[SCM] Samba Shared Repository - branch master updated
Andreas Schneider
asn at samba.org
Thu Apr 29 15:50:01 UTC 2021
The branch, master has been updated
via 54343f50a62 winbindd: remove obsolete sequence_number from struct winbindd_methods
via 27c53355b26 winbindd: remove obsolete sequence_number() from winbindd_reconnect.c
via 7524e6e7b55 winbindd: remove obsolete sequence_number() from winbindd_reconnect_ads.c
via 255a63abb57 s3:winbindd: Remove unused rpc_sequence_number()
via f3c603766be s3:winbindd: Remove obsolete sequence_number callback from ads backend
via 2d8093946dc s3:winbindd: Remove obsolete sequence_number callback from samr backend
via 371bc987668 s3:winbindd: Remove obsolete sequence_number callback from msrpc backend
via edad81c85c9 s3:winbindd: Do not call backends sequence number code
via 9b2c17e57af s3:winbindd: Simplfy sequence number caching
from 75ad84167f5 CVE-2021-20254 passdb: Simplify sids_to_unixids()
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 54343f50a62309967647a21d5d5a4003401fc12b
Author: Ralph Boehme <slow at samba.org>
Date: Tue Apr 27 16:03:29 2021 +0200
winbindd: remove obsolete sequence_number from struct winbindd_methods
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
Autobuild-User(master): Andreas Schneider <asn at cryptomilk.org>
Autobuild-Date(master): Thu Apr 29 15:49:16 UTC 2021 on sn-devel-184
commit 27c53355b26cc0dff08d657e1315d52659833d1c
Author: Ralph Boehme <slow at samba.org>
Date: Tue Apr 27 16:02:32 2021 +0200
winbindd: remove obsolete sequence_number() from winbindd_reconnect.c
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit 7524e6e7b553fc82f7edb3b59566de5860d4d0e6
Author: Ralph Boehme <slow at samba.org>
Date: Tue Apr 27 16:01:45 2021 +0200
winbindd: remove obsolete sequence_number() from winbindd_reconnect_ads.c
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit 255a63abb57bfb1228024f698779d2210027277c
Author: Andreas Schneider <asn at samba.org>
Date: Mon Apr 26 14:03:38 2021 +0200
s3:winbindd: Remove unused rpc_sequence_number()
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
commit f3c603766bee2973aff0224bfab56901bab22c38
Author: Andreas Schneider <asn at samba.org>
Date: Mon Apr 26 13:54:30 2021 +0200
s3:winbindd: Remove obsolete sequence_number callback from ads backend
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
commit 2d8093946dc1a06f10676480e7ed3969d712170c
Author: Andreas Schneider <asn at samba.org>
Date: Mon Apr 26 13:53:09 2021 +0200
s3:winbindd: Remove obsolete sequence_number callback from samr backend
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
commit 371bc987668463dc9693283921f400258112a744
Author: Andreas Schneider <asn at samba.org>
Date: Mon Apr 26 13:52:14 2021 +0200
s3:winbindd: Remove obsolete sequence_number callback from msrpc backend
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
commit edad81c85c9d726e2b08779ba9cd7729cdbeeeef
Author: Andreas Schneider <asn at samba.org>
Date: Mon Apr 26 14:01:39 2021 +0200
s3:winbindd: Do not call backends sequence number code
This is not needed anymore.
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
commit 9b2c17e57afffafc010e99b41c33dc8858bab95b
Author: Andreas Schneider <asn at samba.org>
Date: Fri Apr 23 14:16:02 2021 +0200
s3:winbindd: Simplfy sequence number caching
The sequence number is used to detect if the cache is still valid. It
expires when the `winbind cache time` is over. After that time we want
to fetch new information from a DC to make sure we are up to date.
If a DC goes down and we recreate the connection, we want to expire the
caches sooner. So we reset the sequence number and the next call should
refill the caches.
