Changeset 204 for branches/samba-3.2.x/source/libsmb

Timestamp:

May 20, 2009, 6:46:53 PM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.4

Location:

branches/samba-3.2.x/source/libsmb

Files:

• async_smb.c (modified) (8 diffs)
• clikrb5.c (modified) (1 diff)
• libsmb_xattr.c (modified) (9 diffs)
• samlogon_cache.c (modified) (1 diff)
• trusts_util.c (modified) (2 diffs)

branches/samba-3.2.x/source/libsmb/async_smb.c

@@ -320 +320 @@
         struct cli_state *cli = (struct cli_state *)p;
         struct cli_request *req;
+        NTSTATUS status;
 
         DEBUG(11, ("cli_state_handler called with flags %d\n", flags));
@@ -332 +333 @@
                         DEBUG(10, ("ioctl(FIONREAD) failed: %s\n",
                                    strerror(errno)));
+                        status = map_nt_error_from_unix(errno);
                         goto sock_error;
                 }
@@ -337 +339 @@
                 if (available == 0) {
                         /* EOF */
+                        status = NT_STATUS_END_OF_FILE;
                         goto sock_error;
                 }
@@ -345 +348 @@
                 if (new_size < old_size) {
                         /* wrap */
+                        status = NT_STATUS_UNEXPECTED_IO_ERROR;
                         goto sock_error;
                 }
@@ -352 +356 @@
                 if (tmp == NULL) {
                         /* nomem */
+                        status = NT_STATUS_NO_MEMORY;
                         goto sock_error;
                 }
@@ -359 +364 @@
                 if (res == -1) {
                         DEBUG(10, ("recv failed: %s\n", strerror(errno)));
+                        status = map_nt_error_from_unix(errno);
                         goto sock_error;
                 }
@@ -403 +409 @@
 
                 if (sent < 0) {
+                        status = map_nt_error_from_unix(errno);
                         goto sock_error;
                 }
@@ -416 +423 @@
  sock_error:
         for (req = cli->outstanding_requests; req; req = req->next) {
-                req->async->state = ASYNC_REQ_ERROR;
-                req->async->status = map_nt_error_from_unix(errno);
+                async_req_error(req->async, status);
         }
         TALLOC_FREE(cli->fd_event);

branches/samba-3.2.x/source/libsmb/clikrb5.c

@@ -744 +744 @@
                                                 &in_data );
                 if (retval) {
-                        DEBUG( 1, ("ads_krb5_get_fwd_ticket failed (%s)\n", error_message( retval ) ) );
-                        goto cleanup_creds;
-                }
-
-                if (retval) {
-                        DEBUG( 1, ("krb5_auth_con_set_req_cksumtype failed (%s)\n",
-                                error_message( retval ) ) );
-                        goto cleanup_creds;
-                }
-
+                        DEBUG( 3, ("ads_krb5_get_fwd_ticket failed (%s)\n", error_message( retval ) ) );
+
+                        /*
+                         * This is not fatal. Delete the *auth_context and continue
+                         * with krb5_mk_req_extended to get a non-forwardable ticket.
+                         */
+
+                        if (in_data.data) {
+                                free( in_data.data );
+                                in_data.data = NULL;
+                                in_data.length = 0;
+                        }
+                        krb5_auth_con_free(context, *auth_context);
+                        *auth_context = NULL;
+                }
         }
 #endif

