winbindd: load the trusted domains on a DC already in init_domain_list()

We should do that in the parent as early as possible.
Similar to our primary domain, which is also a direct trust.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index 9c8e39f79c151b746281a6e0fe1cf75a6bba0c55..2f145cdd48afb7567586405996ece47ca022acb3 100644 (file)
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -30,6 +30,7 @@
 #include "passdb.h"
 #include "source4/lib/messaging/messaging.h"
 #include "librpc/gen_ndr/ndr_lsa.h"
+#include "librpc/gen_ndr/ndr_drsblobs.h"
 #include "auth/credentials/credentials.h"
 #include "libsmb/samlogon_cache.h"
 
@@ -1035,6 +1036,180 @@ bool init_domain_list(void)
 
        }
 
+       if (IS_DC && (pdb_capabilities() & PDB_CAP_TRUSTED_DOMAINS_EX)) {
+               uint32_t num_domains = 0;
+               struct pdb_trusted_domain **domains = NULL;
+               uint32_t i;
+
+               status = pdb_enum_trusted_domains(talloc_tos(), &num_domains, &domains);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DBG_ERR("pdb_enum_trusted_domains() failed - %s\n",
+                               nt_errstr(status));
+                       return false;
+               }
+
+               for (i = 0; i < num_domains; i++) {
+                       enum netr_SchannelType sec_chan_type = SEC_CHAN_DOMAIN;
+                       uint32_t trust_flags = 0;
+
+                       if (domains[i]->trust_type == LSA_TRUST_TYPE_UPLEVEL) {
+                               sec_chan_type = SEC_CHAN_DNS_DOMAIN;
+                       }
+
+                       if (!(domains[i]->trust_direction & LSA_TRUST_DIRECTION_OUTBOUND)) {
+                               sec_chan_type = SEC_CHAN_NULL;
+                       }
+
+                       if (domains[i]->trust_direction & LSA_TRUST_DIRECTION_INBOUND) {
+                               trust_flags |= NETR_TRUST_FLAG_INBOUND;
+                       }
+                       if (domains[i]->trust_direction & LSA_TRUST_DIRECTION_OUTBOUND) {
+                               trust_flags |= NETR_TRUST_FLAG_OUTBOUND;
+                       }
+                       if (domains[i]->trust_attributes & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST) {
+                               trust_flags |= NETR_TRUST_FLAG_IN_FOREST;
+                       }
+
+                       status = add_trusted_domain(domains[i]->netbios_name,
+                                                   domains[i]->domain_name,
+                                                   &domains[i]->security_identifier,
+                                                   domains[i]->trust_type,
+                                                   trust_flags,
+                                                   domains[i]->trust_attributes,
+                                                   sec_chan_type,
+                                                   &domain);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               DBG_NOTICE("add_trusted_domain returned %s\n",
+                                          nt_errstr(status));
+                               return false;
+                       }
+
+                       if (domains[i]->trust_type == LSA_TRUST_TYPE_UPLEVEL) {
+                               domain->active_directory = true;
+                       }
+                       domain->domain_type = domains[i]->trust_type;
+                       domain->domain_trust_attribs = domains[i]->trust_attributes;
+
+                       if (sec_chan_type != SEC_CHAN_NULL) {
+                               /* Even in the parent winbindd we'll need to
+                                  talk to the DC, so try and see if we can
+                                  contact it. Theoretically this isn't neccessary
+                                  as the init_dc_connection() in init_child_recv()
+                                  will do this, but we can start detecting the DC
+                                  early here. */
+                               set_domain_online_request(domain);
+                       }
+               }
+
+               for (i = 0; i < num_domains; i++) {
+                       struct ForestTrustInfo fti;
+                       uint32_t fi;
+                       enum ndr_err_code ndr_err;
+
+                       if (domains[i]->trust_type != LSA_TRUST_TYPE_UPLEVEL) {
+                               continue;
+                       }
+
+                       if (!(domains[i]->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)) {
+                               continue;
+                       }
+
+                       if (domains[i]->trust_forest_trust_info.length == 0) {
+                               continue;
+                       }
+
+                       ndr_err = ndr_pull_struct_blob_all(
+                                       &domains[i]->trust_forest_trust_info,
+                                       talloc_tos(), &fti,
+                                       (ndr_pull_flags_fn_t)ndr_pull_ForestTrustInfo);
+                       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                               DBG_ERR("ndr_pull_ForestTrustInfo(%s) - %s\n",
+                                       domains[i]->netbios_name,
+                                       ndr_map_error2string(ndr_err));
+                               return false;
+                       }
+
+                       for (fi = 0; fi < fti.count; fi++) {
+                               struct ForestTrustInfoRecord *rec =
+                                       &fti.records[fi].record;
+                               struct ForestTrustDataDomainInfo *drec = NULL;
+
+                               if (rec->type != FOREST_TRUST_DOMAIN_INFO) {
+                                       continue;
+                               }
+                               drec = &rec->data.info;
+
+                               if (rec->flags & LSA_NB_DISABLED_MASK) {
+                                       continue;
+                               }
+
+                               if (rec->flags & LSA_SID_DISABLED_MASK) {
+                                       continue;
+                               }
+
+                               /*
+                                * TODO:
+                                * also try to find a matching
+                                * LSA_TLN_DISABLED_MASK ???
+                                */
+
+                               domain = find_domain_from_name_noinit(drec->netbios_name.string);
+                               if (domain != NULL) {
+                                       continue;
+                               }
+
+                               status = add_trusted_domain(drec->netbios_name.string,
+                                                           drec->dns_name.string,
+                                                           &drec->sid,
+                                                           LSA_TRUST_TYPE_UPLEVEL,
+                                                           NETR_TRUST_FLAG_OUTBOUND,
+                                                           0,
+                                                           SEC_CHAN_NULL,
+                                                           &domain);
+                               if (!NT_STATUS_IS_OK(status)) {
+                                       DBG_NOTICE("add_trusted_domain returned %s\n",
+                                                  nt_errstr(status));
+                                       return false;
+                               }
+                       }
+               }
+       } else if (IS_DC) {
+               uint32_t num_domains = 0;
+               struct trustdom_info **domains = NULL;
+               uint32_t i;
+
+               status = pdb_enum_trusteddoms(talloc_tos(), &num_domains, &domains);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DBG_ERR("pdb_enum_trusteddoms() failed - %s\n",
+                               nt_errstr(status));
+                       return false;
+               }
+
+               for (i = 0; i < num_domains; i++) {
+                       status = add_trusted_domain(domains[i]->name,
+                                                   NULL,
+                                                   &domains[i]->sid,
+                                                   LSA_TRUST_TYPE_DOWNLEVEL,
+                                                   NETR_TRUST_FLAG_OUTBOUND,
+                                                   0,
+                                                   SEC_CHAN_DOMAIN,
+                                                   &domain);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               DBG_NOTICE("add_trusted_domain returned %s\n",
+                                          nt_errstr(status));
+                               return false;
+                       }
+
+                       /* Even in the parent winbindd we'll need to
+                          talk to the DC, so try and see if we can
+                          contact it. Theoretically this isn't neccessary
+                          as the init_dc_connection() in init_child_recv()
+                          will do this, but we can start detecting the DC
+                          early here. */
+                       set_domain_online_request(domain);
+               }
+       }
+
        status = imessaging_register(winbind_imessaging_context(), NULL,
                                     MSG_WINBIND_NEW_TRUSTED_DOMAIN,
                                     wb_imsg_new_trusted_domain);