1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

267 Commits

Author SHA1 Message Date
Günther Deschner
3bb394f3d6 werror: replace WERR_SETUP_NOT_JOINED with WERR_NERR_SETUPNOTJOINED in source3/libnet/libnet_join.c
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-28 00:04:31 +02:00
Günther Deschner
0d8b3e48ed werror: replace WERR_SETUP_ALREADY_JOINED with WERR_NERR_SETUPALREADYJOINED in source3/libnet/libnet_join.c
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-28 00:04:30 +02:00
Günther Deschner
c04f9679a0 werror: replace WERR_DCNOTFOUND with WERR_NERR_DCNOTFOUND in source3/libnet/libnet_join.c
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-28 00:04:29 +02:00
Günther Deschner
0dfab6f0a0 werror: replace WERR_NO_SUCH_SERVICE with WERR_SERVICE_DOES_NOT_EXIST in source3/libnet/libnet_join.c
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-28 00:04:24 +02:00
Günther Deschner
052979b7b7 werror: replace WERR_INVALID_PARAM with WERR_INVALID_PARAMETER in source3/libnet/libnet_join.c
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-28 00:04:22 +02:00
Günther Deschner
7cd429d1cd werror: replace WERR_GENERAL_FAILURE with WERR_GEN_FAILURE in source3/libnet/libnet_join.c
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-28 00:04:20 +02:00
Günther Deschner
0cec6f2b23 werror: replace WERR_NOMEM with WERR_NOT_ENOUGH_MEMORY in source3/libnet/libnet_join.c
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-28 00:04:18 +02:00
Andreas Schneider
631e063f6b s3-lib: Do not set an empty string in split_domain_user()
The function should also return if it failed or not.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sun Sep 25 12:56:17 CEST 2016 on sn-devel-144
2016-09-25 12:56:17 +02:00
Amitay Isaacs
44baf81e83 s3-libnet: Fix format-nonliteral warning
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12168

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-24 01:33:50 +02:00
Amitay Isaacs
23b4fb681a s3-libnet: Add missing format element
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12163

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Aug 18 23:49:42 CEST 2016 on sn-devel-144
2016-08-18 23:49:42 +02:00
Andreas Schneider
9316a806db s3-libnet: Add a comment to make cleaŕ we want to fall through
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jun 24 05:58:35 CEST 2016 on sn-devel-144
2016-06-24 05:58:34 +02:00
Michael Adam
e29d8f108c libnet: ignore realm setting for domain security joins to AD domains if 'winbind rpc only = true'
Inspired by initial patch from Matt Rogers @ RedHat.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11977

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Wed Jun 22 05:05:47 CEST 2016 on sn-devel-144
2016-06-22 05:05:47 +02:00
Michael Adam
7720d04755 Revert "s3:libnet: accept empty realm for AD domains when only security=domain is set."
This reverts commit 234a470f19.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2016-06-22 01:02:27 +02:00
Michael Adam
d2ebe2d17d libnet: only create local private krb5.conf if joining an AD domain
This prevents irritating warning messages.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jun 17 08:13:55 CEST 2016 on sn-devel-144
2016-06-17 08:13:55 +02:00
Günther Deschner
234a470f19 s3:libnet: accept empty realm for AD domains when only security=domain is set.
Initial patch from Matt Rogers @ RedHat.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11977

Guenther

Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Jun 15 20:28:31 CEST 2016 on sn-devel-144
2016-06-15 20:28:31 +02:00
Alexander Bokovoy
4c408f6de5 libnet_join: use sitename if it was set by pre-join detection
When domain member is joined to AD, we need to use the same DC to
authenticate against after the join because the machine account might
not be replicated yet to other domain controllers, including off-site.

Bug https://bugzilla.samba.org/show_bug.cgi?id=11769 dealt with
detection of the site pre-join. However, we rewrite private local
krb5.conf afterwards without taking the discovered site name into
account.

