1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

400 Commits

Author SHA1 Message Date
Stefan Metzmacher
dd9155a7ec s3:winbindd: make use of lp_cli_{min,max}protocol()
This changes winbindd back to use NT1 as defeault.

https://bugzilla.samba.org/show_bug.cgi?id=9514

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-08-15 09:07:05 +02:00
Andreas Schneider
7080917a87 Followup patch for BUG: https://bugzilla.samba.org/show_bug.cgi?id=10082
Thanks to Jim Brown <jim.brown@rsmas.miami.edu>

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Aug 15 03:46:20 CEST 2013 on sn-devel-104
2013-08-15 03:46:19 +02:00
Volker Lendecke
5f75814586 winbind3: Fix an invalid free
This fixes a warning I've never seen before :-)

../source3/winbindd/winbindd_cm.c:781:59: warning: attempt to free a non-heap object ‘machine_krb5_principal’ [-Wfree-nonheap-object]

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Aug 14 14:04:16 CEST 2013 on sn-devel-104
2013-08-14 14:04:16 +02:00
Günther Deschner
1b57fd180c s3-winbindd: fix fallback to ncacn_np in cm_connect_lsat().
Fallback to lsa named-pipe connection when tcp connection has failed twice (it
could be a trusted domain connection where we cannot setup a secure channel).

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9615
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9899

Signed-off-by: Günther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Tested-by: Christof Schmitt <christof.schmitt@us.ibm.com>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Aug 13 20:55:33 CEST 2013 on sn-devel-104
2013-08-13 20:55:33 +02:00
Andreas Schneider
52d66d81f1 s3-winbind: Fix a segfault passing NULL to a fstring argument.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10082

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Aug 13 13:58:26 CEST 2013 on sn-devel-104
2013-08-13 13:58:25 +02:00
Günther Deschner
9813fe2b04 s3-rpc_cli: pass down ndr_interface_table to cli_rpc_pipe_open_noauth().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:30:00 +02:00
Günther Deschner
3dc3a6c848 s3-rpc_cli: pass down ndr_interface_table to cli_rpc_pipe_open_schannel_with_key().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-08-05 10:30:00 +02:00
Andreas Schneider
659dd65f8f winbind: Correctly use names in the domain struct.
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-03-05 23:29:29 +01:00
Andreas Schneider
14bae61ba3 winbind: Use talloc for allocating domain, dns, forest and dc name.
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-03-05 23:29:11 +01:00
Andreas Schneider
d555f6d789 winbind: Don't leak memory on return.
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2013-02-22 16:36:13 +01:00
Andreas Schneider
de14fd942a winbind: Use uint8_t type and use const where needed.
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2013-02-22 16:36:12 +01:00
Stefan Metzmacher
fdf9da96c5 s3:winbindd: s/event_add_timed/tevent_add_timer
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-02-19 23:48:02 +01:00
Stefan Metzmacher
3ae2ed4504 s3:winbindd: s/struct timed_event/struct tevent_timer
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-02-19 23:47:55 +01:00
Stefan Metzmacher
b946b45799 s3:winbindd: s/struct event_context/struct tevent_context
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-02-19 23:47:50 +01:00
Günther Deschner
7bd9a3b86f s3-winbindd: add cm_connect_lsat().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-30 11:49:34 +01:00
Andreas Schneider
cb0064d35c BUG 9436: Fix leaking sockets of SMB connections to a DC.
As this is a burst of 3 unbound sockets with each try to reach a DC
we're running out of file descriptors pretty fast. So winbind is then
mostly spinning in an accept loop failing with EMFILE.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jim McDonough <jmcd@samba.org>

Autobuild-User(master): Jim McDonough <jmcd@samba.org>
Autobuild-Date(master): Wed Nov 28 17:17:21 CET 2012 on sn-devel-104
2012-11-28 17:17:20 +01:00
Stefan Metzmacher
2a3eb641fe s3:winbindd: use PROTOCOL_LATEST instead of PROTOCOL_SMB2_02 (bug #9175)
We should use the latest supported dialect.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewd-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Nov  1 18:11:27 CET 2012 on sn-devel-104
2012-11-01 18:11:26 +01:00
Stefan Metzmacher
45105afffc s3:winbindd: disconnection after getting NETWORK_SESSION_EXPIRED (bug #9175)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-01 16:27:14 +01:00
Sumit Bose
8e53b9dd51 s3-winbindd: Allow DNS resolution of trusted domains if DNS name is avaliable
Signed-off-by: Günther Deschner <gd@samba.org>
2012-09-28 22:44:08 +02:00
Jeremy Allison
526e875cec Check error returns from strupper_m() (in all reasonable places). 2012-08-09 12:06:54 -07:00
Andrew Bartlett
f3562424b6 lib/param: Move all enum declarations to lib/param
This is in preperation for the parameter table being made common.

Andrew Bartlett

Pair-Programmed-With: Andrew Tridgell <tridge@samba.org>
2012-07-24 11:01:17 +02:00
Andreas Schneider
98b9ef54f2 Enable AES in winbind.
Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 13:53:38 +02:00
Jeremy Allison
726ecf6a91 Fix bug #9016 - Connection to outbound trusted domain goes offline.
By the time we've gotten to init_dc_connection_network() we shouldn't
be second guessing the caller by calling winbindd_can_contact_domain().

If for some reason we do need to restrict the contact list here we
can add a condition to only contact the primary domain or domains
listed in the tdc cache, but I don't think that's neccessary.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Jul 14 03:17:57 CEST 2012 on sn-devel-104
2012-07-14 03:17:57 +02:00
Michael Adam
c43505b621 s3: rename sid_check_is_domain() to sid_check_is_our_sam()
This does not check whether the given sid is the domain sid,
but whether it is the sid of the local sam, which is different
for a domain member server.
2012-07-12 16:43:51 +02:00
Luk Claes
764b5e5610 s3:libsmb: get rid of cli_negprot
Signed-off-by: Luk Claes <luk@debian.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-05-28 14:49:49 +02:00
Luk Claes
82895ab22f s3:libsmb: get rid of cli_state_disconnect
Signed-off-by: Luk Claes <luk@debian.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-05-28 14:49:49 +02:00
Luk Claes
278ba9928a s3:libsmb: get rid of cli_state_security_mode
Signed-off-by: Luk Claes <luk@debian.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-05-28 14:49:48 +02:00
Luk Claes
3c9c06ac05 s3:libsmb: get rid of cli_state_capabilities
Signed-off-by: Luk Claes <luk@debian.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-05-28 14:49:46 +02:00
Luk Claes
d8c0646a5d s3:libsmb: get rid of cli_state_protocol
Signed-off-by: Luk Claes <luk@debian.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-05-28 14:49:45 +02:00
Luk Claes
4f6f4ea93c s3:libsmb: get rid of cli_state_remote_name
Signed-off-by: Luk Claes <luk@debian.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-05-28 14:49:45 +02:00
Luk Claes
987e81b0ee s3:libsmb: get rid of cli_state_*_sockaddr
Signed-off-by: Luk Claes <luk@debian.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-05-28 14:49:44 +02:00
Herb Lewis
42b2026a83 Second part of fix for bug 8953 - winbind can hang as nbt_getdc() has no timeout.
If we're running with SEC_ADS and we don't get a cldap response from
the server when querying its name, don't fall back to NetBIOS requests
as they're unlikely to succeed.

