source3/winbindd/wb_lookupsids.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    async lookupsids
   4    Copyright (C) Volker Lendecke 2011
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "librpc/gen_ndr/ndr_winbind_c.h"
  23 #include "../libcli/security/security.h"
  24 #include "passdb/machine_sid.h"
  25
  26 struct wb_lookupsids_domain {
  27         struct dom_sid sid;
  28         struct winbindd_domain *domain;
  29
  30         /*
  31          * Array of sids to be passed into wbint_LookupSids. Preallocated with
  32          * num_sids.
  33          */
  34         struct lsa_SidArray sids;
  35
  36         /*
  37          * Indexes into wb_lookupsids_state->sids and thus
  38          * wb_lookupsids_state->res_names. Preallocated with num_sids.
  39          */
  40         uint32_t *sid_indexes;
  41 };
  42
  43 struct wb_translated_name {
  44         const char *domain_name;
  45         const char *name;
  46         enum lsa_SidType type;
  47 };
  48
  49 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
  50         const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
  51         struct wb_lookupsids_domain **domains, uint32_t num_sids);
  52
  53 struct wb_lookupsids_state {
  54         struct tevent_context *ev;
  55
  56         /*
  57          * SIDs passed in
  58          */
  59         struct dom_sid *sids;
  60         uint32_t num_sids;
  61
  62         /*
  63          * The domains we're using for bulk lookup via wbint_LookupRids or
  64          * wbint_LookupSids. We expect very few domains, so we do a
  65          * talloc_realloc and rely on talloc_array_length.
  66          */
  67         struct wb_lookupsids_domain *domains;
  68         uint32_t domains_done;
  69
  70         /*
  71          * These SIDs are looked up individually via
  72          * wbint_LookupSid. Preallocated with num_sids.
  73          */
  74         uint32_t *single_sids;
  75         /* Pointer into the "domains" array above*/
  76         struct wb_lookupsids_domain **single_domains;
  77         uint32_t num_single_sids;
  78         uint32_t single_sids_done;
  79
  80         /*
  81          * Intermediate store for wbint_LookupRids to passdb. These are
  82          * spliced into res_domains/res_names in wb_lookupsids_move_name.
  83          */
  84         struct wbint_RidArray rids;
  85         const char *domain_name;
  86         struct wbint_Principals rid_names;
  87
  88         /*
  89          * Intermediate results for wbint_LookupSids. These results are
  90          * spliced into res_domains/res_names in wb_lookupsids_move_name.
  91          */
  92         struct lsa_RefDomainList tmp_domains;
  93         struct lsa_TransNameArray tmp_names;
  94
  95         /*
  96          * Results
  97          */
  98         struct lsa_RefDomainList *res_domains;
  99         /*
 100          * Indexed as "sids" in this structure
 101          */
 102         struct lsa_TransNameArray *res_names;
 103 };
 104
 105 static bool wb_lookupsids_next(struct tevent_req *req,
 106                                struct wb_lookupsids_state *state);
 107 static void wb_lookupsids_single_done(struct tevent_req *subreq);
 108 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq);
 109 static void wb_lookupsids_done(struct tevent_req *subreq);
 110
 111 struct tevent_req *wb_lookupsids_send(TALLOC_CTX *mem_ctx,
 112                                       struct tevent_context *ev,
 113                                       struct dom_sid *sids,
 114                                       uint32_t num_sids)
 115 {
 116         struct tevent_req *req;
 117         struct wb_lookupsids_state *state;
 118         uint32_t i;
 119
 120         req = tevent_req_create(mem_ctx, &state, struct wb_lookupsids_state);
 121         if (req == NULL) {
 122                 return NULL;
 123         }
 124         state->ev = ev;
 125         state->sids = sids;
 126         state->num_sids = num_sids;
 127
 128         state->single_sids = talloc_array(state, uint32_t, num_sids);
 129         if (tevent_req_nomem(state->single_sids, req)) {
 130                 return tevent_req_post(req, ev);
 131         }
 132         state->single_domains = talloc_zero_array(state,
 133                                                   struct wb_lookupsids_domain *,
 134                                                   num_sids);
 135         if (tevent_req_nomem(state->single_domains, req)) {
 136                 return tevent_req_post(req, ev);
 137         }
 138
 139         state->res_domains = talloc_zero(state, struct lsa_RefDomainList);
 140         if (tevent_req_nomem(state->res_domains, req)) {
 141                 return tevent_req_post(req, ev);
 142         }
 143         state->res_domains->domains = talloc_array(
