Please review diff for 3.0.23a
Gerald (Jerry) Carter
jerry at samba.org
Thu Jul 20 19:21:42 GMT 2006
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
To all devs:
I'm attaching the diff between SAMBA_3_0_23 and Samba 3.0.23.
Please review and make sure your patches are in there.
If you have not merged the change to SAMBA_3_0_23, it will
*not* be in 3.0.23a. Plans are to release tomorrow.
Thanks.
cheers, jerry
=====================================================================
Samba ------- http://www.samba.org
Centeris ----------- http://www.centeris.com
"What man is a man who does not make the world better?" --Balian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org
iD8DBQFEv9fFIR7qMdg1EfYRAqQ9AJ9zQs+gPhgx3vB/JKxOiX4PnRgxsgCcCqcU
avtJhZyNw762vWGn9EuOZLo=
=2ibY
-----END PGP SIGNATURE-----
-------------- next part --------------
Index: source/VERSION
===================================================================
--- source/VERSION (revision 17017)
+++ source/VERSION (revision 17160)
@@ -37,7 +37,7 @@
# e.g. SAMBA_VERSION_REVISION=a #
# -> "2.2.8a" #
########################################################
-SAMBA_VERSION_REVISION=
+SAMBA_VERSION_REVISION=a
########################################################
# For 'pre' releases the version will be #
@@ -69,7 +69,7 @@
# e.g. SAMBA_VERSION_IS_SVN_SNAPSHOT=yes #
# -> "3.0.0-SVN-build-199" #
########################################################
-SAMBA_VERSION_IS_SVN_SNAPSHOT=
+SAMBA_VERSION_IS_SVN_SNAPSHOT=yes
########################################################
# This can be set by vendors if they want... #
Index: source/smbd/open.c
===================================================================
--- source/smbd/open.c (revision 17017)
+++ source/smbd/open.c (revision 17160)
@@ -185,7 +185,8 @@
SMB_STRUCT_STAT *psbuf,
int flags,
mode_t unx_mode,
- uint32 access_mask)
+ uint32 access_mask, /* client requested access mask. */
+ uint32 open_access_mask) /* what we're actually using in the open. */
{
int accmode = (flags & O_ACCMODE);
int local_flags = flags;
@@ -239,8 +240,8 @@
local_flags = (flags & ~O_ACCMODE)|O_RDWR;
}
- if ((access_mask & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_EXECUTE)) ||
- (local_flags & O_CREAT) ||
+ if ((open_access_mask & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_EXECUTE)) ||
+ (!file_existed && (local_flags & O_CREAT)) ||
((local_flags & O_TRUNC) == O_TRUNC) ) {
/*
@@ -619,8 +620,11 @@
BOOL delay_it = False;
BOOL have_level2 = False;
+ if (oplock_request & INTERNAL_OPEN_ONLY) {
+ fsp->oplock_type = NO_OPLOCK;
+ }
+
if ((oplock_request & INTERNAL_OPEN_ONLY) || is_stat_open(fsp->access_mask)) {
- fsp->oplock_type = NO_OPLOCK;
return False;
}
@@ -1109,6 +1113,7 @@
uint16 mid = get_current_mid();
struct timeval request_time = timeval_zero();
struct share_mode_lock *lck = NULL;
+ uint32 open_access_mask = access_mask;
NTSTATUS status;
if (conn->printer) {
@@ -1199,12 +1204,14 @@
/* If file exists replace/overwrite. If file doesn't
* exist create. */
flags2 |= (O_CREAT | O_TRUNC);
+ open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */
break;
case FILE_OVERWRITE_IF:
/* If file exists replace/overwrite. If file doesn't
* exist create. */
flags2 |= (O_CREAT | O_TRUNC);
+ open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */
break;
case FILE_OPEN:
@@ -1231,6 +1238,7 @@
return NULL;
}
flags2 |= O_TRUNC;
+ open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */
break;
case FILE_CREATE:
@@ -1283,7 +1291,10 @@
/* This is a nasty hack - must fix... JRA. */
if (access_mask == MAXIMUM_ALLOWED_ACCESS) {
- access_mask = FILE_GENERIC_ALL;
+ open_access_mask = access_mask = FILE_GENERIC_ALL;
+ if (flags2 & O_TRUNC) {
+ open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */
+ }
}
/*
@@ -1348,7 +1359,7 @@
fsp->inode = psbuf->st_ino;
fsp->share_access = share_access;
fsp->fh->private_options = create_options;
- fsp->access_mask = access_mask;
+ fsp->access_mask = open_access_mask; /* We change this to the requested access_mask after the open is done. */
/* Ensure no SAMBA_PRIVATE bits can be set. */
fsp->oplock_type = (oplock_request & ~SAMBA_PRIVATE_OPLOCK_MASK);
@@ -1379,6 +1390,7 @@
return NULL;
}
+ /* Use the client requested access mask here, not the one we open with. */
status = open_mode_check(conn, fname, lck,
access_mask, share_access,
create_options, &file_existed);
@@ -1403,6 +1415,8 @@
}
if (!NT_STATUS_IS_OK(status)) {
+ uint32 can_access_mask;
+ BOOL can_access = True;
SMB_ASSERT(NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION));
@@ -1412,6 +1426,8 @@
(NTCREATEX_OPTIONS_PRIVATE_DENY_DOS|
NTCREATEX_OPTIONS_PRIVATE_DENY_FCB)) {
files_struct *fsp_dup;
+
+ /* Use the client requested access mask here, not the one we open with. */
fsp_dup = fcb_or_dos_open(conn, fname, dev,
inode, access_mask,
share_access,
@@ -1433,31 +1449,22 @@
* MS-Access. If a file open will fail due to share
* permissions and also for security (access) reasons,
* we need to return the access failed error, not the
- * share error. This means we must attempt to open the
- * file anyway in order to get the UNIX access error -
- * even if we're going to fail the open for share
- * reasons. This is bad, as we're burning another fd
- * if there are existing locks but there's nothing
- * else we can do. We also ensure we're not going to
- * create or tuncate the file as we only want an
- * access decision at this stage. JRA.
+ * share error. We can't open the file due to kernel
+ * oplock deadlock (it's possible we failed above on
+ * the open_mode_check()) so use a userspace check.
*/
- errno = 0;
- fsp_open = open_file(fsp,conn,fname,psbuf,
- flags|(flags2&~(O_TRUNC|O_CREAT)),
- unx_mode,access_mask);
- DEBUG(4,("open_file_ntcreate : share_mode deny - "
- "calling open_file with flags=0x%X "
- "flags2=0x%X mode=0%o returned %d\n",
- flags, (flags2&~(O_TRUNC|O_CREAT)),
- (unsigned int)unx_mode, (int)fsp_open ));
+ if (flags & O_RDWR) {
+ can_access_mask = FILE_READ_DATA|FILE_WRITE_DATA;
+ } else {
+ can_access_mask = FILE_READ_DATA;
+ }
- if (!fsp_open && errno) {
- /* Default error. */
- set_saved_ntstatus(NT_STATUS_ACCESS_DENIED);
+ if (((flags & O_RDWR) && !CAN_WRITE(conn)) ||
+ !can_access_file(conn,fname,psbuf,can_access_mask)) {
+ can_access = False;
}
-
+
/*
* If we're returning a share violation, ensure we
* cope with the braindead 1 second delay.
@@ -1502,8 +1509,9 @@
}
TALLOC_FREE(lck);
- if (fsp_open) {
- fd_close(conn, fsp);
+ if (!can_access) {
+ set_saved_ntstatus(NT_STATUS_ACCESS_DENIED);
+ } else {
/*
* We have detected a sharing violation here
* so return the correct error code
@@ -1540,7 +1548,7 @@
*/
fsp_open = open_file(fsp,conn,fname,psbuf,flags|flags2,unx_mode,
- access_mask);
+ access_mask, open_access_mask);
if (!fsp_open) {
if (lck != NULL) {
@@ -1550,7 +1558,7 @@
return NULL;
}
- if (!file_existed) {
+ if (!file_existed) {
/*
* Deal with the race condition where two smbd's detect the
@@ -1612,6 +1620,7 @@
/*
* We exit this block with the share entry *locked*.....
*/
+
}
SMB_ASSERT(lck != NULL);
@@ -1655,6 +1664,11 @@
fsp->access_mask = access_mask;
if (file_existed) {
+ /* stat opens on existing files don't get oplocks. */
+ if (is_stat_open(open_access_mask)) {
+ fsp->oplock_type = NO_OPLOCK;
+ }
+
if (!(flags2 & O_TRUNC)) {
info = FILE_WAS_OPENED;
} else {
@@ -1794,7 +1808,7 @@
/* note! we must use a non-zero desired access or we don't get
a real file descriptor. Oh what a twisted web we weave. */
- fsp_open = open_file(fsp,conn,fname,psbuf,O_WRONLY,0,FILE_WRITE_DATA);
+ fsp_open = open_file(fsp,conn,fname,psbuf,O_WRONLY,0,FILE_WRITE_DATA,FILE_WRITE_DATA);
/*
* This is not a user visible file open.
Index: source/smbd/posix_acls.c
===================================================================
--- source/smbd/posix_acls.c (revision 17017)
+++ source/smbd/posix_acls.c (revision 17160)
@@ -3912,7 +3912,7 @@
Return -1 if no match, 0 if match and denied, 1 if match and allowed.
****************************************************************************/
-static int check_posix_acl_group_write(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf)
+static int check_posix_acl_group_access(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf, uint32 access_mask)
{
SMB_ACL_T posix_acl = NULL;
int entry_id = SMB_ACL_FIRST_ENTRY;
@@ -3923,17 +3923,21 @@
int ret = -1;
gid_t cu_gid;
+ DEBUG(10,("check_posix_acl_group_access: requesting 0x%x on file %s\n",
+ (unsigned int)access_mask, fname ));
+
if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS)) == NULL) {
goto check_stat;
}
- /* First ensure the group mask allows group read. */
+ /* First ensure the group mask allows group access. */
/* Also check any user entries (these take preference over group). */
while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) {
SMB_ACL_TAG_T tagtype;
SMB_ACL_PERMSET_T permset;
int have_write = -1;
+ int have_read = -1;
/* get_next... */
if (entry_id == SMB_ACL_FIRST_ENTRY)
@@ -3947,6 +3951,11 @@
goto check_stat;
}
+ have_read = SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ);
+ if (have_read == -1) {
+ goto check_stat;
+ }
+
have_write = SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE);
if (have_write == -1) {
goto check_stat;
@@ -3957,16 +3966,36 @@
* canonicalize to 0 or 1.
*/
have_write = (have_write ? 1 : 0);
+ have_read = (have_read ? 1 : 0);
switch(tagtype) {
case SMB_ACL_MASK:
seen_mask = True;
- if (!have_write) {
- /* We don't have any group or explicit user write permission. */
- ret = -1; /* Allow caller to check "other" permissions. */
- DEBUG(10,("check_posix_acl_group_write: file %s \
-refusing write due to mask.\n", fname));
- goto done;
+ switch (access_mask) {
+ case FILE_READ_DATA:
+ if (!have_read) {
+ ret = -1;
+ DEBUG(10,("check_posix_acl_group_access: file %s "
+ "refusing read due to mask.\n", fname));
+ goto done;
+ }
+ break;
+ case FILE_WRITE_DATA:
+ if (!have_write) {
+ ret = -1;
+ DEBUG(10,("check_posix_acl_group_access: file %s "
+ "refusing write due to mask.\n", fname));
+ goto done;
+ }
+ break;
+ default: /* FILE_READ_DATA|FILE_WRITE_DATA */
+ if (!have_write || !have_read) {
+ ret = -1;
+ DEBUG(10,("check_posix_acl_group_access: file %s "
+ "refusing read/write due to mask.\n", fname));
+ goto done;
+ }
+ break;
}
break;
case SMB_ACL_USER:
@@ -3978,9 +4007,21 @@
}
if (current_user.ut.uid == *puid) {
/* We have a uid match but we must ensure we have seen the acl mask. */
- ret = have_write;
- DEBUG(10,("check_posix_acl_group_write: file %s \
-match on user %u -> %s.\n", fname, (unsigned int)*puid, ret ? "can write" : "cannot write"));
+ switch (access_mask) {
+ case FILE_READ_DATA:
+ ret = have_read;
+ break;
+ case FILE_WRITE_DATA:
+ ret = have_write;
+ break;
+ default: /* FILE_READ_DATA|FILE_WRITE_DATA */
+ ret = (have_write & have_read);
+ break;
+ }
+ DEBUG(10,("check_posix_acl_group_access: file %s "
+ "match on user %u -> %s.\n",
+ fname, (unsigned int)*puid,
+ ret ? "can access" : "cannot access"));
if (seen_mask) {
goto done;
}
@@ -4003,6 +4044,7 @@
SMB_ACL_TAG_T tagtype;
SMB_ACL_PERMSET_T permset;
int have_write = -1;
+ int have_read = -1;
/* get_next... */
if (entry_id == SMB_ACL_FIRST_ENTRY)
@@ -4016,6 +4058,11 @@
goto check_stat;
}
+ have_read = SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ);
+ if (have_read == -1) {
+ goto check_stat;
+ }
+
have_write = SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE);
if (have_write == -1) {
goto check_stat;
@@ -4026,6 +4073,7 @@
* canonicalize to 0 or 1.
*/
have_write = (have_write ? 1 : 0);
+ have_read = (have_read ? 1 : 0);
switch(tagtype) {
case SMB_ACL_GROUP:
@@ -4050,13 +4098,25 @@
for (cu_gid = get_current_user_gid_first(&i); cu_gid != (gid_t)-1;
cu_gid = get_current_user_gid_next(&i)) {
if (cu_gid == *pgid) {
- ret = have_write;
- DEBUG(10,("check_posix_acl_group_write: file %s \
-match on group %u -> can write.\n", fname, (unsigned int)cu_gid ));
+ switch (access_mask) {
+ case FILE_READ_DATA:
+ ret = have_read;
+ break;
+ case FILE_WRITE_DATA:
+ ret = have_write;
+ break;
+ default: /* FILE_READ_DATA|FILE_WRITE_DATA */
+ ret = (have_write & have_read);
+ break;
+ }
- /* If we don't have write permission this entry doesn't
+ DEBUG(10,("check_posix_acl_group_access: file %s "
+ "match on group %u -> can access.\n",
+ fname, (unsigned int)cu_gid ));
+
+ /* If we don't have access permission this entry doesn't
terminate the enumeration of the entries. */
- if (have_write) {
+ if (ret) {
goto done;
}
/* But does terminate the group iteration. */
@@ -4073,12 +4133,12 @@
/* If ret is -1 here we didn't match on the user entry or
supplemental group entries. */
- DEBUG(10,("check_posix_acl_group_write: ret = %d before check_stat:\n", ret));
+ DEBUG(10,("check_posix_acl_group_access: ret = %d before check_stat:\n", ret));
check_stat:
/*
- * We only check the S_IWGRP permissions if we haven't already
+ * We only check the S_I[RW]GRP permissions if we haven't already
* seen an owning group SMB_ACL_GROUP_OBJ ace entry. If there is an
* SMB_ACL_GROUP_OBJ ace entry then the group bits in st_gid are
* the same as the SMB_ACL_MASK bits, not the SMB_ACL_GROUP_OBJ
@@ -4095,16 +4155,33 @@
for (cu_gid = get_current_user_gid_first(&i); cu_gid != (gid_t)-1;
cu_gid = get_current_user_gid_next(&i)) {
if (cu_gid == psbuf->st_gid) {
- ret = (psbuf->st_mode & S_IWGRP) ? 1 : 0;
- DEBUG(10,("check_posix_acl_group_write: file %s \
-match on owning group %u -> %s.\n", fname, (unsigned int)psbuf->st_gid, ret ? "can write" : "cannot write"));
+ switch (access_mask) {
+ case FILE_READ_DATA:
+ ret = (psbuf->st_mode & S_IRGRP) ? 1 : 0;
+ break;
+ case FILE_WRITE_DATA:
+ ret = (psbuf->st_mode & S_IWGRP) ? 1 : 0;
+ break;
+ default: /* FILE_READ_DATA|FILE_WRITE_DATA */
+ if ((psbuf->st_mode & (S_IWGRP|S_IRGRP)) == (S_IWGRP|S_IRGRP)) {
+ ret = 1;
+ } else {
+ ret = 0;
+ }
+ break;
+ }
+ DEBUG(10,("check_posix_acl_group_access: file %s "
+ "match on owning group %u -> %s.\n",
+ fname, (unsigned int)psbuf->st_gid,
+ ret ? "can access" : "cannot access"));
break;
}
}
if (cu_gid == (gid_t)-1) {
- DEBUG(10,("check_posix_acl_group_write: file %s \
-failed to match on user or group in token (ret = %d).\n", fname, ret ));
+ DEBUG(10,("check_posix_acl_group_access: file %s "
+ "failed to match on user or group in token (ret = %d).\n",
+ fname, ret ));
}
}
@@ -4114,7 +4191,7 @@
SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl);
}
- DEBUG(10,("check_posix_acl_group_write: file %s returning (ret = %d).\n", fname, ret ));
+ DEBUG(10,("check_posix_acl_group_access: file %s returning (ret = %d).\n", fname, ret ));
return ret;
}
@@ -4170,7 +4247,7 @@
#endif
/* Check group or explicit user acl entry write access. */
- ret = check_posix_acl_group_write(conn, dname, &sbuf);
+ ret = check_posix_acl_group_access(conn, dname, &sbuf, FILE_WRITE_DATA);
if (ret == 0 || ret == 1) {
return ret ? True : False;
}
@@ -4180,15 +4257,23 @@
}
/****************************************************************************
- Actually emulate the in-kernel access checking for write access. We need
+ Actually emulate the in-kernel access checking for read/write access. We need
this to successfully check for ability to write for dos filetimes.