Signed-off-by: Jeremy Allison <jra@samba.org>

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed May 23 03:49:36 CEST 2012 on sn-devel-104
2012-05-23 03:49:35 +02:00
Jeremy Allison
d673402992 Fix bug #8953 - winbind can hang as nbt_getdc() has no timeout.
Add a timeout_in_seconds parameter to nbt_getdc() to make it fail
after that time with NT_STATUS_IO_TIMEOUT.
2012-05-22 16:25:14 -07:00
Stefan Metzmacher
34ffa6175b s3:winbindd: also try SMB2 when connecting to "IPC$"
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Fri Apr 27 13:10:15 CEST 2012 on sn-devel-104
2012-04-27 13:10:15 +02:00
Jelmer Vernooij
c0288e0612 lib/util: Remove obsolete sys_getpid() and sys_fork().
The performance of these is minimal (these days) and they can return
invalid results when used as part of applications that do not use
sys_fork().

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sat Mar 24 21:55:41 CET 2012 on sn-devel-104
2012-03-24 21:55:40 +01:00
Christopher R. Hertel (crh)
b5b204184a Rename obscure defined constants.
Replaced the undescriptive SMB_PORT1 and SMB_PORT2 defined constants
with the slightly more descriptive names NBT_SMB_PORT and TCP_SMB_PORT.
Also replaced several hard-coded references to the well-known port
numbers (139 and 445, respectively) as appropriate.

Small changes to clarify some comments regarding the two transport
types.

Signed-off-by: Simo Sorce <idra@samba.org>

Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Thu Feb 16 08:29:41 CET 2012 on sn-devel-104
2012-02-16 08:29:41 +01:00
Matthieu Patou
05036fab0a s3-winbindd: set the can_do_validation6 also for trusted domain
The flag can_do_validation6 was only set for the domain to which
winbindd is the member. Setting this flag in other domains (trusted
domain) if it's active directory domain is a good idea as it allow to do
level 6 validation also when winbindd is querying them directly.
2012-02-10 12:52:19 -08:00
Andrew Bartlett
40715e1251 s3-librpc: pass struct ndr_interface_table down to cli_pipe_open_generic/spnego()
This allows the target service (as determined from the IDL) to be
passed to GSSAPI (rather than the current, incorrect, "cifs").

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:24 +01:00
Andrew Bartlett
c62af4f652 s3-librpc Make cli_rpc_pipe_open_spnego_ntlmssp() generic
This also avoids passing NULL as the server to
gensec_set_target_hostname() in spnego_generic_init_client().

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-18 16:23:23 +01:00
Stefan Metzmacher
c53a52a264 s3:winbindd_cm: make use of cli_tree_connect()
metze
2011-11-24 19:02:32 +01:00
Stefan Metzmacher
aa2e415442 s3:winbindd_cm: close sockfd on error in cm_prepare_connection()
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Mon Nov 21 19:58:58 CET 2011 on sn-devel-104
2011-11-21 19:58:57 +01:00
Björn Baumbach
aef5fcbfc7 s3-winbindd/winbindd_cm.c: remove cli_nt_error()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-11-16 19:02:12 +01:00
Stefan Metzmacher
c64ebcf643 s3:winbindd_cm: remove unused ads_status
metze
2011-11-16 19:02:12 +01:00
Stefan Metzmacher
6db670386b s3:winbindd: s/Undefined/SMB_SIGNING_DEFAULT/
metze
2011-11-03 16:55:12 +01:00
Stefan Metzmacher
3f00cce9b3 s3:libsmb: pass max_protocol to cli_negprot()
metze
2011-09-15 10:25:17 +02:00
Stefan Metzmacher
faab79e28e s3:winbindd_cm: make use of cli_state_security_mode()
metze
2011-09-13 18:12:23 +02:00
Stefan Metzmacher
cdca1e0ac3 s3:libsmb: pass CLI_FULL_CONNECTION_* flags to cli_state_create()
metze
2011-09-08 08:51:48 +02:00
Stefan Metzmacher
33a6a4ea85 s3:winbindd_cm: use cli_session_setup() instead of cli_session_setup_spnego()
metze
2011-08-10 11:14:56 +02:00
Stefan Metzmacher
c6a3dedd99 s3:libsmb: store the remote_realm on the cli_state
metze
2011-08-10 11:14:55 +02:00
Stefan Metzmacher
71cec7b37a s3:winbindd_cm: make use of cli_set_timeout()
metze
2011-08-03 09:01:39 +02:00
Stefan Metzmacher
a60b1695b1 s3:winbindd_cm: make use of cli_state_protocol()
metze
2011-08-02 04:54:28 +02:00
Stefan Metzmacher
3ce648aee4 s3:winbindd_cm: make use of cli_state_capabilities()
metze
2011-08-02 04:54:28 +02:00
Stefan Metzmacher
477a8a7e47 s3:winbindd_cm: use controller instead of cli->desthost
The should have the same value.

metze
2011-07-22 17:06:10 +02:00
Stefan Metzmacher
8bea5d6402 s3:winbindd_cm: use cli_state_[local|remote]_sockaddr()
metze
2011-07-22 17:06:08 +02:00
Stefan Metzmacher
2b1fc7c0d3 s3:winbindd_cm: remove unused checks for address family
If we got a connection, we don't need to check what
address family it uses.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Jul 21 23:33:48 CEST 2011 on sn-devel-104
2011-07-21 23:33:48 +02:00
Stefan Metzmacher
ebe258dd40 s3:libsmb: replace cli_initialise[_ex]() by cli_state_create()
This makes sure cli_state->src_ss and cli_state->dest_ss are always
initialized.

metze
2011-07-21 22:08:53 +02:00
Christian Ambach
bca69bfbc3 s3:winbindd remove an unused variable
fixes a compiler warning
2011-07-21 14:57:10 +02:00
Stefan Metzmacher
7c10b5e033 s3:winbindd_cm: make use of cli->src_ss instead of calling getsockname()
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Mon Jul 11 19:31:14 CEST 2011 on sn-devel-104
2011-07-11 19:31:13 +02:00
Stefan Metzmacher
cf4832d010 s3:winbindd_cm: make use of cli->dest_ss instead calling getpeername()
metze
2011-07-11 18:18:30 +02:00
Stefan Metzmacher
7a795ffeb4 s3:winbindd_cm: make use of cli_state_disconnect()
metze
2011-07-11 18:18:29 +02:00
Stefan Metzmacher
0791a4d5be s3:winbindd_cm: make use of cli_state_is_connected()
metze
2011-07-11 18:18:29 +02:00
Andrew Bartlett
74eed8f3ed s3-param Remove special case for global_myname(), rename to lp_netbios_name()
There is no reason this can't be a normal constant string in the
loadparm system, now that we have lp_set_cmdline() to handle overrides
correctly.

