Changeset 124 for branches/samba-3.0/source/nsswitch

Timestamp:

Mar 12, 2008, 9:08:18 AM (18 years ago)

Author:

Paul Smedley

Message:

Update source to 3.0.28a

Location:

branches/samba-3.0/source/nsswitch

Files:

• idmap.c (modified) (2 diffs)
• pam_winbind.c (modified) (1 diff)
• winbind_nss_config.h (modified) (1 diff)
• winbindd.c (modified) (1 diff)
• winbindd_async.c (modified) (9 diffs)
• winbindd_cm.c (modified) (20 diffs)
• winbindd_cred_cache.c (modified) (1 diff)
• winbindd_dual.c (modified) (2 diffs)
• winbindd_nss.h (modified) (1 diff)
• winbindd_pam.c (modified) (1 diff)
• winbindd_util.c (modified) (2 diffs)

branches/samba-3.0/source/nsswitch/idmap.c

@@ -368 +368 @@
                 dl[1] = NULL;
 
-                dom_list = dl;
+                dom_list = (const char **)dl;
                 default_domain = dl[0];
         }
@@ -907 +907 @@
                 /* huh, couldn't find a suitable domain,
                  *  let's just leave it unmapped */
-                DEBUG(10, ("Could not find idmap backend for SID %s",
+                DEBUG(10, ("Could not find idmap backend for SID %s\n",
                            sid_string_static(map->sid)));
                 return NT_STATUS_NO_SUCH_DOMAIN;

branches/samba-3.0/source/nsswitch/pam_winbind.c

@@ -1029 +1029 @@
         request.data.auth.uid = -1;
         
-        request.flags = WBFLAG_PAM_INFO3_TEXT | WBFLAG_PAM_CONTACT_TRUSTDOM;
+        request.flags = WBFLAG_PAM_INFO3_TEXT |
+                        WBFLAG_PAM_GET_PWD_POLICY |
+                        WBFLAG_PAM_CONTACT_TRUSTDOM;
 
         if (ctrl & (WINBIND_KRB5_AUTH|WINBIND_CACHED_LOGIN)) {

branches/samba-3.0/source/nsswitch/winbind_nss_config.h

@@ -37 +37 @@
 #endif
 
-#include "system/passwd.h"
 #include "system/filesys.h"
 #include "system/network.h"
+#include "system/passwd.h"
 
 #include "nsswitch/winbind_nss.h"

branches/samba-3.0/source/nsswitch/winbindd.c

@@ -542 +542 @@
         if (*(uint32 *)(&state->request) != sizeof(state->request)) {
                 DEBUG(0,("request_len_recv: Invalid request size received: %d (expected %d)\n",
-                         *(uint32 *)(&state->request), sizeof(state->request)));
+                         *(uint32 *)(&state->request), (uint32)sizeof(state->request)));
                 state->finished = True;
                 return;

branches/samba-3.0/source/nsswitch/winbindd_async.c

@@ -783 +783 @@
 ********************************************************************/
 
+struct lookupname_state {
+        char *dom_name;
+        char *name;
+        void *caller_private_data;
+};
+
 static void lookupname_recv2(TALLOC_CTX *mem_ctx, BOOL success,
                             struct winbindd_response *response,
@@ -791 +797 @@
                 (void (*)(void *, BOOL, const DOM_SID *, enum lsa_SidType))c;
         DOM_SID sid;
+        struct lookupname_state *s = talloc_get_type_abort(private_data, struct lookupname_state);
 
         if (!success) {
                 DEBUG(5, ("Could not trigger lookup_name\n"));
-                cont(private_data, False, NULL, SID_NAME_UNKNOWN);
+                cont(s->caller_private_data, False, NULL, SID_NAME_UNKNOWN);
                 return;
         }
@@ -800 +807 @@
         if (response->result != WINBINDD_OK) {
                 DEBUG(5, ("lookup_name returned an error\n"));
-                cont(private_data, False, NULL, SID_NAME_UNKNOWN);
+                cont(s->caller_private_data, False, NULL, SID_NAME_UNKNOWN);
                 return;
         }
@@ -807 +814 @@
                 DEBUG(0, ("Could not convert string %s to sid\n",
                           response->data.sid.sid));
-                cont(private_data, False, NULL, SID_NAME_UNKNOWN);
-                return;
-        }
-
-        cont(private_data, True, &sid,
+                cont(s->caller_private_data, False, NULL, SID_NAME_UNKNOWN);
+                return;
+        }
+
+        cont(s->caller_private_data, True, &sid,
              (enum lsa_SidType)response->data.sid.type);
 }
@@ -827 +834 @@
                 (void (*)(void *, BOOL, const DOM_SID *, enum lsa_SidType))c;
         DOM_SID sid;
+        struct lookupname_state *s = talloc_get_type_abort(private_data, struct lookupname_state);
 