Note this doesn't take into account share write permissions.
****************************************************************************/
-BOOL can_write_to_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf)
+BOOL can_access_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf, uint32 access_mask)
{
int ret;
+ if (!(access_mask & (FILE_READ_DATA|FILE_WRITE_DATA))) {
+ return False;
+ }
+ access_mask &= (FILE_READ_DATA|FILE_WRITE_DATA);
+
+ DEBUG(10,("can_access_file: requesting 0x%x on file %s\n",
+ (unsigned int)access_mask, fname ));
+
if (current_user.ut.uid == 0 || conn->admin_user) {
/* I'm sorry sir, I didn't know you were root... */
return True;
@@ -4201,21 +4286,58 @@
}
}
- /* Check primary owner write access. */
+ /* Check primary owner access. */
if (current_user.ut.uid == psbuf->st_uid) {
- return (psbuf->st_mode & S_IWUSR) ? True : False;
+ switch (access_mask) {
+ case FILE_READ_DATA:
+ return (psbuf->st_mode & S_IRUSR) ? True : False;
+
+ case FILE_WRITE_DATA:
+ return (psbuf->st_mode & S_IWUSR) ? True : False;
+
+ default: /* FILE_READ_DATA|FILE_WRITE_DATA */
+
+ if ((psbuf->st_mode & (S_IWUSR|S_IRUSR)) == (S_IWUSR|S_IRUSR)) {
+ return True;
+ } else {
+ return False;
+ }
+ }
}
- /* Check group or explicit user acl entry write access. */
- ret = check_posix_acl_group_write(conn, fname, psbuf);
+ /* Check group or explicit user acl entry access. */
+ ret = check_posix_acl_group_access(conn, fname, psbuf, access_mask);
if (ret == 0 || ret == 1) {
return ret ? True : False;
}
- /* Finally check other write access. */
- return (psbuf->st_mode & S_IWOTH) ? True : False;
+ /* Finally check other access. */
+ switch (access_mask) {
+ case FILE_READ_DATA:
+ return (psbuf->st_mode & S_IROTH) ? True : False;
+
+ case FILE_WRITE_DATA:
+ return (psbuf->st_mode & S_IWOTH) ? True : False;
+
+ default: /* FILE_READ_DATA|FILE_WRITE_DATA */
+
+ if ((psbuf->st_mode & (S_IWOTH|S_IROTH)) == (S_IWOTH|S_IROTH)) {
+ return True;
+ }
+ }
+ return False;
}
+/****************************************************************************
+ Userspace check for write access.
+ Note this doesn't take into account share write permissions.
+****************************************************************************/
+
+BOOL can_write_to_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf)
+{
+ return can_access_file(conn, fname, psbuf, FILE_WRITE_DATA);
+}
+
/********************************************************************
Pull the NT ACL from a file on disk or the OpenEventlog() access
check. Caller is responsible for freeing the returned security
Index: source/auth/auth_util.c
===================================================================
--- source/auth/auth_util.c (revision 17017)
+++ source/auth/auth_util.c (revision 17160)
@@ -955,7 +955,8 @@
return NT_STATUS_NO_MEMORY;
}
- if (server_info->was_mapped) {
+ if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
+ server_info->was_mapped) {
status = create_token_from_username(server_info,
server_info->unix_name,
server_info->guest,
Index: source/nsswitch/winbindd_nss.h
===================================================================
--- source/nsswitch/winbindd_nss.h (revision 17017)
+++ source/nsswitch/winbindd_nss.h (revision 17160)
@@ -4,6 +4,7 @@
Winbind daemon for ntdom nss module
Copyright (C) Tim Potter 2000
+ Copyright (C) Gerald Carter 2006
You are free to use this interface definition in any way you see
fit, including without restriction, using this header in your own
@@ -36,6 +37,17 @@
#define WINBIND_INTERFACE_VERSION 14
+/* Have to deal with time_t being 4 or 8 bytes due to structure alignment.
+ On a 64bit Linux box, we have to support a constant structure size
+ between /lib/libnss_winbind.so.2 and /li64/libnss_winbind.so.2.
+ The easiest way to do this is to always use 8byte values for time_t. */
+
+#if defined(uint64)
+# define SMB_TIME_T uint64
+#else
+# define SMB_TIME_t time_t
+#endif
+
/* Socket commands */
enum winbindd_cmd {
@@ -184,6 +196,14 @@
/* Winbind request structure */
+/*******************************************************************************
+ * This structure MUST be the same size in the 32bit and 64bit builds
+ * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so
+ *
+ * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST
+ * A 64BIT WINBINDD --jerry
+ ******************************************************************************/
+
struct winbindd_request {
uint32 length;
enum winbindd_cmd cmd; /* Winbindd command to execute */
@@ -213,9 +233,9 @@
fstring user;
fstring domain;
fstring lm_resp;
- uint16 lm_resp_len;
+ uint32 lm_resp_len;
fstring nt_resp;
- uint16 nt_resp_len;
+ uint32 nt_resp_len;
fstring workstation;
fstring require_membership_of_sid;
} auth_crap;
@@ -255,11 +275,15 @@
fstring sid;
} dual_idmapset;
BOOL list_all_domains;
+
+ /* padding -- needed to fix alignment between 32bit and 64bit libs.
+ The size if the sizeof the union without the padding aligned on
+ an 8 byte boundary. --jerry */
+
+ char padding[1560];
} data;
union {
-#if defined(uint64)
- uint64 z;
-#endif
+ SMB_TIME_T padding;
char *data;
} extra_data;
uint32 extra_len;
@@ -276,6 +300,14 @@
/* Winbind response structure */
+/*******************************************************************************
+ * This structure MUST be the same size in the 32bit and 64bit builds
+ * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so
+ *
+ * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST
+ * A 64BIT WINBINDD --jerry
+ ******************************************************************************/
+
struct winbindd_response {
/* Header information */
@@ -326,30 +358,32 @@
char user_session_key[16];
char first_8_lm_hash[8];
fstring krb5ccname;
+ uint32 reject_reason;
+ uint32 padding;
struct policy_settings {
- uint16 min_length_password;
- uint16 password_history;
+ uint32 min_length_password;
+ uint32 password_history;
uint32 password_properties;
- time_t expire;
- time_t min_passwordage;
+ uint32 padding;
+ SMB_TIME_T expire;
+ SMB_TIME_T min_passwordage;
} policy;
- uint32 reject_reason;
struct info3_text {
- time_t logon_time;
- time_t logoff_time;
- time_t kickoff_time;
- time_t pass_last_set_time;
- time_t pass_can_change_time;
- time_t pass_must_change_time;
- uint16 logon_count;
- uint16 bad_pw_count;
+ SMB_TIME_T logon_time;
+ SMB_TIME_T logoff_time;
+ SMB_TIME_T kickoff_time;
+ SMB_TIME_T pass_last_set_time;
+ SMB_TIME_T pass_can_change_time;
+ SMB_TIME_T pass_must_change_time;
+ uint32 logon_count;
+ uint32 bad_pw_count;
uint32 user_rid;
uint32 group_rid;
- fstring dom_sid;
uint32 num_groups;
uint32 user_flgs;
uint32 acct_flags;
uint32 num_other_sids;
+ fstring dom_sid;
fstring user_name;
fstring full_name;
fstring logon_script;
@@ -381,9 +415,7 @@
/* Variable length return data */
union {
-#if defined(uint64)
- uint64 z;
-#endif
+ SMB_TIME_T padding;
void *data;
} extra_data;
};
Index: source/nsswitch/winbindd_util.c
===================================================================
--- source/nsswitch/winbindd_util.c (revision 17017)
+++ source/nsswitch/winbindd_util.c (revision 17160)
@@ -812,14 +812,28 @@
/* Is this a domain which we may assume no DOMAIN\ prefix? */
-static BOOL assume_domain(const char *domain) {
- if ((lp_winbind_use_default_domain()
- || lp_winbind_trusted_domains_only()) &&
- strequal(lp_workgroup(), domain))
- return True;
+static BOOL assume_domain(const char *domain)
+{
+ /* never assume the domain on a standalone server */
- if (strequal(get_global_sam_name(), domain))
+ if ( lp_server_role() == ROLE_STANDALONE )
+ return False;
+
+ /* domain member servers may possibly assume for the domain name */
+
+ if ( lp_server_role() == ROLE_DOMAIN_MEMBER ) {
+ if ( !strequal(lp_workgroup(), domain) )
+ return False;
+
+ if ( lp_winbind_use_default_domain() || lp_winbind_trusted_domains_only() )
+ return True;
+ }
+
+ /* only left with a domain controller */
+
+ if ( strequal(get_global_sam_name(), domain) ) {
return True;
+ }
return False;
}
@@ -832,7 +846,7 @@
if ( !p ) {
fstrcpy(user, domuser);
-
+
if ( assume_domain(lp_workgroup())) {
fstrcpy(domain, lp_workgroup());
} else {
@@ -1211,13 +1225,13 @@
int ret = nscd_flush_cache("passwd");
if (ret) {
DEBUG(5,("failed to flush nscd cache for 'passwd' service: %s\n",
- strerror(ret)));
+ strerror(errno)));
}
ret = nscd_flush_cache("group");
if (ret) {
DEBUG(5,("failed to flush nscd cache for 'group' service: %s\n",
- strerror(ret)));
+ strerror(errno)));
}
#else
return;
Index: source/nsswitch/winbindd_group.c
===================================================================
--- source/nsswitch/winbindd_group.c (revision 17017)
+++ source/nsswitch/winbindd_group.c (revision 17160)
@@ -42,7 +42,7 @@
{
fstring full_group_name;
- fill_domain_username( full_group_name, dom_name, gr_name, False);
+ fill_domain_username( full_group_name, dom_name, gr_name, True );
gr->gr_gid = unix_gid;
@@ -146,7 +146,7 @@
/* Append domain name */
- fill_domain_username(name, domain->name, the_name, False);
+ fill_domain_username(name, domain->name, the_name, True);
len = strlen(name);
@@ -752,7 +752,7 @@
/* Fill in group entry */
fill_domain_username(domain_group_name, ent->domain_name,
- name_list[ent->sam_entry_index].acct_name, False);
+ name_list[ent->sam_entry_index].acct_name, True);
result = fill_grent(&group_list[group_list_ndx],
ent->domain_name,
@@ -929,7 +929,7 @@
groups.sam_entries)[i].acct_name;
fstring name;
- fill_domain_username(name, domain->name, group_name, False);
+ fill_domain_username(name, domain->name, group_name, True);
/* Append to extra data */
memcpy(&extra_data[extra_data_len], name,
strlen(name));
Index: source/nsswitch/wins.c
===================================================================
--- source/nsswitch/wins.c (revision 17017)
+++ source/nsswitch/wins.c (revision 17160)
@@ -80,6 +80,7 @@
TimeInit();
setup_logging("nss_wins",False);
+ load_case_tables();
lp_load(dyn_CONFIGFILE,True,False,False,True);
load_interfaces();
}
Index: source/nsswitch/winbindd_cache.c
===================================================================
--- source/nsswitch/winbindd_cache.c (revision 17017)
+++ source/nsswitch/winbindd_cache.c (revision 17160)
@@ -1891,7 +1891,8 @@
/* when working offline we must not clear the cache on restart */
wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
- TDB_DEFAULT /*TDB_CLEAR_IF_FIRST*/, O_RDWR|O_CREAT, 0600);
+ lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
+ O_RDWR|O_CREAT, 0600);
if (wcache->tdb == NULL) {
DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
@@ -2133,7 +2134,8 @@
/* when working offline we must not clear the cache on restart */
wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
- TDB_DEFAULT /* TDB_CLEAR_IF_FIRST */, O_RDWR|O_CREAT, 0600);
+ lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
+ O_RDWR|O_CREAT, 0600);
if (!wcache->tdb) {
DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
Index: source/nsswitch/pam_winbind.c
===================================================================
--- source/nsswitch/pam_winbind.c (revision 17017)
+++ source/nsswitch/pam_winbind.c (revision 17160)
@@ -750,8 +750,8 @@
}
}
} else {
- _pam_log(LOG_NOTICE
- ,"could not recover authentication token");
+ _pam_log(LOG_NOTICE, "could not recover authentication token");
+ retval = PAM_AUTHTOK_RECOVER_ERR;
}
}
Index: source/libsmb/namequery.c
===================================================================
--- source/libsmb/namequery.c (revision 17017)
+++ source/libsmb/namequery.c (revision 17160)
@@ -1051,16 +1051,18 @@
return False;
}
- i = 0;
- while ( i < numdcs ) {
+ *return_count = 0;
+ for (i=0;i<numdcs;i++) {
+ struct ip_service *r = &(*return_iplist)[*return_count];
+
/* use the IP address from the SRV structure if we have one */
if ( is_zero_ip( dcs[i].ip ) )
- (*return_iplist)[i].ip = *interpret_addr2(dcs[i].hostname);
+ r->ip = *interpret_addr2(dcs[i].hostname);
else
- (*return_iplist)[i].ip = dcs[i].ip;
+ r->ip = dcs[i].ip;
- (*return_iplist)[i].port = dcs[i].port;
+ r->port = dcs[i].port;
/* make sure it is a valid IP. I considered checking the negative
connection cache, but this is the wrong place for it. Maybe only
@@ -1069,15 +1071,11 @@
The standard reason for falling back to netbios lookups is that
our DNS server doesn't know anything about the DC's -- jerry */
- if ( is_zero_ip((*return_iplist)[i].ip) )
- continue;
-
- i++;
+ if ( ! is_zero_ip(r->ip) )
+ (*return_count)++;
}
TALLOC_FREE( dcs );
-
- *return_count = i;
return True;
}
Index: source/libsmb/clikrb5.c
===================================================================
--- source/libsmb/clikrb5.c (revision 17017)
+++ source/libsmb/clikrb5.c (revision 17160)
@@ -112,7 +112,7 @@
#ifndef HAVE_KRB5_SET_REAL_TIME
/*
- * This function is not in the Heimdal mainline.
+ * Thir function is not in the Heimdal mainline.
*/
krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
{
@@ -682,7 +682,7 @@
else
err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
if (err == 0 && skey != NULL) {
- DEBUG(10, ("Got KRB5 session key of length %d\n", KRB5_KEY_LENGTH(skey)));
+ DEBUG(10, ("Got KRB5 session key of length %d\n", (int)KRB5_KEY_LENGTH(skey)));
*session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
Index: source/rpc_server/srv_samr_nt.c
===================================================================
--- source/rpc_server/srv_samr_nt.c (revision 17017)
+++ source/rpc_server/srv_samr_nt.c (revision 17160)
@@ -2463,8 +2463,6 @@
return NT_STATUS_NO_MEMORY;
}
- strlower_m(account);
-
nt_status = can_create(p->mem_ctx, account);
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
@@ -3203,7 +3201,7 @@
if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
- DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
+ DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n"));
} else {
/* update the UNIX password */
if (lp_unix_password_sync() ) {
@@ -3385,10 +3383,25 @@
if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info))
return NT_STATUS_INVALID_HANDLE;
- /* observed when joining an XP client to a Samba domain */
+ /* This is tricky. A WinXP domain join sets
+ (SA_RIGHT_USER_SET_PASSWORD|SA_RIGHT_USER_SET_ATTRIBUTES|SA_RIGHT_USER_ACCT_FLAGS_EXPIRY)
+ The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
+ standard Win32 API calls just ask for SA_RIGHT_USER_SET_PASSWORD in the SamrOpenUser().