Andrew Bartlett
2011-06-09 12:40:09 +02:00
Andrew Bartlett
73b377432c s3-talloc Change TALLOC_REALLOC_ARRAY() to talloc_realloc()
Using the standard macro makes it easier to move code into common, as
TALLOC_REALLOC_ARRAY isn't standard talloc.

Andrew Bartlett
2011-06-09 12:40:08 +02:00
Günther Deschner
27022587e3 s3-libsmb: move protos to libsmb/proto.h
Guenther
2011-05-06 16:37:18 +02:00
Jeremy Allison
8380835fc6 Fix warning messages caused by addition of null check in fstrcpy macro. 2011-05-04 12:12:15 -07:00
Günther Deschner
0bb4701a74 s3: remove various references to server side dcerpc structs (which are not needed).
Guenther
2011-05-02 15:03:44 +02:00
Volker Lendecke
aa5abcaf7e s3: Make winbindd_reinit_after_fork return NTSTATUS 2011-04-29 16:57:37 +02:00
Volker Lendecke
0757688eb3 s3: In winbind, close parent/child sockets
This should further reduce fd load in winbind children
2011-04-29 16:57:36 +02:00
Volker Lendecke
2e1522f378 s3: Close the winbind client fds after forking
In an overload situation, the winbind helper child process inherits all those
hundreds of fd's which it will never talk to. Close them.

We (Christian Ambach and me) just saw a crash in libkrb5. Christian's analysis
showed that libkrb5 also does select, probably exceeding FD_SETSIZE and
crashing due to that reason. The parent winbind in theory does not do Kerberos
at all, so this should fix that problem.

The crash is interesting because the child process did not really crash.
Somewhere in glibc backtrace() is called, probably due to an assert() or some
explicit consistency check. This then somehow generates a signal probably due
to corrupted memory structures. That signal triggers Samba to again call
backtrace(). This blocks hard on a ptrace_once(). Sorry for the long backtrace
here, but this *is* interesting.

The child process blocking and not really crashing makes the situation worse:
The parent process does not get told the child has crashed and more client
sockets pile up.

This patch is intended to put some relief on this problem by closing the
majority of sockets the parent holds.

(gdb) bt
\#0  0x00002ad686a2b07b in pthread_once () from /lib64/libpthread.so.0
\#1  0x00002ad6867adf87 in backtrace () from /lib64/libc.so.6
\#2  0x00002ad683eab27c in log_stack_trace () at lib/util.c:1580
\#3  0x00002ad683eab34b in smb_panic (why=0x2ad6841c6ec3 "internal error") at lib/util.c:1481
\#4  0x00002ad683e9af3e in fault_report (sig=1) at lib/fault.c:52
\#5  sig_fault (sig=1) at lib/fault.c:75 #6  <signal handler called>
\#7  0x00002ad68673b005 in _int_malloc () from /lib64/libc.so.6
\#8  0x00002ad68673c95d in calloc () from /lib64/libc.so.6
\#9  0x00002ad684503e25 in _dl_new_object () from /lib64/ld-linux-x86-64.so.2
\#10 0x00002ad6844ffadc in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2
\#11 0x00002ad684501d43 in _dl_map_object () from /lib64/ld-linux-x86-64.so.2
\#12 0x00002ad68450ac8d in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
\#13 0x00002ad684506ed6 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
\#14 0x00002ad68450a68c in _dl_open () from /lib64/ld-linux-x86-64.so.2
\#15 0x00002ad6867d0ba0 in do_dlopen () from /lib64/libc.so.6
\#16 0x00002ad684506ed6 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
\#17 0x00002ad6867d0d07 in __libc_dlopen_mode () from /lib64/libc.so.6
\#18 0x00002ad6867adeea in init () from /lib64/libc.so.6
\#19 0x00002ad686a2b083 in pthread_once () from /lib64/libpthread.so.0
\#20 0x00002ad6867adf87 in backtrace () from /lib64/libc.so.6
\#21 0x00002ad68673285f in __libc_message () from /lib64/libc.so.6
\#22 0x00002ad68673a30f in _int_free () from /lib64/libc.so.6
\#23 0x00002ad68673a76b in free () from /lib64/libc.so.6
\#24 0x00002ad6853fe346 in krb5int_sendto () from /usr/lib64/libkrb5.so.3
\#25 0x00002ad6853fe511 in krb5_sendto_kdc () from /usr/lib64/libkrb5.so.3
\#26 0x00002ad6853df7c4 in ?? () from /usr/lib64/libkrb5.so.3
\#27 0x00002ad6853e0919 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3
\#28 0x00002ad6853e2a94 in krb5_get_init_creds_password () from /usr/lib64/libkrb5.so.3
\#29 0x00002ad684169ff1 in kerberos_kinit_password_ext (principal=0x2ad684702180 "<sanitized>", password=0x2ad6844c5bb0 "<sanitized>", time_offset=0, expire_time=0x2ad6846bf380, renew_till_time=0x0, cache_name=0x2ad6843cb3e0 "MEMORY:winbind_ccache", request_pac=false, add_netbios_addr=false, renewable_time=<value optimized out>, ntstatus=0x0) at libads/kerberos.c:223
\#30 0x00002ad68416a223 in ads_kinit_password (ads=0x2ad6846bf330) at libads/kerberos.c:327
\#31 0x00002ad68415f725 in ads_sasl_spnego_bind (ads=0x2ad6846bf330) at libads/sasl.c:812
\#32 0x00002ad68415dbc1 in ads_sasl_bind (ads=0x2ad6846bf330) at libads/sasl.c:1114
\#33 0x00002ad68415c09b in ads_connect (ads=0x2ad6846bf330) at libads/ldap.c:711
\#34 0x00002ad683e1b8f7 in ads_cached_connection (domain=0x2ad6846b07c0) at winbindd/winbindd_ads.c:124
\#35 0x00002ad683e1bc85 in sequence_number (domain=0x2ad6846b07c0, seq=0x2ad6846b0cd8) at winbindd/winbindd_ads.c:1233
\#36 0x00002ad683dffdd7 in refresh_sequence_number (domain=0x2ad6846b07c0, force=128) at winbindd/winbindd_cache.c:510
\#37 0x00002ad683e00520 in wcache_fetch (cache=<value optimized out>, domain=0x2ad6846b07c0, format=0x2ad68419901e "U/%s") at winbindd/winbindd_cache.c:638
\#38 0x00002ad683e04ac8 in query_user (domain=0x2ad6846b07c0, mem_ctx=0x2ad6846bc920, user_sid=0x7fff1d0cb8c0, info=0x7fff1d0cb810) at winbindd/winbindd_cache.c:1910
\#39 0x00002ad683df2d38 in winbindd_dual_userinfo (domain=0x2ad6846b07c0, state=0x7fff1d0cc9c0) at winbindd/winbindd_user.c:173
\#40 0x00002ad683e232e0 in fork_domain_child (child=0x2ad6846c2440) at winbindd/winbindd_dual.c:485
\#41 schedule_async_request (child=0x2ad6846c2440) at winbindd/winbindd_dual.c:319
\#42 0x00002ad683e229f2 in async_request_fail (state=0x2ad6846c1d00) at winbindd/winbindd_dual.c:214
\#43 0x00002ad683ebabec in run_events (ev=0x2ad6846aebf0, selrtn=0, read_fds=0x7fff1d0ce910, write_fds=<value optimized out>) at lib/events.c:123
\#44 0x00002ad683df08cb in process_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at winbindd/winbindd.c:1113
\#45 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at winbindd/winbindd.c:1437

Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Thu Apr 28 12:06:12 CEST 2011 on sn-devel-104
2011-04-28 12:06:12 +02:00
Jeremy Allison
1815f0298f Remove fstrings from client struct. Properly talloc strings (ensuring we never end up with a NULL pointer). 2011-04-27 12:06:25 -07:00
Volker Lendecke
23a6af46c8 s3: Add a 10-second timeout for the 445 or netbios connection to a DC 2011-04-25 09:50:32 +02:00
Stefan Metzmacher
f7bc84409a s3:rpc_client: map fault codes to NTSTATUS with dcerpc_fault_to_nt_status()
Most fault codes have a NTSTATUS representation, so use that.

This brings the fault handling in common with the source4/librpc/rpc code,
which make it possible to share more highlevel code, between source3 and
source4 as the error checking can be the same now.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Sun Apr 24 10:44:53 CEST 2011 on sn-devel-104
2011-04-24 10:44:53 +02:00
Günther Deschner
6e3f0d28a4 s3-includes: only include ntdomain.h where needed.
Guenther
2011-03-30 01:13:09 +02:00
Günther Deschner
ab36d597e7 s3-messages: make ndr_messaging.h part of messages.h.
Guenther
2011-03-30 01:13:09 +02:00
Günther Deschner
b2af281e50 s3-messages: only include messages.h where needed.
Guenther
2011-03-30 01:13:09 +02:00
Günther Deschner
235f148590 s3-passdb: use passdb headers where needed.
Guenther
2011-03-30 01:13:08 +02:00
Volker Lendecke
6e9b69fb07 s3: Fix Coverity ID 2173: FORWARD_NULL 2011-03-28 11:16:55 +02:00
Günther Deschner
c53e7f8d58 s3-build: use HAVE_ADS define in some more places.
Guenther
2011-03-19 00:11:18 +01:00
Volker Lendecke
3e4879f3bd s3: Cope with 192.168.1.1/24 in smbcontrol ip-dropped
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Fri Mar 18 14:56:38 CET 2011 on sn-devel-104
2011-03-18 14:56:38 +01:00
Volker Lendecke
a40bb91213 s3: Fix uninitialized variables
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Sat Mar  5 17:25:43 CET 2011 on sn-devel-104
2011-03-05 17:25:43 +01:00
Andreas Schneider
bf18403c81 s3-rpc_client: Move client pipe functions to own header. 2011-02-28 18:15:04 +01:00
Günther Deschner
f60398d7b2 s3-winbindd: let winbind try to use samlogon validation level 6. (bug #7945)
The benefit of this that it makes us more robust to secure channel resets
triggered from tools outside the winbind process. Long term we need to have a
shared tdb secure channel store though as well.

Guenther

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Fri Feb  4 18:11:04 CET 2011 on sn-devel-104
2011-02-04 18:11:04 +01:00
Jeremy Allison
3b4738b2fd Fix value overflow (one too many 'f's ).
Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Thu Feb  3 03:35:32 CET 2011 on sn-devel-104
2011-02-03 03:35:32 +01:00
Günther Deschner
a85b20a164 s3-winbind: prefer dcerpc_lsa_X functions in winbindd/winbind_cm.c
Guenther
2011-02-02 20:00:56 +01:00
Günther Deschner
f21f9192f1 s3-winbind: prefer dcerpc_samr_X functions in invalidate_cm_connection.
Guenther
2011-02-02 13:30:04 +01:00
Günther Deschner
39c6809eeb s3-winbind: prefer dcerpc_samr_X functions in cm_connect_sam.
Guenther
2011-02-02 13:30:04 +01:00
Günther Deschner
02a8e1e490 s3-winbind: use status variable name in cm_connect_sam.
Guenther
2011-02-02 13:30:04 +01:00
Volker Lendecke
7f87d58900 s3: Add wbinfo --dc-info
wbinfo --dc-info prints the current DC name and IP address. This helps
diagnosing problems that might happen when a later wbinfo --ping-dc fails.

This patch started out by using the SAF and NBT cache entires, but those are
relatively short-lived. So I decided to invent a new gencache entry with a very
long timeout. We need to go via the gencache because when for some reason a
winbind child process is stuck, we can't query it for the current DC it's
connected to. This must eventually go away again when we have a fully async
winbind.

Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Wed Jan 19 08:40:28 CET 2011 on sn-devel-104
2011-01-19 08:40:28 +01:00
Günther Deschner
c9b3404c68 s3-winbind: prefer dcerpc_netr_X functions.
Guenther

Signed-off-by: Andreas Schneider <asn@samba.org>
2011-01-13 14:08:09 +01:00
Stefan Metzmacher
cbc7db99d0 s3:winbindd: use ndr_dssetup_c.h instead of cli_dssetup.h
metze
2011-01-11 13:40:56 +01:00
Volker Lendecke
5f4ff3bfbd s3: Use the new nbt_getdc in winbindd_cm 2011-01-07 13:28:07 +01:00
Stefan Metzmacher
f016e4d4bd s3:winbindd: use dcerpc_dssetup_DsRoleGetPrimaryDomainInformation()
metze
2011-01-04 21:29:01 +01:00
Volker Lendecke
9ccef4e62b s3: Remove unused mem_ctx arg from set_getdc_request
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Sat Jan  1 23:00:24 CET 2011 on sn-devel-104
2011-01-01 23:00:24 +01:00
Volker Lendecke
86ff8cf227 s3: Allow more control over smbsock_[any_]connect
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Wed Dec 29 23:30:44 CET 2010 on sn-devel-104
2010-12-29 23:30:44 +01:00
Stefan Metzmacher
c604388ec3 s3:winbindd: remove useless ';'
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Dec 28 12:45:20 CET 2010 on sn-devel-104
2010-12-28 12:45:20 +01:00
Volker Lendecke
5d4ac40f69 s3: Use smbsock_any_connect in winbind 2010-12-22 16:39:15 +01:00
Jeremy Allison
52f2520648 Fix the unexpected.tdb database problem. Change nmbd to store the
transaction id of packets it was requested to send via a client, and
only store replies that match these ids. On the client side change
clients to always attempt to ask nmbd first for name_query and
node_status calls, and then fall back to doing socket calls if
we can't talk to nmbd (either nmbd is not running, or we're not
root and cannot open the messaging tdb's). Fix readers of unexpected.tdb
to delete packets they've successfully read.