 144                 state->res_domains, struct lsa_DomainInfo, num_sids);
 145         if (tevent_req_nomem(state->res_domains->domains, req)) {
 146                 return tevent_req_post(req, ev);
 147         }
 148
 149         state->res_names = talloc_zero(state, struct lsa_TransNameArray);
 150         if (tevent_req_nomem(state->res_names, req)) {
 151                 return tevent_req_post(req, ev);
 152         }
 153         state->res_names->names = talloc_array(
 154                 state->res_names, struct lsa_TranslatedName, num_sids);
 155         if (tevent_req_nomem(state->res_names->names, req)) {
 156                 return tevent_req_post(req, ev);
 157         }
 158
 159         if (num_sids == 0) {
 160                 tevent_req_done(req);
 161                 return tevent_req_post(req, ev);
 162         }
 163
 164         for (i=0; i<num_sids; i++) {
 165                 struct wb_lookupsids_domain *d;
 166
 167                 d = wb_lookupsids_get_domain(&sids[i], state, &state->domains,
 168                                              num_sids);
 169                 if (d != NULL) {
 170                         d->sids.sids[d->sids.num_sids].sid = &sids[i];
 171                         d->sid_indexes[d->sids.num_sids] = i;
 172                         d->sids.num_sids += 1;
 173                 } else {
 174                         state->single_sids[state->num_single_sids] = i;
 175                         state->num_single_sids += 1;
 176                 }
 177         }
 178
 179         if (!wb_lookupsids_next(req, state)) {
 180                 return tevent_req_post(req, ev);
 181         }
 182         return req;
 183 }
 184
 185 static bool wb_lookupsids_next(struct tevent_req *req,
 186                                struct wb_lookupsids_state *state)
 187 {
 188         struct tevent_req *subreq;
 189
 190         if (state->domains_done < talloc_array_length(state->domains)) {
 191                 struct wb_lookupsids_domain *d;
 192                 uint32_t i;
 193
 194                 d = &state->domains[state->domains_done];
 195
 196                 if (sid_check_is_our_sam(&d->sid)) {
 197                         state->rids.num_rids = d->sids.num_sids;
 198                         state->rids.rids = talloc_array(state, uint32_t,
 199                                                         state->rids.num_rids);
 200                         if (tevent_req_nomem(state->rids.rids, req)) {
 201                                 return false;
 202                         }
 203                         for (i=0; i<state->rids.num_rids; i++) {
 204                                 sid_peek_rid(d->sids.sids[i].sid,
 205                                              &state->rids.rids[i]);
 206                         }
 207                         subreq = dcerpc_wbint_LookupRids_send(
 208                                 state, state->ev, dom_child_handle(d->domain),
 209                                 &d->sid, &state->rids, &state->domain_name,
 210                                 &state->rid_names);
 211                         if (tevent_req_nomem(subreq, req)) {
 212                                 return false;
 213                         }
 214                         tevent_req_set_callback(
 215                                 subreq, wb_lookupsids_lookuprids_done, req);
 216                         return true;
 217                 }
 218
 219                 subreq = dcerpc_wbint_LookupSids_send(
 220                         state, state->ev, dom_child_handle(d->domain),
 221                         &d->sids, &state->tmp_domains,  &state->tmp_names);
 222                 if (tevent_req_nomem(subreq, req)) {
 223                         return false;
 224                 }
 225                 tevent_req_set_callback(subreq, wb_lookupsids_done, req);
 226                 return true;
 227         }
 228
 229         if (state->single_sids_done < state->num_single_sids) {
 230                 uint32_t sid_idx;
 231                 const struct dom_sid *sid;
 232
 233                 sid_idx = state->single_sids[state->single_sids_done];
 234                 sid = &state->sids[sid_idx];
 235
 236                 subreq = wb_lookupsid_send(state, state->ev, sid);
 237                 if (tevent_req_nomem(subreq, req)) {
 238                         return false;
 239                 }
 240                 tevent_req_set_callback(subreq, wb_lookupsids_single_done,
 241                                         req);
 242                 return true;
 243         }
 244
 245         tevent_req_done(req);
 246         return false;
 247 }
 248
 249 /*
 250  * Decide whether to do bulk lookupsids. We have optimizations for
 251  * passdb via lookuprids and to remote DCs via lookupsids.