+ This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
+ we'll use the set from the WinXP join as the basis. */
- acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
-
+ switch (switch_value) {
+ case 18:
+ case 24:
+ case 25:
+ case 26:
+ acc_required = SA_RIGHT_USER_SET_PASSWORD;
+ break;
+ default:
+ acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
+ break;
+ }
+
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) {
return r_u->status;
}
@@ -4027,6 +4040,7 @@
BOOL can_add_accounts;
uint32 acb_info;
DISP_INFO *disp_info = NULL;
+ BOOL ret;
DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__));
@@ -4046,7 +4060,11 @@
return NT_STATUS_NO_MEMORY;
}
- if(!pdb_getsampwsid(sam_pass, &user_sid)) {
+ become_root();
+ ret = pdb_getsampwsid(sam_pass, &user_sid);
+ unbecome_root();
+
+ if( !ret ) {
DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n",
sid_string_static(&user_sid)));
TALLOC_FREE(sam_pass);
Index: source/passdb/pdb_tdb.c
===================================================================
--- source/passdb/pdb_tdb.c (revision 17017)
+++ source/passdb/pdb_tdb.c (revision 17160)
@@ -1388,6 +1388,8 @@
pstring rename_script;
BOOL interim_account = False;
int rename_ret;
+ fstring oldname_lower;
+ fstring newname_lower;
/* can't do anything without an external script */
@@ -1431,11 +1433,19 @@
goto done;
}
- /* rename the posix user */
- string_sub2(rename_script, "%unew", newname, sizeof(pstring),
- True, False, True);
- string_sub2(rename_script, "%uold", pdb_get_username(old_acct),
- sizeof(pstring), True, False, True);
+ /* Rename the posix user. Follow the semantics of _samr_create_user()
+ so that we lower case the posix name but preserve the case in passdb */
+
+ fstrcpy( oldname_lower, pdb_get_username(old_acct) );
+ strlower_m( oldname_lower );
+
+ fstrcpy( newname_lower, newname );
+ strlower_m( newname_lower );
+
+ string_sub2(rename_script, "%unew", newname_lower, sizeof(pstring),
+ True, False, True);
+ string_sub2(rename_script, "%uold", oldname_lower, sizeof(pstring),
+ True, False, True);
rename_ret = smbrun(rename_script, NULL);
DEBUG(rename_ret ? 0 : 3,("Running the command `%s' gave %d\n", rename_script, rename_ret));
Index: source/passdb/pdb_ldap.c
===================================================================
--- source/passdb/pdb_ldap.c (revision 17017)
+++ source/passdb/pdb_ldap.c (revision 17160)
@@ -1830,6 +1830,7 @@
const char *oldname;
int rc;
pstring rename_script;
+ fstring oldname_lower, newname_lower;
if (!old_acct) {
DEBUG(0, ("ldapsam_rename_sam_account: old_acct was NULL!\n"));
@@ -1851,10 +1852,17 @@
DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
oldname, newname));
- /* we have to allow the account name to end with a '$' */
- string_sub2(rename_script, "%unew", newname, sizeof(pstring),
+ /* We have to allow the account name to end with a '$'.
+ Also, follow the semantics in _samr_create_user() and lower case the
+ posix name but preserve the case in passdb */
+
+ fstrcpy( oldname_lower, oldname );
+ strlower_m( oldname_lower );
+ fstrcpy( newname_lower, newname );
+ strlower_m( newname_lower );
+ string_sub2(rename_script, "%unew", newname_lower, sizeof(pstring),
True, False, True);
- string_sub2(rename_script, "%uold", oldname, sizeof(pstring),
+ string_sub2(rename_script, "%uold", oldname_lower, sizeof(pstring),
True, False, True);
rc = smbrun(rename_script, NULL);
Index: source/passdb/pdb_interface.c
===================================================================
--- source/passdb/pdb_interface.c (revision 17017)
+++ source/passdb/pdb_interface.c (revision 17160)
@@ -344,6 +344,7 @@
if ( !(pwd = Get_Pwnam_alloc(tmp_ctx, name)) ) {
pstring add_script;
int add_ret;
+ fstring name2;
if ((acb_info & ACB_NORMAL) && name[strlen(name)-1] != '$') {
pstrcpy(add_script, lp_adduser_script());
@@ -357,7 +358,11 @@
return NT_STATUS_NO_SUCH_USER;
}
- all_string_sub(add_script, "%u", name, sizeof(add_script));
+ /* lowercase the username before creating the Unix account for
+ compatibility with previous Samba releases */
+ fstrcpy( name2, name );
+ strlower_m( name2 );
+ all_string_sub(add_script, "%u", name2, sizeof(add_script));
add_ret = smbrun(add_script,NULL);
DEBUG(add_ret ? 0 : 3, ("_samr_create_user: Running the command `%s' gave %d\n",
add_script, add_ret));
@@ -383,6 +388,10 @@
return NT_STATUS_INTERNAL_ERROR;
}
+ /* Use the username case specified in the original request */
+
+ pdb_set_username( sam_pass, name, PDB_SET );
+
/* Disable the account on creation, it does not have a reasonable password yet. */
acb_info |= ACB_DISABLED;
@@ -435,6 +444,7 @@
struct samu *sam_acct)
{
NTSTATUS status;
+ fstring username;
status = pdb_delete_sam_account(sam_acct);
if (!NT_STATUS_IS_OK(status)) {
@@ -447,7 +457,14 @@
* not necessary present and maybe the sysadmin doesn't want to delete
* the unix side
*/
- smb_delete_user( pdb_get_username(sam_acct) );
+
+ /* always lower case the username before handing it off to
+ external scripts */
+
+ fstrcpy( username, pdb_get_username(sam_acct) );
+ strlower_m( username );
+
+ smb_delete_user( username );
return status;
}
@@ -504,6 +521,7 @@
{
struct pdb_methods *pdb = pdb_get_methods();
uid_t uid;
+ NTSTATUS status;
if (csamuser != NULL) {
TALLOC_FREE(csamuser);
@@ -520,7 +538,12 @@
return NT_STATUS_ACCESS_DENIED;
}
- return pdb->rename_sam_account(pdb, oldname, newname);
+ status = pdb->rename_sam_account(pdb, oldname, newname);
+
+ /* always flush the cache here just to be safe */
+ flush_pwnam_cache();
+
+ return status;
}
NTSTATUS pdb_update_login_attempts(struct samu *sam_acct, BOOL success)
Index: source/rpc_parse/parse_lsa.c
===================================================================
--- source/rpc_parse/parse_lsa.c (revision 17017)
+++ source/rpc_parse/parse_lsa.c (revision 17160)
@@ -986,6 +986,9 @@
if(!prs_uint16("info_class", ps, depth, &ctr->info_class))
return False;
+ if(!prs_align(ps))
+ return False;
+
switch (ctr->info_class) {
case 1:
if(!lsa_io_dom_query_1("", &ctr->info.id1, ps, depth))
Index: source/sam/idmap_ad.c
===================================================================
--- source/sam/idmap_ad.c (revision 17017)
+++ source/sam/idmap_ad.c (revision 17160)
@@ -35,7 +35,6 @@
NTSTATUS init_module(void);
static ADS_STRUCT *ad_idmap_ads = NULL;
-static char *ad_idmap_uri = NULL;
static char *attr_uidnumber = NULL;
static char *attr_gidnumber = NULL;
@@ -139,17 +138,13 @@
return ads;
}
-static NTSTATUS ad_idmap_init(char *uri)
+/* no op */
+static NTSTATUS ad_idmap_init(const char *uri)
{
- ad_idmap_uri = SMB_STRDUP(uri);
- if (ad_idmap_uri == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
-
return NT_STATUS_OK;
}
-static NTSTATUS ad_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, int id_type)
+static NTSTATUS ad_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, int id_type, int flags)
{
ADS_STATUS rc;
NTSTATUS status = NT_STATUS_NONE_MAPPED;
Index: source/include/rpc_ds.h
===================================================================
--- source/include/rpc_ds.h (revision 17017)
+++ source/include/rpc_ds.h (revision 17160)
@@ -49,7 +49,14 @@
#define DSROLE_BDC 4
#define DSROLE_PDC 5
+/* Settings for the domainFunctionality attribteu in the rootDSE */
+#define DS_DOMAIN_FUNCTION_2000 0
+#define DS_DOMAIN_FUCNTION_2003_MIXED 1
+#define DS_DOMAIN_FUNCTION_2003 2
+
+
+
typedef struct
{
uint16 machine_role;
Index: source/locking/brlock.c
===================================================================
--- source/locking/brlock.c (revision 17017)
+++ source/locking/brlock.c (revision 17160)
@@ -666,6 +666,7 @@
return NT_STATUS_NO_MEMORY;
}
br_lck->num_locks = count;
+ SAFE_FREE(br_lck->lock_data);
br_lck->lock_data = (void *)tp;
br_lck->modified = True;
return NT_STATUS_OK;
@@ -722,7 +723,7 @@
Check if an unlock overlaps a pending lock.
****************************************************************************/
-static BOOL brl_pending_overlap(struct lock_struct *lock, struct lock_struct *pend_lock)
+static BOOL brl_pending_overlap(const struct lock_struct *lock, const struct lock_struct *pend_lock)
{
if ((lock->start <= pend_lock->start) && (lock->start + lock->size > pend_lock->start))
return True;
@@ -738,12 +739,11 @@
static BOOL brl_unlock_windows(struct byte_range_lock *br_lck, const struct lock_struct *plock)
{
unsigned int i, j;
- struct lock_struct *lock = NULL;
struct lock_struct *locks = (struct lock_struct *)br_lck->lock_data;
#if ZERO_ZERO
for (i = 0; i < br_lck->num_locks; i++) {
- lock = &locks[i];
+ struct lock_struct *lock = &locks[i];
if (lock->lock_type == WRITE_LOCK &&
brl_same_context(&lock->context, &plock->context) &&
@@ -766,7 +766,7 @@
#endif
for (i = 0; i < br_lck->num_locks; i++) {
- lock = &locks[i];
+ struct lock_struct *lock = &locks[i];
/* Only remove our own locks that match in start, size, and flavour. */
if (brl_same_context(&lock->context, &plock->context) &&
@@ -798,7 +798,7 @@
}
/* We could send specific lock info here... */
- if (brl_pending_overlap(lock, pend_lock)) {
+ if (brl_pending_overlap(plock, pend_lock)) {
DEBUG(10,("brl_unlock: sending unlock message to pid %s\n",
procid_str_static(&pend_lock->context.pid )));
@@ -828,7 +828,6 @@
static BOOL brl_unlock_posix(struct byte_range_lock *br_lck, const struct lock_struct *plock)
{
unsigned int i, j, count;
- struct lock_struct *lock = NULL;
struct lock_struct *tp;
struct lock_struct *locks = (struct lock_struct *)br_lck->lock_data;
BOOL overlap_found = False;
@@ -857,11 +856,11 @@
count = 0;
for (i = 0; i < br_lck->num_locks; i++) {
+ struct lock_struct *lock = &locks[i];
struct lock_struct tmp_lock[3];
BOOL lock_was_added = False;
unsigned int tmp_count;
- lock = &locks[i];
/* Only remove our own locks - ignore fnum. */
if (lock->lock_type == PENDING_LOCK ||
@@ -956,11 +955,11 @@
}
br_lck->num_locks = count;
- br_lck->lock_data = (void *)tp;
+ SAFE_FREE(br_lck->lock_data);
+ locks = br_lck->lock_data = (void *)tp;
br_lck->modified = True;
/* Send unlock messages to any pending waiters that overlap. */
- locks = tp;
for (j=0; j < br_lck->num_locks; j++) {
struct lock_struct *pend_lock = &locks[j];
@@ -971,7 +970,7 @@
}
/* We could send specific lock info here... */
- if (brl_pending_overlap(lock, pend_lock)) {
+ if (brl_pending_overlap(plock, pend_lock)) {
DEBUG(10,("brl_unlock: sending unlock message to pid %s\n",
procid_str_static(&pend_lock->context.pid )));
Index: source/configure.in
===================================================================
--- source/configure.in (revision 17017)
+++ source/configure.in (revision 17160)
@@ -4752,6 +4752,20 @@
fi
#################################################
+# check for cluster extensions
+
+AC_MSG_CHECKING(whether to include cluster support)
+AC_ARG_WITH(cluster-support,
+[ --with-cluster-support Enable cluster extensions (default=no)])
+if test "x$with_cluster_support" = "xyes"; then
+ AC_DEFINE(CLUSTER_SUPPORT,1,[Whether to enable cluster extensions])
+ AC_MSG_RESULT(yes)
+else
+ AC_MSG_RESULT(no)
+fi
+
+
+#################################################
# check for ACL support
AC_MSG_CHECKING(whether to support ACLs)
Index: source/libads/kerberos_verify.c
===================================================================
--- source/libads/kerberos_verify.c (revision 17017)
+++ source/libads/kerberos_verify.c (revision 17160)
@@ -202,9 +202,13 @@
BOOL auth_ok = False;
char *password_s = NULL;
krb5_data password;
- krb5_enctype *enctypes = NULL;
+ krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
int i;
+#if defined(ENCTYPE_ARCFOUR_HMAC)
+ enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
+#endif
+
ZERO_STRUCTP(keyblock);
if (!secrets_init()) {
@@ -223,12 +227,6 @@
/* CIFS doesn't use addresses in tickets. This would break NAT. JRA */
- if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) {
- DEBUG(1,("ads_secrets_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n",
- error_message(ret)));
- goto out;
- }
-
p_packet->length = ticket->length;
p_packet->data = (krb5_pointer)ticket->data;
@@ -273,8 +271,6 @@
}
out:
-
- free_kerberos_etypes(context, enctypes);
SAFE_FREE(password_s);
return auth_ok;
Index: source/libads/ldap_schema.c
===================================================================
--- source/libads/ldap_schema.c (revision 17017)
+++ source/libads/ldap_schema.c (revision 17160)
@@ -283,22 +283,27 @@
if (strequal(ADS_ATTR_RFC2307_UIDNUMBER_OID, oids_out[i]) ||
strequal(ADS_ATTR_SFU_UIDNUMBER_OID, oids_out[i])) {
+ SAFE_FREE(ads->schema.posix_uidnumber_attr);
ads->schema.posix_uidnumber_attr = SMB_STRDUP(names_out[i]);
}
if (strequal(ADS_ATTR_RFC2307_GIDNUMBER_OID, oids_out[i]) ||
strequal(ADS_ATTR_SFU_GIDNUMBER_OID, oids_out[i])) {
+ SAFE_FREE(ads->schema.posix_gidnumber_attr);
ads->schema.posix_gidnumber_attr = SMB_STRDUP(names_out[i]);
}
if (strequal(ADS_ATTR_RFC2307_HOMEDIR_OID, oids_out[i]) ||
strequal(ADS_ATTR_SFU_HOMEDIR_OID, oids_out[i])) {
+ SAFE_FREE(ads->schema.posix_homedir_attr);
ads->schema.posix_homedir_attr = SMB_STRDUP(names_out[i]);
}
if (strequal(ADS_ATTR_RFC2307_SHELL_OID, oids_out[i]) ||
strequal(ADS_ATTR_SFU_SHELL_OID, oids_out[i])) {
+ SAFE_FREE(ads->schema.posix_shell_attr);
ads->schema.posix_shell_attr = SMB_STRDUP(names_out[i]);
}
if (strequal(ADS_ATTR_RFC2307_GECOS_OID, oids_out[i]) ||
strequal(ADS_ATTR_SFU_GECOS_OID, oids_out[i])) {
+ SAFE_FREE(ads->schema.posix_gecos_attr);
ads->schema.posix_gecos_attr = SMB_STRDUP(names_out[i]);
}
}
Index: source/libads/kerberos_keytab.c
===================================================================
--- source/libads/kerberos_keytab.c (revision 17017)
+++ source/libads/kerberos_keytab.c (revision 17160)
@@ -9,6 +9,7 @@
Copyright (C) Rakesh Patel 2004
Copyright (C) Dan Perry 2004
Copyright (C) Jeremy Allison 2004
+ Copyright (C) Gerald Carter 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -29,120 +30,35 @@
#ifdef HAVE_KRB5
+/* This MAX_NAME_LEN is a constant defined in krb5.h */
+#ifndef MAX_KEYTAB_NAME_LEN
+#define MAX_KEYTAB_NAME_LEN 1100
+#endif
+
+
/**********************************************************************
- Adds a single service principal, i.e. 'host' to the system keytab
-***********************************************************************/
+**********************************************************************/
-int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
+static int smb_krb5_kt_add_entry( krb5_context context, krb5_keytab keytab,
+ krb5_kvno kvno, const char *princ_s,
+ krb5_enctype *enctypes, krb5_data password )
{
krb5_error_code ret = 0;
- krb5_context context = NULL;
- krb5_keytab keytab = NULL;
krb5_kt_cursor cursor;
krb5_keytab_entry kt_entry;
krb5_principal princ = NULL;
- krb5_data password;
- krb5_enctype *enctypes = NULL;
- krb5_kvno kvno;
-
- char *principal = NULL;
- char *princ_s = NULL;
- char *password_s = NULL;
-#ifndef MAX_KEYTAB_NAME_LEN
-#define MAX_KEYTAB_NAME_LEN 1100
-#endif
- char keytab_name[MAX_KEYTAB_NAME_LEN]; /* This MAX_NAME_LEN is a constant defined in krb5.h */
- fstring my_fqdn;
int i;
char *ktprinc = NULL;
ZERO_STRUCT(kt_entry);
ZERO_STRUCT(cursor);
-
- initialize_krb5_error_table();
- ret = krb5_init_context(&context);
- if (ret) {
- DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
- return -1;
- }
-#ifdef HAVE_WRFILE_KEYTAB /* MIT */
- keytab_name[0] = 'W';
- keytab_name[1] = 'R';
- ret = krb5_kt_default_name(context, (char *) &keytab_name[2], MAX_KEYTAB_NAME_LEN - 4);
-#else /* Heimdal */
- ret = krb5_kt_default_name(context, (char *) &keytab_name[0], MAX_KEYTAB_NAME_LEN - 2);