branches/samba-3.2.x/source/libsmb/libsmb_xattr.c

@@ -747 +747 @@
         uint16 mode = 0;
         SMB_INO_T ino = 0;
-        struct cli_state *cli = srv->cli;
+        struct cli_state *cli = srv->cli;
         struct {
                 const char * create_time_attr;
@@ -884 +884 @@
          */
         if (ipc_cli && (all || some_nt || all_nt_acls)) {
+                char *targetpath = NULL;
+                struct cli_state *targetcli = NULL;
+
                 /* Point to the portion after "system.nt_sec_desc." */
                 name += 19;     /* if (all) this will be invalid but unused */
-                
+
+                if (!cli_resolve_path(ctx, "", cli, filename,
+                                &targetcli, &targetpath)) {
+                        DEBUG(5, ("cacl_get Could not resolve %s\n",
+                                filename));
+                        errno = ENOENT;
+                        return -1;
+                }
+
                 /* ... then obtain any NT attributes which were requested */
-                fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
-                
+                fnum = cli_nt_create(targetcli, targetpath, CREATE_ACCESS_READ);
+
                 if (fnum == -1) {
-                        DEBUG(5, ("cacl_get failed to open %s: %s\n",
-                                  filename, cli_errstr(cli)));
-                        errno = 0;
-                        return -1;
-                }
-                
-                sd = cli_query_secdesc(cli, fnum, ctx);
-                
+                        DEBUG(5, ("cacl_get failed to open %s: %s\n",
+                                targetpath, cli_errstr(targetcli)));
+                        errno = 0;
+                        return -1;
+                }
+
+                sd = cli_query_secdesc(targetcli, fnum, ctx);
+
                 if (!sd) {
                         DEBUG(5,
@@ -905 +916 @@
                         return -1;
                 }
-                
-                cli_close(cli, fnum);
-                
+
+                cli_close(targetcli, fnum);
+
                 if (! exclude_nt_revision) {
                         if (all || all_nt) {
@@ -1504 +1515 @@
         char *p;
         bool numeric = True;
-        
+        char *targetpath = NULL;
+        struct cli_state *targetcli = NULL;
+
         /* the_acl will be null for REMOVE_ALL operations */
         if (the_acl) {
@@ -1533 +1546 @@
                 return -1;
         }
-        
+
+        if (!cli_resolve_path(ctx, "", cli, filename,
+                                &targetcli, &targetpath)) {
+                DEBUG(5,("cacl_set: Could not resolve %s\n", filename));
+                errno = ENOENT;
+                return -1;
+        }
+
         /* The desired access below is the only one I could find that works
            with NT4, W2KP and Samba */
-        
-        fnum = cli_nt_create(cli, filename, CREATE_ACCESS_READ);
-        
+
+        fnum = cli_nt_create(targetcli, targetpath, CREATE_ACCESS_READ);
+
         if (fnum == -1) {
                 DEBUG(5, ("cacl_set failed to open %s: %s\n",
-                          filename, cli_errstr(cli)));
+                          targetpath, cli_errstr(targetcli)));
                 errno = 0;
                 return -1;
         }
-        
-        old = cli_query_secdesc(cli, fnum, ctx);
-        
+
+        old = cli_query_secdesc(targetcli, fnum, ctx);
+
         if (!old) {
                 DEBUG(5, ("cacl_set Failed to query old descriptor\n"));
@@ -1553 +1573 @@
                 return -1;
         }
-        
-        cli_close(cli, fnum);
-        
+
+        cli_close(targetcli, fnum);
+
         switch (mode) {
         case SMBC_XATTR_MODE_REMOVE_ALL:
@@ -1561 +1581 @@
                 dacl = old->dacl;
                 break;
-                
+
         case SMBC_XATTR_MODE_REMOVE:
                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
                         bool found = False;
-                        
+
                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
                                 if (sec_ace_equal(&sd->dacl->aces[i],
@@ -1643 +1663 @@
                            owner_sid, group_sid, NULL, dacl, &sd_size);
         
-        fnum = cli_nt_create(cli, filename,
+        fnum = cli_nt_create(targetcli, targetpath,
                              WRITE_DAC_ACCESS | WRITE_OWNER_ACCESS);
         
         if (fnum == -1) {
                 DEBUG(5, ("cacl_set failed to open %s: %s\n",
-                          filename, cli_errstr(cli)));
+                          targetpath, cli_errstr(targetcli)));
                 errno = 0;
                 return -1;
         }
         
-        if (!cli_set_secdesc(cli, fnum, sd)) {
-                DEBUG(5, ("ERROR: secdesc set failed: %s\n", cli_errstr(cli)));
+        if (!cli_set_secdesc(targetcli, fnum, sd)) {
+                DEBUG(5, ("ERROR: secdesc set failed: %s\n",
+                        cli_errstr(targetcli)));
                 ret = -1;
         }
@@ -1661 +1682 @@
         
 failed:
-        cli_close(cli, fnum);
+        cli_close(targetcli, fnum);
         
         if (err != 0) {

branches/samba-3.2.x/source/libsmb/samlogon_cache.c

@@ -60 +60 @@
 ***********************************************************************/
 
-void netsamlogon_clear_cached_user(TDB_CONTEXT *tdb, struct netr_SamInfo3 *info3)
-{
-        bool got_tdb = false;
-        DOM_SID sid;
-        fstring key_str, sid_string;
-
-        /* We may need to call this function from smbd which will not have
-           winbindd_cache.tdb open.  Open the tdb if a NULL is passed. */
-
-        if (!tdb) {
-                tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
-                                   WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
-                                   TDB_DEFAULT, O_RDWR, 0600);
-                if (!tdb) {
-                        DEBUG(5, ("netsamlogon_clear_cached_user: failed to open cache\n"));
-                        return;
-                }
-                got_tdb = true;
-        }
-
-        sid_copy(&sid, info3->base.domain_sid);
-        sid_append_rid(&sid, info3->base.rid);
-
-        /* Clear U/SID cache entry */
-
-        fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
-
-        DEBUG(10, ("netsamlogon_clear_cached_user: clearing %s\n", key_str));
-
-        tdb_delete(tdb, string_tdb_data(key_str));
-
-        /* Clear UG/SID cache entry */
-
-        fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
-
-        DEBUG(10, ("netsamlogon_clear_cached_user: clearing %s\n", key_str));
-
-        tdb_delete(tdb, string_tdb_data(key_str));
-
-        if (got_tdb) {
-                tdb_close(tdb);
-        }
+void netsamlogon_clear_cached_user(struct netr_SamInfo3 *info3)
+{
+        DOM_SID user_sid;
+        fstring keystr, tmp;
+
+        if (!info3) {
+                return;
+        }
+
+        if (!netsamlogon_cache_init()) {
+                DEBUG(0,("netsamlogon_clear_cached_user: cannot open "
+                        "%s for write!\n",
+                        NETSAMLOGON_TDB));
+                return;
+        }
+        sid_copy(&user_sid, info3->base.domain_sid);
+        sid_append_rid(&user_sid, info3->base.rid);
+
+        /* Prepare key as DOMAIN-SID/USER-RID string */
+        slprintf(keystr, sizeof(keystr), "%s", sid_to_fstring(tmp, &user_sid));
+
+        DEBUG(10,("netsamlogon_clear_cached_user: SID [%s]\n", keystr));
+
+        tdb_delete_bystring(netsamlogon_tdb, keystr);
 }
 

