  (unsigned long) gid);
if (filter == NULL((void*)0)) {
ret = ENOMEM12;
goto done;
}

ret = smbldap_search(ipasam_state->ldap_state,
	     ipasam_state->base_dn,
	     LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002),filter, NULL((void*)0), 0,
	     &result);
if (ret != LDAP_SUCCESS0x00) {
ret = ENOENT2;
goto done;
}

count = ldap_count_entries(priv2ld(ipasam_state), result);
if (count != 1) {
ret = ENOENT2;
goto done;
}

entry = ldap_first_entry(priv2ld(ipasam_state), result);
if (entry == NULL((void*)0)) {
ret = ENOENT2;
goto done;
}

sid_str = get_single_attribute(tmp_ctx,
		       priv2ld(ipasam_state),
		       entry, LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
if (sid_str == NULL((void*)0)) {
ret = ENOENT2;
goto done;
}

err = sss_idmap_sid_to_smb_sid(ipasam_state->idmap_ctx,
		       sid_str, &sid);
if (err != IDMAP_SUCCESS) {
ret = EFAULT14;
goto done;
}
sid_copy(_sid, sid);

ipasam_unixid_from_gid(&id, gid);

idmap_cache_set_sid2unixid(sid, &id);

ret = 0;

3284done:
talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "3285");
ldap_msgfree(result);
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "3287");

return ret;
3290}

3292static int ipasam_get_primary_group_sid(TALLOC_CTX *mem_ctx,
			struct ipasam_private *ipasam_state,
			LDAPMessage *entry,
			struct dom_sid **_group_sid)
3296{
int ret;
uint32_t uid;
uint32_t gid;
struct dom_sid *group_sid;
struct unixid id;

TALLOC_CTX *tmp_ctx = talloc_init("ipasam_get_primary_group_sid");
if (tmp_ctx == NULL((void*)0)) {
return ENOMEM12;
}

if (!get_uint32_t_from_ldap_msg(ipasam_state, entry,
			LDAP_ATTRIBUTE_UIDNUMBER"uidnumber", &uid)) {
ret = ENOENT2;
DEBUG(1, ("No uidnumber attribute found for this user!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3311", __FUNCTION__
 )) && (dbgtext ("No uidnumber attribute found for this user!\n"
)) );
goto done;
}

if (!get_uint32_t_from_ldap_msg(ipasam_state, entry,
			LDAP_ATTRIBUTE_GIDNUMBER"gidnumber", &gid)) {
ret = ENOENT2;
DEBUG(1, ("No gidnumber attribute found for this user!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3318", __FUNCTION__
 )) && (dbgtext ("No gidnumber attribute found for this user!\n"
)) );
goto done;
}

group_sid = talloc(tmp_ctx, struct dom_sid)(struct dom_sid *)talloc_named_const(tmp_ctx, sizeof(struct dom_sid
), "struct dom_sid");
if (group_sid == NULL((void*)0)) {
ret = ENOMEM12;
goto done;
}

if (uid == gid) { /* User private group, use default fallback group */
sid_copy(group_sid,
	 &ipasam_state->fallback_primary_group);
ret = 0;
goto done;
} else {
ret = ipasam_get_sid_by_gid(ipasam_state, gid, group_sid);
if (ret != 0) {
	goto done;
}
}

ipasam_unixid_from_gid(&id, gid);

idmap_cache_set_sid2unixid(group_sid, &id);

ret = 0;
3345done:

if (ret == 0) {
*_group_sid = talloc_steal(mem_ctx, group_sid)({ __typeof__(group_sid) __talloc_steal_ret = (__typeof__(group_sid
))_talloc_steal_loc((mem_ctx),(group_sid), "ipa_sam.c" ":" "3348"
); __talloc_steal_ret; });
}

talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "3351");

return ret;
3354}

3356static bool_Bool init_sam_from_ldap(struct ipasam_private *ipasam_state,
		struct samu * sampass,
		LDAPMessage * entry)
3359{
char *username = NULL((void*)0);
struct berval **usernames = NULL((void*)0);
char *domain = NULL((void*)0);
char *nt_username = NULL((void*)0);
char *fullname = NULL((void*)0);
char *homedir = NULL((void*)0);
char *dir_drive = NULL((void*)0);
char *logon_script = NULL((void*)0);
char *profile_path = NULL((void*)0);
char *temp = NULL((void*)0);
bool_Bool ret = false0;
bool_Bool retval = false0;
bool_Bool machine_account = false0;
int status;
int len = 0;
int idx = 0;
19
←
'idx' initialized to 0→
size_t conv_size = 0;
DATA_BLOB nthash;
struct dom_sid *group_sid;

TALLOC_CTX *tmp_ctx = talloc_init("init_sam_from_ldap");
if (!tmp_ctx) {
20
←
Assuming 'tmp_ctx' is non-null→
21
←
Taking false branch→
return false0;
}
if (sampass == NULL((void*)0) || ipasam_state22.1
'ipasam_state' is not equal to NULL
 == NULL((void*)0) || entry22.2
'entry' is not equal to NULL
 == NULL((void*)0)) {
22
←
Assuming 'sampass' is not equal to NULL→
23
←
Taking false branch→
DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3385", __FUNCTION__
 )) && (dbgtext ("init_sam_from_ldap: NULL parameters found!\n"
)) );
goto fn_exit;
}

if (priv2ld(ipasam_state) == NULL((void*)0)) {
24
←
Assuming the condition is false→
25
←
Taking false branch→
DEBUG(0, ("init_sam_from_ldap: ipasam_state->ldap_state->"(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3391", __FUNCTION__
 )) && (dbgtext ("init_sam_from_ldap: ipasam_state->ldap_state->"
 "ldap_struct is NULL!\n")) )
	  "ldap_struct is NULL!\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3391", __FUNCTION__
 )) && (dbgtext ("init_sam_from_ldap: ipasam_state->ldap_state->"
 "ldap_struct is NULL!\n")) );
goto fn_exit;
}

usernames = ldap_get_values_len(priv2ld(ipasam_state), entry,
			LDAP_ATTRIBUTE_UID"uid");

if (usernames == NULL((void*)0)) {
26
←
Assuming 'usernames' is not equal to NULL→
27
←
Taking false branch→
DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3400", __FUNCTION__
 )) && (dbgtext ("init_sam_from_ldap: No uid attribute found for "
 "this user!\n")) )
	  "this user!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3400", __FUNCTION__
 )) && (dbgtext ("init_sam_from_ldap: No uid attribute found for "
 "this user!\n")) );
goto fn_exit;
}

len = ldap_count_values_len(usernames);
28
←
Assigning value→
if (len > 1) {
29
←
Assuming 'len' is > 1→
30
←
Taking true branch→
/* Extract machine account as a user name if exists.
 * If not, extract the first returned value */
for (int i=0; i30.1
'i' is < 'len'
1
'i' is < 'len'
 < len; i++) {
31
←
Loop condition is true.  Entering loop body→
33
←
Loop condition is true.  Entering loop body→
35
←
Assuming 'i' is >= 'len'→
36
←
Loop condition is false. Execution continues on line 3422→
	if (usernames[i] != NULL((void*)0) &&
32
←
Assuming pointer value is null→
34
←
Assuming the condition is false→
	    usernames[i]->bv_len > 0 &&
	    usernames[i]->bv_val[usernames[i]->bv_len-1] == '$') {
		idx = i;
		machine_account = true1;
		break;
	}
}
}

/* convert_string_talloc() will eventually call smb_iconv() which will
* implicitly allocate space for NULL-termination in an encoding we use,
* thus we are OK with passing non-NULL-terminated source string. */
retval = convert_string_talloc(tmp_ctx,
		       CH_UTF8, CH_UNIX,
		       usernames[idx]->bv_val,
37
←
Access to field 'bv_val' results in a dereference of a null pointer
		       usernames[idx]->bv_len,
		       (void**)&username,
		       &conv_size);

if (!retval) {
DEBUG(1, ("init_sam_from_ldap: error converting uid to UNIX encoding!\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3430", __FUNCTION__
 )) && (dbgtext ("init_sam_from_ldap: error converting uid to UNIX encoding!\n"
)) );
goto fn_exit;
}

DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "3434", __FUNCTION__
 )) && (dbgtext ("init_sam_from_ldap: Entry found for user: %s\n"
, username)) );

nt_username = talloc_strdup(tmp_ctx, username);
if (!nt_username) {
goto fn_exit;
}

domain = talloc_strdup(tmp_ctx, ipasam_state->domain_name);
if (!domain) {
goto fn_exit;
}

pdb_set_username(sampass, username, PDB_SET);

pdb_set_domain(sampass, domain, PDB_DEFAULT);
pdb_set_nt_username(sampass, nt_username, PDB_SET);

if ((temp = smbldap_talloc_single_attribute(
	priv2ld(ipasam_state),
	entry, LDAP_ATTRIBUTE_SECURITY_IDENTIFIER"ipaNTSecurityIdentifier",
	tmp_ctx)) != NULL((void*)0)) {
pdb_set_user_sid_from_string(sampass, temp, PDB_SET);

status = ipasam_get_primary_group_sid(tmp_ctx, ipasam_state,
				      entry, &group_sid);
if (status != 0) {
	goto fn_exit;
}
} else {
goto fn_exit;
}

fullname = smbldap_talloc_single_attribute(
	priv2ld(ipasam_state),
	entry,
	LDAP_ATTRIBUTE_CN"cn",
	tmp_ctx);
if (fullname) {
pdb_set_fullname(sampass, fullname, PDB_SET);
}

dir_drive = smbldap_talloc_single_attribute(
	priv2ld(ipasam_state),
	entry, LDAP_ATTRIBUTE_HOME_DRIVE"ipaNTHomeDirectoryDrive", tmp_ctx);
if (dir_drive) {
pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
}

homedir = smbldap_talloc_single_attribute(
	priv2ld(ipasam_state),
	entry, LDAP_ATTRIBUTE_HOME_PATH"ipaNTHomeDirectory", tmp_ctx);
if (homedir) {
pdb_set_homedir(sampass, homedir, PDB_SET);
}

logon_script = smbldap_talloc_single_attribute(
	priv2ld(ipasam_state),
	entry, LDAP_ATTRIBUTE_LOGON_SCRIPT"ipaNTLogonScript", tmp_ctx);
if (logon_script) {
pdb_set_logon_script(sampass, logon_script, PDB_SET);
}

profile_path = smbldap_talloc_single_attribute(
	priv2ld(ipasam_state),
	entry, LDAP_ATTRIBUTE_PROFILE_PATH"ipaNTProfilePath", tmp_ctx);
if (profile_path) {
pdb_set_profile_path(sampass, profile_path, PDB_SET);
}


/* Force machine accounts to be workstation trust type */
pdb_set_acct_ctrl(sampass, machine_account ? ACB_WSTRUST( 0x00000080 ) : ACB_NORMAL( 0x00000010 ),
	  PDB_SET);

retval = smbldap_talloc_single_blob(tmp_ctx,
			priv2ld(ipasam_state),
			entry, LDAP_ATTRIBUTE_NTHASH"ipaNTHash",
			&nthash);
if (!retval) {
/* NT Hash is not in place. Attempt to retrieve it from
 * the RC4-HMAC key if that exists in Kerberos credentials.
 * IPA 389-ds plugin allows to ask for it by setting
 * ipaNTHash to MagicRegen value.
 * */
temp = smbldap_talloc_dn(tmp_ctx, priv2ld(ipasam_state), entry);
if (temp) {
	retval = ipasam_nthash_regen(ipasam_state,
				     tmp_ctx, temp);
	if (retval) {
		retval = ipasam_nthash_retrieve(ipasam_state,
						tmp_ctx, temp, &nthash);
	}
}
}

if (!retval) {
DEBUG(5, ("Failed to read NT hash form LDAP response.\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3530", __FUNCTION__
 )) && (dbgtext ("Failed to read NT hash form LDAP response.\n"
)) );
}

if (nthash.length != NT_HASH_LEN16 && nthash.length != 0) {
DEBUG(5, ("NT hash from LDAP has the wrong size. Perhaps password was not re-set?\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3534", __FUNCTION__
 )) && (dbgtext ("NT hash from LDAP has the wrong size. Perhaps password was not re-set?\n"
)) );
} else {
if (!pdb_set_nt_passwd(sampass, nthash.data, PDB_SET)) {
	DEBUG(5, ("Failed to set NT hash.\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3537", __FUNCTION__
 )) && (dbgtext ("Failed to set NT hash.\n")) );
}
}
3540/* FIXME: */
if (!pdb_set_pass_last_set_time(sampass, (time_t) 1, PDB_SET)) {
DEBUG(5, ("Failed to set last time set.\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3542", __FUNCTION__
 )) && (dbgtext ("Failed to set last time set.\n")) );
}

ret = true1;

3547fn_exit:

if (usernames != NULL((void*)0)) {
ldap_value_free_len(usernames);
}
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "3552");
return ret;
3554}

3556static NTSTATUS getsam_interdom_trust_account(struct pdb_methods *methods,
			      struct samu *user,
			      const char *sname, int lastidx)
3559{
char *dom_name;
struct ipasam_private *ipasam_state =
	talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "3562");
TALLOC_CTX *tmp_ctx;
struct pdb_trusted_domain *td;
NTSTATUS status;
LDAPMessage *entry = NULL((void*)0);

/* The caller must check that (sname[lastidx] == '.') || (sname[lastidx] == '$'))
* before calling this function.
*/

tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "3572");
if (tmp_ctx == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

dom_name = talloc_strdup(tmp_ctx, sname);
if (dom_name == NULL((void*)0)) {
status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
goto done;
}
dom_name[lastidx] = '\0';

if (!get_trusted_domain_by_name_int(ipasam_state, tmp_ctx, dom_name,
			    &entry)) {
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}
if (entry == NULL((void*)0)) {
DEBUG(5, ("getsam_interdom_trust_account: no such trusted " \(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3591", __FUNCTION__
 )) && (dbgtext ("getsam_interdom_trust_account: no such trusted "
 "domain: %s\n", dom_name)) )
                        "domain: %s\n", dom_name))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3591", __FUNCTION__
 )) && (dbgtext ("getsam_interdom_trust_account: no such trusted "
 "domain: %s\n", dom_name)) );
status = NT_STATUS_NO_SUCH_DOMAIN((NTSTATUS) { 0xc00000df });
goto done;
}

if (!fill_pdb_trusted_domain(tmp_ctx, ipasam_state, entry, &td)) {
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

if (!init_sam_from_td(user, td, entry, ipasam_state)) {
DEBUG(5, ("init_sam_from_td failed.\n"))(void)( ((5) <= 1000) && (debuglevel_get_class(0) >=
 (5)) && (dbghdrclass( 5, 0, "ipa_sam.c" ":" "3602", __FUNCTION__
 )) && (dbgtext ("init_sam_from_td failed.\n")) );
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

status = NT_STATUS_OK((NTSTATUS) { 0x0 });

3609done:
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "3610");
return status;
3612}

3614/*
* lookup of an account by SID
*
* Samba may ask for an account based on a SID value. Implement a callback to
* return a result of such lookup since we should have SID for every domain
* account that is supposed to be usable through SMB protocol.
*/
3621static NTSTATUS ipasam_getsampwsid(struct pdb_methods *methods,
		    struct samu *user,
		    const struct dom_sid *sid)
3624{
struct ipasam_private *ipasam_state =
	talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "3626");
TALLOC_CTX *tmp_ctx;
NTSTATUS status;
char *filter = NULL((void*)0);
char *sid_str = NULL((void*)0);
LDAPMessage *result = NULL((void*)0);
LDAPMessage *entry = NULL((void*)0);
int ret;
int count;

tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "3636");
if (tmp_ctx == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

sid_str = sid_talloc_string(ipasam_state->idmap_ctx, tmp_ctx, sid);
if (sid_str == NULL((void*)0)) {
status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
goto done;
}

filter = talloc_asprintf(tmp_ctx, "(&(|(%s=%s)(%s=%s))(%s=%s))",
			  LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
			  LDAP_OBJ_SAMBASAMACCOUNT"ipaNTUserAttrs",
			  LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
			  LDAP_OBJ_ID_OBJECT"ipaIDobject",
			  LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier", sid_str);
if (filter == NULL((void*)0)) {
status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
goto done;
}

ret = smbldap_search(ipasam_state->ldap_state,
	     ipasam_state->base_dn,
	     LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002), filter, NULL((void*)0), 0,
	     &result);
if (ret != LDAP_SUCCESS0x00) {
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

count = ldap_count_entries(priv2ld(ipasam_state), result);
if (count != 1) {
DEBUG(3, ("Expected single entry returned for a SID lookup. "(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "3670", __FUNCTION__
 )) && (dbgtext ("Expected single entry returned for a SID lookup. "
 "Got %d. Refuse lookup by SID %s", count, sid_str)) )
	  "Got %d. Refuse lookup by SID %s", count, sid_str))(void)( ((3) <= 1000) && (debuglevel_get_class(0) >=
 (3)) && (dbghdrclass( 3, 0, "ipa_sam.c" ":" "3670", __FUNCTION__
 )) && (dbgtext ("Expected single entry returned for a SID lookup. "
 "Got %d. Refuse lookup by SID %s", count, sid_str)) );
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

entry = ldap_first_entry(priv2ld(ipasam_state), result);
if (entry == NULL((void*)0)) {
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

if (!init_sam_from_ldap(ipasam_state, user, entry)) {
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

status = NT_STATUS_OK((NTSTATUS) { 0x0 });

3688done:
if (result != NULL((void*)0)) {
ldap_msgfree(result);
}
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "3692");
return status;
3694}