Using the current time as the sequence number is more reliable, as the
sequence number of two DCs could in theory be equal. All we have to do
is to make sure we reset it after we reconnect to a DC.
Previously the sequence number check was based on the AD database change
sequence number. Now this is based on a current time value which gets
reset after a successful (re)connect.
Pair-Programmed-With: Stefan Metzmacher <metze at samba.org>
Signed-off-by: Andreas Schneider <asn at samba.org>
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
-----------------------------------------------------------------------
Summary of changes:
source3/winbindd/winbindd.h | 3 -
source3/winbindd/winbindd_ads.c | 49 ----------
source3/winbindd/winbindd_cache.c | 127 +-----------------------
source3/winbindd/winbindd_cm.c | 4 +
source3/winbindd/winbindd_msrpc.c | 156 ------------------------------
source3/winbindd/winbindd_reconnect.c | 14 ---
source3/winbindd/winbindd_reconnect_ads.c | 15 ---
source3/winbindd/winbindd_rpc.c | 59 -----------
source3/winbindd/winbindd_rpc.h | 7 --
source3/winbindd/winbindd_samr.c | 53 ----------
10 files changed, 7 insertions(+), 480 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/winbindd/winbindd.h b/source3/winbindd/winbindd.h
index 480ba4f1282..0dbd832c209 100644
--- a/source3/winbindd/winbindd.h
+++ b/source3/winbindd/winbindd.h
@@ -285,9 +285,6 @@ struct winbindd_methods {
struct dom_sid **sid_mem, char ***names,
uint32_t **name_types);
- /* return the current global sequence number */
- NTSTATUS (*sequence_number)(struct winbindd_domain *domain, uint32_t *seq);
-
/* return the lockout policy */
NTSTATUS (*lockout_policy)(struct winbindd_domain *domain,
TALLOC_CTX *mem_ctx,
diff --git a/source3/winbindd/winbindd_ads.c b/source3/winbindd/winbindd_ads.c
index 6a9d1234f40..948c903f165 100644
--- a/source3/winbindd/winbindd_ads.c
+++ b/source3/winbindd/winbindd_ads.c
@@ -1324,54 +1324,6 @@ done:
return status;
}
-/* find the sequence number for a domain */
-static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32_t *seq)
-{
- ADS_STRUCT *ads = NULL;
- ADS_STATUS rc;
-
- DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
-
- if ( !winbindd_can_contact_domain( domain ) ) {
- DEBUG(10,("sequence: No incoming trust for domain %s\n",
- domain->name));
- *seq = time(NULL);
- return NT_STATUS_OK;
- }
-
- if (IS_AD_DC) {
- DEBUG(10,("sequence: Avoid LDAP connection for domain %s\n",
- domain->name));
- *seq = time(NULL);
- return NT_STATUS_OK;
- }
-
- *seq = DOM_SEQUENCE_NONE;
-
- ads = ads_cached_connection(domain);
-
- if (!ads) {
- domain->last_status = NT_STATUS_SERVER_DISABLED;
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- rc = ads_USN(ads, seq);
-
- if (!ADS_ERR_OK(rc)) {
-
- /* its a dead connection, destroy it */
-
- if (domain->private_data) {
- ads = (ADS_STRUCT *)domain->private_data;
- ads->is_mine = True;
- ads_destroy(&ads);
- ads_kdestroy(WINBIND_CCACHE_NAME);
- domain->private_data = NULL;
- }
- }
- return ads_ntstatus(rc);
-}
-
/* find the lockout policy of a domain - use rpc methods */
static NTSTATUS lockout_policy(struct winbindd_domain *domain,
TALLOC_CTX *mem_ctx,
@@ -1574,7 +1526,6 @@ struct winbindd_methods ads_methods = {
lookup_usergroups,
lookup_useraliases,
lookup_groupmem,
- sequence_number,
lockout_policy,
password_policy,
trusted_domains,
diff --git a/source3/winbindd/winbindd_cache.c b/source3/winbindd/winbindd_cache.c
index 201bb34b98a..4a366ee6ff8 100644
--- a/source3/winbindd/winbindd_cache.c
+++ b/source3/winbindd/winbindd_cache.c
@@ -534,13 +534,6 @@ static void refresh_sequence_number(struct winbindd_domain *domain)
get_cache( domain );