         if (!success) {
                 DEBUG(5, ("lookupname_recv: lookup_name() failed!\n"));
-                cont(private_data, False, NULL, SID_NAME_UNKNOWN);
+                cont(s->caller_private_data, False, NULL, SID_NAME_UNKNOWN);
                 return;
         }
@@ -837 +845 @@
                 /* Try again using the forest root */
                 struct winbindd_domain *root_domain = find_root_domain();
-                struct winbindd_cli_state *state = (struct winbindd_cli_state*)private_data;            
-                struct winbindd_request request;                
-                char *name_domain, *name_account;
-                
+                struct winbindd_request request;
+
                 if ( !root_domain ) {
                         DEBUG(5,("lookupname_recv: unable to determine forest root\n"));
-                        cont(private_data, False, NULL, SID_NAME_UNKNOWN);
+                        cont(s->caller_private_data, False, NULL, SID_NAME_UNKNOWN);
                         return;
                 }
 
-                name_domain  = state->request.data.name.dom_name;
-                name_account = state->request.data.name.name;   
-
                 ZERO_STRUCT(request);
                 request.cmd = WINBINDD_LOOKUPNAME;
-                fstrcpy(request.data.name.dom_name, name_domain);
-                fstrcpy(request.data.name.name, name_account);
+                fstrcpy(request.data.name.dom_name, s->dom_name);
+                fstrcpy(request.data.name.name, s->name);
 
                 do_async_domain(mem_ctx, root_domain, &request, lookupname_recv2,
-                                (void *)cont, private_data);
+                                (void *)cont, s);
 
                 return;
@@ -864 +867 @@
                 DEBUG(0, ("Could not convert string %s to sid\n",
                           response->data.sid.sid));
-                cont(private_data, False, NULL, SID_NAME_UNKNOWN);
-                return;
-        }
-
-        cont(private_data, True, &sid,
+                cont(s->caller_private_data, False, NULL, SID_NAME_UNKNOWN);
+                return;
+        }
+
+        cont(s->caller_private_data, True, &sid,
              (enum lsa_SidType)response->data.sid.type);
 }
@@ -887 +890 @@
         struct winbindd_request request;
         struct winbindd_domain *domain;
+        struct lookupname_state *s;
 
         if ( (domain = find_lookup_domain_from_name(dom_name)) == NULL ) {
@@ -899 +903 @@
         fstrcpy(request.data.name.name, name);
 
+        if ( (s = TALLOC_ZERO_P(mem_ctx, struct lookupname_state)) == NULL ) {
+                DEBUG(0, ("winbindd_lookupname_async: talloc failed\n"));
+                cont(private_data, False, NULL, SID_NAME_UNKNOWN);
+                return;
+        }
+
+        s->dom_name = talloc_strdup( s, dom_name );
+        s->name     = talloc_strdup( s, name );
+        if (!s->dom_name || !s->name) {
+                cont(private_data, False, NULL, SID_NAME_UNKNOWN);
+                return;
+        }
+
+        s->caller_private_data = private_data;
+
         do_async_domain(mem_ctx, domain, &request, lookupname_recv,
-                        (void *)cont, private_data);
+                        (void *)cont, s);
 }
 