3697static NTSTATUS ipasam_getsampwnam(struct pdb_methods *methods,
		    struct samu *user,
		    const char *sname)
3700{
struct ipasam_private *ipasam_state =
	talloc_get_type_abort(methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(methods->private_data
, "struct ipasam_private", "ipa_sam.c" ":" "3702");
int lastidx;
TALLOC_CTX *tmp_ctx;
NTSTATUS status;
char *filter;
char *escaped_user;
LDAPMessage *result = NULL((void*)0);
LDAPMessage *entry = NULL((void*)0);
int ret;
int count;

lastidx = strlen(sname);
if (lastidx > 0) {
1
Assuming 'lastidx' is > 0→
2
←
Taking true branch→
lastidx--;
} else {
/* strlen() must return >= 0 so it means we've got an empty name */
return NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
}
if ((sname[lastidx] == '.') || (sname[lastidx] == '$')) {
3
←
Assuming the condition is false→
4
←
Assuming the condition is false→
5
←
Taking false branch→
status = getsam_interdom_trust_account(methods, user, sname, lastidx);
/* If last character was '$', we should ignore failure and continue
 * as this could still be a machine account */
if ((sname[lastidx] == '.') || NT_STATUS_IS_OK(status)((((status).v) == 0))) {
	return status;
}
}

tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "3729");
if (tmp_ctx == NULL((void*)0)) {
6
←
Assuming 'tmp_ctx' is not equal to NULL→
7
←
Taking false branch→
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

escaped_user = escape_ldap_string(tmp_ctx, sname);
if (escaped_user == NULL((void*)0)) {
8
←
Assuming 'escaped_user' is not equal to NULL→
9
←
Taking false branch→
status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
goto done;
}

filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)(%s=%s))",
			  LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
			  LDAP_OBJ_SAMBASAMACCOUNT"ipaNTUserAttrs",
			  LDAP_ATTRIBUTE_UID"uid", escaped_user);
if (filter == NULL((void*)0)) {
10
←
Assuming 'filter' is not equal to NULL→
11
←
Taking false branch→
status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
goto done;
}

ret = smbldap_search(ipasam_state->ldap_state,
	     ipasam_state->base_dn,
	     LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002),filter, NULL((void*)0), 0,
	     &result);
if (ret != LDAP_SUCCESS0x00) {
12
←
Assuming 'ret' is equal to LDAP_SUCCESS→
13
←
Taking false branch→
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

count = ldap_count_entries(priv2ld(ipasam_state), result);
if (count != 1) {
14
←
Assuming 'count' is equal to 1→
15
←
Taking false branch→
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

entry = ldap_first_entry(priv2ld(ipasam_state), result);
if (entry == NULL((void*)0)) {
16
←
Assuming 'entry' is not equal to NULL→
17
←
Taking false branch→
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

if (!init_sam_from_ldap(ipasam_state, user, entry)) {
18
←
Calling 'init_sam_from_ldap'→
status = NT_STATUS_NO_SUCH_USER((NTSTATUS) { 0xc0000064 });
goto done;
}

status = NT_STATUS_OK((NTSTATUS) { 0x0 });

3777done:
ldap_msgfree(result);
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "3779");
return status;
3781}

3783static bool_Bool ipasam_get_trusteddom_pw(struct pdb_methods *methods,
		      const char *domain,
		      char** pwd,
		      struct dom_sid *sid,
		      time_t *pass_last_set_time)
3788{
NTSTATUS status;
TALLOC_CTX *tmp_ctx;
struct pdb_trusted_domain *td;
bool_Bool ret = false0;
char *trustpw;
NTTIME last_update;

tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "3796");
if (tmp_ctx == NULL((void*)0)) {
return false0;
}

status = ipasam_get_trusted_domain(methods, tmp_ctx, domain, &td);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
ret = false0;
goto done;
}

status = get_trust_pwd(tmp_ctx, &td->trust_auth_incoming,
	       &trustpw, &last_update);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
ret = false0;
goto done;
}

/* trusteddom_pw routines do not use talloc yet... */
if (pwd != NULL((void*)0)) {
*pwd = strdup(trustpw);
memset(trustpw, 0, strlen(trustpw));
talloc_free(trustpw)_talloc_free(trustpw, "ipa_sam.c" ":" "3818");
if (*pwd == NULL((void*)0)) {
	ret =false0;
	goto done;
}
}

if (pass_last_set_time != NULL((void*)0)) {
*pass_last_set_time = nt_time_to_unix(last_update);
}

if (sid != NULL((void*)0)) {
sid_copy(sid, &td->security_identifier);
}

ret = true1;
3834done:
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "3835");
return ret;
3837}

3839static bool_Bool ipasam_set_trusteddom_pw(struct pdb_methods *methods,
		      const char* domain,
		      const char* pwd,
		      const struct dom_sid *sid)
3843{
return false0;
3845}

3847static bool_Bool ipasam_del_trusteddom_pw(struct pdb_methods *methods,
		      const char *domain)
3849{
return false0;
3851}

3853static struct pdb_domain_info *pdb_ipasam_get_domain_info(struct pdb_methods *pdb_methods,
					  TALLOC_CTX *mem_ctx)
3855{
struct pdb_domain_info *info;
struct ipasam_private *ipasam_state =
	talloc_get_type_abort(pdb_methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(pdb_methods->
private_data, "struct ipasam_private", "ipa_sam.c" ":" "3858"
);
char sid_buf[24];
DATA_BLOB sid_blob;
NTSTATUS status;

info = talloc(mem_ctx, struct pdb_domain_info)(struct pdb_domain_info *)talloc_named_const(mem_ctx, sizeof(
struct pdb_domain_info), "struct pdb_domain_info");
if (info == NULL((void*)0)) {
DEBUG(1, ("talloc failed\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3865", __FUNCTION__
 )) && (dbgtext ("talloc failed\n")) );
return NULL((void*)0);
}

info->name = talloc_strdup(info, ipasam_state->flat_name);
if (info->name == NULL((void*)0)) {
DEBUG(1, ("talloc_strdup domain_name failed\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3871", __FUNCTION__
 )) && (dbgtext ("talloc_strdup domain_name failed\n"
)) );
goto fail;
}

status = ipasam_get_domain_name(ipasam_state, info, &info->dns_domain);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0)) || (info->dns_domain == NULL((void*)0))) {
goto fail;
}
info->dns_forest = talloc_strdup(info, info->dns_domain);

/* we expect a domain SID to have 4 sub IDs */
if (ipasam_state->domain_sid.num_auths != 4) {
goto fail;
}

sid_copy(&info->sid, &ipasam_state->domain_sid);

if (!sid_linearize(sid_buf, sizeof(sid_buf), &info->sid)) {
goto fail;
}

/* the first 8 bytes of the linearized SID are not random,
* so we skip them */
sid_blob.data = (uint8_t *) sid_buf + 8 ;
sid_blob.length = 16;

status = GUID_from_ndr_blob(&sid_blob, &info->guid);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
goto fail;
}

return info;

3904fail:
TALLOC_FREE(info)do { if (info != ((void*)0)) { _talloc_free(info, "ipa_sam.c"
 ":" "3905"); info=((void*)0); } } while(0);
return NULL((void*)0);
3907}

3909static void ipasam_free_private_data(void **vp)
3910{
struct ipasam_private **ipasam_state = (struct ipasam_private **)vp;

smbldap_free_struct(&(*ipasam_state)->ldap_state);

if ((*ipasam_state)->result != NULL((void*)0)) {
ldap_msgfree((*ipasam_state)->result);
(*ipasam_state)->result = NULL((void*)0);
}
if ((*ipasam_state)->domain_dn != NULL((void*)0)) {
free((*ipasam_state)->domain_dn);
(*ipasam_state)->domain_dn = NULL((void*)0);
}

*ipasam_state = NULL((void*)0);

/* No need to free any further, as it is talloc()ed */
3927}

3929static struct dom_sid *get_fallback_group_sid(TALLOC_CTX *mem_ctx,
			      struct smbldap_state *ldap_state,
			      struct sss_idmap_ctx *idmap_ctx,
			      LDAPMessage *dom_entry,
			      char **fallback_group_gid_str)
3934{
char *dn;
char *sid;
char *gidnumber;
int ret;
const char *filter = "objectClass=*";
const char *attr_list[] = {
			LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier",
			LDAP_ATTRIBUTE_GIDNUMBER"gidnumber",
			NULL((void*)0)};
LDAPMessage *result;
LDAPMessage *entry;
LDAP *ld = NULL((void*)0);
enum idmap_error_code err;
struct dom_sid *fallback_group_sid;

ld = _smbldap_get_ldap(ldap_state);
dn = get_single_attribute(mem_ctx, ld,
		  dom_entry,
		  LDAP_ATTRIBUTE_FALLBACK_PRIMARY_GROUP"ipaNTFallbackPrimaryGroup");
if (dn == NULL((void*)0)) {
DEBUG(0, ("Missing mandatory attribute %s.\n",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3956", __FUNCTION__
 )) && (dbgtext ("Missing mandatory attribute %s.\n",
 "ipaNTFallbackPrimaryGroup")) )
	  LDAP_ATTRIBUTE_FALLBACK_PRIMARY_GROUP))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3956", __FUNCTION__
 )) && (dbgtext ("Missing mandatory attribute %s.\n",
 "ipaNTFallbackPrimaryGroup")) );
return NULL((void*)0);
}

ret = smbldap_search(ldap_state, dn, LDAP_SCOPE_BASE((ber_int_t) 0x0000), filter, attr_list,
	     0, &result);
talloc_free(dn)_talloc_free(dn, "ipa_sam.c" ":" "3962");
if (ret != LDAP_SUCCESS0x00) {
DEBUG(2,("Failed to read faillback group [%s].", dn))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "3964", __FUNCTION__
 )) && (dbgtext ("Failed to read faillback group [%s]."
, dn)) );
return NULL((void*)0);
}

ld = _smbldap_get_ldap(ldap_state);
entry = ldap_first_entry(ld, result);
if (entry == NULL((void*)0)) {
DEBUG(0, ("Could not get fallback group entry\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3971", __FUNCTION__
 )) && (dbgtext ("Could not get fallback group entry\n"
)) );
ldap_msgfree(result);
return NULL((void*)0);
}