This should fix a long standing problem of unexpected.tdb
growing out of control in noisy NetBIOS envioronments with
lots of bradcasts, yet still allow unprivileged client apps
to work mostly as well as they already did (nmblookup for
example) in an environment when nmbd isn't running.

Jeremy.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Sun Nov 14 05:22:45 UTC 2010 on sn-devel-104
2010-11-14 05:22:45 +00:00
Andrew Bartlett
f768b32e37 libcli/security Provide a common, top level libcli/security/security.h
This will reduce the noise from merges of the rest of the
libcli/security code, without this commit changing what code
is actually used.

This includes (along with other security headers) dom_sid.h and
security_token.h

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Oct 12 05:54:10 UTC 2010 on sn-devel-104
2010-10-12 05:54:10 +00:00
Volker Lendecke
bad98e37e7 s3: Add "smbcontrol winbindd ip-dropped <local-ip>"
This is supposed to improve the winbind reconnect time after an ip address
has been moved away from a box. Any kind of HA scenario will benefit from
this, because winbindd does not have to wait for the TCP timeout to kick in
when a local IP address has been dropped and DC replies are not received
anymore.
2010-09-30 14:30:33 +02:00
Björn Jacke
306465a5a4 s3/winbind: use mono time for startup timeout check 2010-09-10 23:10:26 +02:00
Volker Lendecke
e2b63996e8 s3: Make winbind_add_failed_connection_entry static 2010-09-08 21:10:18 +02:00
Volker Lendecke
3928565bc9 s3: Fix a typo 2010-09-08 21:00:03 +02:00
Volker Lendecke
2226347182 s3: Simplify cm_connect_sam a bit 2010-09-08 18:28:16 +02:00
Volker Lendecke
bcad45ed43 s3: Check for sid instead of name in cm_connect_sam 2010-09-08 18:28:16 +02:00
Jeremy Allison
33060f67be Final part of fix for bug #7636 - winbind internal error, backtrace.
Ensure cm_get_schannel_creds() returns NTSTATUS.

Jeremy.
2010-08-23 16:53:45 -07:00
Günther Deschner
be396411a4 s3-winbind: Fix Bug #7568: Make sure cm_connect_lsa_tcp does not reset the secure channel.
This is an important fix as the following could and is happening:

* winbind authenticates a user via schannel secured netlogon samlogonex call,
current secure channel cred state is stored in winbind state, winbind
sucessfully decrypts session key from the info3

* winbind sets up a new schannel ncacn_ip_tcp lsa pipe (and thereby resets the
secure channel on the dc)

* subsequent samlogonex calls use the new secure channel creds on the dc to
encrypt info3 session key, while winbind tries to use old schannel creds for
decryption

Guenther
2010-08-09 16:36:22 +02:00
Günther Deschner
c136b84f0d s3-secrets: only include secrets.h when needed.
Guenther
2010-08-05 10:12:25 +02:00
Günther Deschner
e7a6a3ec0d s3: avoid global include of ads.h.
Guenther
2010-08-05 00:32:02 +02:00
Günther Deschner
0da5e15378 s3-winbindd: route samr chgpwd ops for own domain over internal samr pipe as well.
Guenther
2010-07-07 16:49:26 +02:00
Andreas Schneider
9d23f8fbc5 s3-winbind: Make sure that the policy handles are closed. 2010-07-06 18:38:13 +02:00
Günther Deschner
fbb7814f91 s3: only use netlogon/nbt header when needed.
Guenther
2010-05-31 11:32:37 +02:00
Günther Deschner
230b880d14 s3-rpc_client: move protos to cli_lsarpc.h
Guenther
2010-05-18 21:42:41 +02:00
Günther Deschner
5ed3654112 s3-rpc_client: move protos to cli_netlogon.h
Guenther
2010-05-18 21:42:37 +02:00
Günther Deschner
e3bdff3d67 s3-kerberos: pass down kdc_name to create_local_private_krb5_conf_for_domain().
Guenther
2010-05-17 12:47:50 +02:00
Günther Deschner
14ac2bb36e s3-winbind: make the getpeername() checks in cm_prepare_connection IPv6 aware.
Note that this failure was hard to track, as winbind did only log a super helpful
"cm_prepare_connection: Success" debug message.

IPv6 gurus, please check

Successfully tested in two independent IPv6 networks now.

Guenther
2010-05-17 12:47:34 +02:00
Günther Deschner
c6ebab846d s3: only include gen_ndr headers where needed.
This shrinks include/includes.h.gch by the size of 7 MB and reduces build time
as follows:

ccache build w/o patch
real    4m21.529s
ccache build with patch
real    3m6.402s

pch build w/o patch
real    4m26.318s
pch build with patch
real    3m6.932s

Guenther
2010-05-06 00:22:59 +02:00
Volker Lendecke
f43d1827f3 s3: init_dc_connection() can't init for internal domains
This fixes a crash in winbindd_dual_pam_chng_pswd_auth_crap when given
global_sam_name() in the domain field
2010-04-23 23:41:04 +02:00
Stefan Metzmacher
73577205cf s3:winbindd: fix problems with SIGCHLD handling (bug #7317)
The main problem is that we call CatchChild() within the
parent winbindd, which overwrites the signal handler
that was registered by winbindd_setup_sig_chld_handler().

That means winbindd_sig_chld_handler() and winbind_child_died()
are never triggered when a winbindd domain child dies.
As a result will get "broken pipe" for all requests to that domain.

To reduce the risk of similar bugs in future we call
CatchChild() in winbindd_reinit_after_fork() now.

We also use a full winbindd_reinit_after_fork() in the
cache validation child now instead instead of just resetting
the SIGCHLD handler by hand. This will also fix possible
tdb problems on systems without pread/pwrite and disabled mmap
as we now correctly reopen the tdb handle for the child.

metze
2010-04-01 17:25:11 +02:00
Stefan Metzmacher
a2411c5708 s3:winbindd: correctly invalidate the cached connection
There're maybe additional TCP connection for ncacn_ip_tcp.

metze
2010-04-01 13:01:27 +02:00
Stefan Metzmacher
d930904b99 s3:winbindd: make sure we don't try rpc requests against unaccessable domains
This makes sure we don't crash while trying to dereference domain->conn.cli->foo
while trying to establish a rpc connection to the server.

metze
2010-04-01 13:01:26 +02:00
Stefan Metzmacher
94a4bcd2f0 s3:winbindd_cm: invalidate connection if cm_connect_netlogon() fails
metze
2010-03-29 18:11:18 +02:00
Stefan Metzmacher
4f391fedac s3:winbindd: consistently use TALLOC_FREE(conn->foo_pipe) is we create a new connection
metze
2010-03-29 18:11:18 +02:00
Stefan Metzmacher
d980c06a99 s3:winbindd_cm: use rpccli_is_connected() helper function
metze
2010-03-29 18:11:18 +02:00
Stefan Metzmacher
408a3eb35a s3:winbindd_cm: use cli_state_is_connected() helper function
metze
2010-03-29 18:11:17 +02:00
Simo Sorce
61b7a24f16 s3 move the sitename cache in its own file 2010-02-23 12:46:26 -05:00
Stefan Metzmacher
f924b77492 s3:winbindd: never mark external domains as internal!
This way we can endup with silently using builtin_passdb_methods
for an ad domain without an inbound trust.