branches/samba-3.2.x/source/libsmb/trusts_util.c

@@ -32 +32 @@
 static NTSTATUS just_change_the_password(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx, 
                                          const unsigned char orig_trust_passwd_hash[16],
+                                         const char *new_trust_pwd_cleartext,
                                          const unsigned char new_trust_passwd_hash[16],
                                          uint32 sec_channel_type)
 {
         NTSTATUS result;
-
-        /* Check if the netlogon pipe is open using schannel. If so we
-           already have valid creds. If not we must set them up. */
-
-        if (cli->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
-                uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-
-                result = rpccli_netlogon_setup_creds(cli, 
-                                        cli->cli->desthost, /* server name */
-                                        lp_workgroup(), /* domain */
-                                        global_myname(), /* client name */
-                                        global_myname(), /* machine account name */
-                                        orig_trust_passwd_hash,
-                                        sec_channel_type,
-                                        &neg_flags);
-
-                if (!NT_STATUS_IS_OK(result)) {
-                        DEBUG(3,("just_change_the_password: unable to setup creds (%s)!\n",
-                                 nt_errstr(result)));
-                        return result;
+        uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
+
+        result = rpccli_netlogon_setup_creds(cli,
+                                             cli->cli->desthost, /* server name */
+                                             lp_workgroup(), /* domain */
+                                             global_myname(), /* client name */
+                                             global_myname(), /* machine account name */
+                                             orig_trust_passwd_hash,
+                                             sec_channel_type,
+                                             &neg_flags);
+
+        if (!NT_STATUS_IS_OK(result)) {
+                DEBUG(3,("just_change_the_password: unable to setup creds (%s)!\n",
+                         nt_errstr(result)));
+                return result;
+        }
+
+        if (neg_flags & NETLOGON_NEG_PASSWORD_SET2) {
+
+                struct netr_Authenticator clnt_creds, srv_cred;
+                struct netr_CryptPassword new_password;
+                struct samr_CryptPassword password_buf;
+
+                netlogon_creds_client_step(cli->dc, &clnt_creds);
+
+                encode_pw_buffer(password_buf.data, new_trust_pwd_cleartext, STR_UNICODE);
+
+                SamOEMhash(password_buf.data, cli->dc->sess_key, 516);
+                memcpy(new_password.data, password_buf.data, 512);
+                new_password.length = IVAL(password_buf.data, 512);
+
+                result = rpccli_netr_ServerPasswordSet2(cli, mem_ctx,
+                                                       cli->dc->remote_machine,
+                                                       cli->dc->mach_acct,
+                                                       sec_channel_type,
+                                                       global_myname(),
+                                                       &clnt_creds,
+                                                       &srv_cred,
+                                                       &new_password);
+
+                /* Always check returned credentials. */
+                if (!netlogon_creds_client_check(cli->dc, &srv_cred.cred)) {
+                        DEBUG(0,("rpccli_netr_ServerPasswordSet2: "
+                                "credentials chain check failed\n"));
+                        return NT_STATUS_ACCESS_DENIED;
                 }
-        }
-
-        {
+
+        } else {
+
                 struct netr_Authenticator clnt_creds, srv_cred;
                 struct samr_Password new_password;
@@ -119 +145 @@
         E_md4hash(new_trust_passwd, new_trust_passwd_hash);
 
-        nt_status = just_change_the_password(cli, mem_ctx, orig_trust_passwd_hash,
-                                             new_trust_passwd_hash, sec_channel_type);
+        nt_status = just_change_the_password(cli, mem_ctx,
+                                             orig_trust_passwd_hash,
+                                             new_trust_passwd,
+                                             new_trust_passwd_hash,
+                                             sec_channel_type);
         
         if (NT_STATUS_IS_OK(nt_status)) {