samr open and close on different TCP connections

[Stefan (metze) Metzmacher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

James Peach schrieb:
> Hi all,
> 
> I have a packet trace where Vista (with all updates, running inside
> VMWare), appears to do a SamrConnect5 on one TCP connection, and then
> closes the returned handle with a SamrCloseHandle on a different TCP
> connection. Samba (3.0.25b + patches) doesn't like the close, presumably
> because the handle was created in a different process.
> 
> Is this a legitimate Vista behaviour, or is there something incredibly
> screwy with by setup?

Hi James,

I think windows is using the assoc_group_id feature of DCERPC, which is
the virtual container for context handles, and it's possible to
have multiple connection having the same assoc_group_id, which means
the context handles are shared between the connections.

In Samba4 we have support for this on the client side (which is very
simple), but no support on the server side, which will be a lot of work
and maybe means we'll need to store all context handles in a tdb...

See also the RPC-HANDLE tests RPC-HANDLE-lsarpc-shared demonstrates
the shared handles.

W2K3 also uses this when becoming a DC of an existing domain...
That's the reason we also use this in the NET-API-BECOME-DC test.

metze
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org

iD8DBQFG9MRmm70gjA5TCD8RAiX8AKCWQu+PlVXl5KIL2rPfMvT8HOnBBgCcDuIk
4RxY5I/GPLDSFZHUTXU3sTA=
=Weh2
-----END PGP SIGNATURE-----