 252  */
 253
 254 static bool wb_lookupsids_bulk(const struct dom_sid *sid)
 255 {
 256         if (sid->num_auths != 5) {
 257                 /*
 258                  * Only do "S-1-5-21-x-y-z-rid" domains via bulk
 259                  * lookup
 260                  */
 261                 DEBUG(10, ("No bulk setup for SID %s with %d subauths\n",
 262                            sid_string_dbg(sid), sid->num_auths));
 263                 return false;
 264         }
 265
 266         if (sid_check_is_in_our_sam(sid)) {
 267                 /*
 268                  * Passdb lookup via lookuprids
 269                  */
 270                 DEBUG(10, ("%s is in our domain\n", sid_string_tos(sid)));
 271                 return true;
 272         }
 273
 274         if ((lp_server_role() == ROLE_DOMAIN_PDC) ||
 275             (lp_server_role() == ROLE_DOMAIN_BDC)) {
 276                 /*
 277                  * Bulk lookups to trusted DCs
 278                  */
 279                 return (find_domain_from_sid_noinit(sid) != NULL);
 280         }
 281
 282         if (lp_server_role() != ROLE_DOMAIN_MEMBER) {
 283                 /*
 284                  * Don't do bulk lookups as standalone, the only bulk
 285                  * lookup left is for domain members.
 286                  */
 287                 return false;
 288         }
 289
 290         if (sid_check_is_in_unix_groups(sid) ||
 291             sid_check_is_unix_groups(sid) ||
 292             sid_check_is_in_unix_users(sid) ||
 293             sid_check_is_unix_users(sid) ||
 294             sid_check_is_in_builtin(sid) ||
 295             sid_check_is_builtin(sid)) {
 296                 /*
 297                  * These are locally done piece by piece anyway, no
 298                  * need for bulk optimizations.
 299                  */
 300                 return false;
 301         }
 302
 303         /*
 304          * All other SIDs are sent to the DC we're connected to as
 305          * member via a single lsa_lookupsids call.
 306          */
 307         return true;
 308 }
 309
 310 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
 311         const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
 312         struct wb_lookupsids_domain **pdomains, uint32_t num_sids)
 313 {
 314         struct wb_lookupsids_domain *domains, *domain;
 315         struct winbindd_domain *wb_domain;
 316         uint32_t i, num_domains;
 317
 318         if (!wb_lookupsids_bulk(sid)) {
 319                 return NULL;
 320         }
 321
 322         domains = *pdomains;
 323         num_domains = talloc_array_length(domains);
 324
 325         for (i=0; i<num_domains; i++) {
 326                 if (dom_sid_compare_domain(sid, &domains[i].sid) == 0) {
 327                         return &domains[i];
 328                 }
 329         }
 330
 331         wb_domain = find_lookup_domain_from_sid(sid);
 332         if (wb_domain == NULL) {
 333                 return NULL;
 334         }
 335
 336         domains = talloc_realloc(
 337                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains+1);
 338         if (domains == NULL) {
 339                 return NULL;
 340         }
 341         *pdomains = domains;
 342
 343         domain = &domains[num_domains];
 344         sid_copy(&domain->sid, sid);
 345         sid_split_rid(&domain->sid, NULL);
 346         domain->domain = wb_domain;
 347
 348         domain->sids.sids = talloc_array(domains, struct lsa_SidPtr, num_sids);
 349         if (domains->sids.sids == NULL) {
 350                 goto fail;
 351         }
 352         domain->sids.num_sids = 0;
 353
 354         domain->sid_indexes = talloc_array(domains, uint32_t, num_sids);
 355         if (domain->sid_indexes == NULL) {
 356                 TALLOC_FREE(domain->sids.sids);
 357                 goto fail;
 358         }
 359         return domain;
 360
 361 fail:
 362         /*
 363          * Realloc to the state it was in before
 364          */
 365         *pdomains = talloc_realloc(
 366                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains);