branches/samba-3.0/source/nsswitch/winbindd_cm.c

@@ -586 +586 @@
 }
 
+/**
+ * Helper function to assemble trust password and account name
+ */
+static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
+                                char **machine_password,
+                                char **machine_account,
+                                char **machine_krb5_principal)
+{
+        const char *account_name;
+
+        if (!get_trust_pw_clear(domain->name, machine_password,
+                                &account_name, NULL))
+        {
+                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+        }
+
+        if ((machine_account != NULL) &&
+            (asprintf(machine_account, "%s$", account_name) == -1))
+        {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* this is at least correct when domain is our domain,
+         * which is the only case, when this is currently used: */
+        if (machine_krb5_principal != NULL)
+        {
+                if (asprintf(machine_krb5_principal, "%s$@%s",
+                             account_name, domain->alt_name) == -1)
+                {
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                strupper_m(*machine_krb5_principal);
+        }
+
+        return NT_STATUS_OK;
+}
+
 /************************************************************************
  Given a fd with a just-connected TCP connection to a DC, open a connection
@@ -597 +635 @@
                                       BOOL *retry)
 {
-        char *machine_password, *machine_krb5_principal, *machine_account;
-        char *ipc_username, *ipc_domain, *ipc_password;
+        char *machine_password = NULL;
+        char *machine_krb5_principal = NULL;
+        char *machine_account = NULL;
+        char *ipc_username = NULL;
+        char *ipc_domain = NULL;
+        char *ipc_password = NULL;
 
         BOOL got_mutex;
@@ -611 +653 @@
         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
                 controller, domain->name ));
-
-        machine_password = secrets_fetch_machine_password(lp_workgroup(), NULL,
-                                                          NULL);
-        
-        if (asprintf(&machine_account, "%s$", global_myname()) == -1) {
-                SAFE_FREE(machine_password);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (asprintf(&machine_krb5_principal, "%s$@%s", global_myname(),
-                     lp_realm()) == -1) {
-                SAFE_FREE(machine_account);
-                SAFE_FREE(machine_password);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
 
         *retry = True;
@@ -685 +710 @@
                 goto done;
         }
-                        
-        if ((*cli)->protocol >= PROTOCOL_NT1 && (*cli)->capabilities & CAP_EXTENDED_SECURITY) {
+
+        if (!is_trusted_domain_situation(domain->name) &&
+            (*cli)->protocol >= PROTOCOL_NT1 &&
+            (*cli)->capabilities & CAP_EXTENDED_SECURITY)
+        {
                 ADS_STATUS ads_status;
+
+                result = get_trust_creds(domain, &machine_password,
+                                         &machine_account,
+                                         &machine_krb5_principal);
+                if (!NT_STATUS_IS_OK(result)) {
+                        goto done;
+                }
 
                 if (lp_security() == SEC_ADS) {
@@ -701 +736 @@
                                                               machine_krb5_principal, 
                                                               machine_password, 
-                                                              lp_workgroup());
+                                                              domain->name);
 
                         if (!ADS_ERR_OK(ads_status)) {
@@ -711 +746 @@
                         if (NT_STATUS_IS_OK(result)) {
                                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
-                                cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
+                                cli_init_creds(*cli, machine_account, domain->name, machine_password);
                                 goto session_setup_done;
                         }
@@ -721 +756 @@
                 DEBUG(5, ("connecting to %s from %s with username "
                           "[%s]\\[%s]\n",  controller, global_myname(),
-                          lp_workgroup(), machine_account));
+                          domain->name, machine_account));
 
                 ads_status = cli_session_setup_spnego(*cli,
                                                       machine_account, 
                                                       machine_password, 
-                                                      lp_workgroup());
+                                                      domain->name);
                 if (!ADS_ERR_OK(ads_status)) {
                         DEBUG(4, ("authenticated session setup failed with %s\n",
@@ -735 +770 @@
                 if (NT_STATUS_IS_OK(result)) {
                         /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
-                        cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
+                        cli_init_creds(*cli, machine_account, domain->name, machine_password);
                         goto session_setup_done;
                 }
         }
 
-        /* Fall back to non-kerberos session setup */
+        /* Fall back to non-kerberos session setup with auth_user */
 
         (*cli)->use_kerberos = False;
+
+        cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
 
         if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
@@ -908 +945 @@
         p += 2;
 
