r11684: freezing 3.0.21rc1 (current with SAMBA_3_0 r11667)

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 9de7f75c31d8ad29a4aec104bf2ca82a0b55a7b1..91ed878e93f7974d0488a5427d237bc27f077a86 100644 (file)
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,32 +1,22 @@
-                   ==================================
-                   Release Notes for Samba 3.0.21pre2
-                              Nov 9, 2005
-                   ==================================
+                   =================================
+                   Release Notes for Samba 3.0.21rc1
+                              Nov 12, 2005
+                   =================================
 
 This is a release candidate of the 3.0.21 code base and is provided
 for testing purposes only.  While close to the final stable release,
 this snapshot is *not* intended for production servers.  
 
-
-Common bugs fixed in 3.0.21pre2 include:
+Common bugs fixed in 3.0.21rc1 include:
 
   o Portability and crash bugs.
   o Performance issues in winbindd.
 
-New features introduced in Samba 3.0.21pre2 include:
+New features introduced in Samba 3.0.21rc1 include:
 
   o Performance Counter external daemon.
-
-
-Known Issues
-============
-
-The final known issue to be resolved prior to the final 3.0.21
-release is compatibility issues with AD trusted domains and 
-"security = domain".  Work is underway to provide auto selection
-of the appropriate user and group query mechanisms at run time.
-
-
+  o Winbindd auto-detection query methods when communicating with
+    a domain controller.
 
 
 ######################################################################
@@ -79,6 +69,7 @@ o   Jeremy Allison <jra@samba.org>
       on a Samba PDC.
     * Backport Samba 4 time zone handling.
     * Fix core dump if setmntent() returns NULL.
+    * Replace old crc32 code with one from the FreeBSD tree.
 
 
 o   Andrew Bartlett <abartlet@samba.org>
@@ -108,7 +99,14 @@ o   Gerald (Jerry) Carter <jerry@samba.org>
     * Convert eventlog API to use NTSTATUS return codes rather 
       than WERROR.
     * Fix segv in winbindd caused by an uninitialized variable 
-      in winbindd_dual_getsidaliases()
+      in winbindd_dual_getsidaliases().
+    * Allow winbindd to select the appropriate backend methods
+      based on the DC attributes and not the security parameter.
+    * Re-add the netsamlogon_cache tdb and ensure that user entries
+      are updated from the PAC data during kerberos ticket 
+      validation.
+    * Fix lockup when running 'wbinfo -t' on a Samba PDC caused 
+      by mangling machine names in sub_set_smb_name().
 
 
 o   Guenther Deschner <gd@samba.org>
@@ -167,6 +165,11 @@ o   Lars Müller <lmuelle@samba.org>
     * Only install smbsh manpage if smbwrapper has been successfully
       built.
 
+
+o   Ricky Nance <ricky.nance@gmail.com>
+    * Updates for the mklogon perl scripts.
+
+
 o   Chris Nicholls <skel@samba.org>
     * Fix libmsrpc build of on the Sun compiler by removing empty 
       structure declarations.

diff --git a/source/auth/auth_domain.c b/source/auth/auth_domain.c
index 94b138e55b1afee134c6734f1bdfbb6bbddf5085..266851b22923a235a0a66fbd7612383ceafce798 100644 (file)
--- a/source/auth/auth_domain.c
+++ b/source/auth/auth_domain.c
@@ -252,6 +252,8 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx,
                                                domain,
                                                server_info,
                                                &info3);
+
+               netsamlogon_cache_store( user_info->smb_name.str, &info3 );
        }
 
