[SCM] Samba Shared Repository - branch v3-6-test updated
Jeremy Allison
jra at samba.org
Mon Feb 7 11:29:12 MST 2011
The branch, v3-6-test has been updated
via 0655e11 s3: Make "endpoint_table" static
via 6c0ce47 s3: Use the right credentials in check_netlogond_security
via 16caa41 s3: Only build auth_netlogond for the developer build
via f70c91c s3: Add primary group in pdb_ads_enum_group_memberships
via 5633cab s3: Fix auth_netlogond to cope with netlogon_creds_CredentialState
via 1da26c3 s3: Fix a potential memleak in secrets_fetch_trusted_domain_password (cherry picked from commit 47d07df37f5b089ff16ee0e28cde23ed9470f214)
via 05386e5 s3: Fetch the machinepw via ldapi in pdb_ads (cherry picked from commit 843825f56728a6cec2b0b00cc32f97b4b05b3ea8)
via bb4edbd s3: In pdb_ads, cope with artificial samu structs (cherry picked from commit 8c367162f09c7772091a80d8426de6bead0c030d)
via 0e4d78e s3: Use strlcpy in pdb_ads_connect (cherry picked from commit 08f2a8562f67982f69f4bbf5b1034a42529ab226)
via 9e3224a s3: Fix some nonempty blank lines (cherry picked from commit 8af7400d553f9552df78ab4958da7536f15eddf2)
from 4265815 s3-waf: add --with-automount option.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-6-test
- Log -----------------------------------------------------------------
commit 0655e11e968dd4166ef4d349b59d215b0f5e314b
Author: Volker Lendecke <vl at samba.org>
Date: Sun Feb 6 20:42:52 2011 +0100
s3: Make "endpoint_table" static
Andreas, this is only used in srv_epmapper right now. Make public again when
this will be used somewhere else.
Autobuild-User: Volker Lendecke <vlendec at samba.org>
Autobuild-Date: Sun Feb 6 21:33:04 CET 2011 on sn-devel-104
(cherry picked from commit a61b17ce564a1fcd77102f51466844bef6431797)
commit 6c0ce4769eaf99343fc635f52353160fc71febbd
Author: Volker Lendecke <vl at samba.org>
Date: Sun Feb 6 19:56:22 2011 +0100
s3: Use the right credentials in check_netlogond_security
Autobuild-User: Volker Lendecke <vlendec at samba.org>
Autobuild-Date: Sun Feb 6 20:43:03 CET 2011 on sn-devel-104
(cherry picked from commit 40a46a9cca88cc06b028b415e8d1c49d54076307)
commit 16caa415bfe3f10257e7a7f849a899018db6d2d9
Author: Volker Lendecke <vl at samba.org>
Date: Sun Feb 6 19:10:40 2011 +0100
s3: Only build auth_netlogond for the developer build
Autobuild-User: Volker Lendecke <vlendec at samba.org>
Autobuild-Date: Sun Feb 6 19:55:49 CET 2011 on sn-devel-104
(cherry picked from commit 007dc95b143e41d068bb0d83310212cd67b56586)
commit f70c91cb2a1e618b04657cbb8c72dd215aef1fe2
Author: Volker Lendecke <vl at samba.org>
Date: Sun Feb 6 17:53:37 2011 +0100
s3: Add primary group in pdb_ads_enum_group_memberships
Autobuild-User: Volker Lendecke <vlendec at samba.org>
Autobuild-Date: Sun Feb 6 18:41:08 CET 2011 on sn-devel-104
(cherry picked from commit 0539ca51ab450753997d2333d3f4fc44654fa1f5)
commit 5633cab3551695289f759551ee731e035494c49e
Author: Volker Lendecke <vl at samba.org>
Date: Sun Feb 6 15:50:04 2011 +0100
s3: Fix auth_netlogond to cope with netlogon_creds_CredentialState
Autobuild-User: Volker Lendecke <vlendec at samba.org>
Autobuild-Date: Sun Feb 6 17:30:48 CET 2011 on sn-devel-104
(cherry picked from commit d515c6cd5c4884d781f6a84290f16925a3e34af6)
commit 1da26c33212f1275bddb7a09abc6b2f839238cce