-#endif
- if (ret) {
- DEBUG(1,("ads_keytab_add_entry: krb5_kt_default_name failed (%s)\n", error_message(ret)));
- goto out;
- }
- DEBUG(2,("ads_keytab_add_entry: Using default system keytab: %s\n", (char *) &keytab_name));
- ret = krb5_kt_resolve(context, (char *) &keytab_name, &keytab);
- if (ret) {
- DEBUG(1,("ads_keytab_add_entry: krb5_kt_resolve failed (%s)\n", error_message(ret)));
- goto out;
- }
-
- /* retrieve the password */
- if (!secrets_init()) {
- DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
- ret = -1;
- goto out;
- }
- password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
- if (!password_s) {
- DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
- ret = -1;
- goto out;
- }
- password.data = password_s;
- password.length = strlen(password_s);
-
- /* Construct our principal */
- name_to_fqdn(my_fqdn, global_myname());
- strlower_m(my_fqdn);
-
- if (strchr_m(srvPrinc, '@')) {
- /* It's a fully-named principal. */
- asprintf(&princ_s, "%s", srvPrinc);
- } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
- /* It's the machine account, as used by smbclient clients. */
- asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm());
- } else {
- /* It's a normal service principal. Add the SPN now so that we
- * can obtain credentials for it and double-check the salt value
- * used to generate the service's keys. */
- asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm());
- /* Update the directory with the SPN */
- DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
- if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), srvPrinc))) {
- DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
- goto out;
- }
- }
-
- ret = get_kerberos_allowed_etypes(context,&enctypes);
- if (ret) {
- DEBUG(1,("ads_keytab_add_entry: get_kerberos_allowed_etypes failed (%s)\n",error_message(ret)));
- goto out;
- }
-
- /* Guess at how the KDC is salting keys for this principal. */
- kerberos_derive_salting_principal(princ_s);
-
+
ret = smb_krb5_parse_name(context, princ_s, &princ);
if (ret) {
DEBUG(1,("ads_keytab_add_entry: smb_krb5_parse_name(%s) failed (%s)\n", princ_s, error_message(ret)));
goto out;
}
- kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
- if (kvno == -1) { /* -1 indicates failure, everything else is OK */
- DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n"));
- ret = -1;
- goto out;
- }
-
/* Seek and delete old keytab entries */
ret = krb5_kt_start_seq_get(context, keytab, &cursor);
if (ret != KRB5_KT_END && ret != ENOENT ) {
@@ -275,15 +191,8 @@
}
}
- krb5_kt_close(context, keytab);
- keytab = NULL; /* Done with keytab now. No double free. */
out:
-
- SAFE_FREE(principal);
- SAFE_FREE(password_s);
- SAFE_FREE(princ_s);
-
{
krb5_keytab_entry zero_kt_entry;
ZERO_STRUCT(zero_kt_entry);
@@ -294,10 +203,7 @@
if (princ) {
krb5_free_principal(context, princ);
}
- if (enctypes) {
- free_kerberos_etypes(context, enctypes);
- }
-
+
{
krb5_kt_cursor zero_csr;
ZERO_STRUCT(zero_csr);
@@ -305,6 +211,157 @@
krb5_kt_end_seq_get(context, keytab, &cursor);
}
}
+
+ return (int)ret;
+}
+
+
+/**********************************************************************
+ Adds a single service principal, i.e. 'host' to the system keytab
+***********************************************************************/
+
+int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
+{
+ krb5_error_code ret = 0;
+ krb5_context context = NULL;
+ krb5_keytab keytab = NULL;
+ krb5_data password;
+ krb5_kvno kvno;
+ krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
+ char *princ_s = NULL, *short_princ_s = NULL;
+ char *password_s = NULL;
+ char *my_fqdn;
+ char keytab_name[MAX_KEYTAB_NAME_LEN];
+ TALLOC_CTX *ctx = NULL;
+ char *machine_name;
+
+#if defined(ENCTYPE_ARCFOUR_HMAC)
+ enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
+#endif
+
+ initialize_krb5_error_table();
+ ret = krb5_init_context(&context);
+ if (ret) {
+ DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
+ return -1;
+ }
+
+#ifdef HAVE_WRFILE_KEYTAB /* MIT */
+ keytab_name[0] = 'W';
+ keytab_name[1] = 'R';
+ ret = krb5_kt_default_name(context, (char *) &keytab_name[2], MAX_KEYTAB_NAME_LEN - 4);
+#else /* Heimdal */
+ ret = krb5_kt_default_name(context, (char *) &keytab_name[0], MAX_KEYTAB_NAME_LEN - 2);
+#endif
+ if (ret) {
+ DEBUG(1,("ads_keytab_add_entry: krb5_kt_default_name failed (%s)\n", error_message(ret)));
+ goto out;
+ }
+ DEBUG(2,("ads_keytab_add_entry: Using default system keytab: %s\n", (char *) &keytab_name));
+ ret = krb5_kt_resolve(context, (char *) &keytab_name, &keytab);
+ if (ret) {
+ DEBUG(1,("ads_keytab_add_entry: krb5_kt_resolve failed (%s)\n", error_message(ret)));
+ goto out;
+ }
+
+ /* retrieve the password */
+ if (!secrets_init()) {
+ DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
+ ret = -1;
+ goto out;
+ }
+ password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
+ if (!password_s) {
+ DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
+ ret = -1;
+ goto out;
+ }
+ password.data = password_s;
+ password.length = strlen(password_s);
+
+ /* we need the dNSHostName value here */
+
+ if ( (ctx = talloc_init("ads_keytab_add_entry")) == NULL ) {
+ DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n"));
+ ret = -1;
+ goto out;
+ }
+
+ if ( (my_fqdn = ads_get_dnshostname( ads, ctx, global_myname())) == NULL ) {
+ DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n"));
+ ret = -1;
+ goto out;
+ }
+
+ if ( (machine_name = ads_get_samaccountname( ads, ctx, global_myname())) == NULL ) {
+ DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n"));
+ ret = -1;
+ goto out;
+ }
+ /*strip the trailing '$' */
+ machine_name[strlen(machine_name)-1] = '\0';
+
+ /* Construct our principal */
+
+ if (strchr_m(srvPrinc, '@')) {
+ /* It's a fully-named principal. */
+ asprintf(&princ_s, "%s", srvPrinc);
+ } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
+ /* It's the machine account, as used by smbclient clients. */
+ asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm());
+ } else {
+ /* It's a normal service principal. Add the SPN now so that we
+ * can obtain credentials for it and double-check the salt value
+ * used to generate the service's keys. */
+
+ asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm());
+ asprintf(&short_princ_s, "%s/%s@%s", srvPrinc, machine_name, lp_realm());
+
+ /* According to http://support.microsoft.com/kb/326985/en-us,
+ certain principal names are automatically mapped to the host/...
+ principal in the AD account. So only create these in the
+ keytab, not in AD. --jerry */
+
+ if ( !strequal( srvPrinc, "cifs" ) && !strequal(srvPrinc, "host" ) ) {
+ DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
+
+ if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), my_fqdn, srvPrinc))) {
+ DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
+ goto out;
+ }
+ }
+ }
+
+ kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
+ if (kvno == -1) { /* -1 indicates failure, everything else is OK */
+ DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n"));
+ ret = -1;
+ goto out;
+ }
+
+ /* add the fqdn principal to the keytab */
+
+ ret = smb_krb5_kt_add_entry( context, keytab, kvno, princ_s, enctypes, password );
+ if ( ret ) {
+ DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n"));
+ goto out;
+ }
+
+ /* add the short principal name if we have one */
+
+ if ( short_princ_s ) {
+ ret = smb_krb5_kt_add_entry( context, keytab, kvno, short_princ_s, enctypes, password );
+ if ( ret ) {
+ DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n"));
+ goto out;
+ }
+ }
+
+out:
+ SAFE_FREE( princ_s );
+ SAFE_FREE( short_princ_s );
+ TALLOC_FREE( ctx );
+
if (keytab) {
krb5_kt_close(context, keytab);
}
@@ -440,95 +497,77 @@
krb5_kt_cursor cursor;
krb5_keytab_entry kt_entry;
krb5_kvno kvno;
- fstring my_fqdn, my_Fqdn, my_name, my_NAME, my_host_realm;
- char *p_fqdn;
int i, found = 0;
+ char *sam_account_name, *upn;
char **oldEntries = NULL, *princ_s[26];
+ TALLOC_CTX *ctx = NULL;
+ fstring machine_name;
memset(princ_s, '\0', sizeof(princ_s));
- ret = ads_keytab_add_entry(ads, "host");
- if (ret) {
+ fstrcpy( machine_name, global_myname() );
+
+ /* these are the main ones we need */
+
+ if ( (ret = ads_keytab_add_entry(ads, "host") ) != 0 ) {
DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n"));
return ret;
}
- ret = ads_keytab_add_entry(ads, "cifs");
- if (ret) {
+
+
+#if 0 /* don't create the CIFS/... keytab entries since no one except smbd
+ really needs them and we will fall back to verifying against secrets.tdb */
+
+ if ( (ret = ads_keytab_add_entry(ads, "cifs")) != 0 ) {
DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n"));
return ret;
}
+#endif
- fstrcpy(my_name, global_myname());
- strlower_m(my_name);
+ if ( (ctx = talloc_init("ads_keytab_create_default")) == NULL ) {
+ DEBUG(0,("ads_keytab_create_default: talloc() failed!\n"));
+ return -1;
+ }
- fstrcpy(my_NAME, global_myname());
- strupper_m(my_NAME);
-
- my_fqdn[0] = '\0';
- name_to_fqdn(my_fqdn, global_myname());
- strlower_m(my_fqdn);
-
- p_fqdn = strchr_m(my_fqdn, '.');
- fstrcpy(my_Fqdn, my_NAME);
- if (p_fqdn) {
- fstrcat(my_Fqdn, p_fqdn);
+ /* now add the userPrincipalName and sAMAccountName entries */
+
+ if ( (sam_account_name = ads_get_samaccountname( ads, ctx, machine_name)) == NULL ) {
+ DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n"));
+ TALLOC_FREE( ctx );
+ return -1;
}
- fstrcpy(my_host_realm, my_name);
- fstrcat(my_host_realm, ".");
- fstrcat(my_host_realm, lp_realm());
- strlower_m(my_host_realm);
-
- asprintf(&princ_s[0], "%s$@%s", my_name, lp_realm());
- asprintf(&princ_s[1], "%s$@%s", my_NAME, lp_realm());
- asprintf(&princ_s[2], "host/%s@%s", my_name, lp_realm());
- asprintf(&princ_s[3], "host/%s@%s", my_NAME, lp_realm());
- asprintf(&princ_s[4], "host/%s@%s", my_fqdn, lp_realm());
- asprintf(&princ_s[5], "host/%s@%s", my_Fqdn, lp_realm());
- asprintf(&princ_s[6], "HOST/%s@%s", my_name, lp_realm());
- asprintf(&princ_s[7], "HOST/%s@%s", my_NAME, lp_realm());
- asprintf(&princ_s[8], "HOST/%s@%s", my_fqdn, lp_realm());
- asprintf(&princ_s[9], "HOST/%s@%s", my_Fqdn, lp_realm());
- asprintf(&princ_s[10], "cifs/%s@%s", my_name, lp_realm());
- asprintf(&princ_s[11], "cifs/%s@%s", my_NAME, lp_realm());
- asprintf(&princ_s[12], "cifs/%s@%s", my_fqdn, lp_realm());
- asprintf(&princ_s[13], "cifs/%s@%s", my_Fqdn, lp_realm());
- asprintf(&princ_s[14], "CIFS/%s@%s", my_name, lp_realm());
- asprintf(&princ_s[15], "CIFS/%s@%s", my_NAME, lp_realm());
- asprintf(&princ_s[16], "CIFS/%s@%s", my_fqdn, lp_realm());
- asprintf(&princ_s[17], "CIFS/%s@%s", my_Fqdn, lp_realm());
- asprintf(&princ_s[18], "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm());
- asprintf(&princ_s[19], "CIFS/%s.%s@%s", my_name, lp_realm(), lp_realm());
- asprintf(&princ_s[20], "host/%s.%s@%s", my_name, lp_realm(), lp_realm());
- asprintf(&princ_s[21], "HOST/%s.%s@%s", my_name, lp_realm(), lp_realm());
-
- /* when dnsdomain == realm, don't add duplicate principal */
- if (!strequal(my_host_realm, my_fqdn)) {
- asprintf(&princ_s[22], "cifs/%s@%s", my_host_realm, lp_realm());
- asprintf(&princ_s[23], "CIFS/%s@%s", my_host_realm, lp_realm());
- asprintf(&princ_s[24], "host/%s@%s", my_host_realm, lp_realm());
- asprintf(&princ_s[25], "HOST/%s@%s", my_host_realm, lp_realm());
+ if ( (ret = ads_keytab_add_entry(ads, sam_account_name )) != 0 ) {
+ DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n",
+ sam_account_name));
+ return ret;
}
-
- for (i = 0; i < sizeof(princ_s) / sizeof(princ_s[0]); i++) {
- if (princ_s[i] != NULL) {
- ret = ads_keytab_add_entry(ads, princ_s[i]);
- if (ret != 0) {
- DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding '%s'.\n", princ_s[i]));
- }
- SAFE_FREE(princ_s[i]);
+
+ /* remember that not every machine account will have a upn */
+
+ upn = ads_get_upn( ads, ctx, machine_name);
+ if ( upn ) {
+ if ( (ret = ads_keytab_add_entry(ads, upn)) != 0 ) {
+ DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n",
+ upn));
+ TALLOC_FREE( ctx );
+ return ret;
}
}
- kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
+ TALLOC_FREE( ctx );
+
+ /* Now loop through the keytab and update any other existing entries... */
+
+ kvno = (krb5_kvno) ads_get_kvno(ads, machine_name);
if (kvno == -1) {
DEBUG(1,("ads_keytab_create_default: ads_get_kvno failed to determine the system's kvno.\n"));
return -1;
}
+
+ DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to "
+ "preserve and update.\n"));
- DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to preserve and update.\n"));
- /* Now loop through the keytab and update any other existing entries... */
-
ZERO_STRUCT(kt_entry);
ZERO_STRUCT(cursor);
Index: source/libads/kerberos.c
===================================================================
--- source/libads/kerberos.c (revision 17017)
+++ source/libads/kerberos.c (revision 17160)
@@ -5,6 +5,7 @@
Copyright (C) Remus Koos 2001
Copyright (C) Nalin Dahyabhai <nalin at redhat.com> 2004.
Copyright (C) Jeremy Allison 2004.
+ Copyright (C) Gerald Carter 2006.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -268,11 +269,85 @@
}
/************************************************************************
- Routine to get the salting principal for this service. Active
- Directory may use a non-obvious principal name to generate the salt
- when it determines the key to use for encrypting tickets for a service,
- and hopefully we detected that when we joined the domain.
- Caller must free if return is not null.
+ Return the standard DES salt key
+************************************************************************/
+
+char* kerberos_standard_des_salt( void )
+{
+ fstring salt;
+
+ fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() );
+ strlower_m( salt );
+ fstrcat( salt, lp_realm() );
+
+ return SMB_STRDUP( salt );
+}
+
+/************************************************************************
+************************************************************************/
+
+static char* des_salt_key( void )
+{
+ char *key;
+
+ asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL, lp_realm());
+
+ return key;
+}
+
+/************************************************************************
+************************************************************************/
+
+BOOL kerberos_secrets_store_des_salt( const char* salt )
+{
+ char* key;
+ BOOL ret;
+
+ if ( (key = des_salt_key()) == NULL ) {
+ DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
+ return False;
+ }
+
+ if ( !salt ) {
+ DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
+ secrets_delete( key );
+ return True;
+ }
+
+ DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
+
+ ret = secrets_store( key, salt, strlen(salt)+1 );
+
+ SAFE_FREE( key );
+
+ return ret;
+}
+
+/************************************************************************
+************************************************************************/
+
+char* kerberos_secrets_fetch_des_salt( void )
+{
+ char *salt, *key;
+
+ if ( (key = des_salt_key()) == NULL ) {
+ DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
+ return False;
+ }
+
+ salt = (char*)secrets_fetch( key, NULL );
+
+ SAFE_FREE( key );
+
+ return salt;
+}
+
+
+/************************************************************************
+ Routine to get the salting principal for this service. This is
+ maintained for backwards compatibilty with releases prior to 3.0.24.
+ Since we store the salting principal string only at join, we may have
+ to look for the older tdb keys. Caller must free if return is not null.