-#if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
- /* trying to reconnect is expensive, don't do it too often */
- if (domain->sequence_number == DOM_SEQUENCE_NONE) {
- cache_time *= 8;
- }
-#endif
-
time_diff = t - domain->last_seq_check;
/* see if we have to refetch the domain sequence number */
@@ -561,30 +554,9 @@ static void refresh_sequence_number(struct winbindd_domain *domain)
goto done;
}
- /* important! make sure that we know if this is a native
- mode domain or not. And that we can contact it. */
-
- if ( winbindd_can_contact_domain( domain ) ) {
- status = domain->backend->sequence_number(domain,
- &domain->sequence_number);
- } else {
- /* just use the current time */
- status = NT_STATUS_OK;
- domain->sequence_number = time(NULL);
- }
-
-
- /* the above call could have set our domain->backend to NULL when
- * coming from offline to online mode, make sure to reinitialize the
- * backend - Guenther */
- get_cache( domain );
-
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
- domain->sequence_number = DOM_SEQUENCE_NONE;
- }
-
- domain->last_status = status;
+ /* just use the current time */
+ domain->last_status = NT_STATUS_OK;
+ domain->sequence_number = time(NULL);
domain->last_seq_check = time(NULL);
/* save the new sequence number in the cache */
@@ -1488,11 +1460,6 @@ do_cached:
do_query:
- /* Return status value returned by seq number check */
-
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
/* Put the query_user_list() in a retry loop. There appears to be
* some bug either with Windows 2000 or Samba's handling of large
* rpc replies. This manifests itself as sudden disconnection
@@ -1624,11 +1591,6 @@ do_query:
*num_entries = 0;
*info = NULL;
- /* Return status value returned by seq number check */
-
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
domain->name ));
@@ -1729,11 +1691,6 @@ do_query:
*num_entries = 0;
*info = NULL;
- /* Return status value returned by seq number check */
-
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
domain->name ));
@@ -1845,17 +1802,6 @@ NTSTATUS wb_cache_name_to_sid(struct winbindd_domain *domain,
ZERO_STRUCTP(sid);
- /* If the seq number check indicated that there is a problem
- * with this DC, then return that status... except for
- * access_denied. This is special because the dc may be in
- * "restrict anonymous = 1" mode, in which case it will deny
- * most unauthenticated operations, but *will* allow the LSA
- * name-to-sid that we try as a fallback. */
-
- if (!(NT_STATUS_IS_OK(domain->last_status)
- || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
- return domain->last_status;
-
DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
domain->name ));
@@ -1984,17 +1930,6 @@ NTSTATUS wb_cache_sid_to_name(struct winbindd_domain *domain,
*name = NULL;
*domain_name = NULL;
- /* If the seq number check indicated that there is a problem
- * with this DC, then return that status... except for
- * access_denied. This is special because the dc may be in
- * "restrict anonymous = 1" mode, in which case it will deny
- * most unauthenticated operations, but *will* allow the LSA
- * sid-to-name that we try as a fallback. */
-
- if (!(NT_STATUS_IS_OK(domain->last_status)
- || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
- return domain->last_status;
-
DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
domain->name ));
@@ -2276,21 +2211,6 @@ static NTSTATUS wcache_query_user(struct winbindd_domain *domain,
return NT_STATUS_NOT_FOUND;
}
- /*
- * If we have an access denied cache entry and a cached info3
- * in the samlogon cache then do a query. This will force the
- * rpc back end to return the info3 data.