 367         return NULL;
 368 }
 369
 370 static bool wb_lookupsids_find_dom_idx(struct lsa_DomainInfo *domain,
 371                                        struct lsa_RefDomainList *list,
 372                                        uint32_t *idx)
 373 {
 374         uint32_t i;
 375         struct lsa_DomainInfo *new_domain;
 376
 377         for (i=0; i<list->count; i++) {
 378                 if (dom_sid_equal(domain->sid, list->domains[i].sid)) {
 379                         *idx = i;
 380                         return true;
 381                 }
 382         }
 383
 384         new_domain = &list->domains[list->count];
 385
 386         new_domain->name.string = talloc_strdup(
 387                 list->domains, domain->name.string);
 388         if (new_domain->name.string == NULL) {
 389                 return false;
 390         }
 391
 392         new_domain->sid = dom_sid_dup(list->domains, domain->sid);
 393         if (new_domain->sid == NULL) {
 394                 return false;
 395         }
 396
 397         *idx = list->count;
 398         list->count += 1;
 399         return true;
 400 }
 401
 402 static bool wb_lookupsids_move_name(struct lsa_RefDomainList *src_domains,
 403                                     struct lsa_TranslatedName *src_name,
 404                                     struct lsa_RefDomainList *dst_domains,
 405                                     struct lsa_TransNameArray *dst_names,
 406                                     uint32_t dst_name_index)
 407 {
 408         struct lsa_TranslatedName *dst_name;
 409         struct lsa_DomainInfo *src_domain;
 410         uint32_t src_domain_index, dst_domain_index;
 411
 412         src_domain_index = src_name->sid_index;
 413         if (src_domain_index >= src_domains->count) {
 414                 return false;
 415         }
 416         src_domain = &src_domains->domains[src_domain_index];
 417
 418         if (!wb_lookupsids_find_dom_idx(
 419                     src_domain, dst_domains, &dst_domain_index)) {
 420                 return false;
 421         }
 422
 423         dst_name = &dst_names->names[dst_name_index];
 424
 425         dst_name->sid_type = src_name->sid_type;
 426         dst_name->name.string = talloc_move(dst_names->names,
 427                                             &src_name->name.string);
 428         dst_name->sid_index = dst_domain_index;
 429         dst_names->count += 1;
 430
 431         return true;
 432 }
 433
 434 static void wb_lookupsids_done(struct tevent_req *subreq)
 435 {
 436         struct tevent_req *req = tevent_req_callback_data(
 437                 subreq, struct tevent_req);
 438         struct wb_lookupsids_state *state = tevent_req_data(
 439                 req, struct wb_lookupsids_state);
 440         struct wb_lookupsids_domain *d;
 441         uint32_t i;
 442         bool fallback = false;
 443
 444         NTSTATUS status, result;
 445
 446         status = dcerpc_wbint_LookupSids_recv(subreq, state, &result);
 447         TALLOC_FREE(subreq);
 448         if (tevent_req_nterror(req, status)) {
 449                 return;
 450         }
 451
 452         d = &state->domains[state->domains_done];
 453
 454         if (NT_STATUS_IS_ERR(result)) {
 455                 fallback = true;
 456         } else if (state->tmp_names.count != d->sids.num_sids) {
 457                 fallback = true;
 458         }
 459
 460         if (fallback) {
 461                 for (i=0; i < d->sids.num_sids; i++) {
 462                         uint32_t res_sid_index = d->sid_indexes[i];
 463
 464                         state->single_sids[state->num_single_sids] =
 465                                 res_sid_index;
 466                         state->single_domains[state->num_single_sids] = d;
 467                         state->num_single_sids += 1;
 468                 }
 469                 state->domains_done += 1;
 470                 wb_lookupsids_next(req, state);
 471                 return;
 472         }
 473
 474         /*
 475          * Look at the individual states in the translated names.
