Changeset 165 for branches/samba-3.0/source/libsmb

Timestamp:

Mar 11, 2009, 9:14:55 AM (16 years ago)

Author:

Paul Smedley

Message:

Add 'missing' 3.0.34 diffs

Location:

branches/samba-3.0/source/libsmb

Files:

• cliconnect.c (modified) (4 diffs)
• libsmbclient.c (modified) (7 diffs)
• namequery.c (modified) (7 diffs)
• trusts_util.c (modified) (3 diffs)

branches/samba-3.0/source/libsmb/cliconnect.c

@@ -539 +539 @@
 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 
-static BOOL cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob, DATA_BLOB session_key_krb5)
+static BOOL cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 {
         int32 remaining = blob.length;
@@ -563 +563 @@
                         remaining -= max_blob_size;
                 } else {
-                        DATA_BLOB null_blob = data_blob(NULL, 0);
-
                         send_blob.length = remaining; 
                         remaining = 0;
-
-                        /* This is the last packet in the sequence - turn signing on. */
-                        cli_simple_set_signing(cli, session_key_krb5, null_blob); 
                 }
 
@@ -617 +612 @@
         DATA_BLOB negTokenTarg;
         DATA_BLOB session_key_krb5;
+        DATA_BLOB null_blob = data_blob(NULL, 0);
+        NTSTATUS nt_status;
+        BOOL res;
         int rc;
+
+        cli_temp_set_signing(cli);
 
         DEBUG(2,("Doing kerberos session setup\n"));
@@ -634 +634 @@
 #endif
 
-        if (!cli_session_setup_blob(cli, negTokenTarg, session_key_krb5)) {
-                data_blob_free(&negTokenTarg);
-                data_blob_free(&session_key_krb5);
-                return ADS_ERROR_NT(cli_nt_error(cli));
+        if (!cli_session_setup_blob(cli, negTokenTarg)) {
+                nt_status = cli_nt_error(cli);
+                goto nt_error;
+        }
+
+        if (cli_is_error(cli)) {
+                nt_status = cli_nt_error(cli);
+                if (NT_STATUS_IS_OK(nt_status)) {
+                        nt_status = NT_STATUS_UNSUCCESSFUL;
+                }
+                goto nt_error;
         }
 
         cli_set_session_key(cli, session_key_krb5);
+
+        res = cli_simple_set_signing(cli, session_key_krb5, null_blob);
+        if (res) {
+                /* 'resign' the last message, so we get the right sequence numbers
+                   for checking the first reply from the server */
+                cli_calculate_sign_mac(cli);
+
+                if (!cli_check_sign_mac(cli)) {
+                        nt_status = NT_STATUS_ACCESS_DENIED;
+                        goto nt_error;
+                }
+        }
 
         data_blob_free(&negTokenTarg);
         data_blob_free(&session_key_krb5);
 
-        if (cli_is_error(cli)) {
-                if (NT_STATUS_IS_OK(cli_nt_error(cli))) {
-                        return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
-                }
-        } 
-        return ADS_ERROR_NT(cli_nt_error(cli));
+        return ADS_ERROR_NT(NT_STATUS_OK);
+
+nt_error:
+        data_blob_free(&negTokenTarg);
+        data_blob_free(&session_key_krb5);
+        cli->vuid = 0;
+        return ADS_ERROR_NT(nt_status);
 }
 #endif  /* HAVE_KRB5 */

branches/samba-3.0/source/libsmb/libsmbclient.c

@@ -4527 +4527 @@
          */
         if (ipc_cli && (all || some_nt || all_nt_acls)) {
+                pstring targetpath;
+                struct cli_state *targetcli;
+
                 /* Point to the portion after "system.nt_sec_desc." */
                 name += 19;     /* if (all) this will be invalid but unused */
 
+                if (!cli_resolve_path("", cli, filename,
+                                      &targetcli, targetpath))
+                {
+                        d_printf("Could not resolve %s\n", filename);
+                        return -1;
+                }
+
                 /* ... then obtain any NT attributes which were requested */
-                fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
+                fnum = cli_nt_create(targetcli, targetpath, CREATE_ACCESS_READ);
 
                 if (fnum == -1) {
                         DEBUG(5, ("cacl_get failed to open %s: %s\n",
-                                  filename, cli_errstr(cli)));
+                                  targetpath, cli_errstr(targetcli)));
                         errno = 0;
                         return -1;
                 }
 