sid = get_single_attribute(mem_ctx, ld,
		  entry, LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");
if (sid == NULL((void*)0)) {
DEBUG(0, ("Missing mandatory attribute %s.\n",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3980", __FUNCTION__
 )) && (dbgtext ("Missing mandatory attribute %s.\n",
 "ipaNTSecurityIdentifier")) )
	  LDAP_ATTRIBUTE_SID))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3980", __FUNCTION__
 )) && (dbgtext ("Missing mandatory attribute %s.\n",
 "ipaNTSecurityIdentifier")) );
ldap_msgfree(result);
return NULL((void*)0);
}

err = sss_idmap_sid_to_smb_sid(idmap_ctx, sid, &fallback_group_sid);
if (err != IDMAP_SUCCESS) {
DEBUG(1, ("SID [%s] could not be converted\n", sid))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "3987", __FUNCTION__
 )) && (dbgtext ("SID [%s] could not be converted\n",
 sid)) );
ldap_msgfree(result);
talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "3989");
return NULL((void*)0);
}
talloc_free(sid)_talloc_free(sid, "ipa_sam.c" ":" "3992");

gidnumber = get_single_attribute(mem_ctx, ld,
			entry, LDAP_ATTRIBUTE_GIDNUMBER"gidnumber");
if (gidnumber == NULL((void*)0)) {
DEBUG(0, ("Missing mandatory attribute %s.\n",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3998", __FUNCTION__
 )) && (dbgtext ("Missing mandatory attribute %s.\n",
 "gidnumber")) )
	  LDAP_ATTRIBUTE_GIDNUMBER))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "3998", __FUNCTION__
 )) && (dbgtext ("Missing mandatory attribute %s.\n",
 "gidnumber")) );
ldap_msgfree(result);
return NULL((void*)0);
}

*fallback_group_gid_str = gidnumber;

ldap_msgfree(result);

return fallback_group_sid;
4008}

4010static NTSTATUS ipasam_search_domain_info(struct smbldap_state *ldap_state,
			    LDAPMessage ** result)
4012{
const char *filter = "objectClass=ipaNTDomainAttrs";
const char *attr_list[] = {
			LDAP_ATTRIBUTE_FLAT_NAME"ipaNTFlatName",
			LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier",
			LDAP_ATTRIBUTE_FALLBACK_PRIMARY_GROUP"ipaNTFallbackPrimaryGroup",
			LDAP_ATTRIBUTE_OBJECTCLASS"objectClass",
			NULL((void*)0)};
int count;
int ret;

ret = smbldap_search_suffix(ldap_state, filter, attr_list , result);

if (ret != LDAP_SUCCESS0x00) {
DEBUG(2,("ipasam_search_domain_info: "(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "4028", __FUNCTION__
 )) && (dbgtext ("ipasam_search_domain_info: " "smbldap_search_suffix failed: %s\n"
, ldap_err2string (ret))) )
	 "smbldap_search_suffix failed: %s\n",(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "4028", __FUNCTION__
 )) && (dbgtext ("ipasam_search_domain_info: " "smbldap_search_suffix failed: %s\n"
, ldap_err2string (ret))) )
	 ldap_err2string (ret)))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "4028", __FUNCTION__
 )) && (dbgtext ("ipasam_search_domain_info: " "smbldap_search_suffix failed: %s\n"
, ldap_err2string (ret))) );
DEBUG(2,("ipasam_search_domain_info: Query was: %s\n", filter))(void)( ((2) <= 1000) && (debuglevel_get_class(0) >=
 (2)) && (dbghdrclass( 2, 0, "ipa_sam.c" ":" "4029", __FUNCTION__
 )) && (dbgtext ("ipasam_search_domain_info: Query was: %s\n"
, filter)) );
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

count = ldap_count_entries(_smbldap_get_ldap(ldap_state), *result);

if (count == 1) {
return NT_STATUS_OK((NTSTATUS) { 0x0 });
}

DEBUG(0, ("iapsam_search_domain_info: Got [%d] domain info entries, "(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4040", __FUNCTION__
 )) && (dbgtext ("iapsam_search_domain_info: Got [%d] domain info entries, "
 "but expected only 1.\n", count)) )
  "but expected only 1.\n", count))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4040", __FUNCTION__
 )) && (dbgtext ("iapsam_search_domain_info: Got [%d] domain info entries, "
 "but expected only 1.\n", count)) );

return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
4043}

4045static NTSTATUS ipasam_get_base_dn(struct smbldap_state *ldap_state,
		   TALLOC_CTX *mem_ctx, char **base_dn)
4047{
int ret;
LDAPMessage *result;
LDAPMessage *entry = NULL((void*)0);
LDAP *ld = NULL((void*)0);
int count;
char *nc;
const char *attr_list[] = {
			"namingContexts",
			"defaultNamingContext",
			NULL((void*)0)
		  };

ret = smbldap_search(ldap_state, "", LDAP_SCOPE_BASE((ber_int_t) 0x0000),
	     "(objectclass=*)", attr_list, 0, &result);
if (ret != LDAP_SUCCESS0x00) {
DEBUG(1, ("Failed to get base DN from RootDSE: %s\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4064", __FUNCTION__
 )) && (dbgtext ("Failed to get base DN from RootDSE: %s\n"
, ldap_err2string (ret))) )
	  ldap_err2string (ret)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4064", __FUNCTION__
 )) && (dbgtext ("Failed to get base DN from RootDSE: %s\n"
, ldap_err2string (ret))) );
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

ld = _smbldap_get_ldap(ldap_state);
count = ldap_count_entries(ld, result);

if (count != 1) {
DEBUG(1, ("Unexpected number of results [%d] for base DN "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4073", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for base DN "
 "search.\n", count)) )
	  "search.\n", count))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4073", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for base DN "
 "search.\n", count)) );
ldap_msgfree(result);
return NT_STATUS_OK((NTSTATUS) { 0x0 });
}

entry = ldap_first_entry(ld, result);
if (entry == NULL((void*)0)) {
DEBUG(0, ("Could not get RootDSE entry\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4080", __FUNCTION__
 )) && (dbgtext ("Could not get RootDSE entry\n")) );
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

nc = get_single_attribute(mem_ctx, ld, entry,
		  "defaultNamingContext");
if (nc != NULL((void*)0)) {
*base_dn = nc;
ldap_msgfree(result);
return NT_STATUS_OK((NTSTATUS) { 0x0 });
}

nc = get_single_attribute(mem_ctx, ld, entry,
		  "namingContexts");
if (nc != NULL((void*)0)) {
*base_dn = nc;
ldap_msgfree(result);
return NT_STATUS_OK((NTSTATUS) { 0x0 });
}

ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
4103}

4105static NTSTATUS ipasam_get_domain_name(struct ipasam_private *ipasam_state,
		       TALLOC_CTX *mem_ctx,
		       char **domain_name)
4108{
int ret;
LDAPMessage *result;
LDAPMessage *entry = NULL((void*)0);
LDAP *ld = NULL((void*)0);
int count;
char *cn;
struct smbldap_state *ldap_state = ipasam_state->ldap_state;
const char *attr_list[] = {
			LDAP_ATTRIBUTE_ASSOCIATED_DOMAIN"associatedDomain",
			NULL((void*)0)
		  };

ret = smbldap_search(ldap_state,
	     ipasam_state->base_dn,
	     LDAP_SCOPE_BASE((ber_int_t) 0x0000),
	     "objectclass=" LDAP_OBJ_DOMAINRELATED"domainRelatedObject", attr_list, 0,
	     &result);
if (ret != LDAP_SUCCESS0x00) {
DEBUG(1, ("Failed to get domain name: %s\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4128", __FUNCTION__
 )) && (dbgtext ("Failed to get domain name: %s\n", ldap_err2string
 (ret))) )
	  ldap_err2string (ret)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4128", __FUNCTION__
 )) && (dbgtext ("Failed to get domain name: %s\n", ldap_err2string
 (ret))) );
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

ld = _smbldap_get_ldap(ldap_state);
count = ldap_count_entries(ld, result);

if (count != 1) {
DEBUG(1, ("Unexpected number of results [%d] for domain name "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4137", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for domain name "
 "search.\n", count)) )
	  "search.\n", count))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4137", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for domain name "
 "search.\n", count)) );
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

entry = ldap_first_entry(ld, result);
if (entry == NULL((void*)0)) {
DEBUG(0, ("Could not get domainRelatedObject entry\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4144", __FUNCTION__
 )) && (dbgtext ("Could not get domainRelatedObject entry\n"
)) );
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

cn = get_single_attribute(mem_ctx, ld, entry,
		  LDAP_ATTRIBUTE_ASSOCIATED_DOMAIN"associatedDomain");
if (cn == NULL((void*)0)) {
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

*domain_name = cn;
ldap_msgfree(result);
return NT_STATUS_OK((NTSTATUS) { 0x0 });
4159}