Author: Volker Lendecke <vl at samba.org>
Date: Sun Feb 6 15:33:26 2011 +0100
s3: Fix a potential memleak in secrets_fetch_trusted_domain_password
(cherry picked from commit 47d07df37f5b089ff16ee0e28cde23ed9470f214)
commit 05386e5ac316f98b39eee0acead341ea2c3c2485
Author: Volker Lendecke <vl at samba.org>
Date: Sat Feb 5 14:42:01 2011 +0100
s3: Fetch the machinepw via ldapi in pdb_ads
(cherry picked from commit 843825f56728a6cec2b0b00cc32f97b4b05b3ea8)
commit bb4edbdee9a88f5214fd5061bbd9e1f25f084f1e
Author: Volker Lendecke <vl at samba.org>
Date: Sun Feb 6 10:15:50 2011 +0100
s3: In pdb_ads, cope with artificial samu structs
(cherry picked from commit 8c367162f09c7772091a80d8426de6bead0c030d)
commit 0e4d78e3f8400ccce4f53171b9570a1f119c835c
Author: Volker Lendecke <vl at samba.org>
Date: Sat Feb 5 14:41:52 2011 +0100
s3: Use strlcpy in pdb_ads_connect
(cherry picked from commit 08f2a8562f67982f69f4bbf5b1034a42529ab226)
commit 9e3224af50815f4912c9cdcd23afbecd454cf53e
Author: Volker Lendecke <vl at samba.org>
Date: Thu Feb 3 21:47:42 2011 +0100
s3: Fix some nonempty blank lines
(cherry picked from commit 8af7400d553f9552df78ab4958da7536f15eddf2)
-----------------------------------------------------------------------
Summary of changes:
source3/auth/auth_netlogond.c | 240 +++++++++++++++++++++++++++---------
source3/configure.in | 2 +-
source3/include/secrets.h | 2 -
source3/nmbd/nmbd.c | 7 +-
source3/passdb/pdb_ads.c | 50 +++++---
source3/passdb/secrets.c | 29 +----
source3/rpc_client/cli_netlogon.c | 2 +-
source3/rpc_server/srv_epmapper.c | 2 +-
source3/smbd/process.c | 6 +-
9 files changed, 224 insertions(+), 116 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/auth/auth_netlogond.c b/source3/auth/auth_netlogond.c
index 1e3ccb1..9c367e6 100644
--- a/source3/auth/auth_netlogond.c
+++ b/source3/auth/auth_netlogond.c
@@ -20,16 +20,74 @@
#include "includes.h"
#include "../libcli/auth/libcli_auth.h"
#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_schannel.h"
#include "rpc_client/cli_netlogon.h"
#include "secrets.h"
+#include "tldap.h"
+#include "tldap_util.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
+static bool secrets_store_local_schannel_creds(
+ const struct netlogon_creds_CredentialState *creds)
+{
+ DATA_BLOB blob;
+ enum ndr_err_code ndr_err;
+ bool ret;
+
+ ndr_err = ndr_push_struct_blob(
+ &blob, talloc_tos(), creds,
+ (ndr_push_flags_fn_t)ndr_push_netlogon_creds_CredentialState);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ DEBUG(10, ("ndr_push_netlogon_creds_CredentialState failed: "
+ "%s\n", ndr_errstr(ndr_err)));
+ return false;
+ }
+ ret = secrets_store(SECRETS_LOCAL_SCHANNEL_KEY,
+ blob.data, blob.length);
+ data_blob_free(&blob);
+ return ret;
+}
+
+static struct netlogon_creds_CredentialState *
+secrets_fetch_local_schannel_creds(TALLOC_CTX *mem_ctx)
+{
+ struct netlogon_creds_CredentialState *creds;
+ enum ndr_err_code ndr_err;
+ DATA_BLOB blob;
+
+ blob.data = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY,
+ &blob.length);
+ if (blob.data == NULL) {
+ DEBUG(10, ("secrets_fetch failed\n"));
+ return NULL;
+ }
+
+ creds = talloc(mem_ctx, struct netlogon_creds_CredentialState);
+ if (creds == NULL) {
+ DEBUG(10, ("talloc failed\n"));