************************************************************************/
krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
@@ -281,23 +356,29 @@
{
char *unparsed_name = NULL, *salt_princ_s = NULL;
krb5_principal ret_princ = NULL;
+
+ /* lookup new key first */
- if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
- return (krb5_principal)NULL;
- }
+ if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
+
+ /* look under the old key. If this fails, just use the standard key */
- if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
- SAFE_FREE(unparsed_name);
- return (krb5_principal)NULL;
+ if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
+ return (krb5_principal)NULL;
+ }
+ if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
+ /* fall back to host/machine.realm at REALM */
+ salt_princ_s = kerberos_standard_des_salt();
+ }
}
if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) {
- SAFE_FREE(unparsed_name);
- SAFE_FREE(salt_princ_s);
- return (krb5_principal)NULL;
+ ret_princ = NULL;
}
+
SAFE_FREE(unparsed_name);
SAFE_FREE(salt_princ_s);
+
return ret_princ;
}
@@ -362,466 +443,10 @@
return ret;
}
-/************************************************************************
- Routine to get initial credentials as a service ticket for the local machine.
- Returns a buffer initialized with krb5_mk_req_extended.
- ************************************************************************/
-static krb5_error_code get_service_ticket(krb5_context ctx,
- krb5_ccache ccache,
- const char *service_principal,
- int enctype,
- krb5_data *p_outbuf)
-{
- krb5_creds creds, *new_creds = NULL;
- char *service_s = NULL;
- char *machine_account = NULL, *password = NULL;
- krb5_data in_data;
- krb5_auth_context auth_context = NULL;
- krb5_error_code err = 0;
-
- ZERO_STRUCT(creds);
-
- asprintf(&machine_account, "%s$@%s", global_myname(), lp_realm());
- if (machine_account == NULL) {
- goto out;
- }
- password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
- if (password == NULL) {
- goto out;
- }
- if ((err = kerberos_kinit_password(machine_account, password,
- 0, LIBADS_CCACHE_NAME)) != 0) {
- DEBUG(0,("get_service_ticket: kerberos_kinit_password %s failed: %s\n",
- machine_account,
- error_message(err)));
- goto out;
- }
-
- /* Ok - the above call has gotten a TGT. Now we need to get a service
- ticket to ourselves. */
-
- /* Set up the enctype and client and server principal fields for krb5_get_credentials. */
- kerberos_set_creds_enctype(&creds, enctype);
-
- if ((err = krb5_cc_get_principal(ctx, ccache, &creds.client))) {
- DEBUG(3, ("get_service_ticket: krb5_cc_get_principal failed: %s\n",
- error_message(err)));
- goto out;
- }
-
- if (strchr_m(service_principal, '@')) {
- asprintf(&service_s, "%s", service_principal);
- } else {
- asprintf(&service_s, "%s@%s", service_principal, lp_realm());
- }
-
- if ((err = smb_krb5_parse_name(ctx, service_s, &creds.server))) {
- DEBUG(0,("get_service_ticket: smb_krb5_parse_name %s failed: %s\n",
- service_s, error_message(err)));
- goto out;
- }
-
- if ((err = krb5_get_credentials(ctx, 0, ccache, &creds, &new_creds))) {
- DEBUG(5,("get_service_ticket: krb5_get_credentials for %s enctype %d failed: %s\n",
- service_s, enctype, error_message(err)));
- goto out;
- }
-
- memset(&in_data, '\0', sizeof(in_data));
- if ((err = krb5_mk_req_extended(ctx, &auth_context, 0, &in_data,
- new_creds, p_outbuf)) != 0) {
- DEBUG(0,("get_service_ticket: krb5_mk_req_extended failed: %s\n",
- error_message(err)));
- goto out;
- }
-
- out:
-
- if (auth_context) {
- krb5_auth_con_free(ctx, auth_context);
- }
- if (new_creds) {
- krb5_free_creds(ctx, new_creds);
- }
- if (creds.server) {
- krb5_free_principal(ctx, creds.server);
- }
- if (creds.client) {
- krb5_free_principal(ctx, creds.client);
- }
-
- SAFE_FREE(service_s);
- SAFE_FREE(password);
- SAFE_FREE(machine_account);
- return err;
-}
-
/************************************************************************
- Check if the machine password can be used in conjunction with the salting_principal
- to generate a key which will successfully decrypt the AP_REQ already
- gotten as a message to the local machine.
- ************************************************************************/
+************************************************************************/
-static BOOL verify_service_password(krb5_context ctx,
- int enctype,
- const char *salting_principal,
- krb5_data *in_data)
-{
- BOOL ret = False;
- krb5_principal salting_kprinc = NULL;
- krb5_ticket *ticket = NULL;
- krb5_keyblock key;
- krb5_data passdata;
- char *salting_s = NULL;
- char *machine_account = NULL, *password = NULL;
- krb5_auth_context auth_context = NULL;
- krb5_error_code err;
-
- memset(&passdata, '\0', sizeof(passdata));
- memset(&key, '\0', sizeof(key));
-
- asprintf(&machine_account, "%s$@%s", global_myname(), lp_realm());
- if (machine_account == NULL) {
- goto out;
- }
- password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
- if (password == NULL) {
- goto out;
- }
-
- if (strchr_m(salting_principal, '@')) {
- asprintf(&salting_s, "%s", salting_principal);
- } else {
- asprintf(&salting_s, "%s@%s", salting_principal, lp_realm());
- }
-
- if ((err = smb_krb5_parse_name(ctx, salting_s, &salting_kprinc))) {
- DEBUG(0,("verify_service_password: smb_krb5_parse_name %s failed: %s\n",
- salting_s, error_message(err)));
- goto out;
- }
-
- passdata.length = strlen(password);
- passdata.data = (char*)password;
- if ((err = create_kerberos_key_from_string_direct(ctx, salting_kprinc, &passdata, &key, enctype))) {
- DEBUG(0,("verify_service_password: create_kerberos_key_from_string %d failed: %s\n",
- enctype, error_message(err)));
- goto out;
- }
-
- if ((err = krb5_auth_con_init(ctx, &auth_context)) != 0) {
- DEBUG(0,("verify_service_password: krb5_auth_con_init failed %s\n", error_message(err)));
- goto out;
- }
-
- if ((err = krb5_auth_con_setuseruserkey(ctx, auth_context, &key)) != 0) {
- DEBUG(0,("verify_service_password: krb5_auth_con_setuseruserkey failed %s\n", error_message(err)));
- goto out;
- }
-
- if (!(err = krb5_rd_req(ctx, &auth_context, in_data, NULL, NULL, NULL, &ticket))) {
- DEBUG(10,("verify_service_password: decrypted message with enctype %u salt %s!\n",
- (unsigned int)enctype, salting_s));
- ret = True;
- }
-
- out:
-
- memset(&passdata, 0, sizeof(passdata));
- krb5_free_keyblock_contents(ctx, &key);
- if (ticket != NULL) {
- krb5_free_ticket(ctx, ticket);
- }
- if (salting_kprinc) {
- krb5_free_principal(ctx, salting_kprinc);
- }
- SAFE_FREE(salting_s);
- SAFE_FREE(password);
- SAFE_FREE(machine_account);
- return ret;
-}
-
-/************************************************************************
- *
- * From the current draft of kerberos-clarifications:
- *
- * It is not possible to reliably generate a user's key given a pass
- * phrase without contacting the KDC, since it will not be known
- * whether alternate salt or parameter values are required.
- *
- * And because our server has a password, we have this exact problem. We
- * make multiple guesses as to which principal name provides the salt which
- * the KDC is using.
- *
- ************************************************************************/
-
-static void kerberos_derive_salting_principal_for_enctype(const char *service_principal,
- krb5_context ctx,
- krb5_ccache ccache,
- krb5_enctype enctype,
- krb5_enctype *enctypes)
-{
- char *salting_principals[3] = {NULL, NULL, NULL}, *second_principal = NULL;
- krb5_error_code err = 0;
- krb5_data outbuf;
- int i, j;
-
- memset(&outbuf, '\0', sizeof(outbuf));
-
- /* Check that the service_principal is useful. */
- if ((service_principal == NULL) || (strlen(service_principal) == 0)) {
- return;
- }
-
- /* Generate our first guess -- the principal as-given. */
- asprintf(&salting_principals[0], "%s", service_principal);
- if ((salting_principals[0] == NULL) || (strlen(salting_principals[0]) == 0)) {
- return;
- }
-
- /* Generate our second guess -- the computer's principal, as Win2k3. */
- asprintf(&second_principal, "host/%s.%s", global_myname(), lp_realm());
- if (second_principal != NULL) {
- strlower_m(second_principal);
- asprintf(&salting_principals[1], "%s@%s", second_principal, lp_realm());
- SAFE_FREE(second_principal);
- }
- if ((salting_principals[1] == NULL) || (strlen(salting_principals[1]) == 0)) {
- goto out;
- }
-
- /* Generate our third guess -- the computer's principal, as Win2k. */
- asprintf(&second_principal, "HOST/%s", global_myname());
- if (second_principal != NULL) {
- strlower_m(second_principal + 5);
- asprintf(&salting_principals[2], "%s@%s",
- second_principal, lp_realm());
- SAFE_FREE(second_principal);
- }
- if ((salting_principals[2] == NULL) || (strlen(salting_principals[2]) == 0)) {
- goto out;
- }
-
- /* Get a service ticket for ourselves into our memory ccache. */
- /* This will commonly fail if there is no principal by that name (and we're trying
- many names). So don't print a debug 0 error. */
-
- if ((err = get_service_ticket(ctx, ccache, service_principal, enctype, &outbuf)) != 0) {
- DEBUG(3, ("verify_service_password: get_service_ticket failed: %s\n",
- error_message(err)));
- goto out;
- }
-
- /* At this point we have a message to ourselves, salted only the KDC knows how. We
- have to work out what that salting is. */
-
- /* Try and find the correct salting principal. */
- for (i = 0; i < sizeof(salting_principals) / sizeof(salting_principals[i]); i++) {
- if (verify_service_password(ctx, enctype, salting_principals[i], &outbuf)) {
- break;
- }
- }
-
- /* If we failed to get a match, return. */
- if (i >= sizeof(salting_principals) / sizeof(salting_principals[i])) {
- goto out;
- }
-
- /* If we succeeded, store the principal for use for all enctypes which
- * share the same cipher and string-to-key function. Doing this here
- * allows servers which just pass a keytab to krb5_rd_req() to work
- * correctly. */
- for (j = 0; enctypes[j] != 0; j++) {
- if (enctype != enctypes[j]) {
- /* If this enctype isn't compatible with the one which
- * we used, skip it. */
-
- if (!kerberos_compatible_enctypes(ctx, enctypes[j], enctype))
- continue;
- }
- /* If the principal which gives us the proper salt is the one
- * which we would normally guess, don't bother noting anything
- * in the secrets tdb. */
- if (strcmp(service_principal, salting_principals[i]) != 0) {
- kerberos_secrets_store_salting_principal(service_principal,
- enctypes[j],
- salting_principals[i]);
- }
- }
-
- out :
-
- kerberos_free_data_contents(ctx, &outbuf);
- SAFE_FREE(salting_principals[0]);
- SAFE_FREE(salting_principals[1]);
- SAFE_FREE(salting_principals[2]);
- SAFE_FREE(second_principal);
-}
-
-/************************************************************************
- Go through all the possible enctypes for this principal.
- ************************************************************************/
-
-static void kerberos_derive_salting_principal_direct(krb5_context context,
- krb5_ccache ccache,
- krb5_enctype *enctypes,
- char *service_principal)
-{
- int i;
-
- /* Try for each enctype separately, because the rules are
- * different for different enctypes. */
- for (i = 0; enctypes[i] != 0; i++) {
- /* Delete secrets entry first. */
- kerberos_secrets_store_salting_principal(service_principal, 0, NULL);
-#ifdef ENCTYPE_ARCFOUR_HMAC
- if (enctypes[i] == ENCTYPE_ARCFOUR_HMAC) {
- /* Of course this'll always work, so just save
- * ourselves the effort. */
- continue;
- }
-#endif
- /* Try to figure out what's going on with this
- * principal. */
- kerberos_derive_salting_principal_for_enctype(service_principal,
- context,
- ccache,
- enctypes[i],
- enctypes);
- }
-}
-
-/************************************************************************
- Wrapper function for the above.
- ************************************************************************/
-
-BOOL kerberos_derive_salting_principal(char *service_principal)
-{
- krb5_context context = NULL;
- krb5_enctype *enctypes = NULL;
- krb5_ccache ccache = NULL;
- krb5_error_code ret = 0;
-
- initialize_krb5_error_table();
- if ((ret = krb5_init_context(&context)) != 0) {
- DEBUG(1,("kerberos_derive_cifs_salting_principals: krb5_init_context failed. %s\n",
- error_message(ret)));
- return False;
- }
- if ((ret = get_kerberos_allowed_etypes(context, &enctypes)) != 0) {
- DEBUG(1,("kerberos_derive_cifs_salting_principals: get_kerberos_allowed_etypes failed. %s\n",
- error_message(ret)));
- goto out;
- }
-
- if ((ret = krb5_cc_resolve(context, LIBADS_CCACHE_NAME, &ccache)) != 0) {
- DEBUG(3, ("get_service_ticket: krb5_cc_resolve for %s failed: %s\n",
- LIBADS_CCACHE_NAME, error_message(ret)));
- goto out;
- }
-
- kerberos_derive_salting_principal_direct(context, ccache, enctypes, service_principal);
-
- out:
- if (enctypes) {
- free_kerberos_etypes(context, enctypes);
- }
- if (ccache) {
- krb5_cc_destroy(context, ccache);
- }
- if (context) {
- krb5_free_context(context);
- }
-
- return ret ? False : True;
-}
-
-/************************************************************************
- Core function to try and determine what salt is being used for any keytab
- keys.
- ************************************************************************/
-
-BOOL kerberos_derive_cifs_salting_principals(void)
-{
- fstring my_fqdn;
- char *service = NULL;
- krb5_context context = NULL;
- krb5_enctype *enctypes = NULL;
- krb5_ccache ccache = NULL;
- krb5_error_code ret = 0;
- BOOL retval = False;
-
- initialize_krb5_error_table();
- if ((ret = krb5_init_context(&context)) != 0) {
- DEBUG(1,("kerberos_derive_cifs_salting_principals: krb5_init_context failed. %s\n",
- error_message(ret)));
- return False;
- }
- if ((ret = get_kerberos_allowed_etypes(context, &enctypes)) != 0) {
- DEBUG(1,("kerberos_derive_cifs_salting_principals: get_kerberos_allowed_etypes failed. %s\n",
- error_message(ret)));
- goto out;
- }
-
- if ((ret = krb5_cc_resolve(context, LIBADS_CCACHE_NAME, &ccache)) != 0) {
- DEBUG(3, ("get_service_ticket: krb5_cc_resolve for %s failed: %s\n",
- LIBADS_CCACHE_NAME, error_message(ret)));
- goto out;
- }
-
- if (asprintf(&service, "%s$", global_myname()) != -1) {
- strlower_m(service);
- kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
- SAFE_FREE(service);
- }
- if (asprintf(&service, "cifs/%s", global_myname()) != -1) {
- strlower_m(service);
- kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
- SAFE_FREE(service);
- }
- if (asprintf(&service, "host/%s", global_myname()) != -1) {
- strlower_m(service);
- kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
- SAFE_FREE(service);
- }
- if (asprintf(&service, "cifs/%s.%s", global_myname(), lp_realm()) != -1) {
- strlower_m(service);
- kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
- SAFE_FREE(service);
- }
- if (asprintf(&service, "host/%s.%s", global_myname(), lp_realm()) != -1) {
- strlower_m(service);
- kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
- SAFE_FREE(service);
- }
- name_to_fqdn(my_fqdn, global_myname());
- if (asprintf(&service, "cifs/%s", my_fqdn) != -1) {
- strlower_m(service);
- kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
- SAFE_FREE(service);
- }
- if (asprintf(&service, "host/%s", my_fqdn) != -1) {
- strlower_m(service);
- kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
- SAFE_FREE(service);
- }
-
- retval = True;
-
- out:
- if (enctypes) {
- free_kerberos_etypes(context, enctypes);
- }
- if (ccache) {
- krb5_cc_destroy(context, ccache);
- }
- if (context) {
- krb5_free_context(context);
- }
- return retval;
-}
-
int kerberos_kinit_password(const char *principal,
const char *password,
int time_offset,
Index: source/libads/util.c
===================================================================
--- source/libads/util.c (revision 17017)
+++ source/libads/util.c (revision 17160)
@@ -48,14 +48,6 @@
goto failed;
}
- /* Determine if the KDC is salting keys for this principal in a
- * non-obvious way. */
- if (!kerberos_derive_salting_principal(host_principal)) {
- DEBUG(1,("Failed to determine correct salting principal for %s\n", host_principal));
- ret = ADS_ERROR_SYSTEM(EACCES);
- goto failed;
- }
-
failed:
SAFE_FREE(password);
return ret;
Index: source/libads/ldap.c
===================================================================
--- source/libads/ldap.c (revision 17017)
+++ source/libads/ldap.c (revision 17160)
@@ -5,6 +5,7 @@
Copyright (C) Remus Koos 2001
Copyright (C) Jim McDonough <jmcd at us.ibm.com> 2002
Copyright (C) Guenther Deschner 2005
+ Copyright (C) Gerald Carter 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -286,16 +287,9 @@
DEBUG(3,("Connected to LDAP server %s\n", inet_ntoa(ads->ldap_ip)));
if (!ads->auth.user_name) {
- /* have to use the userPrincipalName value here and
- not servicePrincipalName; found by Guenther Deschner @ Sernet.