4161static NTSTATUS ipasam_get_enctypes(struct ipasam_private *ipasam_state,
		    uint32_t *enctypes)
4163{
int ret;
LDAPMessage *result;
LDAPMessage *entry = NULL((void*)0);
LDAP *ld = NULL((void*)0);
int count, i;
char **enctype_list, *dn;
krb5_enctype enctype;
krb5_error_code err;
struct smbldap_state *ldap_state = ipasam_state->ldap_state;
const char *attr_list[] = {
			"krbDefaultEncSaltTypes",
			NULL((void*)0)
		  };

dn = talloc_asprintf(ipasam_state, "cn=%s,cn=kerberos,%s",
	     ipasam_state->realm,
	     ipasam_state->base_dn);

if (dn == NULL((void*)0)) {
DEBUG(1, ("Failed to construct DN to the realm's kerberos container\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4183", __FUNCTION__
 )) && (dbgtext ("Failed to construct DN to the realm's kerberos container\n"
)) );
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

ret = smbldap_search(ldap_state, dn, LDAP_SCOPE_BASE((ber_int_t) 0x0000),
	     "objectclass=krbrealmcontainer", attr_list, 0,
	     &result);
if (ret != LDAP_SUCCESS0x00) {
DEBUG(1, ("Failed to get kerberos realm encryption types: %s\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4192", __FUNCTION__
 )) && (dbgtext ("Failed to get kerberos realm encryption types: %s\n"
, ldap_err2string (ret))) )
	  ldap_err2string (ret)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4192", __FUNCTION__
 )) && (dbgtext ("Failed to get kerberos realm encryption types: %s\n"
, ldap_err2string (ret))) );
talloc_free(dn)_talloc_free(dn, "ipa_sam.c" ":" "4193");
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

ld = _smbldap_get_ldap(ldap_state);
count = ldap_count_entries(ld, result);

if (count != 1) {
DEBUG(1, ("Unexpected number of results [%d] for realm "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4202", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for realm "
 "search.\n", count)) )
	  "search.\n", count))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4202", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for realm "
 "search.\n", count)) );
ldap_msgfree(result);
talloc_free(dn)_talloc_free(dn, "ipa_sam.c" ":" "4204");
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

entry = ldap_first_entry(ld, result);
if (entry == NULL((void*)0)) {
DEBUG(0, ("Could not get krbrealmcontainer entry\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4210", __FUNCTION__
 )) && (dbgtext ("Could not get krbrealmcontainer entry\n"
)) );
ldap_msgfree(result);
talloc_free(dn)_talloc_free(dn, "ipa_sam.c" ":" "4212");
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

enctype_list = get_attribute_values(dn, ld, entry,
			    "krbDefaultEncSaltTypes", &count);
ldap_msgfree(result);
if (enctype_list == NULL((void*)0)) {
talloc_free(dn)_talloc_free(dn, "ipa_sam.c" ":" "4220");
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

*enctypes = 0;
for (i = 0; i < count ; i++) {
char *enc = strchr(enctype_list[i], ':');
if (enc != NULL((void*)0)) {
	*enc = '\0';
}
err = krb5_string_to_enctype(enctype_list[i], &enctype);
if (enc != NULL((void*)0)) {
	*enc = ':';
}
if (err) {
	continue;
}
switch (enctype) {
	case ENCTYPE_DES_CBC_CRC0x0001:
		*enctypes |= KERB_ENCTYPE_DES_CBC_CRC( 0x00000001 );
		break;
	case ENCTYPE_DES_CBC_MD50x0003:
		*enctypes |= KERB_ENCTYPE_DES_CBC_MD5( 0x00000002 );
		break;
	case ENCTYPE_ARCFOUR_HMAC0x0017:
		if (!ipasam_state->fips_enabled) {
			*enctypes |= KERB_ENCTYPE_RC4_HMAC_MD5( 0x00000004 );
		}
		break;
	case ENCTYPE_AES128_CTS_HMAC_SHA1_960x0011:
		*enctypes |= KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96( 0x00000008 );
		break;
	case ENCTYPE_AES256_CTS_HMAC_SHA1_960x0012:
		*enctypes |= KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96( 0x00000010 );
		break;
	default:
		break;
}
}

talloc_free(dn)_talloc_free(dn, "ipa_sam.c" ":" "4260");
return NT_STATUS_OK((NTSTATUS) { 0x0 });
4262}

4264static NTSTATUS ipasam_get_realm(struct ipasam_private *ipasam_state,
		 char **realm)
4266{
int ret;
LDAPMessage *result;
LDAPMessage *entry = NULL((void*)0);
LDAP *ld = NULL((void*)0);
int count;
char *cn;
struct smbldap_state *ldap_state = ipasam_state->ldap_state;
const char *attr_list[] = {
			"cn",
			NULL((void*)0)
		  };

ret = smbldap_search(ldap_state,
	     ipasam_state->base_dn,
	     LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002),
	     "objectclass=krbrealmcontainer", attr_list, 0,
	     &result);
if (ret != LDAP_SUCCESS0x00) {
DEBUG(1, ("Failed to get realm: %s\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4286", __FUNCTION__
 )) && (dbgtext ("Failed to get realm: %s\n", ldap_err2string
 (ret))) )
	  ldap_err2string (ret)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4286", __FUNCTION__
 )) && (dbgtext ("Failed to get realm: %s\n", ldap_err2string
 (ret))) );
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

ld = _smbldap_get_ldap(ldap_state);
count = ldap_count_entries(ld, result);

if (count != 1) {
DEBUG(1, ("Unexpected number of results [%d] for realm "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4295", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for realm "
 "search.\n", count)) )
	  "search.\n", count))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4295", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for realm "
 "search.\n", count)) );
ldap_msgfree(result);
return NT_STATUS_OK((NTSTATUS) { 0x0 });
}

entry = ldap_first_entry(ld, result);
if (entry == NULL((void*)0)) {
DEBUG(0, ("Could not get krbrealmcontainer entry\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4302", __FUNCTION__
 )) && (dbgtext ("Could not get krbrealmcontainer entry\n"
)) );
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

cn = get_single_attribute(ipasam_state, ld,
		  entry,
		  "cn");
if (cn == NULL((void*)0)) {
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

*realm = cn;
ldap_msgfree(result);
return NT_STATUS_OK((NTSTATUS) { 0x0 });
4318}

4320#ifdef HAVE_PDB_ENUM_UPN_SUFFIXES1
4321static NTSTATUS ipasam_enum_upn_suffixes(struct pdb_methods *pdb_methods,
			 TALLOC_CTX *mem_ctx,
			 uint32_t *num_suffixes,
			 char ***suffixes)
4325{
int ret;
LDAPMessage *result;
LDAPMessage *entry = NULL((void*)0);
LDAP *ld = NULL((void*)0);
int count, i;
char *realmdomains_dn = NULL((void*)0);
char **domains = NULL((void*)0);
struct ipasam_private *ipasam_state;
struct smbldap_state *ldap_state;
const char *attr_list[] = {
			LDAP_ATTRIBUTE_ASSOCIATED_DOMAIN"associatedDomain",
			NULL((void*)0)
		  };

if ((suffixes == NULL((void*)0)) || (num_suffixes == NULL((void*)0))) {
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

ipasam_state = talloc_get_type_abort(pdb_methods->private_data, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(pdb_methods->
private_data, "struct ipasam_private", "ipa_sam.c" ":" "4344"
);
ldap_state = ipasam_state->ldap_state;

realmdomains_dn = talloc_asprintf(mem_ctx, "%s,%s", LDAP_CN_REALM_DOMAINS"cn=Realm Domains,cn=ipa,cn=etc",
			  ipasam_state->base_dn);
if (realmdomains_dn == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

ret = smbldap_search(ldap_state,
	     realmdomains_dn,
	     LDAP_SCOPE_BASE((ber_int_t) 0x0000),
	     "objectclass=" LDAP_OBJ_DOMAINRELATED"domainRelatedObject", attr_list, 0,
	     &result);
if (ret != LDAP_SUCCESS0x00) {
DEBUG(1, ("Failed to get list of realm domains: %s\n",(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4360", __FUNCTION__
 )) && (dbgtext ("Failed to get list of realm domains: %s\n"
, ldap_err2string (ret))) )
	  ldap_err2string (ret)))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4360", __FUNCTION__
 )) && (dbgtext ("Failed to get list of realm domains: %s\n"
, ldap_err2string (ret))) );
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

ld = _smbldap_get_ldap(ldap_state);
count = ldap_count_entries(ld, result);
if (count != 1) {
DEBUG(1, ("Unexpected number of results [%d] for realm domains "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4368", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for realm domains "
 "search.\n", count)) )
	  "search.\n", count))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4368", __FUNCTION__
 )) && (dbgtext ("Unexpected number of results [%d] for realm domains "
 "search.\n", count)) );
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

entry = ldap_first_entry(ld, result);
if (entry == NULL((void*)0)) {
DEBUG(0, ("Could not get domainRelatedObject entry\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4375", __FUNCTION__
 )) && (dbgtext ("Could not get domainRelatedObject entry\n"
)) );
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

domains = get_attribute_values(mem_ctx, ld, entry,
			LDAP_ATTRIBUTE_ASSOCIATED_DOMAIN"associatedDomain", &count);
if (domains == NULL((void*)0)) {
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

/* Since associatedDomain has attributeType MUST, there must be at least one domain */
for (i = 0; i < count ; i++) {
/* TODO: use comparison function friendly to IDN */
if (strcasecmp(ipasam_state->domain_name, domains[i]) == 0) {
	break;
}
}

if (i < count) {
/* If we found our primary domain in the list and it is alone, exit with empty list */
if (count == 1) {
	ldap_msgfree(result);
	talloc_free(domains)_talloc_free(domains, "ipa_sam.c" ":" "4399");
	return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

talloc_free(domains[i])_talloc_free(domains[i], "ipa_sam.c" ":" "4403");