        /* Note - once the cli stream is shutdown the mem_ctx used

diff --git a/source/lib/crc32.c b/source/lib/crc32.c
index da3aeaa901d5236456a271d9ed57183427a35c23..c6a13fada12ff0c6c91ef4a77f781286292583bc 100644 (file)
--- a/source/lib/crc32.c
+++ b/source/lib/crc32.c
@@ -1,67 +1,103 @@
-/* 
- * Copyright Francesco Ferrara, 1998 <francesco@aerra.it> 
+/*-
+ *  COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or
+ *  code or tables extracted from it, as desired without restriction.
  *
- * Used by kind permission, 14th October 1998. http://www.aerre.it/francesco
+ *  First, the polynomial itself and its table of feedback terms.  The
+ *  polynomial is
+ *  X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0
  *
+ *  Note that we take it "backwards" and put the highest-order term in
+ *  the lowest-order bit.  The X^32 term is "implied"; the LSB is the
+ *  X^31 term, etc.  The X^0 term (usually shown as "+1") results in
+ *  the MSB being 1
  *
+ *  Note that the usual hardware shift register implementation, which
+ *  is what we're using (we're merely optimizing it by doing eight-bit
+ *  chunks at a time) shifts bits into the lowest-order term.  In our
+ *  implementation, that means shifting towards the right.  Why do we
+ *  do it this way?  Because the calculated CRC must be transmitted in
+ *  order from highest-order term to lowest-order term.  UARTs transmit
+ *  characters in order from LSB to MSB.  By storing the CRC this way
+ *  we hand it to the UART in the order low-byte to high-byte; the UART
+ *  sends each low-bit to hight-bit; and the result is transmission bit
+ *  by bit from highest- to lowest-order term without requiring any bit
+ *  shuffling on our part.  Reception works similarly
+ *
+ *  The feedback terms table consists of 256, 32-bit entries.  Notes
+ *
+ *      The table can be generated at runtime if desired; code to do so
+ *      is shown later.  It might not be obvious, but the feedback
+ *      terms simply represent the results of eight shift/xor opera
+ *      tions for all combinations of data and CRC register values
+ *
+ *      The values must be right-shifted by eight bits by the "updcrc
+ *      logic; the shift must be unsigned (bring in zeroes).  On some
+ *      hardware you could probably optimize the shift in assembler by
+ *      using byte-swap instructions
+ *      polynomial $edb88320
+ *
+ *
+ * CRC32 code derived from work by Gary S. Brown.
  */
 
 #include "includes.h"
 