- */
-
- if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
- netsamlogon_cache_have(user_sid)) {
- DEBUG(10, ("query_user: cached access denied and have cached "
- "info3\n"));
- domain->last_status = NT_STATUS_OK;
- centry_free(centry);
- return NT_STATUS_NOT_FOUND;
- }
-
/* if status is not ok then this is a negative hit
and the rest of the data doesn't matter */
status = centry->status;
@@ -2374,19 +2294,6 @@ static NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
return NT_STATUS_NOT_FOUND;
}
- /* If we have an access denied cache entry and a cached info3 in the
- samlogon cache then do a query. This will force the rpc back end
- to return the info3 data. */
-
- if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
- && netsamlogon_cache_have(user_sid)) {
- DEBUG(10, ("lookup_usergroups: cached access denied and have "
- "cached info3\n"));
- domain->last_status = NT_STATUS_OK;
- centry_free(centry);
- return NT_STATUS_NOT_FOUND;
- }
-
num_sids = centry_uint32(centry);
sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
if (sids == NULL) {
@@ -2433,11 +2340,6 @@ NTSTATUS wb_cache_lookup_usergroups(struct winbindd_domain *domain,
(*num_groups) = 0;
(*user_gids) = NULL;
- /* Return status value returned by seq number check */
-
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
domain->name ));
@@ -2589,9 +2491,6 @@ NTSTATUS wb_cache_lookup_useraliases(struct winbindd_domain *domain,
(*num_aliases) = 0;
(*alias_rids) = NULL;
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
"for domain %s\n", domain->name ));
@@ -2726,11 +2625,6 @@ NTSTATUS wb_cache_lookup_groupmem(struct winbindd_domain *domain,
(*names) = NULL;
(*name_types) = NULL;
- /* Return status value returned by seq number check */
-
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
domain->name ));
@@ -2861,11 +2755,6 @@ do_fetch_cache:
return NT_STATUS_OK;
do_query:
- /* Return status value returned by seq number check */
-
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
domain->name ));
@@ -2932,11 +2821,6 @@ do_fetch_cache:
do_query:
ZERO_STRUCTP(policy);
- /* Return status value returned by seq number check */
-
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
domain->name ));
@@ -3004,11 +2888,6 @@ do_fetch_cache:
do_query:
ZERO_STRUCTP(policy);
- /* Return status value returned by seq number check */
-
- if (!NT_STATUS_IS_OK(domain->last_status))
- return domain->last_status;
-
DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
domain->name ));
diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index df785a0ba62..79e84078004 100644
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -2070,6 +2070,10 @@ void invalidate_cm_connection(struct winbindd_domain *domain)
NTSTATUS result;
struct winbindd_cm_conn *conn = &domain->conn;
+ domain->sequence_number = DOM_SEQUENCE_NONE;
+ domain->last_seq_check = 0;
+ domain->last_status = NT_STATUS_SERVER_DISABLED;
+
/* We're closing down a possibly dead
connection. Don't have impossibly long (10s) timeouts. */
diff --git a/source3/winbindd/winbindd_msrpc.c b/source3/winbindd/winbindd_msrpc.c
index 342f22cfde3..3ac13b0e3d1 100644
--- a/source3/winbindd/winbindd_msrpc.c
+++ b/source3/winbindd/winbindd_msrpc.c
@@ -705,161 +705,6 @@ static NTSTATUS msrpc_lookup_groupmem(struct winbindd_domain *domain,
return NT_STATUS_OK;
}
-#ifdef HAVE_LDAP
-
-#include "ads.h"
-
-static int get_ldap_seq(const char *server, struct sockaddr_storage *ss, int port, uint32_t *seq)
-{
- int ret = -1;
- struct timeval to;
- const char *attrs[] = {"highestCommittedUSN", NULL};
- LDAPMessage *res = NULL;
- char **values = NULL;
- LDAP *ldp = NULL;
-
- *seq = DOM_SEQUENCE_NONE;
-
- /*
- * Parameterised (5) second timeout on open. This is needed as the
- * search timeout doesn't seem to apply to doing an open as well. JRA.
