Changeset 732 for branches/samba-3.5.x/source3/winbindd

Timestamp:

Nov 12, 2012, 4:35:55 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server 3.5: update branche to 3.5.12

Location:

branches/samba-3.5.x/source3/winbindd

Files:

• wb_group_members.c (modified) (1 diff)
• winbindd.c (modified) (1 diff)
• winbindd_dual.c (modified) (4 diffs)
• winbindd_pam.c (modified) (4 diffs)

branches/samba-3.5.x/source3/winbindd/wb_group_members.c

@@ -214 +214 @@
 
         if (!NT_STATUS_IS_OK(status)) {
-                tevent_req_nterror(req, status);
-                return;
+                if (!NT_STATUS_EQUAL(
+                            status, NT_STATUS_TRUSTED_DOMAIN_FAILURE)) {
+                        tevent_req_nterror(req, status);
+                        return;
+                }
+                num_members = 0;
         }
 

branches/samba-3.5.x/source3/winbindd/winbindd.c

@@ -904 +904 @@
                                           struct winbindd_listen_state);
 
-        while (winbindd_num_clients() >
-               WINBINDD_MAX_SIMULTANEOUS_CLIENTS - 1) {
+        while (winbindd_num_clients() > lp_winbind_max_clients() - 1) {
                 DEBUG(5,("winbindd: Exceeding %d client "
                          "connections, removing idle "
-                         "connection.\n",
-                         WINBINDD_MAX_SIMULTANEOUS_CLIENTS));
+                         "connection.\n", lp_winbind_max_clients()));
                 if (!remove_idle_client()) {
                         DEBUG(0,("winbindd: Exceeding %d "
                                  "client connections, no idle "
                                  "connection found\n",
-                                 WINBINDD_MAX_SIMULTANEOUS_CLIENTS));
+                                 lp_winbind_max_clients()));
                         break;
                 }

branches/samba-3.5.x/source3/winbindd/winbindd_dual.c

@@ -135 +135 @@
         struct tevent_req *subreq;
 
-        if ((state->child->pid == 0) && (!fork_domain_child(state->child))) {
+        if ((state->child->sock == -1) && (!fork_domain_child(state->child))) {
                 tevent_req_error(req, errno);
                 return;
@@ -165 +165 @@
         TALLOC_FREE(subreq);
         if (ret == -1) {
+                /*
+                 * The basic parent/child communication broke, close
+                 * our socket
+                 */
+                close(state->child->sock);
+                state->child->sock = -1;
                 tevent_req_error(req, err);
                 return;
@@ -503 +509 @@
         }
 
+        child->sock = -1;
         child->domain = domain;
         child->table = table;
@@ -531 +538 @@
 
         DLIST_REMOVE(children, child);
-
-        close(child->sock);
-        child->sock = -1;
         child->pid = 0;
 }

branches/samba-3.5.x/source3/winbindd/winbindd_pam.c

@@ -1383 +1383 @@
                                   &my_info3);
 
-                if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
-                    && contact_domain->can_do_samlogon_ex) {
-                        DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
-                                  "retrying with NetSamLogon\n"));
-                        contact_domain->can_do_samlogon_ex = false;
+                if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
+
                         /*
                          * It's likely that the server also does not support
@@ -1393 +1390 @@
                          */
                         domain->can_do_validation6 = false;
-                        retry = true;
-                        continue;
+
+                        if (contact_domain->can_do_samlogon_ex) {
+                                DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
+                                          "retrying with NetSamLogon\n"));
+                                contact_domain->can_do_samlogon_ex = false;
+                                retry = true;
+                                continue;
+                        }
+
+                        /* Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
+                         * (no Ex). This happens against old Samba
+                         * DCs. Drop the connection.
+                         */
+                        invalidate_cm_connection(&contact_domain->conn);
+                        result = NT_STATUS_LOGON_FAILURE;
+                        break;
                 }
 
@@ -1997 +2008 @@
                                   &info3);
 
-                if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
-                    && contact_domain->can_do_samlogon_ex) {
-                        DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
-                                  "retrying with NetSamLogon\n"));
-                        contact_domain->can_do_samlogon_ex = false;
+                if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
+
                         /*
                          * It's likely that the server also does not support
@@ -2007 +2015 @@
                          */
                         domain->can_do_validation6 = false;
-                        retry = true;
-                        continue;
+
+                        if (contact_domain->can_do_samlogon_ex) {
+                                DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
+                                          "retrying with NetSamLogon\n"));
+                                contact_domain->can_do_samlogon_ex = false;
+                                retry = true;
+                                continue;
+                        }
+
+                        /* Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
+                         * (no Ex). This happens against old Samba
+                         * DCs. Drop the connection.
+                         */
+                        invalidate_cm_connection(&contact_domain->conn);
+                        result = NT_STATUS_LOGON_FAILURE;
+                        break;
                 }