-                sd = cli_query_secdesc(cli, fnum, ctx);
+                sd = cli_query_secdesc(targetcli, fnum, ctx);
 
                 if (!sd) {
@@ -4549 +4559 @@
                 }
 
-                cli_close(cli, fnum);
+                cli_close(targetcli, fnum);
 
                 if (! exclude_nt_revision) {
@@ -5149 +5159 @@
         BOOL numeric = True;
 
+        pstring targetpath;
+        struct cli_state *targetcli;
+
         /* the_acl will be null for REMOVE_ALL operations */
         if (the_acl) {
@@ -5178 +5191 @@
         }
 
+        if (!cli_resolve_path("", cli, filename,
+                              &targetcli, targetpath))
+        {
+                d_printf("Could not resolve %s\n", filename);
+                errno = ENOENT;
+                return -1;
+        }
+
         /* The desired access below is the only one I could find that works
            with NT4, W2KP and Samba */
 
-        fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
+        fnum = cli_nt_create(targetcli, targetpath, CREATE_ACCESS_READ);
 
         if (fnum == -1) {
                 DEBUG(5, ("cacl_set failed to open %s: %s\n",
-                          filename, cli_errstr(cli)));
+                          targetpath, cli_errstr(targetcli)));
                 errno = 0;
                 return -1;
         }
 
-        old = cli_query_secdesc(cli, fnum, ctx);
+        old = cli_query_secdesc(targetcli, fnum, ctx);
 
         if (!old) {
@@ -5198 +5219 @@
         }
 
-        cli_close(cli, fnum);
+        cli_close(targetcli, fnum);
 
         switch (mode) {
@@ -5287 +5308 @@
                            owner_sid, group_sid, NULL, dacl, &sd_size);
 
-        fnum = cli_nt_create(cli, filename,
+        fnum = cli_nt_create(targetcli, targetpath,
                              WRITE_DAC_ACCESS | WRITE_OWNER_ACCESS);
 
         if (fnum == -1) {
                 DEBUG(5, ("cacl_set failed to open %s: %s\n",
-                          filename, cli_errstr(cli)));
+                          targetpath, cli_errstr(targetcli)));
                 errno = 0;
                 return -1;
         }
 
-        if (!cli_set_secdesc(cli, fnum, sd)) {
-                DEBUG(5, ("ERROR: secdesc set failed: %s\n", cli_errstr(cli)));
+        if (!cli_set_secdesc(targetcli, fnum, sd)) {
+                DEBUG(5, ("ERROR: secdesc set failed: %s\n", cli_errstr(targetcli)));
                 ret = -1;
         }
@@ -5305 +5326 @@
 
  failed:
-        cli_close(cli, fnum);
+        cli_close(targetcli, fnum);
 
         if (err != 0) {

branches/samba-3.0/source/libsmb/namequery.c

@@ -35 +35 @@
 #define SAFKEY_FMT      "SAF/DOMAIN/%s"
 #define SAF_TTL         900
+#define SAFJOINKEY_FMT  "SAFJOIN/DOMAIN/%s"
+#define SAFJOIN_TTL     3600
 
 static char *saf_key(const char *domain)
@@ -41 +43 @@
         
         asprintf( &keystr, SAFKEY_FMT, strupper_static(domain) );
+
+        return keystr;
+}
+
+static char *saf_join_key(const char *domain)
+{
+        char *keystr;
+
+        asprintf( &keystr, SAFJOINKEY_FMT, strupper_static(domain) );
 
         return keystr;
@@ -68 +79 @@
         
         key = saf_key( domain );
-        expire = time( NULL ) + SAF_TTL;
+        expire = time( NULL ) + lp_parm_int(-1, "saf","ttl", SAF_TTL);
         