+ SAFE_FREE(blob.data);
+ return NULL;
+ }
+ ndr_err = ndr_pull_struct_blob(
+ &blob, creds, creds,
+ (ndr_pull_flags_fn_t)ndr_pull_netlogon_creds_CredentialState);
+ SAFE_FREE(blob.data);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ DEBUG(10, ("ndr_pull_netlogon_creds_CredentialState failed: "
+ "%s\n", ndr_errstr(ndr_err)));
+ TALLOC_FREE(creds);
+ return NULL;
+ }
+
+ return creds;
+}
+
static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
const struct auth_context *auth_context,
const char *ncalrpc_sockname,
- uint8_t schannel_key[16],
+ struct netlogon_creds_CredentialState *creds,
const struct auth_usersupplied_info *user_info,
struct netr_SamInfo3 **pinfo3,
NTSTATUS *schannel_bind_result)
@@ -49,17 +107,7 @@ static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
return status;
}
- /*
- * We have to fake a struct dcinfo, so that
- * rpccli_netlogon_sam_network_logon_ex can decrypt the session keys.
- */
-
- p->dc = netlogon_creds_client_init_session_key(p, schannel_key);
- if (p->dc == NULL) {
- DEBUG(0, ("talloc failed\n"));
- TALLOC_FREE(p);
- return NT_STATUS_NO_MEMORY;
- }
+ p->dc = creds;
status = rpccli_schannel_bind_data(p, lp_workgroup(),
DCERPC_AUTH_LEVEL_PRIVACY,
@@ -107,51 +155,125 @@ static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
return NT_STATUS_OK;
}
-static char *mymachinepw(TALLOC_CTX *mem_ctx)
+static NTSTATUS get_ldapi_ctx(TALLOC_CTX *mem_ctx, struct tldap_context **pld)
{
- fstring pwd;
- const char *script;
- char *to_free = NULL;
- ssize_t nread;
- int ret, fd;
-
- script = lp_parm_const_string(
- GLOBAL_SECTION_SNUM, "auth_netlogond", "machinepwscript",
- NULL);
-
- if (script == NULL) {
- to_free = talloc_asprintf(talloc_tos(), "%s/%s",
- get_dyn_SBINDIR(), "mymachinepw");
- script = to_free;
- }
- if (script == NULL) {
- return NULL;
+ struct tldap_context *ld;
+ struct sockaddr_un addr;
+ char *sockaddr;
+ int fd;
+ NTSTATUS status;
+ int res;
+
+ sockaddr = talloc_asprintf(talloc_tos(), "/%s/ldap_priv/ldapi",
+ lp_private_dir());
+ if (sockaddr == NULL) {
+ DEBUG(10, ("talloc failed\n"));
+ return NT_STATUS_NO_MEMORY;
}
- ret = smbrun(script, &fd);
- DEBUG(ret ? 0 : 3, ("mymachinepw: Running the command `%s' gave %d\n",
- script, ret));
- TALLOC_FREE(to_free);
+ ZERO_STRUCT(addr);
+ addr.sun_family = AF_UNIX;
+ strncpy(addr.sun_path, sockaddr, sizeof(addr.sun_path));
+ TALLOC_FREE(sockaddr);
- if (ret != 0) {
- return NULL;
+ status = open_socket_out((struct sockaddr_storage *)(void *)&addr,
+ 0, 0, &fd);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(10, ("Could not connect to %s: %s\n", addr.sun_path,
+ nt_errstr(status)));
+ return status;
}
+ set_blocking(fd, false);
- nread = read(fd, pwd, sizeof(pwd)-1);
- close(fd);
+ ld = tldap_context_create(mem_ctx, fd);
+ if (ld == NULL) {
+ close(fd);
+ return NT_STATUS_NO_MEMORY;
+ }
+ res = tldap_fetch_rootdse(ld);
+ if (res != TLDAP_SUCCESS) {
+ DEBUG(10, ("tldap_fetch_rootdse failed: %s\n",
+ tldap_errstr(talloc_tos(), ld, res)));
+ TALLOC_FREE(ld);
+ return NT_STATUS_LDAP(res);
+ }
+ *pld = ld;
+ return NT_STATUS_OK;;
+}
- if (nread <= 0) {
- DEBUG(3, ("mymachinepwd: Could not read password\n"));
- return NULL;
+static NTSTATUS mymachinepw(uint8_t pwd[16])
+{
+ TALLOC_CTX *frame = talloc_stackframe();