+ /* Must use the userPrincipalName value here or sAMAccountName
+ and not servicePrincipalName; found by Guenther Deschner */
- Is this still correct? The comment does not match
- the code. --jerry
-
- Yes it is :)
- - Guenther
- */
-
asprintf(&ads->auth.user_name, "%s$", global_myname() );
}
@@ -1402,20 +1396,21 @@
* (found by hostname) in AD.
* @param ads An initialized ADS_STRUCT
* @param machine_name the NetBIOS name of the computer, which is used to identify the computer account.
+ * @param my_fqdn The fully qualified DNS name of the machine
* @param spn A string of the service principal to add, i.e. 'host'
* @return 0 upon sucess, or non-zero if a failure occurs
**/
-ADS_STATUS ads_add_service_principal_name(ADS_STRUCT *ads, const char *machine_name, const char *spn)
+ADS_STATUS ads_add_service_principal_name(ADS_STRUCT *ads, const char *machine_name,
+ const char *my_fqdn, const char *spn)
{
ADS_STATUS ret;
TALLOC_CTX *ctx;
LDAPMessage *res = NULL;
- char *host_spn, *psp1, *psp2, *psp3;
+ char *psp1, *psp2;
ADS_MODLIST mods;
- fstring my_fqdn;
char *dn_string = NULL;
- const char *servicePrincipalName[4] = {NULL, NULL, NULL, NULL};
+ const char *servicePrincipalName[3] = {NULL, NULL, NULL};
ret = ads_find_machine_acct(ads, (void **)(void *)&res, machine_name);
if (!ADS_ERR_OK(ret) || ads_count_replies(ads, res) != 1) {
@@ -1433,84 +1428,59 @@
return ADS_ERROR(LDAP_NO_MEMORY);
}
- name_to_fqdn(my_fqdn, machine_name);
- strlower_m(my_fqdn);
-
- if (!(host_spn = talloc_asprintf(ctx, "HOST/%s", my_fqdn))) {
+ /* add short name spn */
+
+ if ( (psp1 = talloc_asprintf(ctx, "%s/%s", spn, machine_name)) == NULL ) {
talloc_destroy(ctx);
ads_msgfree(ads, res);
return ADS_ERROR(LDAP_NO_MEMORY);
}
-
- /* Add the extra principal */
- psp1 = talloc_asprintf(ctx, "%s/%s", spn, machine_name);
- if (!psp1) {
- talloc_destroy(ctx);
- ads_msgfree(ads, res);
- return ADS_ERROR(LDAP_NO_MEMORY);
- }
-
strupper_m(psp1);
strlower_m(&psp1[strlen(spn)]);
- DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp1, machine_name));
servicePrincipalName[0] = psp1;
- psp2 = talloc_asprintf(ctx, "%s/%s.%s", spn, machine_name, ads->config.realm);
- if (!psp2) {
- talloc_destroy(ctx);
- ads_msgfree(ads, res);
- return ADS_ERROR(LDAP_NO_MEMORY);
+
+ DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n",
+ psp1, machine_name));
+
+
+ /* add fully qualified spn */
+
+ if ( (psp2 = talloc_asprintf(ctx, "%s/%s", spn, my_fqdn)) == NULL ) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto out;
}
-
strupper_m(psp2);
strlower_m(&psp2[strlen(spn)]);
- DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp2, machine_name));
servicePrincipalName[1] = psp2;
- /* Add another principal in case the realm != the DNS domain, so that
- * the KDC doesn't send "server principal unknown" errors to clients
- * which use the DNS name in determining service principal names. */
- psp3 = talloc_asprintf(ctx, "%s/%s", spn, my_fqdn);
- if (!psp3) {
- talloc_destroy(ctx);
- ads_msgfree(ads, res);
- return ADS_ERROR(LDAP_NO_MEMORY);
- }
+ DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n",
+ psp2, machine_name));
- strupper_m(psp3);
- strlower_m(&psp3[strlen(spn)]);
- if (strcmp(psp2, psp3) != 0) {
- DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp3, machine_name));
- servicePrincipalName[2] = psp3;
+ if ( (mods = ads_init_mods(ctx)) == NULL ) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto out;
}
-
- if (!(mods = ads_init_mods(ctx))) {
- talloc_destroy(ctx);
- ads_msgfree(ads, res);
- return ADS_ERROR(LDAP_NO_MEMORY);
- }
+
ret = ads_add_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName);
if (!ADS_ERR_OK(ret)) {
DEBUG(1,("ads_add_service_principal_name: Error: Updating Service Principals in LDAP\n"));
- talloc_destroy(ctx);
- ads_msgfree(ads, res);
- return ret;
+ goto out;
}
- dn_string = ads_get_dn(ads, res);
- if (!dn_string) {
- talloc_destroy(ctx);
- ads_msgfree(ads, res);
- return ADS_ERROR(LDAP_NO_MEMORY);
+
+ if ( (dn_string = ads_get_dn(ads, res)) == NULL ) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto out;
}
+
ret = ads_gen_mod(ads, dn_string, mods);
ads_memfree(ads,dn_string);
if (!ADS_ERR_OK(ret)) {
DEBUG(1,("ads_add_service_principal_name: Error: Updating Service Principals in LDAP\n"));
- talloc_destroy(ctx);
- ads_msgfree(ads, res);
- return ret;
+ goto out;
}
- talloc_destroy(ctx);
+ out:
+ TALLOC_FREE( ctx );
ads_msgfree(ads, res);
return ret;
}
@@ -2241,13 +2211,9 @@
return timegm(&tm);
}
-/**
- * Find the servers name and realm - this can be done before authentication
- * The ldapServiceName field on w2k looks like this:
- * vnet3.home.samba.org:win2000-vnet3$@VNET3.HOME.SAMBA.ORG
- * @param ads connection to ads server
- * @return status of search
- **/
+/********************************************************************
+********************************************************************/
+
ADS_STATUS ads_current_time(ADS_STRUCT *ads)
{
const char *attrs[] = {"currentTime", NULL};
@@ -2257,7 +2223,7 @@
TALLOC_CTX *ctx;
ADS_STRUCT *ads_s = ads;
- if (!(ctx = talloc_init("ads_server_info"))) {
+ if (!(ctx = talloc_init("ads_current_time"))) {
return ADS_ERROR(LDAP_NO_MEMORY);
}
@@ -2277,14 +2243,12 @@
status = ads_do_search(ads_s, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res);
if (!ADS_ERR_OK(status)) {
- talloc_destroy(ctx);
goto done;
}
timestr = ads_pull_string(ads_s, ctx, res, "currentTime");
if (!timestr) {
ads_msgfree(ads, res);
- talloc_destroy(ctx);
status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
goto done;
}
@@ -2312,6 +2276,60 @@
return status;
}
+/********************************************************************
+********************************************************************/
+
+ADS_STATUS ads_domain_func_level(ADS_STRUCT *ads, uint32 *val)
+{
+ const char *attrs[] = {"domainFunctionality", NULL};
+ ADS_STATUS status;
+ void *res;
+ ADS_STRUCT *ads_s = ads;
+
+ *val = DS_DOMAIN_FUNCTION_2000;
+
+ /* establish a new ldap tcp session if necessary */
+
+ if ( !ads->ld ) {
+ if ( (ads_s = ads_init( ads->server.realm, ads->server.workgroup,
+ ads->server.ldap_server )) == NULL )
+ {
+ goto done;
+ }
+ ads_s->auth.flags = ADS_AUTH_ANON_BIND;
+ status = ads_connect( ads_s );
+ if ( !ADS_ERR_OK(status))
+ goto done;
+ }
+
+ /* If the attribute does not exist assume it is a Windows 2000
+ functional domain */
+
+ status = ads_do_search(ads_s, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res);
+ if (!ADS_ERR_OK(status)) {
+ if ( status.err.rc == LDAP_NO_SUCH_ATTRIBUTE ) {
+ status = ADS_SUCCESS;
+ }
+ goto done;
+ }
+
+ if ( !ads_pull_uint32(ads_s, res, "domainFunctionality", val) ) {
+ DEBUG(5,("ads_domain_func_level: Failed to pull the domainFunctionality attribute.\n"));
+ }
+ DEBUG(3,("ads_domain_func_level: %d\n", *val));
+
+
+ ads_msgfree(ads, res);
+
+done:
+ /* free any temporary ads connections */
+ if ( ads_s != ads ) {
+ ads_destroy( &ads_s );
+ }
+
+ return status;
+}
+
/**
* find the domain sid for our domain
* @param ads connection to ads server
@@ -2622,4 +2640,100 @@
return dn_count;
}
+/********************************************************************
+********************************************************************/
+
+char* ads_get_dnshostname( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name )
+{
+ LDAPMessage *res = NULL;
+ ADS_STATUS status;
+ int count = 0;
+ char *name = NULL;
+
+ status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname());
+ if (!ADS_ERR_OK(status)) {
+ DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n",
+ global_myname()));
+ goto out;
+ }
+
+ if ( (count = ads_count_replies(ads, res)) != 1 ) {
+ DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count));
+ goto out;
+ }
+
+ if ( (name = ads_pull_string(ads, ctx, res, "dNSHostName")) == NULL ) {
+ DEBUG(0,("ads_get_dnshostname: No dNSHostName attribute!\n"));
+ }
+
+out:
+ ads_msgfree(ads, res);
+
+ return name;
+}
+
+/********************************************************************
+********************************************************************/
+
+char* ads_get_upn( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name )
+{
+ LDAPMessage *res = NULL;
+ ADS_STATUS status;
+ int count = 0;
+ char *name = NULL;
+
+ status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname());
+ if (!ADS_ERR_OK(status)) {
+ DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n",
+ global_myname()));
+ goto out;
+ }
+
+ if ( (count = ads_count_replies(ads, res)) != 1 ) {
+ DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count));
+ goto out;
+ }
+
+ if ( (name = ads_pull_string(ads, ctx, res, "userPrincipalName")) == NULL ) {
+ DEBUG(0,("ads_get_dnshostname: No userPrincipalName attribute!\n"));
+ }
+
+out:
+ ads_msgfree(ads, res);
+
+ return name;
+}
+
+/********************************************************************
+********************************************************************/
+
+char* ads_get_samaccountname( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name )
+{
+ LDAPMessage *res = NULL;
+ ADS_STATUS status;
+ int count = 0;
+ char *name = NULL;
+
+ status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname());
+ if (!ADS_ERR_OK(status)) {
+ DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n",
+ global_myname()));
+ goto out;
+ }
+
+ if ( (count = ads_count_replies(ads, res)) != 1 ) {
+ DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count));
+ goto out;
+ }
+
+ if ( (name = ads_pull_string(ads, ctx, res, "sAMAccountName")) == NULL ) {
+ DEBUG(0,("ads_get_dnshostname: No sAMAccountName attribute!\n"));
+ }
+
+out:
+ ads_msgfree(ads, res);
+
+ return name;
+}
+
#endif
Index: source/libads/cldap.c
===================================================================
--- source/libads/cldap.c (revision 17017)
+++ source/libads/cldap.c (revision 17160)
@@ -191,6 +191,11 @@
char *p;
blob = data_blob(NULL, 8192);
+ if (blob.data == NULL) {
+ DEBUG(1, ("data_blob failed\n"));
+ errno = ENOMEM;
+ return -1;
+ }
/* Setup timeout */
gotalarm = 0;
@@ -206,6 +211,7 @@
if (ret <= 0) {
DEBUG(1,("no reply received to cldap netlogon\n"));
+ data_blob_free(&blob);
return -1;
}
blob.length = ret;
@@ -227,6 +233,7 @@
asn1_end_tag(&data);
if (data.has_error) {
+ data_blob_free(&blob);
asn1_free(&data);
DEBUG(1,("Failed to parse cldap reply\n"));
return -1;
Index: source/libads/dns.c
===================================================================
--- source/libads/dns.c (revision 17017)
+++ source/libads/dns.c (revision 17160)
@@ -39,8 +39,12 @@
#define MAX_DNS_PACKET_SIZE 0xffff
#ifdef NS_HFIXEDSZ /* Bind 8/9 interface */
+#if !defined(C_IN) /* AIX 5.3 already defines C_IN */
# define C_IN ns_c_in
+#endif
+#if !defined(T_A) /* AIX 5.3 already defines T_A */
# define T_A ns_t_a
+#endif
# define T_SRV ns_t_srv
#else
# ifdef HFIXEDSZ
Index: source/utils/net_ads.c
===================================================================
--- source/utils/net_ads.c (revision 17017)
+++ source/utils/net_ads.c (revision 17160)
@@ -24,22 +24,6 @@
#include "includes.h"
#include "utils/net.h"
-/* Macro for checking RPC error codes to make things more readable */
-
-#if 0
-#define CHECK_RPC_ERR(rpc, msg) \
- if (!NT_STATUS_IS_OK(result = rpc)) { \
- DEBUG(0, (msg ": %s\n", nt_errstr(result))); \
- goto done; \
- }
-
-#define CHECK_RPC_ERR_DEBUG(rpc, debug_args) \
- if (!NT_STATUS_IS_OK(result = rpc)) { \
- DEBUG(0, debug_args); \
- goto done; \
- }
-
-#endif
#ifdef HAVE_ADS
int net_ads_usage(int argc, const char **argv)
@@ -80,7 +64,18 @@
return -1;
}
+/* when we do not have sufficient input parameters to contact a remote domain
+ * we always fall back to our own realm - Guenther*/
+static const char *assume_own_realm(void)
+{
+ if (!opt_host && strequal(lp_workgroup(), opt_target_workgroup)) {
+ return lp_realm();
+ }
+
+ return NULL;
+}
+
/*
do a cldap netlogon query
*/
@@ -161,11 +156,8 @@
{
ADS_STRUCT *ads;
ADS_STATUS status;
- const char *realm = NULL;
+ const char *realm = assume_own_realm();
- if ( strequal(lp_workgroup(), opt_target_workgroup ) )
- realm = lp_realm();
-
ads = ads_init(realm, opt_target_workgroup, opt_host);
if (ads) {
ads->auth.flags |= ADS_AUTH_NO_BIND;
@@ -190,8 +182,9 @@
static int net_ads_info(int argc, const char **argv)
{
ADS_STRUCT *ads;
+ const char *realm = assume_own_realm();
- if ( (ads = ads_init(lp_realm(), opt_target_workgroup, opt_host)) != NULL ) {
+ if ( (ads = ads_init(realm, opt_target_workgroup, opt_host)) != NULL ) {
ads->auth.flags |= ADS_AUTH_NO_BIND;
}
@@ -228,21 +221,26 @@
setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
}
-static ADS_STRUCT *ads_startup(void)
+static ADS_STRUCT *ads_startup(BOOL only_own_domain)
{
ADS_STRUCT *ads;
ADS_STATUS status;
BOOL need_password = False;
BOOL second_time = False;
char *cp;
+ const char *realm = NULL;
/* lp_realm() should be handled by a command line param,
However, the join requires that realm be set in smb.conf
and compares our realm with the remote server's so this is
ok until someone needs more flexibility */
-
- ads = ads_init(lp_realm(), opt_target_workgroup, opt_host);
+ if (only_own_domain) {
+ realm = lp_realm();
+ }
+
+ ads = ads_init(realm, opt_target_workgroup, opt_host);
+
if (!opt_user_name) {
opt_user_name = "administrator";
}
@@ -299,12 +297,12 @@
ads_startup() stores the password in opt_password if it needs to so
that rpc or rap can use it without re-prompting.