This fixes bug #7170.

metze
2010-02-23 10:23:32 +01:00
Bo Yang
36493bf2f6 s3: Fix infinite loop in NCACN_IP_TCP asa there is no timeout. Assume lsa_pipe_tcp is ok but network is down, then send request is ok, but select() on writeable fds loops forever since there is no response.
Signed-off-by: Bo Yang <boyang@samba.org>
2010-01-06 19:19:35 +08:00
Günther Deschner
3d679a3b5f s3-rpc: Avoid including every pipe's client and server stubs everywhere in samba.
Guenther
2009-11-26 20:03:17 +01:00
Volker Lendecke
de63a5ad91 s3: Always try SamLogonEx
Required for cluster systems working in a Samba domain. With NT4 this won't
work, but real NT4 DCs should not be around in environments that pay big bucks
for a cluster... And if they are, they can always install a Samba DC trusting
that NT4 domain.
2009-11-24 16:55:30 +01:00
Günther Deschner
ebe0e64ba9 s3: use enum netr_SchannelType all over the place.
Guenther
2009-10-13 10:21:46 +02:00
Volker Lendecke
872f9c4f91 Revert "s3: Attempt to fix machine password change"
This reverts commit 20a8ea91e1.

Ooops, this should not have been committed.
2009-10-05 22:14:06 +02:00
Volker Lendecke
20a8ea91e1 s3: Attempt to fix machine password change 2009-10-05 22:12:20 +02:00
Stefan Metzmacher
bfd3a6f13a s3:winbindd_cm: don't invalidate the whole connection when just samr gave ACCCESS_DENIED
metze
2009-09-25 08:18:45 +02:00
Stefan Metzmacher
f8425b73d7 Revert "s3:winbindd: use a tcp connection for lsa in case lookup_names/lookup_sids doesn't work over ncacn_np"
This reverts commit f23691cffd.

This should not have been commited...

metze
2009-09-24 06:45:10 +02:00
Günther Deschner
f23691cffd s3:winbindd: use a tcp connection for lsa in case lookup_names/lookup_sids doesn't work over ncacn_np
metze
2009-09-24 06:41:11 +02:00
Volker Lendecke
0724649a8a s3:winbind: Fix an uninitialized variable 2009-09-23 06:25:24 +02:00
Günther Deschner
6a8ef6c424 s3-winbindd: Fix Bug #6711: trusts to windows 2008 (2008 r2) not working.
Winbindd should always try to use LSA via an schannel authenticated ncacn_ip_tcp
connection when talking to AD for LSA lookup calls.

In Samba <-> W2k8 interdomain trust scenarios, LookupSids3 and LookupNames4 via an
schannel ncacn_ip_tcp LSA connection are the *only* options to successfully resolve
sids and names.

Guenther
2009-09-22 16:49:31 +02:00
Günther Deschner
58f2deb940 s3-winbindd: add cm_connect_lsa_tcp().
Guenther
2009-09-22 11:38:06 +02:00
Günther Deschner
d3af0346c8 s3-dcerpc: use dcerpc_AuthLevel and remove duplicate set of flags.
Guenther
2009-09-15 17:49:34 +02:00
Günther Deschner
bea8e5fa60 s3-rpc_client: add dcerpc_transport_t to cli_rpc_pipe_open_schannel().
Guenther
2009-09-11 09:59:04 +02:00
Günther Deschner
032e01e7c1 s3-rpc_client: add dcerpc_transport_t to cli_rpc_pipe_open_spnego_ntlmssp and cli_rpc_pipe_open_ntlmssp.
Guenther
2009-09-11 09:59:04 +02:00
Günther Deschner
32c28e4f64 s3-winbindd: Fix Bug #6700: Use dns domain name when needing to guess server principal.
Patch from Robert LeBlanc <robert@leblancnet.us>.

Thanks!

Guenther
2009-09-09 02:29:58 +02:00
Volker Lendecke
963419be1b s3:winbind: For internal domains it is pointless to connect to a DC 2009-08-23 10:19:32 +02:00
Jeremy Allison
5d05d22999 Added prefer_ipv4 bool parameter to resolve_name().
W2K3 DC's can have IPv6 addresses but won't serve
krb5/ldap or cldap on those addresses. Make sure when
we're asking for DC's we prefer IPv4.
If you have an IPv6-only network this prioritizing code
will be a no-op. And if you have a mixed network then you
need to prioritize IPv4 due to W2K3 DC's.
Jeremy.
2009-07-28 11:51:58 -07:00
Volker Lendecke
d3132e21f3 Fix a typo 2009-07-27 16:15:54 +02:00
Volker Lendecke
646668bc51 Fix some type-punned warnings 2009-05-07 23:38:48 +02:00
Günther Deschner
b5bec1a6d7 s3-secdesc: use SEC_FLAG_MAXIMUM_ALLOWED instead of SEC_RIGHTS_MAXIMUM_ALLOWED.
Guenther
2009-04-21 12:40:47 +02:00
Andrew Bartlett
c185e7a29c Fix to use modified cli_rpc_pipe_open_schannel_with_key API 2009-04-20 17:04:33 +02:00
Andrew Bartlett
53765c81f7 Remove use of talloc_reference in cli_rpc_pipe_open_schannel_with_key() 2009-04-20 16:50:49 +02:00
Andrew Bartlett
32062013c3 s3: Fix ntlm_auth and winbindd to use new common libcli/auth APIs 2009-04-14 19:33:04 +10:00
Andrew Bartlett
f28f113d8e Rework Samba3 to use new libcli/auth code (partial)
This commit is mostly to cope with the removal of SamOemHash (replaced
by arcfour_crypt()) and other collisions (such as changed function
arguments compared to Samba3).

