Changeset 920 for trunk/server/source3/winbindd/winbindd_cm.c

Timestamp:

Jun 9, 2016, 2:23:12 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to trunk

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/winbindd/winbindd_cm.c (modified) (3 diffs)

trunk/server/source3/winbindd/winbindd_cm.c

@@ -2385 +2385 @@
 
  anonymous:
+        if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+                status = NT_STATUS_DOWNGRADE_DETECTED;
+                DEBUG(1, ("Unwilling to make SAMR connection to domain %s "
+                          "without connection level security, "
+                          "must set 'winbind sealed pipes = false' "
+                          "to proceed: %s\n",
+                          domain->name, nt_errstr(status)));
+                goto done;
+        }
 
         /* Finally fall back to anonymous. */
@@ -2611 +2620 @@
  anonymous:
 
+        if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+                result = NT_STATUS_DOWNGRADE_DETECTED;
+                DEBUG(1, ("Unwilling to make LSA connection to domain %s "
+                          "without connection level security, "
+                          "must set 'winbind sealed pipes = false' "
+                          "to proceed: %s\n",
+                          domain->name, nt_errstr(result)));
+                goto done;
+        }
+
         result = cli_rpc_pipe_open_noauth(conn->cli,
                                           &ndr_table_lsarpc.syntax_id,
@@ -2750 +2769 @@
  no_schannel:
         if ((lp_client_schannel() == False) ||
-                        ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
+                ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
+                if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+                        result = NT_STATUS_DOWNGRADE_DETECTED;
+                        DEBUG(1, ("Unwilling to make connection to domain %s "
+                                  "without connection level security, "
+                                  "must set 'winbind sealed pipes = false' "
+                                  "to proceed: %s\n",
+                                  domain->name, nt_errstr(result)));
+                        TALLOC_FREE(netlogon_pipe);
+                        invalidate_cm_connection(conn);
+                        return result;
+                }
                 /*
                  * NetSamLogonEx only works for schannel