/* if i is not last element, move everything down */
if (i != (count - 1)) {
	memmove(domains + i, domains + i + 1, sizeof(char *) * (count - i - 1));
}

/* we don't resize whole list, only reduce number of elements in it
 * since sizing down a single pointer will not reduce memory usage in talloc
 */
domains[count - 1] = NULL((void*)0);
*suffixes = domains;
*num_suffixes = count - 1;
} else {
/* There is no our primary domain in the list */
*suffixes = domains;
*num_suffixes = count;
}

ldap_msgfree(result);
return NT_STATUS_OK((NTSTATUS) { 0x0 });
4424}
4425#endif /* HAVE_PDB_ENUM_UPN_SUFFIXES */


4428#define SECRETS_DOMAIN_SID"SECRETS/SID"    "SECRETS/SID"
4429static char *sec_key(TALLOC_CTX *mem_ctx, const char *d)
4430{
char *tmp;
char *res;

tmp = talloc_asprintf(mem_ctx, "%s/%s", SECRETS_DOMAIN_SID"SECRETS/SID", d);
res = talloc_strdup_upper(mem_ctx, tmp);
talloc_free(tmp)_talloc_free(tmp, "ipa_sam.c" ":" "4436");

return res;
4439}

4441static NTSTATUS save_sid_to_secret(struct ipasam_private *ipasam_state)
4442{
char hostname[255];
int ret;
char *p;
TALLOC_CTX *tmp_ctx;
NTSTATUS status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });

tmp_ctx =talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "ipa_sam.c" ":"
 "4449");
if (tmp_ctx == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

if (!secrets_store(sec_key(tmp_ctx, ipasam_state->domain_name),
	   &ipasam_state->domain_sid, sizeof(struct dom_sid))) {
DEBUG(1, ("Failed to store domain SID"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4456", __FUNCTION__
 )) && (dbgtext ("Failed to store domain SID")) );
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

if (!secrets_store(sec_key(tmp_ctx,
		   ipasam_state->flat_name),
	   &ipasam_state->domain_sid, sizeof(struct dom_sid))) {
DEBUG(1, ("Failed to store domain SID"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4464", __FUNCTION__
 )) && (dbgtext ("Failed to store domain SID")) );
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

ret = gethostname(hostname, sizeof(hostname));
if (ret == -1) {
DEBUG(1, ("gethostname failed.\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4471", __FUNCTION__
 )) && (dbgtext ("gethostname failed.\n")) );
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}
hostname[sizeof(hostname)-1] = '\0';
p = strchr(hostname, '.');
if (p != NULL((void*)0)) {
*p = '\0';
}

if (!secrets_store(sec_key(tmp_ctx, hostname),
	   &ipasam_state->domain_sid, sizeof(struct dom_sid))) {
DEBUG(1, ("Failed to store domain SID"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4483", __FUNCTION__
 )) && (dbgtext ("Failed to store domain SID")) );
status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
goto done;
}

status = NT_STATUS_OK((NTSTATUS) { 0x0 });

4490done:
talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "ipa_sam.c" ":" "4491");
return status;
4493}

4495struct ipasam_sasl_interact_priv {
krb5_context context;
krb5_principal principal;
krb5_keytab keytab;
krb5_get_init_creds_opt *options;
krb5_creds creds;
krb5_ccache ccache;
const char *name;
int name_len;
4504};

4506static int ldap_sasl_interact(LDAP *ld, unsigned flags, void *priv_data, void *sit)
4507{
sasl_interact_t *in = NULL((void*)0);
int ret = LDAP_OTHER0x50;
struct ipasam_sasl_interact_priv *data = (struct ipasam_sasl_interact_priv*) priv_data;

if (!ld) return LDAP_PARAM_ERROR(-9);

for (in = sit; in && in->id != SASL_CB_LIST_END0; in++) {
switch(in->id) {
case SASL_CB_USER0x4001:
	in->result = data->name;
	in->len = data->name_len;
	ret = LDAP_SUCCESS0x00;
	break;
case SASL_CB_GETREALM(0x4008):
	in->result = data->principal->realm.data;
	in->len = data->principal->realm.length;
	ret = LDAP_SUCCESS0x00;
	break;
default:
	in->result = NULL((void*)0);
	in->len = 0;
	ret = LDAP_OTHER0x50;
}
}
return ret;
4533}


4536static void bind_callback_cleanup_creds(struct ipasam_sasl_interact_priv *datap) {
krb5_free_cred_contents(datap->context, &datap->creds);

if (datap->options) {
krb5_get_init_creds_opt_free(datap->context, datap->options);
datap->options = NULL((void*)0);
}
4543}

4545static void bind_callback_cleanup(struct ipasam_sasl_interact_priv *datap, krb5_error_code rc) {
const char *errstring = NULL((void*)0);

if (!datap->context) {
return;
}

if (rc) {
errstring = krb5_get_error_message(datap->context, rc);
DEBUG(0,("kerberos error: code=%d, message=%s\n", rc, errstring))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4554", __FUNCTION__
 )) && (dbgtext ("kerberos error: code=%d, message=%s\n"
, rc, errstring)) );
krb5_free_error_message(datap->context, errstring);
}

bind_callback_cleanup_creds(datap);

if (datap->keytab) {
krb5_kt_close(datap->context, datap->keytab);
datap->keytab = NULL((void*)0);
}

if (datap->ccache) {
krb5_cc_close(datap->context, datap->ccache);
datap->ccache = NULL((void*)0);
}

if (datap->principal) {
krb5_free_principal(datap->context, datap->principal);
datap->principal = NULL((void*)0);
}

krb5_free_context(datap->context);
datap->context = NULL((void*)0);
4577}

4579static krb5_error_code bind_callback_obtain_creds(struct ipasam_sasl_interact_priv *datap) {
krb5_error_code rc;

rc = krb5_get_init_creds_opt_alloc(datap->context, &datap->options);
if (rc) {
return rc;
}

rc = krb5_get_init_creds_opt_set_out_ccache(datap->context, datap->options, datap->ccache);
if (rc) {
return rc;
}

rc = krb5_get_init_creds_keytab(datap->context, &datap->creds, datap->principal, datap->keytab,
			0, NULL((void*)0), datap->options);
return rc;
4595}

4597extern const char * lp_dedicated_keytab_file(void);
4598static int bind_callback(LDAP *ldap_struct, struct smbldap_state *ldap_state, void* ipasam_priv) {
krb5_error_code rc;
krb5_creds *out_creds = NULL((void*)0);
krb5_creds in_creds;

struct ipasam_sasl_interact_priv data;
struct ipasam_private *ipasam_state = NULL((void*)0);
int ret;

memset(&data, 0, sizeof(struct ipasam_sasl_interact_priv));
memset(&in_creds, 0, sizeof(krb5_creds));

ipasam_state = talloc_get_type_abort(ipasam_priv, struct ipasam_private)(struct ipasam_private *)_talloc_get_type_abort(ipasam_priv, "struct ipasam_private"
, "ipa_sam.c" ":" "4610");

if ((ipasam_state->client_princ == NULL((void*)0)) ||
   (ipasam_state->server_princ == NULL((void*)0))) {
DEBUG(0, ("bind_callback: ipasam service principals are not set, cannot use GSSAPI bind\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4614", __FUNCTION__
 )) && (dbgtext ("bind_callback: ipasam service principals are not set, cannot use GSSAPI bind\n"
)) );
return LDAP_LOCAL_ERROR(-2);
}

data.name = ipasam_state->client_princ;
data.name_len = strlen(data.name);

rc = krb5_init_context(&data.context);
if (rc) {
return LDAP_LOCAL_ERROR(-2);
}

rc = krb5_parse_name(data.context, data.name, &data.principal);
if (rc) {
bind_callback_cleanup(&data, rc);
return LDAP_LOCAL_ERROR(-2);
}

rc = krb5_cc_default(data.context, &data.ccache);

if (rc) {
bind_callback_cleanup(&data, rc);
return LDAP_LOCAL_ERROR(-2);
}

rc = krb5_kt_resolve(data.context, lp_dedicated_keytab_file(), &data.keytab);
if (rc) {
bind_callback_cleanup(&data, rc);
return LDAP_LOCAL_ERROR(-2);
}

rc = krb5_parse_name(data.context, ipasam_state->client_princ, &in_creds.client);
if (rc) {
krb5_free_principal(data.context, data.creds.client);
bind_callback_cleanup(&data, rc);
return LDAP_LOCAL_ERROR(-2);
}

rc = krb5_parse_name(data.context, ipasam_state->server_princ, &in_creds.server);
if (rc) {
krb5_free_principal(data.context, in_creds.server);
bind_callback_cleanup(&data, rc);
return LDAP_LOCAL_ERROR(-2);
}

rc = krb5_get_credentials(data.context, KRB5_GC_CACHED2, data.ccache, &in_creds, &out_creds);
krb5_free_principal(data.context, in_creds.server);
krb5_free_principal(data.context, in_creds.client);

if (rc != 0 && rc != KRB5KRB_AP_ERR_TKT_NYV(-1765328351L) && rc != KRB5KRB_AP_ERR_TKT_EXPIRED(-1765328352L)) {
rc = bind_callback_obtain_creds(&data);
if (rc) {
	bind_callback_cleanup(&data, rc);
	return LDAP_LOCAL_ERROR(-2);
}
}

ret = ldap_sasl_interactive_bind_s(ldap_struct,
			   NULL((void*)0), "GSSAPI",
			   NULL((void*)0), NULL((void*)0),
			   LDAP_SASL_QUIET2U,
			   ldap_sasl_interact, &data);