-static const unsigned long CRCTable[256] = 
-{
-        0x00000000,0x77073096,0xEE0E612C,0x990951BA,0x076DC419,0x706AF48F,
-        0xE963A535,0x9E6495A3,0x0EDB8832,0x79DCB8A4,0xE0D5E91E,0x97D2D988,
-        0x09B64C2B,0x7EB17CBD,0xE7B82D07,0x90BF1D91,0x1DB71064,0x6AB020F2,
-        0xF3B97148,0x84BE41DE,0x1ADAD47D,0x6DDDE4EB,0xF4D4B551,0x83D385C7,
-        0x136C9856,0x646BA8C0,0xFD62F97A,0x8A65C9EC,0x14015C4F,0x63066CD9,
-        0xFA0F3D63,0x8D080DF5,0x3B6E20C8,0x4C69105E,0xD56041E4,0xA2677172,
-        0x3C03E4D1,0x4B04D447,0xD20D85FD,0xA50AB56B,0x35B5A8FA,0x42B2986C,
-        0xDBBBC9D6,0xACBCF940,0x32D86CE3,0x45DF5C75,0xDCD60DCF,0xABD13D59,
-        0x26D930AC,0x51DE003A,0xC8D75180,0xBFD06116,0x21B4F4B5,0x56B3C423,
-        0xCFBA9599,0xB8BDA50F,0x2802B89E,0x5F058808,0xC60CD9B2,0xB10BE924,
-        0x2F6F7C87,0x58684C11,0xC1611DAB,0xB6662D3D,0x76DC4190,0x01DB7106,
-        0x98D220BC,0xEFD5102A,0x71B18589,0x06B6B51F,0x9FBFE4A5,0xE8B8D433,
-        0x7807C9A2,0x0F00F934,0x9609A88E,0xE10E9818,0x7F6A0DBB,0x086D3D2D,
-        0x91646C97,0xE6635C01,0x6B6B51F4,0x1C6C6162,0x856530D8,0xF262004E,
-        0x6C0695ED,0x1B01A57B,0x8208F4C1,0xF50FC457,0x65B0D9C6,0x12B7E950,
-        0x8BBEB8EA,0xFCB9887C,0x62DD1DDF,0x15DA2D49,0x8CD37CF3,0xFBD44C65,
-        0x4DB26158,0x3AB551CE,0xA3BC0074,0xD4BB30E2,0x4ADFA541,0x3DD895D7,
-        0xA4D1C46D,0xD3D6F4FB,0x4369E96A,0x346ED9FC,0xAD678846,0xDA60B8D0,
-        0x44042D73,0x33031DE5,0xAA0A4C5F,0xDD0D7CC9,0x5005713C,0x270241AA,
-        0xBE0B1010,0xC90C2086,0x5768B525,0x206F85B3,0xB966D409,0xCE61E49F,
-        0x5EDEF90E,0x29D9C998,0xB0D09822,0xC7D7A8B4,0x59B33D17,0x2EB40D81,
-        0xB7BD5C3B,0xC0BA6CAD,0xEDB88320,0x9ABFB3B6,0x03B6E20C,0x74B1D29A,
-        0xEAD54739,0x9DD277AF,0x04DB2615,0x73DC1683,0xE3630B12,0x94643B84,
-        0x0D6D6A3E,0x7A6A5AA8,0xE40ECF0B,0x9309FF9D,0x0A00AE27,0x7D079EB1,
-        0xF00F9344,0x8708A3D2,0x1E01F268,0x6906C2FE,0xF762575D,0x806567CB,
-        0x196C3671,0x6E6B06E7,0xFED41B76,0x89D32BE0,0x10DA7A5A,0x67DD4ACC,
-        0xF9B9DF6F,0x8EBEEFF9,0x17B7BE43,0x60B08ED5,0xD6D6A3E8,0xA1D1937E,
-        0x38D8C2C4,0x4FDFF252,0xD1BB67F1,0xA6BC5767,0x3FB506DD,0x48B2364B,
-        0xD80D2BDA,0xAF0A1B4C,0x36034AF6,0x41047A60,0xDF60EFC3,0xA867DF55,
-        0x316E8EEF,0x4669BE79,0xCB61B38C,0xBC66831A,0x256FD2A0,0x5268E236,
-        0xCC0C7795,0xBB0B4703,0x220216B9,0x5505262F,0xC5BA3BBE,0xB2BD0B28,
-        0x2BB45A92,0x5CB36A04,0xC2D7FFA7,0xB5D0CF31,0x2CD99E8B,0x5BDEAE1D,
-        0x9B64C2B0,0xEC63F226,0x756AA39C,0x026D930A,0x9C0906A9,0xEB0E363F,
-        0x72076785,0x05005713,0x95BF4A82,0xE2B87A14,0x7BB12BAE,0x0CB61B38,
-        0x92D28E9B,0xE5D5BE0D,0x7CDCEFB7,0x0BDBDF21,0x86D3D2D4,0xF1D4E242,
-        0x68DDB3F8,0x1FDA836E,0x81BE16CD,0xF6B9265B,0x6FB077E1,0x18B74777,
-        0x88085AE6,0xFF0F6A70,0x66063BCA,0x11010B5C,0x8F659EFF,0xF862AE69,
-        0x616BFFD3,0x166CCF45,0xA00AE278,0xD70DD2EE,0x4E048354,0x3903B3C2,
-        0xA7672661,0xD06016F7,0x4969474D,0x3E6E77DB,0xAED16A4A,0xD9D65ADC,
-        0x40DF0B66,0x37D83BF0,0xA9BCAE53,0xDEBB9EC5,0x47B2CF7F,0x30B5FFE9,
-        0xBDBDF21C,0xCABAC28A,0x53B39330,0x24B4A3A6,0xBAD03605,0xCDD70693,
-        0x54DE5729,0x23D967BF,0xB3667A2E,0xC4614AB8,0x5D681B02,0x2A6F2B94,
-        0xB40BBE37,0xC30C8EA1,0x5A05DF1B,0x2D02EF8D
+const uint32 crc32_tab[] = {
+       0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419, 0x706af48f,
+       0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
+       0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91, 0x1db71064, 0x6ab020f2,