 476          */
 477
 478         for (i=0; i<state->tmp_names.count; i++) {
 479
 480                 uint32_t res_sid_index = d->sid_indexes[i];
 481
 482                 if (state->tmp_names.names[i].sid_type == SID_NAME_UNKNOWN) {
 483                         /*
 484                          * Make unknown SIDs go through
 485                          * wb_lookupsid. This retries the forest root.
 486                          */
 487                         state->single_sids[state->num_single_sids] =
 488                                 res_sid_index;
 489                         state->num_single_sids += 1;
 490                         continue;
 491                 }
 492                 if (!wb_lookupsids_move_name(
 493                             &state->tmp_domains, &state->tmp_names.names[i],
 494                             state->res_domains, state->res_names,
 495                             res_sid_index)) {
 496                         tevent_req_oom(req);
 497                         return;
 498                 }
 499         }
 500         state->domains_done += 1;
 501         wb_lookupsids_next(req, state);
 502 }
 503
 504 static void wb_lookupsids_single_done(struct tevent_req *subreq)
 505 {
 506         struct tevent_req *req = tevent_req_callback_data(
 507                 subreq, struct tevent_req);
 508         struct wb_lookupsids_state *state = tevent_req_data(
 509                 req, struct wb_lookupsids_state);
 510         const char *domain_name, *name;
 511         enum lsa_SidType type;
 512         uint32_t res_sid_index;
 513         uint32_t src_rid;
 514
 515         struct dom_sid src_domain_sid;
 516         struct lsa_DomainInfo src_domain;
 517         struct lsa_RefDomainList src_domains;
 518         struct lsa_TranslatedName src_name;
 519
 520         NTSTATUS status;
 521
 522         status = wb_lookupsid_recv(subreq, talloc_tos(), &type,
 523                                    &domain_name, &name);
 524         TALLOC_FREE(subreq);
 525         if (!NT_STATUS_IS_OK(status)) {
 526                 struct wb_lookupsids_domain *wb_domain;
 527                 const char *tmpname;
 528
 529                 type = SID_NAME_UNKNOWN;
 530
 531                 wb_domain = state->single_domains[state->single_sids_done];
 532                 if (wb_domain != NULL) {
 533                         /*
 534                          * If the lookupsid failed because the rid not
 535                          * found in a domain and we have a reference
 536                          * to the lookup domain, use the name from
 537                          * there.
 538                          *
 539                          * Callers like sid2xid will use the domain
 540                          * name in the idmap backend to figure out
 541                          * which domain to use in processing.
 542                          */
 543                         tmpname = wb_domain->domain->name;
 544                 } else {
 545                         tmpname = "";
 546                 }
 547                 domain_name = talloc_strdup(talloc_tos(), tmpname);
 548                 if (tevent_req_nomem(domain_name, req)) {
 549                         return;
 550                 }
 551                 name = talloc_strdup(talloc_tos(), "");
 552                 if (tevent_req_nomem(name, req)) {
 553                         return;
 554                 }
 555         }
 556
 557         /*
 558          * Fake up structs for wb_lookupsids_move_name
 559          */
 560         res_sid_index = state->single_sids[state->single_sids_done];
 561
 562         sid_copy(&src_domain_sid, &state->sids[res_sid_index]);
 563         sid_split_rid(&src_domain_sid, &src_rid);
 564         src_domain.name.string = domain_name;
 565         src_domain.sid = &src_domain_sid;
 566
 567         src_domains.count = 1;
 568         src_domains.domains = &src_domain;
 569
 570         src_name.sid_type = type;
 571         src_name.name.string = name;
 572         src_name.sid_index = 0;
 573
 574         if (!wb_lookupsids_move_name(
 575                     &src_domains, &src_name,
 576                     state->res_domains, state->res_names,
 577                     res_sid_index)) {
 578                 tevent_req_oom(req);
 579                 return;
 580         }
 581         state->single_sids_done += 1;
 582         wb_lookupsids_next(req, state);
 583 }
 584
 585 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq)
 586 {