         
@@ -81 +92 @@
 }
 
+BOOL saf_join_store( const char *domain, const char *servername )
+{
+        char *key;
+        time_t expire;
+        BOOL ret = False;
+
+        if ( !domain || !servername ) {
+                DEBUG(2,("saf_join_store: Refusing to store empty domain or servername!\n"));
+                return False;
+        }
+
+        if ( (strlen(domain) == 0) || (strlen(servername) == 0) ) {
+                DEBUG(0,("saf_join_store: refusing to store 0 length domain or servername!\n"));
+                return False;
+        }
+
+        if ( !gencache_init() )
+                return False;
+
+        key = saf_join_key( domain );
+        expire = time( NULL ) + lp_parm_int(-1, "saf","join ttl", SAFJOIN_TTL);
+
+        DEBUG(10,("saf_join_store: domain = [%s], server = [%s], expire = [%u]\n",
+                domain, servername, (unsigned int)expire ));
+
+        ret = gencache_set( key, servername, expire );
+
+        SAFE_FREE( key );
+
+        return ret;
+}
+
 BOOL saf_delete( const char *domain )
 {
@@ -94 +137 @@
                 return False;
         
+        key = saf_join_key(domain);
+        ret = gencache_del(key);
+        SAFE_FREE(key);
+
+        if (ret) {
+                DEBUG(10,("saf_delete[join]: domain = [%s]\n", domain ));
+        }
+
         key = saf_key(domain);
         ret = gencache_del(key);
-        
+        SAFE_FREE(key);
+
         if (ret) {
                 DEBUG(10,("saf_delete: domain = [%s]\n", domain ));             
         }
-
-        SAFE_FREE( key );
 
         return ret;
@@ -123 +173 @@
         if ( !gencache_init() ) 
                 return False;
-        
+
+        key = saf_join_key( domain );
+
+        ret = gencache_get( key, &server, &timeout );
+
+        SAFE_FREE( key );
+
+        if ( ret ) {
+                DEBUG(5,("saf_fetch[join]: Returning \"%s\" for \"%s\" domain\n",
+                        server, domain ));
+                return server;
+        }
+
         key = saf_key( domain );
         
@@ -1649 +1711 @@
 
         status = get_dc_list(domain, sitename, ip_list, count, lookup_type, &ordered);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NO_LOGON_SERVERS) && sitename) {
+                DEBUG(3,("get_sorted_dc_list: no server for name %s available"
+                         " in site %s, fallback to all servers\n",
+                         domain, sitename));
+                status = get_dc_list(domain, NULL, ip_list, count,
+                                     lookup_type, &ordered);
+        }
+
         if (!NT_STATUS_IS_OK(status)) {
                 return status; 

branches/samba-3.0/source/libsmb/trusts_util.c

@@ -33 +33 @@
 static NTSTATUS just_change_the_password(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx, 
                                          const unsigned char orig_trust_passwd_hash[16],
+                                         const char *new_trust_pwd_cleartext,
                                          const unsigned char new_trust_passwd_hash[16],
                                          uint32 sec_channel_type)
 {
         NTSTATUS result;
-
-        /* Check if the netlogon pipe is open using schannel. If so we
-           already have valid creds. If not we must set them up. */
-
-        if (cli->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
-                uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-
-                result = rpccli_netlogon_setup_creds(cli, 
+        uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
+
+        result = rpccli_netlogon_setup_creds(cli,
                                         cli->cli->desthost, /* server name */
                                         lp_workgroup(), /* domain */
@@ -53 +49 @@
                                         &neg_flags);
 
-                if (!NT_STATUS_IS_OK(result)) {
-                        DEBUG(3,("just_change_the_password: unable to setup creds (%s)!\n",
-                                 nt_errstr(result)));
-                        return result;
-                }
-        }
-
-        result = rpccli_net_srv_pwset(cli, mem_ctx, global_myname(), new_trust_passwd_hash);
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(3,("just_change_the_password: unable to setup creds (%s)!\n",
+                         nt_errstr(result)));
+                return result;
+        }
+
+        if (neg_flags & NETLOGON_NEG_PASSWORD_SET2) {
+                result = rpccli_net_srv_pwset2(cli, mem_ctx, global_myname(),
+                                               new_trust_pwd_cleartext);
+        } else {
+                result = rpccli_net_srv_pwset(cli, mem_ctx, global_myname(),
+                                              new_trust_passwd_hash);
+        }
 
         if (!NT_STATUS_IS_OK(result)) {
@@ -96 +97 @@
 
         nt_status = just_change_the_password(cli, mem_ctx, orig_trust_passwd_hash,
+                                             new_trust_passwd,
                                              new_trust_passwd_hash, sec_channel_type);