We still provide creds_hash3 until Samba3 uses the credentials code in
netlogon server

Andrew Bartlett
2009-04-14 16:23:35 +10:00
Günther Deschner
531af136f9 s3: remove POLICY_HND.
Guenther
2009-03-18 23:22:29 +01:00
Volker Lendecke
7735650f2e Fix a valgrind error
Found in "make test" -- if we can't connect at all, "cli" is uninitialized
2009-03-17 11:32:23 +01:00
Jeremy Allison
f48a345e4a Remove pwd_cache.c, it was doing nothing. Make user_name, domain, and
password talloc'ed strings within the cli_struct.
Jeremy.
2009-03-13 17:49:24 -07:00
Stefan Metzmacher
589eb81e3f s3:winbindd_cm: remove useless cli_setup_signing_state(*cli, Undefined) call
cli_setup_signing_state() with Undefined is a noop.

metze
2009-03-06 16:37:20 +01:00
Volker Lendecke
0bd92281e4 Make cli_tcon_andx async 2009-01-30 12:47:59 +01:00
Bo Yang
e3ef19b9b9 Fix bug in get_dc_name_via_netlogon(), null pointer refrence. 2009-01-14 11:47:45 -08:00
Jeremy Allison
58b680446f From boyang - ensure we never "return" from a forked child, always _exit().
Jeremy.
2009-01-13 15:42:56 -08:00
Jeremy Allison
d1f7a37174 Make winbindd_cm.c use winbindd_reinit_after_fork().
Jeremy.
2009-01-06 17:34:06 -08:00
Stefan Metzmacher
c34d5f445a s3:events: change event_add_timed() prototype to match samba4
metze
2009-01-05 15:07:35 +01:00
Stefan Metzmacher
492d0e3517 s3:winbindd: regain tickets for all ccache entries, when we go online
set_event_dispatch_time() is stupid by design and only handles
the first event with a given name.

metze
2009-01-05 15:07:33 +01:00
Stefan Metzmacher
f81f21c09b s3:winbindd: recreate the per domain check_online_event without relying on global state
set_event_dispatch_time() is stupid by design and just picks the first
event with the given name.

metze
2009-01-05 15:07:32 +01:00
Bo Yang
f389b97c69 Fix broken krb5 refresh chain
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2009-01-05 15:07:31 +01:00
Bo Yang
022e2f8199 clean event context after child is forked.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2009-01-05 15:07:31 +01:00
Volker Lendecke
bb8ca0fdbf Make cli_negprot return NTSTATUS instead of bool 2008-12-19 10:28:30 +01:00
Tim Prouty
1eb743ab8e s3: Change sockaddr util function names for consistency
Also eliminates name conflicts with OneFS system libraries
2008-12-03 10:40:20 -08:00
Tim Prouty
2efacde8c4 s3: fix a few "shadows a global declaration" warnings 2008-11-03 14:44:38 -08:00
Jelmer Vernooij
ddcab787c4 Rename dos_errstr() to win_errstr() for consistency with Samba 4. 2008-11-01 17:19:26 +01:00
Tim Prouty
0058176ae3 s3: fix simple "incompatible pointer type" build warning 2008-10-23 16:38:19 -07:00
Jelmer Vernooij
d6a5476ee7 Use sockaddr_storage only where we rely on the size, use sockaddr
otherwise (to clarify we can also pass in structs smaller than
sockaddr_storage, such as sockaddr_in).
2008-10-23 19:53:15 +02:00
Günther Deschner
de54bac54c s3: fix NETLOGON_NT_VERSION version flags.
Guenther
2008-09-23 23:20:10 +02:00
Steven Danneman
304554115a Cleanup of DC enumeration in get_dcs()
This is a fix for a few small inefficiencies/bugs in the get_dcs() path.

* because the third add_one_dc_unique() loop was outside the ADS check all DCs
  returned from the non-sitename lookup were being tacked onto the dc_name_ip
  list twice.
* add_one_dc_unique() now checks if the given IP address already exists before
  adding it to the list, making the returned list actually unique
* added more thorough doxygen comment headers
(This used to be commit cb2d488e1d)
2008-09-04 11:50:25 -07:00
Volker Lendecke
d7d3b37d56 Fix some nonempty blank lines
(This used to be commit 541e088656)
2008-08-23 15:12:10 +02:00
Jeremy Allison
4a5ccfb91f Don't re-initialize a token when we already have one. This fixes the build farm failures when winbindd connects as guest.
This one took a *lot* of tracking down :-).
Jeremy.
(This used to be commit dca8277912)
2008-08-22 13:49:46 -07:00
Gerald (Jerry) Carter
7e0314f6a2 winbindd: Fix crash in cm_connect_sam()
Fix segv when talking to parent DC (joined to child domain).

The root cause was

(a) storing the parent domain in the cli_state struct caused
    the NTLMSSP pipe bind to fail which made us fallover to
    the schannel code path
(b) the dcinfo pointer in cm_get_schannel_dcinfo() was returning
    NULL even though the function indicated success.
(This used to be commit 5ce4a2ae66)
2008-08-22 14:50:58 -05:00
Jeremy Allison
79150da70b Here is a re-working of the winbindd
reconnect code to cope with rebooting a DC. This
replaces the code I asked Volker to revert.
The logic is pretty simple. It adds a new parameter,
"winbind reconnect delay", set to 30 seconds by
default, which determines how long to wait between
connection attempts.
To avoid overwhelming the box with DC-probe
forked children, the code now keeps track of
the DC probe child per winbindd_domain struct
and only starts a new one if the existing one
has died.
I also added a little logic to make sure the
dc probe child always sends a message whatever
the reason for exit so we will always reschedule
another connect attempt.
Also added documentation.
Jeremy.
(This used to be commit 8027197635)
2008-08-20 16:24:22 -07:00
Volker Lendecke
e90dc23ff5 Revert "Add winbind:online check timeout parameter"
This reverts commit 9920473cc1.
(This used to be commit 34a32db906)
2008-08-14 11:09:37 +02:00
Volker Lendecke
5a3642d5aa Add winbind:online check timeout parameter
This is a band-aid for the rather convoluted offline/online mess in winbind
right now. Winbind re-uses the offline functionality that is targeted at domain
client installations on laptops to not overload disfunctional DCs. It uses the
winbind cache timeout as the retry timeout after a DC reboot.

I am using a parametric options because when this mess is cleaned up, that
parameter needs to go away again.

I'd recommend to use something like

winbind:online check timeout = 30

in typical LAN environments. This means a reconnect is attempted every 30
seconds.