 587         struct tevent_req *req = tevent_req_callback_data(
 588                 subreq, struct tevent_req);
 589         struct wb_lookupsids_state *state = tevent_req_data(
 590                 req, struct wb_lookupsids_state);
 591         struct dom_sid src_domain_sid;
 592         struct lsa_DomainInfo src_domain;
 593         struct lsa_RefDomainList src_domains;
 594         NTSTATUS status, result;
 595         struct wb_lookupsids_domain *d;
 596         uint32_t i;
 597         bool fallback = false;
 598
 599         status = dcerpc_wbint_LookupRids_recv(subreq, state, &result);
 600         TALLOC_FREE(subreq);
 601         if (tevent_req_nterror(req, status)) {
 602                 return;
 603         }
 604
 605         d = &state->domains[state->domains_done];
 606
 607         if (NT_STATUS_IS_ERR(result)) {
 608                 fallback = true;
 609         } else if (state->rid_names.num_principals != d->sids.num_sids) {
 610                 fallback = true;
 611         }
 612
 613         if (fallback) {
 614                 for (i=0; i < d->sids.num_sids; i++) {
 615                         uint32_t res_sid_index = d->sid_indexes[i];
 616
 617                         state->single_sids[state->num_single_sids] =
 618                                 res_sid_index;
 619                         state->num_single_sids += 1;
 620                 }
 621                 state->domains_done += 1;
 622                 wb_lookupsids_next(req, state);
 623                 return;
 624         }
 625
 626         /*
 627          * Look at the individual states in the translated names.
 628          */
 629
 630         sid_copy(&src_domain_sid, get_global_sam_sid());
 631         src_domain.name.string = get_global_sam_name();
 632         src_domain.sid = &src_domain_sid;
 633         src_domains.count = 1;
 634         src_domains.domains = &src_domain;
 635
 636         for (i=0; i<state->rid_names.num_principals; i++) {
 637                 struct lsa_TranslatedName src_name;
 638                 uint32_t res_sid_index;
 639
 640                 /*
 641                  * Fake up structs for wb_lookupsids_move_name
 642                  */
 643                 res_sid_index = d->sid_indexes[i];
 644
 645                 src_name.sid_type = state->rid_names.principals[i].type;
 646                 src_name.name.string = state->rid_names.principals[i].name;
 647                 src_name.sid_index = 0;
 648
 649                 if (!wb_lookupsids_move_name(
 650                             &src_domains, &src_name,
 651                             state->res_domains, state->res_names,
 652                             res_sid_index)) {
 653                         tevent_req_oom(req);
 654                         return;
 655                 }
 656         }
 657
 658         state->domains_done += 1;
 659         wb_lookupsids_next(req, state);
 660 }
 661
 662 NTSTATUS wb_lookupsids_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 663                             struct lsa_RefDomainList **domains,
 664                             struct lsa_TransNameArray **names)
 665 {
 666         struct wb_lookupsids_state *state = tevent_req_data(
 667                 req, struct wb_lookupsids_state);
 668         NTSTATUS status;
 669
 670         if (tevent_req_is_nterror(req, &status)) {
 671                 return status;
 672         }
 673
 674         /*
 675          * The returned names need to match the given sids,
 676          * if not we have a bug in the code!
 677          *
 678          */
 679         if (state->res_names->count != state->num_sids) {
 680                 DEBUG(0, ("res_names->count = %d, expected %d\n",
 681                           state->res_names->count, state->num_sids));
 682                 return NT_STATUS_INTERNAL_ERROR;
 683         }
 684
 685         /*
 686          * Not strictly needed, but it might make debugging in the callers
 687          * easier in future, if the talloc_array_length() returns the
 688          * expected result...
 689          */
 690         state->res_domains->domains = talloc_realloc(state->res_domains,
 691                                                      state->res_domains->domains,
 692                                                      struct lsa_DomainInfo,
 693                                                      state->res_domains->count);
 694
 695         *domains = talloc_move(mem_ctx, &state->res_domains);
 696         *names = talloc_move(mem_ctx, &state->res_names);
 697         return NT_STATUS_OK;
 698 }