+       0xf3b97148, 0x84be41de, 0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7,
+       0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec, 0x14015c4f, 0x63066cd9,
+       0xfa0f3d63, 0x8d080df5, 0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172,
+       0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b, 0x35b5a8fa, 0x42b2986c,
+       0xdbbbc9d6, 0xacbcf940, 0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59,
+       0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116, 0x21b4f4b5, 0x56b3c423,
+       0xcfba9599, 0xb8bda50f, 0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
+       0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d, 0x76dc4190, 0x01db7106,
+       0x98d220bc, 0xefd5102a, 0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433,
+       0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818, 0x7f6a0dbb, 0x086d3d2d,
+       0x91646c97, 0xe6635c01, 0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e,
+       0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457, 0x65b0d9c6, 0x12b7e950,
+       0x8bbeb8ea, 0xfcb9887c, 0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65,
+       0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2, 0x4adfa541, 0x3dd895d7,
+       0xa4d1c46d, 0xd3d6f4fb, 0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0,
+       0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9, 0x5005713c, 0x270241aa,
+       0xbe0b1010, 0xc90c2086, 0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
+       0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4, 0x59b33d17, 0x2eb40d81,
+       0xb7bd5c3b, 0xc0ba6cad, 0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a,
+       0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683, 0xe3630b12, 0x94643b84,
+       0x0d6d6a3e, 0x7a6a5aa8, 0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1,
+       0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe, 0xf762575d, 0x806567cb,
+       0x196c3671, 0x6e6b06e7, 0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc,
+       0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5, 0xd6d6a3e8, 0xa1d1937e,
+       0x38d8c2c4, 0x4fdff252, 0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b,
+       0xd80d2bda, 0xaf0a1b4c, 0x36034af6, 0x41047a60, 0xdf60efc3, 0xa867df55,
+       0x316e8eef, 0x4669be79, 0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
+       0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f, 0xc5ba3bbe, 0xb2bd0b28,
+       0x2bb45a92, 0x5cb36a04, 0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d,
+       0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a, 0x9c0906a9, 0xeb0e363f,
+       0x72076785, 0x05005713, 0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38,
+       0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21, 0x86d3d2d4, 0xf1d4e242,
+       0x68ddb3f8, 0x1fda836e, 0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777,
+       0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c, 0x8f659eff, 0xf862ae69,
+       0x616bffd3, 0x166ccf45, 0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2,
+       0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db, 0xaed16a4a, 0xd9d65adc,
+       0x40df0b66, 0x37d83bf0, 0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
+       0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6, 0xbad03605, 0xcdd70693,
+       0x54de5729, 0x23d967bf, 0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94,
+       0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d
 };
 