Volker
(This used to be commit 9920473cc1)
2008-08-13 11:40:35 +02:00
Andrew Tridgell
8fed76b73e fixed a fd leak when trying to regain contact to a domain controller
in winbind

When a w2k3 DC is rebooted the 139/445 ports come up before the
udp/389 cldap port. During this brief period, winbind manages to
connect to 139/445 but not to udp 389. It then enters a tight loop
where it leaks one fd each time. In a couple of seconds it runs out of
file descriptors, and leaves winbind crippled after the DC does
finally come up
(This used to be commit 57187cafbc)
2008-08-06 10:50:16 +02:00
Volker Lendecke
ba2cb35ca5 Refactoring: Change calling conventions for cli_rpc_pipe_open_schannel_with_key
Pass in ndr_syntax_id instead of pipe_idx, return NTSTATUS
(This used to be commit 78e9c937ff)
2008-07-20 17:37:13 +02:00
Volker Lendecke
e0be03d8d5 Refactoring: Change calling conventions for cli_rpc_pipe_open_ntlmssp
Pass in ndr_syntax_id instead of pipe_idx, return NTSTATUS
(This used to be commit a13f059955)
2008-07-20 17:37:11 +02:00
Volker Lendecke
1335da2a7c Refactoring: Change calling conventions for cli_rpc_pipe_open_noauth
Pass in ndr_syntax_id instead of pipe_idx, return NTSTATUS
(This used to be commit 9abc9dc4dc)
2008-07-20 17:37:11 +02:00
Gerald W. Carter
9ff1ffcbee libads: Add API call to connect to a global catalog server.
Extends ads_connect() to a new call ads_connect_gc() which connects on port
3268 rather than port 389.  Also makes ads_try_connect() static and
only used internally to ldap.c
(This used to be commit f4c37dbe2c)
2008-06-27 10:26:11 -04:00
Volker Lendecke
ee281b7479 Revert "Fix a memleak caused by a crappy get_sorted_dc_list() API"
This reverts commit 2ea03a1e95.
(This used to be commit 80c2e8295a)
2008-06-17 12:21:03 +02:00
Jeremy Allison
1db2dc1931 Bugfix noticed by Herb. On using the again: tag as a
goto target we were not reinitializing the array counts.

From Herb:

This is in the file nsswitch/winbindd_cm.c (samba-3.0.30) line 1236

We have a label again: where we keep trying to find the name of the DC
from the list of IPs returned by get_dcs. If we fail to figure out the
name we do a goto again at the end of the function. The problem is we
don't reset the num_dcs, num_addrs, etc and free the memory in the
various arrays. This seems wrong to me. I have a winbindd core where
I have 9 IPs returned for the DCs but at the time of the crash num_dcs
is 87 and if I look through the array dcs it keeps repeating entries
from the same group of 9

Jerry, Volker and Guenther please check.

Jeremy.
(This used to be commit 15f464321a)
2008-06-08 14:19:44 -07:00
Volker Lendecke
bde7cbf4a7 Fix a memleak caused by a crappy get_sorted_dc_list() API
(This used to be commit 2ea03a1e95)
2008-06-05 10:56:18 +02:00
Gerald W. Carter
dd7cf3464d winbindd_cm: Replace the use of lp_realm() with our_domain->alt_name.
Reduce the use of config parameters with run time information after discussion
with Guenther.
(This used to be commit 57d596395d)
2008-06-03 11:21:02 -05:00
Michael Adam
c5a030a38a winbind: correctly omit check for trusted domain support in cm_prepare_connection
when checking for a trusted domain situation.
This is how it was meant to be:

Otherwise, with a dc-trusted-domain situation but trusted domains disabled,
we would attempt to do a session setup and fail (wouldn't even get a trust
password).

Michael
(This used to be commit a5a51ca8e5)
2008-05-26 16:42:25 +02:00
Gerald W. Carter
4d2f71e53f Manually merge Steven Danneman's patch for SPNEGO auth to a trusted
Win2008 domain (merged from v3-0-test).

   commit 8dc4e97977
   Author: Steven Danneman <sdanneman@isilon.com>
   Date:   Wed May 7 13:34:26 2008 -0700

      spnego SPN fix when contacting trusted domains

      cli_session_setup_spnego() was not taking into consideration the situation
      where we're connecting to a trusted domain, specifically one (like W2K8)
      which doesn't return a SPN in the NegTokenInit.

      This caused two problems:

      1) When guessing the SPN using kerberos_get_default_realm_from_ccache() we
      were always using our default realm, not the realm of the domain we're
      connecting to.

      2) When falling back on NTLMSSP for authentication we were passing the name
      of the domain we're connecting to for use in our credentials when we should be
      passing our own workgroup name.

      The fix for both was to split the single "domain" parameter into
      "user_domain" and "dest_realm" parameters.  We use the "user_domain"
      parameter to pass into the NTLM call, and we used "dest_realm" to create an SPN
      if none was returned in the NegTokenInit2 packet.  If no "dest_realm" is
      provided we assume we're connecting to our own domain and use the credentials
      cache to build the SPN.

      Since we have a reasonable guess at the SPN, I removed the check that defaults
      us directly to NTLM when negHint is empty.
(This used to be commit b78b14c88e)
2008-05-23 16:01:45 -05:00
Gerald W. Carter
b72fc49f44 Manually port Steven Dannenman fix for using the correct machine domain when
looking up trust credentials in our tdb.

   commit fd0ae47046
   Author: Steven Danneman <sdanneman@isilon.com>
   Date:   Thu May 8 13:34:49 2008 -0700

      Use machine account and machine password from our domain when
      contacting trusted domains.
(This used to be commit 69b37ae607)
2008-05-23 15:19:58 -05:00
Günther Deschner
f11acf3582 Use strip_hostname after dsgetdcname/getdcname calls.
Guenther
(This used to be commit 82cbb3269b)
2008-05-09 14:59:19 +02:00
Günther Deschner
9be17e2187 dsgetdcname: mailslot replies are identical to the cldap ones, use cldap everywhere.
Guenther
(This used to be commit fe904ee77a)
2008-05-09 14:59:19 +02:00
Günther Deschner
1f6065765c mailslot/cldap: use nt_version bits in queries.
Guenther
(This used to be commit b261f06312)
2008-05-06 09:41:41 +02:00
Günther Deschner
b77601a4b7 mailslot: allow to give back struct nbt_ntlogon_packet.
Guenther
(This used to be commit 2b178dcae6)
2008-04-24 22:01:52 +02:00
Günther Deschner
e66d452466 mailslot: allow to define nt_version in send_getdc_request().
Guenther
(This used to be commit ce3728191b)
2008-04-24 22:01:51 +02:00
Volker Lendecke
0c4093a234 Fix CLEAR_IF_FIRST handling of messages.tdb
We now open messages.tdb even before we do the become_daemon. become_daemon()
involves a fork and an immediate exit of the parent, thus the
parent_is_longlived argument must be set to false in this case. The parent is
not really long lived :-)
(This used to be commit 4f4781c6d1)
2008-04-23 22:18:26 +02:00
Günther Deschner
bcbac69d1a cldap: avoid duplicate definitions so remove ads_cldap.h.
Guenther
(This used to be commit 538eefe22a)
2008-04-21 20:21:40 +02:00
Günther Deschner
1eca3f138c winbind: pass down existing talloc context.
Guenther
(This used to be commit 675bf42cff)
2008-04-21 20:21:39 +02:00
Günther Deschner
937091161b winbind: Use libnbt for NTLOGON SAMLOGON mailslot request and reply.
Guenther
(This used to be commit 2d6a1c5da6)
2008-04-21 11:03:32 +02:00
Volker Lendecke
e73e8297f5 Replace cli_rpc_pipe_close by a talloc destructor on rpc_pipe_struct
(This used to be commit 99fc3283c4)
2008-04-20 14:08:16 +02:00