Changeset 860 for vendor/current/source3/auth

Timestamp:

May 12, 2014, 8:58:38 PM (11 years ago)

Author:

Silvan Scherrer

Message:

Samba 3.6: updated vendor to latest version

Location:

vendor/current/source3/auth

Files:

• auth_util.c (modified) (4 diffs)
• auth_winbind.c (modified) (1 diff)
• check_samsec.c (modified) (1 diff)
• proto.h (modified) (1 diff)
• server_info.c (modified) (1 diff)
• user_util.c (modified) (1 diff)

vendor/current/source3/auth/auth_util.c

@@ -121 +121 @@
 
         if (!is_trusted_domain(domain) &&
-            !strequal(domain, my_sam_name()))
+            !strequal(domain, my_sam_name()) &&
+            !strequal(domain, get_global_sam_name()))
         {
                 if (lp_map_untrusted_to_domain())
@@ -902 +903 @@
 NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
                                        const char *username,
+                                       bool use_guest_token,
                                        bool is_guest,
                                        struct auth_serversupplied_info **presult)
@@ -925 +927 @@
         result->guest = is_guest;
 
-        status = create_local_token(result);
+        if (use_guest_token) {
+                status = make_server_info_guest(mem_ctx, &result);
+        } else {
+                status = create_local_token(result);
+        }
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -1175 +1181 @@
                         /* work around 'winbind use default domain = yes' */
 
-                        if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
+                        if ( lp_winbind_use_default_domain() &&
+                             !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
                                 char *domain;
 

vendor/current/source3/auth/auth_winbind.c

@@ -63 +63 @@
 
         /* Send off request */
-
         params.account_name     = user_info->client.account_name;
-        params.domain_name      = user_info->mapped.domain_name;
+        /*
+         * We need to send the domain name from the client to the DC. With
+         * NTLMv2 the domain name is part of the hashed second challenge,
+         * if we change the domain name, the DC will fail to verify the
+         * challenge cause we changed the domain name, this is like a
+         * man in the middle attack.
+         */
+        params.domain_name      = user_info->client.domain_name;
         params.workstation_name = user_info->workstation_name;
 

vendor/current/source3/auth/check_samsec.c

@@ -409 +409 @@
         if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
                 DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", username));
+                TALLOC_FREE(sampass);
                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
         }

vendor/current/source3/auth/proto.h

@@ -150 +150 @@
 NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
                                        const char *username,
+                                       bool use_guest_token,
                                        bool is_guest,
                                        struct auth_serversupplied_info **presult);

vendor/current/source3/auth/server_info.c

@@ -609 +609 @@
         if (!info3) return NULL;
 
-        info3->base.last_logon = info->logon_time;
-        info3->base.last_logoff = info->logoff_time;
-        info3->base.acct_expiry = info->kickoff_time;
+        unix_to_nt_time(&info3->base.last_logon, info->logon_time);
+        unix_to_nt_time(&info3->base.last_logoff, info->logoff_time);
+        unix_to_nt_time(&info3->base.acct_expiry, info->kickoff_time);
         unix_to_nt_time(&info3->base.last_password_change, info->pass_last_set_time);
         unix_to_nt_time(&info3->base.allow_password_change,

vendor/current/source3/auth/user_util.c

@@ -426 +426 @@
 
         /*
-         * Setup the last_from and last_to as an optimization so
+         * If we didn't successfully map a user in the loop above,
+         * setup the last_from and last_to as an optimization so
          * that we don't scan the file again for the same user.
          */
-
-        set_last_from_to(user_in, user_in);
-        store_map_in_gencache(ctx, user_in, user_in);
+        if (!mapped_user) {
+                DEBUG(8, ("The user '%s' has no mapping. "
+                          "Skip it next time.\n", user_in));
+                set_last_from_to(user_in, user_in);
+                store_map_in_gencache(ctx, user_in, user_in);
+        }
 
         return mapped_user;