Fix this by reusing the site discovered pre-join.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11975

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jun 15 15:25:44 CEST 2016 on sn-devel-144
2016-06-15 15:25:44 +02:00
Ralph Boehme
0f6d51f34b s3:libnet:libnet_join: add netbios aliases as SPNs
Add all listed smb.conf netbios aliases as SPNs to the machine account:

  HOST/NETBIOS_ALIAS@REALM

and

  HOST/netbios_alias.dnsdomain.name@REALM

Bug: https://bugzilla.samba.org/show_bug.cgi?id=1703

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed May  4 17:58:05 CEST 2016 on sn-devel-144
2016-05-04 17:58:05 +02:00
Ralph Boehme
121196e187 CVE-2016-2115: s3:libnet: use SMB_SIGNING_IPC_DEFAULT
Use SMB_SIGNING_IPC_DEFAULT for RPC connections.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-04-12 19:25:26 +02:00
Günther Deschner
06aefe4b95 s3:libnet:libnet_join: update msDS-SupportedEncryptionTypes (if required) with machine creds.
Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Mar 14 19:38:48 CET 2016 on sn-devel-144
2016-03-14 19:38:48 +01:00
Günther Deschner
5d498d1b4d s3:libnet:libnet_join: fill in output enctypes and only modify when necessary.
Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-14 16:19:23 +01:00
Günther Deschner
e0da059b39 s3:libnet:libnet_join: define list of desired encryption types only once.
Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-14 16:19:23 +01:00
Günther Deschner
df8f79cc9d s3:libnet:libnet_join: always try to create machineaccount via LDAP first.
Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-14 16:19:23 +01:00
Günther Deschner
71d5634ab5 s3:libnet:libnet_join: prepare to allow connecting with machine creds.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-14 16:19:22 +01:00
Günther Deschner
6686f67d2a Partly revert "s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add"
This partly reverts commit 0c74d62524.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-14 16:19:22 +01:00
Uri Simchoni
0dbab0e33e libnet: make Kerberos domain join site-aware
When joining a domain using Kerberos authentication, create a
configuration file for the Kerberos libs to prefer on-site
domain controllers, without relying on the winbindd Kerberos
locator, which many not be operational at this stage.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11769

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Mar  8 01:30:35 CET 2016 on sn-devel-144
2016-03-08 01:30:35 +01:00
Stefan Metzmacher
0c74d62524 s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add
We may not have the permission to modify the object after creation.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Björn Jacke <bj@sernet.de>
Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Feb 26 11:30:03 CET 2016 on sn-devel-144
2016-02-26 11:30:03 +01:00
Uri Simchoni
ed2ed1ad69 net: fix the order of DC lookup methods when joining a domain
The dsgetdcname() function is able to try just DNS lookup, just NetBIOS,
or start with DNS and fall back to NetBIOS. For "net ads join", we know
most of the time whether the name of the domain we're joining is a DNS
name or a NetBIOS name. In that case, it makes no sense to try both lookup
methods, especially that DNS may fail and we want to fall back from site-aware
DNS lookup to site-less DNS lookup, with no NetBIOS lookup in between.

This change lets "net ads join" tell libnet what is the type of the domain
name, if it is known.

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-09 12:33:25 +02:00
Stefan Metzmacher
0f3e32247c s3:libnet: use cli_credentials based functions in libnet_join_ok()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2015-03-12 17:13:43 +01:00
Noel Power
a5d383cbd5 allow net ads join accept new osServicePack parameter
osServicePack paramater allows the default behaviour ( which is to use
the samba version string as the operatingSystemServicePack attribute )
to be overridden
Additionally make sure if blank string is passed that it is treated
as attribute deletion. This is necessary as values for the os attributes
are eventually passed to ads_modlist_add if the value is "" then the
attempt to add this attribute fails in the underlying ldap
'ldap_modfiy_ext_s' function. In this case we need to pass NULL as the
value to force deletion of the ldap attribute

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan  8 00:18:05 CET 2015 on sn-devel-104
2015-01-08 00:18:05 +01:00
Andrew Bartlett
c3b5f9cff5 auth: Allow domain join to itself when we are a PDC
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10891

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-12-11 19:14:06 +01:00
Andrew Bartlett
b299409410 netapi: Move DC check to NetJoinDomain() where it is needed.
This partially reverts 15f6e27bd5.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10891