-        p += dos_PutUniCode(p, global_myname(), sizeof(pstring), True);
+        p += dos_PutUniCode(p, global_myname(),
+                sizeof(outbuf) - PTR_DIFF(p, outbuf), True);
         fstr_sprintf(my_acct_name, "%s$", global_myname());
-        p += dos_PutUniCode(p, my_acct_name, sizeof(pstring), True);
+        p += dos_PutUniCode(p, my_acct_name,
+                        sizeof(outbuf) - PTR_DIFF(p, outbuf), True);
+
+        if (strlen(my_mailslot)+1 > sizeof(outbuf) - PTR_DIFF(p, outbuf)) {
+                return False;
+        }
 
         memcpy(p, my_mailslot, strlen(my_mailslot)+1);
         p += strlen(my_mailslot)+1;
 
+        if (sizeof(outbuf) - PTR_DIFF(p, outbuf) < 8) {
+                return False;
+        }
         SIVAL(p, 0, 0x80);
         p+=4;
@@ -923 +969 @@
         p = ALIGN4(p, outbuf);
 
-        sid_linearize(p, sid_size(sid), sid);
+        if (PTR_DIFF(p, outbuf) > sizeof(outbuf)) {
+                return False;
+        }
+
+        if (sid_size(sid) + 8 > sizeof(outbuf) - PTR_DIFF(p, outbuf)) {
+                return False;
+        }
+
+        sid_linearize(p, sizeof(outbuf) - PTR_DIFF(p, outbuf), sid);
         p += sid_size(sid);
 
@@ -1690 +1744 @@
         fstring conn_pwd;
         struct dcinfo *p_dcinfo;
+        char *machine_password = NULL;
+        char *machine_account = NULL;
+        char *domain_name = NULL;
 
         result = init_dc_connection(domain);
@@ -1712 +1769 @@
         if ((conn->cli->user_name[0] == '\0') ||
             (conn->cli->domain[0] == '\0') || 
-            (conn_pwd[0] == '\0')) {
-                DEBUG(10, ("cm_connect_sam: No no user available for "
-                           "domain %s, trying schannel\n", conn->cli->domain));
-                goto schannel;
+            (conn_pwd[0] == '\0'))
+        {
+                result = get_trust_creds(domain, &machine_password,
+                                         &machine_account, NULL);
+                if (!NT_STATUS_IS_OK(result)) {
+                        DEBUG(10, ("cm_connect_sam: No no user available for "
+                                   "domain %s, trying schannel\n", conn->cli->domain));
+                        goto schannel;
+                }
+                domain_name = domain->name;
+        } else {
+                machine_password = SMB_STRDUP(conn_pwd);                
+                machine_account = SMB_STRDUP(conn->cli->user_name);
+                domain_name = conn->cli->domain;
+        }
+
+        if (!machine_password || !machine_account) {
+                result = NT_STATUS_NO_MEMORY;
+                goto done;
         }
 
@@ -1723 +1795 @@
                 cli_rpc_pipe_open_spnego_ntlmssp(conn->cli, PI_SAMR,
                                                  PIPE_AUTH_LEVEL_PRIVACY,
-                                                 conn->cli->domain,
-                                                 conn->cli->user_name,
-                                                 conn_pwd, &result);
+                                                 domain_name,
+                                                 machine_account,
+                                                 machine_password, &result);
 
         if (conn->samr_pipe == NULL) {
@@ -1731 +1803 @@
                           "pipe for domain %s using NTLMSSP "
                           "authenticated pipe: user %s\\%s. Error was "
-                          "%s\n", domain->name, conn->cli->domain,
-                          conn->cli->user_name, nt_errstr(result)));
+                          "%s\n", domain->name, domain_name,
+                          machine_account, nt_errstr(result)));
                 goto schannel;
         }
@@ -1739 +1811 @@
                   "domain %s using NTLMSSP authenticated "
                   "pipe: user %s\\%s\n", domain->name,
-                  conn->cli->domain, conn->cli->user_name ));
+                  domain_name, machine_account));
 
         result = rpccli_samr_connect(conn->samr_pipe, mem_ctx,
@@ -1824 +1896 @@
         *cli = conn->samr_pipe;
         *sam_handle = conn->sam_domain_handle;
+        SAFE_FREE(machine_password);
+        SAFE_FREE(machine_account);
         return result;
 }
@@ -1954 +2028 @@
         NTSTATUS result;
 