*/
-int net_ads_check(void)
+static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
{
ADS_STRUCT *ads;
ADS_STATUS status;
- if ( (ads = ads_init( lp_realm(), lp_workgroup(), NULL )) == NULL ) {
+ if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
return -1;
}
@@ -319,6 +317,15 @@
return 0;
}
+int net_ads_check_our_domain(void)
+{
+ return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
+}
+
+int net_ads_check(void)
+{
+ return net_ads_check_int(NULL, opt_workgroup, opt_host);
+}
/*
determine the netbios workgroup name for a domain
*/
@@ -326,12 +333,9 @@
{
ADS_STRUCT *ads;
ADS_STATUS status;
- const char *realm = NULL;
+ const char *realm = assume_own_realm();
struct cldap_netlogon_reply reply;
- if ( strequal(lp_workgroup(), opt_target_workgroup ) )
- realm = lp_realm();
-
ads = ads_init(realm, opt_target_workgroup, opt_host);
if (ads) {
ads->auth.flags |= ADS_AUTH_NO_BIND;
@@ -405,7 +409,7 @@
if (argc < 1) return net_ads_user_usage(argc, argv);
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -490,7 +494,7 @@
return -1;
}
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
SAFE_FREE(escaped_user);
return -1;
}
@@ -506,7 +510,8 @@
return -1;
}
- grouplist = ldap_get_values(ads->ld, res, "memberOf");
+ grouplist = ldap_get_values((LDAP *)ads->ld,
+ (LDAPMessage *)res, "memberOf");
if (grouplist) {
int i;
@@ -536,7 +541,7 @@
return net_ads_user_usage(argc, argv);
}
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -576,7 +581,7 @@
char *disp_fields[2] = {NULL, NULL};
if (argc == 0) {
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -591,7 +596,7 @@
shortattrs, usergrp_display,
disp_fields);
ads_destroy(&ads);
- return 0;
+ return ADS_ERR_OK(rc) ? 0 : -1;
}
return net_run_function(argc, argv, func, net_ads_user_usage);
@@ -613,7 +618,7 @@
return net_ads_group_usage(argc, argv);
}
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -662,7 +667,7 @@
return net_ads_group_usage(argc, argv);
}
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -701,7 +706,7 @@
char *disp_fields[2] = {NULL, NULL};
if (argc == 0) {
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -716,7 +721,7 @@
disp_fields);
ads_destroy(&ads);
- return 0;
+ return ADS_ERR_OK(rc) ? 0 : -1;
}
return net_run_function(argc, argv, func, net_ads_group_usage);
}
@@ -727,7 +732,7 @@
ADS_STATUS rc;
void *res;
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
@@ -776,7 +781,7 @@
/* The finds a DC and takes care of getting the
user creds if necessary */
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
@@ -826,7 +831,7 @@
net_use_machine_password();
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
@@ -923,7 +928,7 @@
static ADS_STATUS net_set_machine_spn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s )
{
ADS_STATUS status = ADS_ERROR(LDAP_SERVER_DOWN);
- char *host_upn, *new_dn;
+ char *new_dn;
ADS_MODLIST mods;
const char *servicePrincipalName[3] = {NULL, NULL, NULL};
char *psp;
@@ -959,9 +964,7 @@
return ADS_ERROR(LDAP_NO_MEMORY);
}
- /* Windows only creates HOST/shortname & HOST/fqdn. We create
- the UPN as well so that 'kinit -k' will work. You can only
- request a TGT for entries with a UPN in AD. */
+ /* Windows only creates HOST/shortname & HOST/fqdn. */
if ( !(psp = talloc_asprintf(ctx, "HOST/%s", machine_name)) )
goto done;
@@ -974,9 +977,63 @@
goto done;
servicePrincipalName[1] = psp;
- if (!(host_upn = talloc_asprintf(ctx, "%s@%s", servicePrincipalName[0], ads_s->config.realm)))
+ if (!(mods = ads_init_mods(ctx))) {
goto done;
+ }
+
+ /* fields of primary importance */
+
+ ads_mod_str(ctx, &mods, "dNSHostName", my_fqdn);
+ ads_mod_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName);
+ status = ads_gen_mod(ads_s, new_dn, mods);
+
+done:
+ ads_msgfree(ads_s, res);
+
+ return status;
+}
+
+/*******************************************************************
+ Set a machines dNSHostName and servicePrincipalName attributes
+ ********************************************************************/
+
+static ADS_STATUS net_set_machine_upn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s, const char *upn )
+{
+ ADS_STATUS status = ADS_ERROR(LDAP_SERVER_DOWN);
+ char *new_dn;
+ ADS_MODLIST mods;
+ LDAPMessage *res = NULL;
+ char *dn_string = NULL;
+ const char *machine_name = global_myname();
+ int count;
+
+ if ( !machine_name ) {
+ return ADS_ERROR(LDAP_NO_MEMORY);
+ }
+
+ /* Find our DN */
+
+ status = ads_find_machine_acct(ads_s, (void **)(void *)&res, machine_name);
+ if (!ADS_ERR_OK(status))
+ return status;
+
+ if ( (count = ads_count_replies(ads_s, res)) != 1 ) {
+ DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count));
+ return ADS_ERROR(LDAP_NO_MEMORY);
+ }
+
+ if ( (dn_string = ads_get_dn(ads_s, res)) == NULL ) {
+ DEBUG(1, ("ads_add_machine_acct: ads_get_dn returned NULL (malloc failure?)\n"));
+ goto done;
+ }
+
+ new_dn = talloc_strdup(ctx, dn_string);
+ ads_memfree(ads_s, dn_string);
+ if (!new_dn) {
+ return ADS_ERROR(LDAP_NO_MEMORY);
+ }
+
/* now do the mods */
if (!(mods = ads_init_mods(ctx))) {
@@ -985,8 +1042,7 @@
/* fields of primary importance */
- ads_mod_str(ctx, &mods, "dNSHostName", my_fqdn);
- ads_mod_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName);
+ ads_mod_str(ctx, &mods, "userPrincipalName", upn);
status = ads_gen_mod(ads_s, new_dn, mods);
@@ -996,7 +1052,6 @@
return status;
}
-
/*******************************************************************
join a domain using ADS (LDAP mods)
********************************************************************/
@@ -1011,7 +1066,7 @@
asprintf(&dn, "%s,%s", ou_str, ads->config.bind_path);
free(ou_str);
- rc = ads_search_dn(ads, (void**)&res, dn, NULL);
+ rc = ads_search_dn(ads, &res, dn, NULL);
ads_msgfree(ads, res);
if (ADS_ERR_OK(rc)) {
@@ -1029,6 +1084,74 @@
return rc;
}
+/************************************************************************
+ ************************************************************************/
+
+static BOOL net_derive_salting_principal( TALLOC_CTX *ctx, ADS_STRUCT *ads )
+{
+ uint32 domain_func;
+ ADS_STATUS status;
+ fstring salt;
+ char *std_salt;
+ LDAPMessage *res = NULL;
+ const char *machine_name = global_myname();
+
+ status = ads_domain_func_level( ads, &domain_func );
+ if ( !ADS_ERR_OK(status) ) {
+ DEBUG(2,("Failed to determine domain functional level!\n"));
+ return False;
+ }
+
+ /* go ahead and setup the default salt */
+
+ if ( (std_salt = kerberos_standard_des_salt()) == NULL ) {
+ DEBUG(0,("net_derive_salting_principal: failed to obtain stanard DES salt\n"));
+ return False;
+ }
+
+ fstrcpy( salt, std_salt );
+ SAFE_FREE( std_salt );
+
+ /* if it's a Windows functional domain, we have to look for the UPN */
+
+ if ( domain_func == DS_DOMAIN_FUNCTION_2000 ) {
+ char *upn;
+ int count;
+
+ status = ads_find_machine_acct(ads, (void **)(void *)&res, machine_name);
+ if (!ADS_ERR_OK(status)) {
+ return False;
+ }
+
+ if ( (count = ads_count_replies(ads, res)) != 1 ) {
+ DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count));
+ return False;
+ }
+
+ upn = ads_pull_string(ads, ctx, res, "userPrincipalName");
+ if ( upn ) {
+ fstrcpy( salt, upn );
+ }
+
+ ads_msgfree(ads, res);
+ }
+
+ return kerberos_secrets_store_des_salt( salt );
+}
+
+/*********************************************************
+ utility function to parse an integer parameter from
+ "parameter = value"
+**********************************************************/
+static char* get_string_param( const char* param )
+{
+ char *p;
+
+ if ( (p = strchr( param, '=' )) == NULL )
+ return NULL;
+
+ return (p+1);
+}
/*******************************************************************
join a domain using ADS (LDAP mods)
********************************************************************/
@@ -1043,13 +1166,17 @@
struct cldap_netlogon_reply cldap_reply;
TALLOC_CTX *ctx;
DOM_SID *domain_sid = NULL;
+ BOOL createupn = False;
+ const char *machineupn = NULL;
+ const char *create_in_ou = NULL;
+ int i;
if ( check_ads_config() != 0 ) {
d_fprintf(stderr, "Invalid configuration. Exiting....\n");
return -1;
}
- if ( (ads = ads_startup()) == NULL ) {
+ if ( (ads = ads_startup(True)) == NULL ) {
return -1;
}
@@ -1066,11 +1193,30 @@
return -1;
}
- /* If we were given an OU, try to create the machine in the OU account
- first and then do the normal RPC join */
+ /* process additional command line args */
+
+ for ( i=0; i<argc; i++ ) {
+ if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
+ createupn = True;
+ machineupn = get_string_param(argv[i]);
+ }
+ else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
+ if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
+ d_fprintf(stderr, "Please supply a valid OU path\n");
+ return -1;
+ }
+ }
+ else {
+ d_fprintf(stderr, "Bad option: %s\n", argv[i]);
+ return -1;
+ }
+ }
- if ( argc > 0 ) {
- status = net_precreate_machine_acct( ads, argv[0] );
+ /* If we were given an OU, try to create the machine in
+ the OU account first and then do the normal RPC join */
+
+ if ( create_in_ou ) {
+ status = net_precreate_machine_acct( ads, create_in_ou );
if ( !ADS_ERR_OK(status) ) {
d_fprintf( stderr, "Failed to pre-create the machine object "
"in OU %s.\n", argv[0]);
@@ -1132,37 +1278,52 @@
status = net_set_machine_spn( ctx, ads );
if ( !ADS_ERR_OK(status) ) {
- d_fprintf(stderr, "Failed to set servicePrincipalNames. Only NTLM authentication will be possible.\n");
- d_fprintf(stderr, "Please ensure that the DNS domain of this server matches the AD domain,\n");
+
+ d_fprintf(stderr, "Failed to set servicePrincipalNames. Please ensure that\n");
+ d_fprintf(stderr, "the DNS domain of this server matches the AD domain,\n");
d_fprintf(stderr, "Or rejoin with using Domain Admin credentials.\n");
-
- /* don't fail */
- }
-
-#if defined(HAVE_KRB5)
- if (asprintf(&machine_account, "%s$", global_myname()) == -1) {
- d_fprintf(stderr, "asprintf failed\n");
- ads_destroy(&ads);
+
+ /* Disable the machine account in AD. Better to fail than to leave
+ a confused admin. */
+
+ if ( net_ads_leave( 0, NULL ) != 0 ) {
+ d_fprintf( stderr, "Failed to disable machine account in AD. Please do so manually.\n");
+ }
+
+ /* clear out the machine password */
+
+ netdom_store_machine_account( lp_workgroup(), domain_sid, "" );
+ netdom_store_machine_account( short_domain_name, domain_sid, "" );
+
return -1;
}
- if (!kerberos_derive_salting_principal(machine_account)) {
+ if ( !net_derive_salting_principal( ctx, ads ) ) {
DEBUG(1,("Failed to determine salting principal\n"));
ads_destroy(&ads);
return -1;
}
- if (!kerberos_derive_cifs_salting_principals()) {
- DEBUG(1,("Failed to determine salting principals\n"));
- ads_destroy(&ads);
- return -1;
+ if ( createupn ) {
+ pstring upn;
+
+ /* default to using the short UPN name */
+ if ( !machineupn ) {
+ snprintf( upn, sizeof(upn), "host/%s@%s", global_myname(),
+ ads->config.realm );
+ machineupn = upn;
+ }
+
+ status = net_set_machine_upn( ctx, ads, machineupn );
+ if ( !ADS_ERR_OK(status) ) {
+ d_fprintf(stderr, "Failed to set userPrincipalName. Are you a Domain Admin?\n");
+ }
}
-
+
/* Now build the keytab, using the same ADS connection */
if (lp_use_kerberos_keytab() && ads_keytab_create_default(ads)) {
DEBUG(1,("Error creating host keytab!\n"));
}
-#endif
d_printf("Joined '%s' to realm '%s'\n", global_myname(), ads->config.realm);
@@ -1202,7 +1363,7 @@
ADS_STATUS rc;
void *res = NULL;
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -1235,7 +1396,7 @@
const char *servername, *printername;
void *res = NULL;
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -1294,7 +1455,7 @@
char *prt_dn, *srv_dn, **srv_cn;
void *res = NULL;
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
@@ -1340,7 +1501,7 @@
return -1;
}
- srv_dn = ldap_get_dn(ads->ld, res);
+ srv_dn = ldap_get_dn((LDAP *)ads->ld, (LDAPMessage *)res);
srv_cn = ldap_explode_dn(srv_dn, 1);
asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn[0], printername, srv_dn);
@@ -1377,7 +1538,7 @@
char *prt_dn;
void *res = NULL;
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
@@ -1473,7 +1634,7 @@
/* use the realm so we can eventually change passwords for users
in realms other than default */
- if (!(ads = ads_init(realm, opt_workgroup, NULL))) {
+ if (!(ads = ads_init(realm, opt_workgroup, opt_host))) {
return -1;
}
@@ -1524,7 +1685,7 @@
use_in_memory_ccache();
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
@@ -1589,7 +1750,7 @@
return net_ads_search_usage(argc, argv);
}
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -1649,7 +1810,7 @@
return net_ads_dn_usage(argc, argv);
}
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -1709,7 +1870,7 @@
return net_ads_sid_usage(argc, argv);
}
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(False))) {
return -1;
}
@@ -1766,7 +1927,7 @@
int ret;
ADS_STRUCT *ads;
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
ret = ads_keytab_flush(ads);
@@ -1781,7 +1942,7 @@
ADS_STRUCT *ads;
d_printf("Processing principals to add...\n");
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
for (i = 0; i < argc; i++) {
@@ -1796,7 +1957,7 @@
ADS_STRUCT *ads;
int ret;
- if (!(ads = ads_startup())) {
+ if (!(ads = ads_startup(True))) {
return -1;
}
ret = ads_keytab_create_default(ads);
@@ -1829,15 +1990,12 @@
{"GROUP", net_ads_group_usage},
{"PRINTER", net_ads_printer_usage},
{"SEARCH", net_ads_search_usage},
-#if 0
{"INFO", net_ads_info},
{"JOIN", net_ads_join},
- {"JOIN2", net_ads_join2},
{"LEAVE", net_ads_leave},
{"STATUS", net_ads_status},
{"PASSWORD", net_ads_password},
{"CHANGETRUSTPW", net_ads_changetrustpw},
-#endif
{NULL, NULL}
};
@@ -1919,9 +2077,14 @@
return -1;
}
+int net_ads_check_our_domain(void)
+{
+ return -1;
+}
+
int net_ads(int argc, const char **argv)
{
return net_ads_usage(argc, argv);
}
-#endif
+#endif /* WITH_ADS */
Index: packaging/Debian/debian-sarge/rules
===================================================================
--- packaging/Debian/debian-sarge/rules (revision 17017)
+++ packaging/Debian/debian-sarge/rules (revision 17160)
@@ -76,7 +76,8 @@
conf_args += \
--with-smbmount \
--with-acl-support \
- --with-quotas
+ --with-quotas \
+ --with-cifsmount
mount_cifs = yes
smbfs = yes
else
@@ -120,9 +121,6 @@
$(MAKE) -C source headers
$(MAKE) -C source all nsswitch/libnss_wins.so python_ext
-ifeq ($(mount_cifs),yes)
- $(MAKE) -C source client/mount.cifs
-endif
touch build-stamp
@@ -138,7 +136,7 @@
# Delete stuff left after a build that is not deleted by 'make clean'
rm -f source/bin/wbinfo source/bin/winbindd source/bin/debug2html \
- source/bin/libsmbclient.a source/client/mount.cifs \
+ source/bin/libsmbclient.a source/bin/mount.cifs \
source/include/stamp-h
sed -e "s/@libacl@/`type-handling any linux-gnu`/g" \
@@ -179,14 +177,11 @@
install -m 0755 debian/mksmbpasswd.awk $(DESTDIR)/usr/sbin/mksmbpasswd
# Install winbind stuff not installed by 'make install'
- install -m 0644 source/nsswitch/libnss_winbind.so \
- $(DESTDIR)/lib/libnss_winbind.so.2
- install -m 0644 source/bin/pam_winbind.so \
- $(DESTDIR)/lib/security/
+ install -m 0644 source/bin/pam_winbind.so $(DESTDIR)/lib/security/
+ install -m 0644 source/nsswitch/libnss_winbind.so $(DESTDIR)/lib/libnss_winbind.so.2