- */
-
- ldp = ldap_open_with_timeout(server, ss, port, lp_ldap_timeout());
- if (ldp == NULL)
- return -1;
-
- /* Timeout if no response within 20 seconds. */
- to.tv_sec = 10;
- to.tv_usec = 0;
-
- if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
- discard_const_p(char *, attrs), 0, &to, &res))
- goto done;
-
- if (ldap_count_entries(ldp, res) != 1)
- goto done;
-
- values = ldap_get_values(ldp, res, "highestCommittedUSN");
- if (!values || !values[0])
- goto done;
-
- *seq = atoi(values[0]);
- ret = 0;
-
- done:
-
- if (values)
- ldap_value_free(values);
- if (res)
- ldap_msgfree(res);
- if (ldp)
- ldap_unbind(ldp);
- return ret;
-}
-
-/**********************************************************************
- Get the sequence number for a Windows AD native mode domain using
- LDAP queries.
-**********************************************************************/
-
-static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32_t *seq)
-{
- int ret = -1;
- char addr[INET6_ADDRSTRLEN];
-
- print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
- if ((ret = get_ldap_seq(addr, &domain->dcaddr, LDAP_PORT, seq)) == 0) {
- DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
- "number for Domain (%s) from DC (%s)\n",
- domain->name, addr));
- }
- return ret;
-}
-
-#endif /* HAVE_LDAP */
-
-/* find the sequence number for a domain */
-static NTSTATUS msrpc_sequence_number(struct winbindd_domain *domain,
- uint32_t *pseq)
-{
- struct rpc_pipe_client *samr_pipe;
- struct policy_handle dom_pol;
- uint32_t seq = DOM_SEQUENCE_NONE;
- TALLOC_CTX *tmp_ctx;
- NTSTATUS status;
-
- DEBUG(3, ("msrpc_sequence_number: fetch sequence_number for %s\n", domain->name));
-
- if (pseq) {
- *pseq = DOM_SEQUENCE_NONE;
- }
-
- tmp_ctx = talloc_stackframe();
- if (tmp_ctx == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
-
- if ( !winbindd_can_contact_domain( domain ) ) {
- DEBUG(10,("sequence_number: No incoming trust for domain %s\n",
- domain->name));
- if (pseq) {
- *pseq = time(NULL);
- }
- status = NT_STATUS_OK;
- goto done;
- }
-
-#ifdef HAVE_LDAP
- if (domain->active_directory) {
- int rc;
-
- DEBUG(8,("using get_ldap_seq() to retrieve the "
- "sequence number\n"));
-
- rc = get_ldap_sequence_number(domain, &seq);
- if (rc == 0) {
- DEBUG(10,("domain_sequence_number: LDAP for "
- "domain %s is %u\n",
- domain->name, seq));
-
- if (pseq) {
- *pseq = seq;
- }
-
- status = NT_STATUS_OK;
- goto done;
- }
-
- DEBUG(10,("domain_sequence_number: failed to get LDAP "
- "sequence number for domain %s\n",
- domain->name ));
- }
-#endif /* HAVE_LDAP */
-
- status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
- if (!NT_STATUS_IS_OK(status)) {
- goto done;
- }
-
- status = rpc_sequence_number(tmp_ctx,
- samr_pipe,
- &dom_pol,
- domain->name,
- &seq);
- if (!NT_STATUS_IS_OK(status)) {
- goto done;
- }
-
- if (pseq) {
- *pseq = seq;
- }
-
-done:
- TALLOC_FREE(tmp_ctx);
- return status;
-}
-
/* get a list of trusted domains */
static NTSTATUS msrpc_trusted_domains(struct winbindd_domain *domain,
TALLOC_CTX *mem_ctx,
@@ -1224,7 +1069,6 @@ struct winbindd_methods msrpc_methods = {
msrpc_lookup_usergroups,
--
Samba Shared Repository
More information about the samba-cvs
mailing list