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-12-11 19:14:06 +01:00
Günther Deschner
a62cc2ce44 samba: pass down size_t instead of int to add_string_to_array().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Mon Nov 17 19:53:22 CET 2014 on sn-devel-104
2014-11-17 19:53:22 +01:00
Andrew Bartlett
ae72733874 s3-winbindd: Attempt to connect to NETLOGON over NCACN_IP_TCP if we can
This is very helpful in the trusted domain situation, as we may not
have a two-way trust but we can use our domain trust account to set up
a connection to NETLOGON

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Oct  8 12:48:15 CEST 2014 on sn-devel-104
2014-10-08 12:48:15 +02:00
Günther Deschner
f64e76dad4 s3-libnet: set list of allowed krb5 encryption types in AD >= 2008.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-09-26 21:11:35 +02:00
Günther Deschner
0aacbe78bb s3-libnet: Make sure we do not overwrite precreated SPNs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9984

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Sep 26 08:22:45 CEST 2014 on sn-devel-104
2014-09-26 08:22:45 +02:00
Andreas Schneider
7e0b8fcce5 s3-libnet: Add libnet_join_get_machine_spns().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9984

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-09-26 05:55:34 +02:00
Andreas Schneider
d70c1e41ec s3-libnet: Improve error message.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jul  2 16:54:10 CEST 2014 on sn-devel-104
2014-07-02 16:54:10 +02:00
Günther Deschner
a8c0de35f7 s3-kerberos: remove unused kdc_name from create_local_private_krb5_conf_for_domain().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Mar  7 18:43:57 CET 2014 on sn-devel-104
2014-03-07 18:43:57 +01:00
Stefan Metzmacher
3a89eee03a s3:libnet: use rpccli_{create,setup}_netlogon_creds() in libnet_join_joindomain_rpc_unsecure
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-01-07 12:47:10 +01:00
Stefan Metzmacher
963800539c s3:libnet_join: make use of rpccli_{create,setup}_netlogon_creds()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-01-07 12:47:10 +01:00
Stefan Metzmacher
5adfc5f9f7 s3:rpc_client: use netlogon_creds_cli_auth_level() in cli_rpc_pipe_open_schannel_with_key()
This means the auth level is now based on the "winbindd sealed pipes" option,
defaulting to "yes" and DCERPC_AUTH_LEVEL_PRIVACY.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-01-07 12:47:07 +01:00
Stefan Metzmacher
38d4dba374 s3:rpc_client: make use of the new netlogon_creds_cli_context
This exchanges rpc_pipe_client->dc with rpc_pipe_client->netlogon_creds
and lets the secure channel session state be stored in node local database.

This is the proper fix for a large number of bugs:
https://bugzilla.samba.org/show_bug.cgi?id=6563
https://bugzilla.samba.org/show_bug.cgi?id=7944
https://bugzilla.samba.org/show_bug.cgi?id=7945
https://bugzilla.samba.org/show_bug.cgi?id=7568
https://bugzilla.samba.org/show_bug.cgi?id=8599

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-01-07 12:47:06 +01:00
Jeremy Allison
0dc6181894 CVE-2013-4408:s3:Ensure LookupNames replies arrays are range checked.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:46 +01:00
Andreas Schneider
d02d70251f s3-libnet: Use a const char for realm.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Nov 15 23:11:54 CET 2013 on sn-devel-104
2013-11-15 23:11:54 +01:00
Günther Deschner
25be92b925 s3-libnetjoin: Fix Bug #10262: use upper-case realm when composing default upn.
In case we are about to generate a keytab during the join make sure the default
upn we create is usable with kinit -k.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10262

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Nov 12 16:39:03 CET 2013 on sn-devel-104
2013-11-12 16:39:03 +01:00
Stefan Metzmacher
beba32619a s3:libnet_join: try to use NETLOGON_NEG_SUPPORTS_AES
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-10 09:18:53 +02:00
Stefan Metzmacher
1242ab0cb3 s3:libnet: let the caller truncate the pw in libnet_join_joindomain_rpc_unsecure()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:30:01 +02:00
Günther Deschner
c4d6d75cf4 s3-libnetjoin: add machine_name length check.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:30:01 +02:00
Günther Deschner
cc0cbd4fdc s3: libnet_join: use admin_domain in libnetjoin.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:30:01 +02:00
Günther Deschner
9813fe2b04 s3-rpc_cli: pass down ndr_interface_table to cli_rpc_pipe_open_noauth().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:30:00 +02:00