+ struct tldap_context *ld;
+ struct tldap_message *rootdse, **msg;
+ const char *attrs[1] = { "unicodePwd" };
+ char *default_nc, *myname;
+ int rc, num_msg;
+ DATA_BLOB pwdblob;
+ NTSTATUS status;
+
+ status = get_ldapi_ctx(talloc_tos(), &ld);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto fail;
+ }
+ rootdse = tldap_rootdse(ld);
+ if (rootdse == NULL) {
+ DEBUG(10, ("Could not get rootdse\n"));
+ status = NT_STATUS_INTERNAL_ERROR;
+ goto fail;
+ }
+ default_nc = tldap_talloc_single_attribute(
+ rootdse, "defaultNamingContext", talloc_tos());
+ if (default_nc == NULL) {
+ DEBUG(10, ("Could not get defaultNamingContext\n"));
+ status = NT_STATUS_NO_MEMORY;
+ goto fail;
}
+ DEBUG(10, ("default_nc = %s\n", default_nc));
- pwd[nread] = '\0';
+ myname = talloc_asprintf_strupper_m(talloc_tos(), "%s$",
+ global_myname());
+ if (myname == NULL) {
+ DEBUG(10, ("talloc failed\n"));
+ status = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
- if (pwd[nread-1] == '\n') {
- pwd[nread-1] = '\0';
+ rc = tldap_search_fmt(
+ ld, default_nc, TLDAP_SCOPE_SUB, attrs, ARRAY_SIZE(attrs), 0,
+ talloc_tos(), &msg,
+ "(&(sAMAccountName=%s)(objectClass=computer))", myname);
+ if (rc != TLDAP_SUCCESS) {
+ DEBUG(10, ("Could not retrieve our account: %s\n",
+ tldap_errstr(talloc_tos(), ld, rc)));
+ status = NT_STATUS_LDAP(rc);
+ goto fail;
+ }
+ num_msg = talloc_array_length(msg);
+ if (num_msg != 1) {
+ DEBUG(10, ("Got %d accounts, expected one\n", num_msg));
+ status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+ goto fail;
+ }
+ if (!tldap_get_single_valueblob(msg[0], "unicodePwd", &pwdblob)) {
+ char *dn = NULL;
+ tldap_entry_dn(msg[0], &dn);
+ DEBUG(10, ("No unicodePwd attribute in %s\n",
+ dn ? dn : "<unknown DN>"));
+ status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+ goto fail;
}
+ if (pwdblob.length != 16) {
+ DEBUG(10, ("Password hash hash has length %d, expected 16\n",
+ (int)pwdblob.length));
+ status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+ goto fail;
+ }
+ memcpy(pwd, pwdblob.data, 16);
- return talloc_strdup(mem_ctx, pwd);
+fail:
+ TALLOC_FREE(frame);
+ return status;
}
static NTSTATUS check_netlogond_security(const struct auth_context *auth_context,
@@ -165,9 +287,8 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
struct rpc_pipe_client *p = NULL;
struct pipe_auth_data *auth = NULL;
uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
- char *plaintext_machinepw = NULL;
uint8_t machine_password[16];
- uint8_t schannel_key[16];
+ struct netlogon_creds_CredentialState *creds;
NTSTATUS schannel_bind_result, status;
struct named_mutex *mutex = NULL;
const char *ncalrpcsock;
@@ -187,12 +308,13 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
goto done;
}
- if (!secrets_fetch_local_schannel_key(schannel_key)) {
+ creds = secrets_fetch_local_schannel_creds(talloc_tos());
+ if (creds == NULL) {
goto new_key;
}
status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
- schannel_key, user_info, &info3,
+ creds, user_info, &info3,
&schannel_bind_result);
DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
@@ -241,15 +363,14 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
goto done;
}
- plaintext_machinepw = mymachinepw(talloc_tos());