/* By now we have 'ret' for LDAP result and 'rc' for Kerberos result
* if LDAP_API_ERROR(ret) is true, LDAP server rejected our ccache. There may be several issues:
*
* 1. Credentials are invalid due to outdated ccache leftover from previous install or ticket is from future
*    Wipe out old ccache and start again
*
* 2. Key in the keytab is not enough to obtain ticket for cifs/FQDN@REALM service
*    Cannot continue without proper keytab
*
* Only process (1) because (2) and other errors will be taken care of by smbd after multiple retries.
*
* Since both smbd and winbindd will use this passdb module, on startup both will try to access the same
* ccache. It may happen that if ccache was missing or contained invalid cached credentials, that one of
* them will complain loudly about missing ccache file at the time when the other one will be creating
* a new ccache file by the above call of bind_callback_obtain_creds(). This is expected and correct behavior.
*
*/

if (LDAP_API_ERROR(ret)((ret)<0) &&
   ((rc == 0) || (rc == KRB5KRB_AP_ERR_TKT_NYV(-1765328351L)) || (rc == KRB5KRB_AP_ERR_TKT_EXPIRED(-1765328352L)))) {
bind_callback_cleanup_creds(&data);
rc = bind_callback_obtain_creds(&data);
if (rc) {
	bind_callback_cleanup(&data, rc);
	return LDAP_LOCAL_ERROR(-2);
}
ret = ldap_sasl_interactive_bind_s(ldap_struct,
				   NULL((void*)0), "GSSAPI",
				   NULL((void*)0), NULL((void*)0),
				   LDAP_SASL_QUIET2U,
				   ldap_sasl_interact, &data);
}

if (LDAP_SECURITY_ERROR(ret)(((0x2F) <= ((ret))) && (((ret)) <= (0x32)))) {
DEBUG(0, ("bind_callback: cannot perform interactive SASL bind with GSSAPI. LDAP security error is %d\n", ret))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4711", __FUNCTION__
 )) && (dbgtext ("bind_callback: cannot perform interactive SASL bind with GSSAPI. LDAP security error is %d\n"
, ret)) );
}

if (out_creds) {
krb5_free_creds(data.context, out_creds);
}
bind_callback_cleanup(&data, 0);
return ret;
4719}

4721static NTSTATUS ipasam_generate_principals(struct ipasam_private *ipasam_state) {

krb5_error_code rc;
int ret;
krb5_context context;
NTSTATUS status = NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
char hostname[255];
char *default_realm = NULL((void*)0);

if (!ipasam_state) {
return status;
}

rc = krb5_init_context(&context);
if (rc) {
return status;
}

ret = gethostname(hostname, sizeof(hostname));
if (ret == -1) {
DEBUG(1, ("gethostname failed.\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4741", __FUNCTION__
 )) && (dbgtext ("gethostname failed.\n")) );
goto done;
}
hostname[sizeof(hostname)-1] = '\0';

rc = krb5_get_default_realm(context, &default_realm);
if (rc) {
goto done;
};

if (ipasam_state->client_princ) {
talloc_free(ipasam_state->client_princ)_talloc_free(ipasam_state->client_princ, "ipa_sam.c" ":" "4752"
);
ipasam_state->client_princ = NULL((void*)0);
}

ipasam_state->client_princ = talloc_asprintf(ipasam_state,
				     "cifs/%s@%s",
				     hostname,
				     default_realm);

if (ipasam_state->client_princ == NULL((void*)0)) {
DEBUG(0, ("Failed to create ipasam client principal.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4762", __FUNCTION__
 )) && (dbgtext ("Failed to create ipasam client principal.\n"
)) );
status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
goto done;
}

if (ipasam_state->server_princ) {
talloc_free(ipasam_state->server_princ)_talloc_free(ipasam_state->server_princ, "ipa_sam.c" ":" "4768"
);
ipasam_state->server_princ = NULL((void*)0);
}

ipasam_state->server_princ = talloc_asprintf(ipasam_state,
				     "ldap/%s@%s",
				     hostname,
				     default_realm);

if (ipasam_state->server_princ == NULL((void*)0)) {
DEBUG(0, ("Failed to create ipasam server principal.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4778", __FUNCTION__
 )) && (dbgtext ("Failed to create ipasam server principal.\n"
)) );
status = NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
goto done;
}

status = NT_STATUS_OK((NTSTATUS) { 0x0 });

4785done:

if (default_realm) {
krb5_free_default_realm(context, default_realm);
}

if (context) {
krb5_free_context(context);
}
return status;
4795}

4797static NTSTATUS pdb_init_ipasam(struct pdb_methods **pdb_method,
		const char *location)
4799{
struct ipasam_private *ipasam_state;

char *uri;
NTSTATUS status;
char *dn = NULL((void*)0);
char *domain_sid_string = NULL((void*)0);
struct dom_sid *ldap_domain_sid = NULL((void*)0);
struct dom_sid *fallback_group_sid = NULL((void*)0);
char *fallback_group_gid_str = NULL((void*)0);

LDAPMessage *result = NULL((void*)0);
LDAPMessage *entry = NULL((void*)0);
enum idmap_error_code err;
uint32_t enctypes = 0;

status = make_pdb_method(pdb_method);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
return status;
}

(*pdb_method)->name = "ipasam";

if ( !(ipasam_state = talloc_zero(*pdb_method, struct ipasam_private)(struct ipasam_private *)_talloc_zero(*pdb_method, sizeof(struct
 ipasam_private), "struct ipasam_private")) ) {
DEBUG(0, ("pdb_init_ipasam: talloc() failed for ipasam private_data!\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4823", __FUNCTION__
 )) && (dbgtext ("pdb_init_ipasam: talloc() failed for ipasam private_data!\n"
)) );
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

uri = talloc_strdup(ipasam_state, location );
if (uri == NULL((void*)0)) {
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}
trim_string( uri, "\"", "\"" );

status = ipasam_generate_principals(ipasam_state);

if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
DEBUG(0, ("Failed to generate kerberos principal for LDAP authentication.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4836", __FUNCTION__
 )) && (dbgtext ("Failed to generate kerberos principal for LDAP authentication.\n"
)) );
return status;
} else {
/* We authenticate via GSSAPI and thus will use kerberos principal to bind our access */
status = smbldap_init(*pdb_method, pdb_get_tevent_context(),
		      uri, false0, NULL((void*)0), NULL((void*)0),
		      &ipasam_state->ldap_state);
if (NT_STATUS_IS_OK(status)((((status).v) == 0))) {
4844#ifdef HAVE_SMBLDAP_SET_BIND_CALLBACK1
	smbldap_set_bind_callback(ipasam_state->ldap_state, bind_callback, ipasam_state);
4846#else
	ipasam_state->ldap_state->bind_callback = bind_callback;
	ipasam_state->ldap_state->bind_callback_data = ipasam_state;
4849#endif
}
}

talloc_free(uri)_talloc_free(uri, "ipa_sam.c" ":" "4853");
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
return status;
}

(*pdb_method)->private_data = ipasam_state;
(*pdb_method)->free_private_data = ipasam_free_private_data;

status = ipasam_get_base_dn(ipasam_state->ldap_state,
		    ipasam_state,
		    &ipasam_state->base_dn);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
DEBUG(0, ("Failed to get base DN.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4865", __FUNCTION__
 )) && (dbgtext ("Failed to get base DN.\n")) );
return status;
}

if (!(smbldap_has_extension(priv2ld(ipasam_state), IPA_KEYTAB_SET_OID"2.16.840.1.113730.3.8.10.1") ||
     smbldap_has_extension(priv2ld(ipasam_state), IPA_KEYTAB_SET_OID_OLD"2.16.840.1.113730.3.8.3.1"))) {
DEBUG(0, ("Server is not an IPA server.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4871", __FUNCTION__
 )) && (dbgtext ("Server is not an IPA server.\n")) );
return NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
}

ipasam_state->fips_enabled = ipapwd_fips_enabled();
ipasam_state->trust_dn = talloc_asprintf(ipasam_state,
				 "cn=ad,cn=trusts,%s",
				 ipasam_state->base_dn);
if (ipasam_state->trust_dn == NULL((void*)0)) {
DEBUG(0, ("Failed to create trsut DN.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4880", __FUNCTION__
 )) && (dbgtext ("Failed to create trsut DN.\n")) );
return NT_STATUS_NO_MEMORY((NTSTATUS) { 0xc0000017 });
}

status = ipasam_get_domain_name(ipasam_state, ipasam_state,
			(char**) &ipasam_state->domain_name);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
DEBUG(0, ("Failed to get domain name.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4887", __FUNCTION__
 )) && (dbgtext ("Failed to get domain name.\n")) );
return status;
}

status = ipasam_get_realm(ipasam_state,
		  &ipasam_state->realm);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
DEBUG(0, ("Failed to get realm.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4894", __FUNCTION__
 )) && (dbgtext ("Failed to get realm.\n")) );
return status;
}

status = ipasam_search_domain_info(ipasam_state->ldap_state, &result);

