[SCM] Samba Shared Repository - branch v3-4-test updated

[Karolin Seeger]

The branch, v3-4-test has been updated
       via  e647f5b... s3-winbind: Fix Bug #7568: Make sure cm_connect_lsa_tcp does not reset the secure channel.
      from  8564193... s3-libsmb: Fix bug #7577.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-test


- Log -----------------------------------------------------------------
commit e647f5b5409502ec329e24f09202b036cfb357ae
Author: Günther Deschner <gd at samba.org>
Date:   Mon Aug 9 14:31:24 2010 +0200

    s3-winbind: Fix Bug #7568: Make sure cm_connect_lsa_tcp does not reset the secure channel.
    
    This is an important fix as the following could and is happening:
    
    * winbind authenticates a user via schannel secured netlogon samlogonex call,
    current secure channel cred state is stored in winbind state, winbind
    sucessfully decrypts session key from the info3
    
    * winbind sets up a new schannel ncacn_ip_tcp lsa pipe (and thereby resets the
    secure channel on the dc)
    
    * subsequent samlogonex calls use the new secure channel creds on the dc to
    encrypt info3 session key, while winbind tries to use old schannel creds for
    decryption
    
    Guenther
    (cherry picked from commit be396411a4e1f3a174f8a44b6c062d834135e70a)

-----------------------------------------------------------------------

Summary of changes:
 source3/winbindd/winbindd_cm.c |   20 +++++++++++++-------
 1 files changed, 13 insertions(+), 7 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index 3b34a32..1b6c03a 100644
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -2217,6 +2217,7 @@ NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
 			    struct rpc_pipe_client **cli)
 {
 	struct winbindd_cm_conn *conn;
+	struct dcinfo *dcinfo;
 	NTSTATUS status;
 
 	DEBUG(10,("cm_connect_lsa_tcp\n"));
@@ -2237,14 +2238,19 @@ NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
 
 	TALLOC_FREE(conn->lsa_pipe_tcp);
 
-	status = cli_rpc_pipe_open_schannel(conn->cli,
-					    &ndr_table_lsarpc.syntax_id,
-					    NCACN_IP_TCP,
-					    PIPE_AUTH_LEVEL_PRIVACY,
-					    domain->name,
-					    &conn->lsa_pipe_tcp);
+	if (!cm_get_schannel_dcinfo(domain, &dcinfo)) {
+		goto done;
+	}
+
+	status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
+						     &ndr_table_lsarpc.syntax_id,
+						     NCACN_IP_TCP,
+						     PIPE_AUTH_LEVEL_PRIVACY,
+						     domain->name,
+						     dcinfo,
+						     &conn->lsa_pipe_tcp);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(10,("cli_rpc_pipe_open_schannel failed: %s\n",
+		DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
 			nt_errstr(status)));
 		goto done;
 	}


-- 
Samba Shared Repository