-        uint32 neg_flags = NETLOGON_NEG_AUTH2_FLAGS;
+        uint32 neg_flags = NETLOGON_NEG_SELECT_AUTH2_FLAGS;
         uint8  mach_pwd[16];
         uint32  sec_chan_type;
@@ -1974 +2048 @@
         }
 
-        if (!get_trust_pw(domain->name, mach_pwd, &sec_chan_type)) {
-                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
-        }
-
         netlogon_pipe = cli_rpc_pipe_open_noauth(conn->cli, PI_NETLOGON,
                                                  &result);
@@ -1984 +2054 @@
         }
 
+        if ((!IS_DC) && (!domain->primary)) {
+                /* Clear the schannel request bit and drop down */
+                neg_flags &= ~NETLOGON_NEG_SCHANNEL;            
+                goto no_schannel;
+        }
+
         if (lp_client_schannel() != False) {
                 neg_flags |= NETLOGON_NEG_SCHANNEL;
         }
 
-        /* if we are a DC and this is a trusted domain, then we need to use our
-           domain name in the net_req_auth2() request */
-
-        if ( IS_DC
-                && !strequal(domain->name, lp_workgroup())
-                && lp_allow_trusted_domains() ) 
+        if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
+                               &sec_chan_type))
         {
-                account_name = lp_workgroup();
-        } else {
-                account_name = domain->primary ?
-                        global_myname() : domain->name;
-        }
-
-        if (account_name == NULL) {
                 cli_rpc_pipe_close(netlogon_pipe);
-                return NT_STATUS_NO_MEMORY;
+                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
         }
 
@@ -2028 +2093 @@
         }
 
+ no_schannel:
         if ((lp_client_schannel() == False) ||
                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {

branches/samba-3.0/source/nsswitch/winbindd_cred_cache.c

@@ -427 +427 @@
 {
         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
-        NTSTATUS status;
+        NTSTATUS status = NT_STATUS_OK;
 #ifdef HAVE_KRB5
         krb5_error_code ret;

branches/samba-3.0/source/nsswitch/winbindd_dual.c

@@ -36 +36 @@
 
 extern BOOL override_logfile;
+extern struct winbindd_methods cache_methods;
 
 /* Read some data from a client connection */
@@ -989 +990 @@
         }
 
+        /* Special case for Winbindd on a Samba DC,
+         * We want to make sure the child can connect to smbd
+         * but not the main daemon */
+
+        if (child->domain && child->domain->internal && IS_DC) {
+                child->domain->internal = False;
+                child->domain->methods = &cache_methods;
+                child->domain->online = False;
+        }
+
         while (1) {
 

branches/samba-3.0/source/nsswitch/winbindd_nss.h

@@ -207 +207 @@
 #define WBFLAG_PAM_FALLBACK_AFTER_KRB5  0x2000
 #define WBFLAG_PAM_CACHED_LOGIN         0x4000
-#define WBFLAG_PAM_GET_PWD_POLICY       0x8000  /* not used */
+#define WBFLAG_PAM_GET_PWD_POLICY       0x8000
 
 #define WINBINDD_MAX_EXTRA_DATA (128*1024)

branches/samba-3.0/source/nsswitch/winbindd_pam.c

@@ -1518 +1518 @@
                 }
 
-                result = fillup_password_policy(domain, state);
-
-                if (!NT_STATUS_IS_OK(result)) {
-                        DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
-                        goto done;
+                if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
+                        result = fillup_password_policy(domain, state);
+
+                        if (!NT_STATUS_IS_OK(result)) {
+                                DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
+                                goto done;
+                        }
                 }
 

branches/samba-3.0/source/nsswitch/winbindd_util.c

@@ -84 +84 @@
                 return False;
 
-        if ( IS_DC )
-                return sid_check_is_builtin(sid);
-
         return (sid_check_is_domain(sid) || sid_check_is_builtin(sid));
 }
@@ -94 +91 @@
         if (sid == NULL)
                 return False;
-
-        if ( IS_DC )
-                return sid_check_is_in_builtin(sid);
 
         return (sid_check_is_in_our_domain(sid) || sid_check_is_in_builtin(sid));