sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-08 04:58:40 +03:00
Code

s4:kdc In the kpasswd server, don't use the client address in mk_priv

Browse Source 
This code eventually calls into mk_priv in the Heimdal code, and if
the client is behind NAT, or somehow has an odd idea about it's own
network addresses, it will fail to accept this packet if we set an
address.  It seems easiser not to.  (Found by testing with NetAPP at
plugfest)

Andrew Bartlett
This commit is contained in:
Andrew Bartlett 2009-09-15 22:02:36 -07:00
parent e8e8e40505
commit 932690c093
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
source4/kdc/kpasswdd.c
View File

@ -528,11 +528,19 @@ bool kpasswdd_process(struct kdc_server *kdc,
/* The kerberos PRIV packets include these addresses. MIT
* clients check that they are present */
#if 0
/* Skip this part for now, it breaks with a NetAPP filer and
* in any case where the client address is behind NAT. If
* older MIT clients need this, we might have to insert more
* complex code */
nt_status = gensec_set_peer_addr(gensec_security, peer_addr);
if (!NT_STATUS_IS_OK(nt_status)) {
talloc_free(tmp_ctx);
return false;
}
#endif
nt_status = gensec_set_my_addr(gensec_security, my_addr);
if (!NT_STATUS_IS_OK(nt_status)) {
talloc_free(tmp_ctx);