if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
DEBUG(0, ("pdb_init_ldapsam: WARNING: Could not get domain "(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4903", __FUNCTION__
 )) && (dbgtext ("pdb_init_ldapsam: WARNING: Could not get domain "
 "info, nor add one to the domain. " "We cannot work reliably without it.\n"
)) )
	  "info, nor add one to the domain. "(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4903", __FUNCTION__
 )) && (dbgtext ("pdb_init_ldapsam: WARNING: Could not get domain "
 "info, nor add one to the domain. " "We cannot work reliably without it.\n"
)) )
	  "We cannot work reliably without it.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4903", __FUNCTION__
 )) && (dbgtext ("pdb_init_ldapsam: WARNING: Could not get domain "
 "info, nor add one to the domain. " "We cannot work reliably without it.\n"
)) );
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO((NTSTATUS) { 0xc00000da });
}

entry = ldap_first_entry(priv2ld(ipasam_state), result);
if (entry == NULL((void*)0)) {
DEBUG(0, ("pdb_init_ipasam: Could not get domain info "(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4910", __FUNCTION__
 )) && (dbgtext ("pdb_init_ipasam: Could not get domain info "
 "entry\n")) )
	  "entry\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4910", __FUNCTION__
 )) && (dbgtext ("pdb_init_ipasam: Could not get domain info "
 "entry\n")) );
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

dn = get_dn(ipasam_state, priv2ld(ipasam_state), entry);
if (dn == NULL((void*)0)) {
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

ipasam_state->domain_dn = smb_xstrdup(dn);
talloc_free(dn)_talloc_free(dn, "ipa_sam.c" ":" "4922");

ipasam_state->flat_name = get_single_attribute(ipasam_state,
				       priv2ld(ipasam_state),
				       entry,
				       LDAP_ATTRIBUTE_FLAT_NAME"ipaNTFlatName");
if (ipasam_state->flat_name == NULL((void*)0)) {
DEBUG(0, ("Missing mandatory attribute %s.\n",(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4930", __FUNCTION__
 )) && (dbgtext ("Missing mandatory attribute %s.\n",
 "ipaNTFlatName")) )
	  LDAP_ATTRIBUTE_FLAT_NAME))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4930", __FUNCTION__
 )) && (dbgtext ("Missing mandatory attribute %s.\n",
 "ipaNTFlatName")) );
ldap_msgfree(result);
return NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
}

err = sss_idmap_init(idmap_talloc, ipasam_state,
	     idmap_talloc_free,
	     &ipasam_state->idmap_ctx);
if (err != IDMAP_SUCCESS) {
DEBUG(1, ("Failed to setup idmap context.\n"))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4939", __FUNCTION__
 )) && (dbgtext ("Failed to setup idmap context.\n"))
 );
ldap_msgfree(result);
return NT_STATUS_UNSUCCESSFUL((NTSTATUS) { 0xc0000001 });
}

fallback_group_sid = get_fallback_group_sid(ipasam_state,
			ipasam_state->ldap_state,
			ipasam_state->idmap_ctx,
			result,
			&fallback_group_gid_str);
if (fallback_group_sid == NULL((void*)0)) {
DEBUG(0, ("Cannot find SID of fallback group.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4950", __FUNCTION__
 )) && (dbgtext ("Cannot find SID of fallback group.\n"
)) );
ldap_msgfree(result);
return NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
}
sid_copy(&ipasam_state->fallback_primary_group, fallback_group_sid);
talloc_free(fallback_group_sid)_talloc_free(fallback_group_sid, "ipa_sam.c" ":" "4955");

if (fallback_group_gid_str == NULL((void*)0)) {
DEBUG(0, ("Cannot find gidNumber of fallback group.\n"))(void)( ((0) <= 1000) && (debuglevel_get_class(0) >=
 (0)) && (dbghdrclass( 0, 0, "ipa_sam.c" ":" "4958", __FUNCTION__
 )) && (dbgtext ("Cannot find gidNumber of fallback group.\n"
)) );
ldap_msgfree(result);
return NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
}
ipasam_state->fallback_primary_group_gid_str = fallback_group_gid_str;

domain_sid_string = get_single_attribute(ipasam_state,
				 priv2ld(ipasam_state),
				 entry,
				 LDAP_ATTRIBUTE_SID"ipaNTSecurityIdentifier");

if (domain_sid_string) {
err = sss_idmap_sid_to_smb_sid(ipasam_state->idmap_ctx,
			       domain_sid_string,
			       &ldap_domain_sid);
if (err != IDMAP_SUCCESS) {
	DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4975", __FUNCTION__
 )) && (dbgtext ("pdb_init_ldapsam: SID [%s] could not be "
 "read as a valid SID\n", domain_sid_string)) )
		  "read as a valid SID\n", domain_sid_string))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "4975", __FUNCTION__
 )) && (dbgtext ("pdb_init_ldapsam: SID [%s] could not be "
 "read as a valid SID\n", domain_sid_string)) );
	ldap_msgfree(result);
	TALLOC_FREE(domain_sid_string)do { if (domain_sid_string != ((void*)0)) { _talloc_free(domain_sid_string
, "ipa_sam.c" ":" "4977"); domain_sid_string=((void*)0); } } while
(0);
	return NT_STATUS_INVALID_PARAMETER((NTSTATUS) { 0xc000000d });
}
sid_copy(&ipasam_state->domain_sid, ldap_domain_sid);
talloc_free(ldap_domain_sid)_talloc_free(ldap_domain_sid, "ipa_sam.c" ":" "4981");
talloc_free(domain_sid_string)_talloc_free(domain_sid_string, "ipa_sam.c" ":" "4982");

status = save_sid_to_secret(ipasam_state);
if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
	ldap_msgfree(result);
	return status;
}
}

ldap_msgfree(result);

status = ipasam_get_enctypes(ipasam_state,
		     &enctypes);

if (!NT_STATUS_IS_OK(status)((((status).v) == 0))) {
enctypes = KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96( 0x00000008 ) |
	   KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96( 0x00000010 );
if (!ipasam_state->fips_enabled) {
	enctypes |= KERB_ENCTYPE_RC4_HMAC_MD5( 0x00000004 );
}
}

ipasam_state->supported_enctypes = enctypes;

(*pdb_method)->getsampwnam = ipasam_getsampwnam;
(*pdb_method)->getsampwsid = ipasam_getsampwsid;
(*pdb_method)->search_users = ipasam_search_users;
(*pdb_method)->search_groups = ipasam_search_groups;
(*pdb_method)->search_aliases = ipasam_search_aliases;
(*pdb_method)->lookup_rids = ldapsam_lookup_rids;
(*pdb_method)->sid_to_id = ldapsam_sid_to_id;
5013#if PASSDB_INTERFACE_VERSION25 >= 24
5014/* Since version 24, uid_to_sid() and gid_to_sid() were removed in favor of id_to_sid() */
(*pdb_method)->id_to_sid = ipasam_id_to_sid;
5016#else
(*pdb_method)->uid_to_sid = ipasam_uid_to_sid;
(*pdb_method)->gid_to_sid = ipasam_gid_to_sid;
5019#endif

(*pdb_method)->capabilities = pdb_ipasam_capabilities;
(*pdb_method)->get_domain_info = pdb_ipasam_get_domain_info;

(*pdb_method)->get_trusteddom_pw = ipasam_get_trusteddom_pw;
(*pdb_method)->set_trusteddom_pw = ipasam_set_trusteddom_pw;
(*pdb_method)->del_trusteddom_pw = ipasam_del_trusteddom_pw;
(*pdb_method)->enum_trusteddoms = ipasam_enum_trusteddoms;

(*pdb_method)->get_trusted_domain = ipasam_get_trusted_domain;
(*pdb_method)->get_trusted_domain_by_sid = ipasam_get_trusted_domain_by_sid;
(*pdb_method)->set_trusted_domain = ipasam_set_trusted_domain;
(*pdb_method)->del_trusted_domain = ipasam_del_trusted_domain;
(*pdb_method)->enum_trusted_domains = ipasam_enum_trusted_domains;
5034#ifdef HAVE_PDB_ENUM_UPN_SUFFIXES1
(*pdb_method)->enum_upn_suffixes = ipasam_enum_upn_suffixes;
DEBUG(1, ("pdb_init_ipasam: support for pdb_enum_upn_suffixes "(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "5037", __FUNCTION__
 )) && (dbgtext ("pdb_init_ipasam: support for pdb_enum_upn_suffixes "
 "enabled for domain %s\n", ipasam_state->domain_name)) )
  "enabled for domain %s\n", ipasam_state->domain_name))(void)( ((1) <= 1000) && (debuglevel_get_class(0) >=
 (1)) && (dbghdrclass( 1, 0, "ipa_sam.c" ":" "5037", __FUNCTION__
 )) && (dbgtext ("pdb_init_ipasam: support for pdb_enum_upn_suffixes "
 "enabled for domain %s\n", ipasam_state->domain_name)) );
5038#endif

return NT_STATUS_OK((NTSTATUS) { 0x0 });
5041}

5043NTSTATUS samba_module_init(void)
5044{
return smb_register_passdb(PASSDB_INTERFACE_VERSION25, "ipasam",
		   pdb_init_ipasam);
5047}

5049NTSTATUS samba_init_module(void)
5050{
return smb_register_passdb(PASSDB_INTERFACE_VERSION25, "ipasam",
		   pdb_init_ipasam);
5053}