- if (plaintext_machinepw == NULL) {
- status = NT_STATUS_NO_MEMORY;
+ status = mymachinepw(machine_password);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(10, ("mymachinepw failed: %s\n", nt_errstr(status)));
goto done;
}
- E_md4hash(plaintext_machinepw, machine_password);
-
- TALLOC_FREE(plaintext_machinepw);
+ DEBUG(10, ("machinepw "));
+ dump_data(10, machine_password, 16);
status = rpccli_netlogon_setup_creds(
p, global_myname(), lp_workgroup(), global_myname(),
@@ -261,10 +382,7 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
goto done;
}
- memcpy(schannel_key, p->dc->session_key, 16);
- secrets_store_local_schannel_key(schannel_key);
-
- TALLOC_FREE(p);
+ secrets_store_local_schannel_creds(p->dc);
/*
* Retry the authentication with the mutex held. This way nobody else
@@ -272,9 +390,11 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
*/
status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
- schannel_key, user_info, &info3,
+ p->dc, user_info, &info3,
&schannel_bind_result);
+ TALLOC_FREE(p);
+
DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
if (!NT_STATUS_IS_OK(status)) {
diff --git a/source3/configure.in b/source3/configure.in
index b15bcf6..f0d8de7 100644
--- a/source3/configure.in
+++ b/source3/configure.in
@@ -426,7 +426,6 @@ default_static_modules="$default_static_modules auth_wbc"
default_static_modules="$default_static_modules auth_server"
default_static_modules="$default_static_modules auth_domain"
default_static_modules="$default_static_modules auth_builtin"
-default_static_modules="$default_static_modules auth_netlogond"
default_static_modules="$default_static_modules vfs_default"
default_static_modules="$default_static_modules nss_info_template"
@@ -464,6 +463,7 @@ default_shared_modules="$default_shared_modules idmap_autorid"
if test "x$developer" = xyes; then
default_static_modules="$default_static_modules rpc_rpcecho pdb_ads"
+ default_static_modules="$default_static_modules auth_netlogond"
default_shared_modules="$default_shared_modules charset_weird perfcount_test"
fi
diff --git a/source3/include/secrets.h b/source3/include/secrets.h
index 095ab6e..7120655 100644
--- a/source3/include/secrets.h
+++ b/source3/include/secrets.h
@@ -123,7 +123,5 @@ void secrets_fetch_ipc_userpass(char **username, char **domain, char **password)
bool secrets_store_generic(const char *owner, const char *key, const char *secret);
char *secrets_fetch_generic(const char *owner, const char *key);
bool secrets_delete_generic(const char *owner, const char *key);
-bool secrets_store_local_schannel_key(uint8_t schannel_key[16]);
-bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16]);
#endif /* _SECRETS_H */
diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c
index b2230c3..2ed4212 100644
--- a/source3/nmbd/nmbd.c
+++ b/source3/nmbd/nmbd.c
@@ -4,20 +4,19 @@
Copyright (C) Andrew Tridgell 1994-1998
Copyright (C) Jeremy Allison 1997-2002
Copyright (C) Jelmer Vernooij 2002,2003 (Conversion to popt)
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
-
*/
#include "includes.h"
diff --git a/source3/passdb/pdb_ads.c b/source3/passdb/pdb_ads.c
index 01f730e..f153c9e 100644
--- a/source3/passdb/pdb_ads.c
+++ b/source3/passdb/pdb_ads.c