# Install libnss_wins.so, which is not installed by 'make install' either.
- install -m 0644 source/nsswitch/libnss_wins.so \
- $(DESTDIR)/lib/libnss_wins.so.2
+ install -m 0644 source/nsswitch/libnss_wins.so $(DESTDIR)/lib/libnss_wins.so.2
# pam_smbpass.so isn't being installed by 'make install'.
# We'll move it here to $(DESTDIR)/lib/security/ and then
@@ -208,7 +203,7 @@
ifeq ($(mount_cifs),yes)
# Install mount.cifs and its man page
- install -m 04755 source/client/mount.cifs $(DESTDIR)/sbin/
+ install -m 04755 source/bin/mount.cifs $(DESTDIR)/sbin/
install -m 0644 docs/manpages/mount.cifs.8 $(DESTDIR)/usr/share/man/man8/
endif
Index: packaging/Debian/debian-sarge/samba-common.files
===================================================================
--- packaging/Debian/debian-sarge/samba-common.files (revision 17017)
+++ packaging/Debian/debian-sarge/samba-common.files (revision 17160)
@@ -5,8 +5,10 @@
usr/bin/nmblookup
usr/bin/smbpasswd
usr/bin/testparm
+usr/bin/profiles
usr/share/man/man1/nmblookup.1
usr/share/man/man1/testparm.1
+usr/share/man/man1/profiles.1
usr/share/man/man5/lmhosts.5
usr/share/man/man5/smb.conf.5
usr/share/man/man7/samba.7
Index: packaging/Debian/debian-sarge/patches/make-distclean.patch
===================================================================
--- packaging/Debian/debian-sarge/patches/make-distclean.patch (revision 17017)
+++ packaging/Debian/debian-sarge/patches/make-distclean.patch (revision 17160)
@@ -9,14 +9,6 @@
# revert to the previously installed version
revert:
-@@ -1437,6 +1438,7 @@
- @rm -f include/proto.h include/build_env.h include/wrepld_proto.h \
- nsswitch/winbindd_proto.h web/swat_proto.h \
- client/client_proto.h utils/net_proto.h \
-+ utils/ntlm_auth_proto.h \
- smbd/build_options.c
-
- MKPROTO_SH = $(srcdir)/script/mkproto.sh
@@ -1512,6 +1514,7 @@
distclean: realclean
Index: packaging/Debian/debian-sarge/patches/samba.patch
===================================================================
--- packaging/Debian/debian-sarge/patches/samba.patch (revision 17017)
+++ packaging/Debian/debian-sarge/patches/samba.patch (revision 17160)
@@ -39,17 +39,18 @@
if (!cli_initialise(&cli))
return False;
---- samba-3.0.1/source/script/installbin.sh.orig 2003-10-10 14:08:36.000000000 -0400
-+++ samba-3.0.1/source/script/installbin.sh 2003-12-17 10:51:45.000000000 -0500
-@@ -24,12 +24,14 @@
- chmod $INSTALLPERMS $BINDIR/$p2
+--- samba-3.0.23/source/script/installbin.sh.in.orig 2006-07-15 09:08:36.000000000 -0400
++++ samba-3.0.23/source/script/installbin.sh.in 2006-07-15 09:51:45.000000000 -0400
+@@ -21,13 +21,14 @@
+ chmod $INSTALLPERMS $DESTDIR/$BINDIR/$p2
# this is a special case, mount needs this in a specific location
- if [ $p2 = smbmount ]; then
-- if [ ! -d $DESTDIR/sbin ]; then
-- mkdir $DESTDIR/sbin
-- fi
-- ln -sf $BINDIR/$p2 $DESTDIR/sbin/mount.smbfs
+- if [ ! -d $DESTDIR/@rootsbindir@ ]; then
+- mkdir $DESTDIR/@rootsbindir@
+- fi
+- echo "Creating sym link $DESTDIR/@rootsbindir@/mount.smbfs to $BINDIR/$p2 "
+- ln -sf $BINDIR/$p2 $DESTDIR/@rootsbindir@/mount.smbfs
- fi
+# Commented out for the Debian Samba package. We take care of this
+# important symlink in debian/rules. (peloy at debian.org)
Index: packaging/Debian/debian-sarge/patches/fhs.patch
===================================================================
--- packaging/Debian/debian-sarge/patches/fhs.patch (revision 17017)
+++ packaging/Debian/debian-sarge/patches/fhs.patch (revision 17160)
@@ -28,11 +28,11 @@
@$(SHELL) $(srcdir)/script/installscripts.sh $(INSTALLPERMS) $(DESTDIR)$(BINDIR) $(SCRIPTS)
installdat: installdirs
-- @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR)$(LIBDIR) $(srcdir)
-+ @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR)$(CODEPAGEDIR) $(srcdir)
+- @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR) $(LIBDIR) $(srcdir)
++ @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR) $(CODEPAGEDIR) $(srcdir)
installmsg: installdirs
- @$(SHELL) $(srcdir)/script/installmsg.sh $(DESTDIR)$(LIBDIR) $(srcdir)
+ @$(SHELL) $(srcdir)/script/installmsg.sh $(DESTDIR) $(LIBDIR) $(srcdir)
diff -uNr samba-3.0.10.orig/source/configure.in samba-3.0.10/source/configure.in
--- samba-3.0.10.orig/source/configure.in 2004-12-17 03:50:08.000000000 -0800
+++ samba-3.0.10/source/configure.in 2004-12-17 03:55:29.000000000 -0800
@@ -57,9 +57,9 @@
esac])
@@ -201,6 +205,9 @@
- AC_SUBST(swatdir)
- AC_SUBST(bindir)
AC_SUBST(sbindir)
+ AC_SUBST(rootsbindir)
+ AC_SUBST(pammodulesdir)
+AC_SUBST(codepagedir)
+AC_SUBST(statedir)
+AC_SUBST(cachedir)
@@ -85,8 +85,8 @@
* @sa lib_path() to get the path to a file inside the LIBDIR.
@@ -70,3 +77,27 @@
- const pstring dyn_SMB_PASSWD_FILE = SMB_PASSWD_FILE;
- const pstring dyn_PRIVATE_DIR = PRIVATE_DIR;
+ pstring dyn_SMB_PASSWD_FILE = SMB_PASSWD_FILE;
+ pstring dyn_PRIVATE_DIR = PRIVATE_DIR;
+
+
+/* In non-FHS mode, these should be configurable using 'lock dir =';
@@ -114,10 +114,11 @@
diff -uNr samba-3.0.10.orig/source/groupdb/mapping.c samba-3.0.10/source/groupdb/mapping.c
--- samba-3.0.10.orig/source/groupdb/mapping.c 2004-12-17 03:50:08.000000000 -0800
+++ samba-3.0.10/source/groupdb/mapping.c 2004-12-17 03:55:29.000000000 -0800
-@@ -140,7 +140,7 @@
+@@ -140,8 +140,8 @@
if (tdb)
return True;
+
- tdb = tdb_open_log(lock_path("group_mapping.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
+ tdb = tdb_open_log(state_path("group_mapping.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
if (!tdb) {
@@ -131,11 +132,11 @@
extern pstring dyn_LOGFILEBASE, dyn_LMHOSTSFILE;
extern pstring dyn_LIBDIR;
+extern pstring dyn_CODEPAGEDIR;
- extern const fstring dyn_SHLIBEXT;
- extern const pstring dyn_LOCKDIR;
- extern const pstring dyn_PIDDIR;
- extern const pstring dyn_SMB_PASSWD_FILE;
- extern const pstring dyn_PRIVATE_DIR;
+ extern fstring dyn_SHLIBEXT;
+ extern pstring dyn_LOCKDIR;
+ extern pstring dyn_PIDDIR;
+ extern pstring dyn_SMB_PASSWD_FILE;
+ extern pstring dyn_PRIVATE_DIR;
+
+char *dyn_STATEDIR(void);
+char *dyn_CACHEDIR(void);
@@ -231,17 +232,20 @@
diff -uNr samba-3.0.10.orig/source/lib/util_unistr.c samba-3.0.10/source/lib/util_unistr.c
--- samba-3.0.10.orig/source/lib/util_unistr.c 2004-12-17 03:50:08.000000000 -0800
+++ samba-3.0.10/source/lib/util_unistr.c 2004-12-17 03:55:29.000000000 -0800
-@@ -54,8 +54,8 @@
- if (initialised) return;
+@@ -54,11 +54,11 @@
+ }
initialised = 1;
- upcase_table = map_file(lib_path("upcase.dat"), 0x20000);
-- lowcase_table = map_file(lib_path("lowcase.dat"), 0x20000);
+ upcase_table = map_file(data_path("upcase.dat"), 0x20000);
+ upcase_table_use_unmap = ( upcase_table != NULL );
+
+- lowcase_table = map_file(lib_path("lowcase.dat"), 0x20000);
+ lowcase_table = map_file(data_path("lowcase.dat"), 0x20000);
+ lowcase_table_use_unmap = ( lowcase_table != NULL );
- /* we would like Samba to limp along even if these tables are
- not available */
+ #ifdef HAVE_SETLOCALE
+ /* Get the name of the current locale. */
@@ -161,7 +161,7 @@
return;
}
@@ -305,18 +309,18 @@
all_string_sub(fname,"//", "/", 0);
slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid());
-diff -uNr samba-3.0.10.orig/source/nsswitch/winbindd_cache.c samba-3.0.10/source/nsswitch/winbindd_cache.c
---- samba-3.0.10.orig/source/nsswitch/winbindd_cache.c 2004-12-17 03:50:09.000000000 -0800
-+++ samba-3.0.10/source/nsswitch/winbindd_cache.c 2004-12-17 03:55:30.000000000 -0800
+diff -uNr samba-3.0.23.orig/source/nsswitch/winbindd_cache.c samba-3.0.23/source/nsswitch/winbindd_cache.c
+--- samba-3.0.23.orig/source/nsswitch/winbindd_cache.c 2006-07-15 09:50:09.000000000 -0400
++++ samba-3.0.23/source/nsswitch/winbindd_cache.c 2006-07-15 09:55:30.000000000 -0400
@@ -57,7 +57,7 @@
- if (opt_nocache)
- return;
+ return True;
-- wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), 5000,
-+ wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"), 5000,
- TDB_CLEAR_IF_FIRST, O_RDWR|O_CREAT, 0600);
+ /* when working offline we must not clear the cache on restart */
+- wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
++ wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
+ WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
+ TDB_DEFAULT /*TDB_CLEAR_IF_FIRST*/, O_RDWR|O_CREAT, 0600);
- if (!wcache->tdb) {
diff -uNr samba-3.0.10.orig/source/nsswitch/winbindd_util.c samba-3.0.10/source/nsswitch/winbindd_util.c
--- samba-3.0.10.orig/source/nsswitch/winbindd_util.c 2004-12-17 03:50:09.000000000 -0800
+++ samba-3.0.10/source/nsswitch/winbindd_util.c 2004-12-17 03:55:30.000000000 -0800
@@ -356,21 +360,18 @@
{"pid directory", P_STRING, P_GLOBAL, &Globals.szPidDir, NULL, NULL, FLAG_ADVANCED},
#ifdef WITH_UTMP
{"utmp directory", P_STRING, P_GLOBAL, &Globals.szUtmpDir, NULL, NULL, FLAG_ADVANCED},
-diff -uNr samba-3.0.10.orig/source/passdb/pdb_tdb.c samba-3.0.10/source/passdb/pdb_tdb.c
---- samba-3.0.10.orig/source/passdb/pdb_tdb.c 2004-12-17 03:50:09.000000000 -0800
-+++ samba-3.0.10/source/passdb/pdb_tdb.c 2004-12-17 03:55:30.000000000 -0800
-@@ -734,10 +734,7 @@
- if (location) {
- tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, location);
- } else {
-- pstring tdbfile;
-- get_private_directory(tdbfile);
-- pstrcat(tdbfile, "/");
-- pstrcat(tdbfile, PASSDB_FILE_NAME);
-+ char *tdbfile = state_path(PASSDB_FILE_NAME);
- tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, tdbfile);
+diff -uNr samba-3.0.23.orig/source/passdb/pdb_tdb.c samba-3.0.23/source/passdb/pdb_tdb.c
+--- samba-3.0.23.orig/source/passdb/pdb_tdb.c 2006-07-15 09:50:09.000000000 -0400
++++ samba-3.0.23/source/passdb/pdb_tdb.c 2006-07-15 09:55:30.000000000 -0400
+@@ -1598,7 +1598,7 @@
+ /* save the path for later */
+
+ if ( !location ) {
+- pstr_sprintf( tdbfile, "%s/%s", lp_private_dir(), PASSDB_FILE_NAME );
++ pstr_sprintf( tdbfile, "%s", state_path(PASSDB_FILE_NAME) );
+ pfile = tdbfile;
}
-
+ pstrcpy( tdbsam_filename, pfile );
diff -uNr samba-3.0.10.orig/source/passdb/secrets.c samba-3.0.10/source/passdb/secrets.c
--- samba-3.0.10.orig/source/passdb/secrets.c 2004-12-17 03:50:09.000000000 -0800
+++ samba-3.0.10/source/passdb/secrets.c 2004-12-17 03:55:30.000000000 -0800
@@ -481,13 +482,13 @@
}
unbecome_root();
-diff -uNr samba-3.0.10.orig/source/rpc_server/srv_srvsvc_nt.c samba-3.0.10/source/rpc_server/srv_srvsvc_nt.c
---- samba-3.0.10.orig/source/rpc_server/srv_srvsvc_nt.c 2004-12-17 03:50:09.000000000 -0800
-+++ samba-3.0.10/source/rpc_server/srv_srvsvc_nt.c 2004-12-17 03:55:31.000000000 -0800
-@@ -133,10 +133,10 @@
-
- if (share_tdb && local_pid == sys_getpid())
+diff -uNr samba-3.0.23.orig/source/lib/sharesec.c samba-3.0.23/source/lib/sharesec.c
+--- samba-3.0.23.orig/source/lib/sharesec.c 2006-07-15 09:50:09.000000000 -0400
++++ samba-3.0.23/source/lib/sharesec.c 2006-07-15 09:55:31.000000000 -0400
+@@ -47,10 +47,10 @@
return True;
+ }
+
- share_tdb = tdb_open_log(lock_path("share_info.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
+ share_tdb = tdb_open_log(state_path("share_info.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
if (!share_tdb) {
@@ -509,21 +510,21 @@
if (!tdbfile) {
DEBUG(0, ("idmap_init: out of memory!\n"));
return NT_STATUS_NO_MEMORY;
-diff -uNr samba-3.0.10.orig/source/smbd/lanman.c samba-3.0.10/source/smbd/lanman.c
---- samba-3.0.10.orig/source/smbd/lanman.c 2004-12-17 03:50:10.000000000 -0800
-+++ samba-3.0.10/source/smbd/lanman.c 2004-12-17 03:55:31.000000000 -0800
-@@ -969,9 +969,9 @@
- BOOL local_list_only;
- int i;
+diff -uNr samba-3.0.23.orig/source/smbd/lanman.c samba-3.0.23/source/smbd/lanman.c
+--- samba-3.0.23.orig/source/smbd/lanman.c 2006-07-15 09:50:10.000000000 -0400
++++ samba-3.0.23/source/smbd/lanman.c 2006-07-15 09:55:31.000000000 -0400
+@@ -1052,9 +1052,9 @@
+ BOOL local_list_only;
+ int i;
-- lines = file_lines_load(lock_path(SERVER_LIST), NULL);
-+ lines = file_lines_load(cache_path(SERVER_LIST), NULL);
- if (!lines) {
-- DEBUG(4,("Can't open %s - %s\n",lock_path(SERVER_LIST),strerror(errno)));
-+ DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
- return(0);
- }
-
+- lines = file_lines_load(lock_path(SERVER_LIST), NULL, 0);
++ lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0);
+ if (!lines) {
+- DEBUG(4,("Can't open %s - %s\n",lock_path(SERVER_LIST),strerror(errno)));
++ DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
+ return 0;
+ }
+
diff -uNr samba-3.0.10.orig/source/utils/net_idmap.c samba-3.0.10/source/utils/net_idmap.c
--- samba-3.0.10.orig/source/utils/net_idmap.c 2004-12-17 03:50:10.000000000 -0800
+++ samba-3.0.10/source/utils/net_idmap.c 2004-12-17 03:55:32.000000000 -0800
@@ -536,27 +537,6 @@
if (!tdbfile) {
DEBUG(0, ("idmap_init: out of memory!\n"));
return NT_STATUS_NO_MEMORY;
-diff -uNr samba-3.0.10.orig/source/wrepld/process.c samba-3.0.10/source/wrepld/process.c
---- samba-3.0.10.orig/source/wrepld/process.c 2004-12-17 03:50:10.000000000 -0800
-+++ samba-3.0.10/source/wrepld/process.c 2004-12-17 03:55:32.000000000 -0800
-@@ -197,7 +197,7 @@
- {
- TDB_CONTEXT *tdb;
-
-- tdb = tdb_open_log(lock_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600);
-+ tdb = tdb_open_log(state_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600);
- if (!tdb) {
- DEBUG(2,("get_our_last_id: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) ));
- return;
-@@ -489,7 +489,7 @@
- }
-
-
-- tdb = tdb_open_log(lock_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600);
-+ tdb = tdb_open_log(state_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600);
- if (!tdb) {
- DEBUG(2,("send_entry_request: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) ));
- return;
diff -uNr samba-3.0.11.orig/source/printing/nt_printing.c samba-3.0.11/source/printing/nt_printing.c
--- samba-3.0.11.orig/source/printing/nt_printing.c 2005-03-23 02:51:08.000000000 -0800
+++ samba-3.0.11/source/printing/nt_printing.c 2005-03-23 02:54:33.000000000 -0800
Index: packaging/Debian/debian-sarge/changelog
===================================================================
--- packaging/Debian/debian-sarge/changelog (revision 17017)
+++ packaging/Debian/debian-sarge/changelog (revision 17160)
@@ -1,3 +1,15 @@
+samba (3.0.23-1) stable; urgency=low
+
+ * samba 3.0.23 Samba Team Release
+
+ -- Simo Sorce <idra at samba.org> Sat, 15 Jul 2006 10:01:30 -0400
+
+samba (3.0.22-1) stable; urgency=high
+
+ * samba 3.0.22 Samba Team Release
+
+ -- Simo Sorce <idra at samba.org> Fri, 07 Apr 2006 15:45:30 -0400
+
samba (3.0.21b-1) stable; urgency=high
* samba 3.0.21b Samba Team Release
More information about the samba-technical
mailing list