@@ -974,8 +974,7 @@ static NTSTATUS pdb_ads_enum_group_memberships(struct pdb_methods *m,
{
struct pdb_ads_state *state = talloc_get_type_abort(
m->private_data, struct pdb_ads_state);
- struct pdb_ads_samu_private *priv = pdb_ads_get_samu_private(
- m, user);
+ struct pdb_ads_samu_private *priv;
const char *attrs[1] = { "objectSid" };
struct tldap_message **groups;
int i, rc, count;
@@ -983,29 +982,44 @@ static NTSTATUS pdb_ads_enum_group_memberships(struct pdb_methods *m,
struct dom_sid *group_sids;
gid_t *gids;
- rc = pdb_ads_search_fmt(
- state, state->domaindn, TLDAP_SCOPE_SUB,
- attrs, ARRAY_SIZE(attrs), 0, talloc_tos(), &groups,
- "(&(member=%s)(grouptype=%d)(objectclass=group))",
- priv->dn, GTYPE_SECURITY_GLOBAL_GROUP);
- if (rc != TLDAP_SUCCESS) {
- DEBUG(10, ("ldap_search failed %s\n",
- tldap_errstr(talloc_tos(), state->ld, rc)));
- return NT_STATUS_LDAP(rc);
+ priv = pdb_ads_get_samu_private(m, user);
+ if (priv != NULL) {
+ rc = pdb_ads_search_fmt(
+ state, state->domaindn, TLDAP_SCOPE_SUB,
+ attrs, ARRAY_SIZE(attrs), 0, talloc_tos(), &groups,
+ "(&(member=%s)(grouptype=%d)(objectclass=group))",
+ priv->dn, GTYPE_SECURITY_GLOBAL_GROUP);
+ if (rc != TLDAP_SUCCESS) {
+ DEBUG(10, ("ldap_search failed %s\n",
+ tldap_errstr(talloc_tos(), state->ld, rc)));
+ return NT_STATUS_LDAP(rc);
+ }
+ count = talloc_array_length(groups);
+ } else {
+ /*
+ * This happens for artificial samu users
+ */
+ DEBUG(10, ("Could not get pdb_ads_samu_private\n"));
+ count = 0;
}
- count = talloc_array_length(groups);
-
- group_sids = talloc_array(mem_ctx, struct dom_sid, count);
+ group_sids = talloc_array(mem_ctx, struct dom_sid, count+1);
if (group_sids == NULL) {
return NT_STATUS_NO_MEMORY;
}
- gids = talloc_array(mem_ctx, gid_t, count);
+ gids = talloc_array(mem_ctx, gid_t, count+1);
if (gids == NULL) {
TALLOC_FREE(group_sids);
return NT_STATUS_NO_MEMORY;
}
- num_groups = 0;
+
+ sid_copy(&group_sids[0], pdb_get_group_sid(user));
+ if (!sid_to_gid(&group_sids[0], &gids[0])) {
+ TALLOC_FREE(gids);
+ TALLOC_FREE(group_sids);
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+ num_groups = 1;
for (i=0; i<count; i++) {
if (!tldap_pull_binsid(groups[i], "objectSid",
@@ -2206,8 +2220,8 @@ static NTSTATUS pdb_ads_connect(struct pdb_ads_state *state,
ZERO_STRUCT(state->socket_address);
state->socket_address.sun_family = AF_UNIX;
- strncpy(state->socket_address.sun_path, location,
- sizeof(state->socket_address.sun_path) - 1);
+ strlcpy(state->socket_address.sun_path, location,
+ sizeof(state->socket_address.sun_path));
ld = pdb_ads_ld(state);
if (ld == NULL) {
diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c
index 28a725a..45f8e15 100644
--- a/source3/passdb/secrets.c
+++ b/source3/passdb/secrets.c
@@ -169,31 +169,6 @@ bool secrets_delete(const char *key)
return NT_STATUS_IS_OK(status);
}
-bool secrets_store_local_schannel_key(uint8_t schannel_key[16])
-{
- return secrets_store(SECRETS_LOCAL_SCHANNEL_KEY, schannel_key, 16);
-}
-
-bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16])
-{
- size_t size = 0;
- uint8_t *key;
-
- key = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY, &size);
- if (key == NULL) {
- return false;
- }
-
- if (size != 16) {
- SAFE_FREE(key);
--
Samba Shared Repository
More information about the samba-cvs
mailing list