-uint32 crc32_calc_buffer( const char *buffer, uint32 count)
+uint32 crc32_calc_buffer(const char *buf, size_t size)
 {
-       uint32 crc=0xffffffff, i;
-        for(i=0;i<count;i++)
-                crc = (crc>>8) ^ CRCTable[(buffer[i] ^ crc) & 0xff];
-        crc^=0xffffffff;
-       DEBUG(10,("crc32_calc_buffer: %x\n", crc));
-       dump_data(100, buffer, count);
-        return crc;
+       const unsigned char *p;
+       uint32 crc;
+
+       p = buf;
+       crc = ~0U;
+
+       while (size--)
+               crc = crc32_tab[(crc ^ *p++) & 0xFF] ^ (crc >> 8);
+
+       return crc ^ ~0U;
 }

diff --git a/source/lib/substitute.c b/source/lib/substitute.c
index 884f038e6db89f20dcd68d1b1633c1c1250d3ce3..4d22518230ff01c216dadc346b05801b25fd2e07 100644 (file)
--- a/source/lib/substitute.c
+++ b/source/lib/substitute.c
@@ -107,15 +107,37 @@ const char* get_local_machine_name(void)
 void sub_set_smb_name(const char *name)
 {
        fstring tmp;
+       int len;
+       BOOL is_machine_account = False;
 
        /* don't let anonymous logins override the name */
        if (! *name)
                return;
 
-       fstrcpy(tmp,name);
-       trim_char(tmp,' ',' ');
-       strlower_m(tmp);
-       alpha_strcpy(smb_user_name,tmp,SAFE_NETBIOS_CHARS,sizeof(smb_user_name)-1);
+
+       fstrcpy( tmp, name );
+       trim_char( tmp, ' ', ' ' );
+       strlower_m( tmp );
+
+       len = strlen( tmp );
+
+       if ( len == 0 )
+               return;
+
+       /* long story but here goes....we have to allow usernames
+          ending in '$' as they are valid machine account names.
+          So check for a machine account and re-add the '$'
+          at the end after the call to alpha_strcpy().   --jerry  */
+          
+       if ( tmp[len-1] == '$' )
+               is_machine_account = True;
+       
+       alpha_strcpy( smb_user_name, tmp, SAFE_NETBIOS_CHARS, sizeof(smb_user_name)-1 );
+
+       if ( is_machine_account ) {
+               len = strlen( smb_user_name );
+               smb_user_name[len-1] = '$';
+       }
 }
 
 char* sub_get_smb_name( void )

diff --git a/source/libads/kerberos.c b/source/libads/kerberos.c
index 7f855add06ecd836941e3c3c6190c309a36cebc9..d5b4b11fa2453df428397c2d7b4b49e3d5adc561 100644 (file)
--- a/source/libads/kerberos.c
+++ b/source/libads/kerberos.c
@@ -130,8 +130,25 @@ int ads_kinit_password(ADS_STRUCT *ads)
 {
        char *s;
        int ret;
+       const char *account_name;
+       fstring acct_name;
 
-       if (asprintf(&s, "%s@%s", ads->auth.user_name, ads->auth.realm) == -1) {
+       if ( IS_DC ) {
+               /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
+               account_name = lp_workgroup();
+       } else {
+               /* always use the sAMAccountName for security = domain */
+               /* global_myname()$@REA.LM */
+               if ( lp_security() == SEC_DOMAIN ) {
+                       fstr_sprintf( acct_name, "%s$", global_myname() );
+                       account_name = acct_name;
+               }
+               else 
+                       /* This looks like host/global_myname()@REA.LM */
+                       account_name = ads->auth.user_name;
+       }
+
+       if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
                return KRB5_CC_NOMEM;
        }
 

diff --git a/source/nsswitch/winbindd.c b/source/nsswitch/winbindd.c
index 7f2f3d780e14829516bab67c43752d0cd41aca13..60a4e2f6c01a418c321ad049dcf0fd43c43b81be 100644 (file)
--- a/source/nsswitch/winbindd.c
+++ b/source/nsswitch/winbindd.c
@@ -1063,6 +1063,8 @@ int main(int argc, char **argv)
        
        poptFreeContext(pc);
 
+       netsamlogon_cache_init(); /* Non-critical */
+       
        init_domain_list();
 
        init_idmap_child();

diff --git a/source/nsswitch/winbindd_ads.c b/source/nsswitch/winbindd_ads.c
index 6b170c33305ecb898a11863081957733e63da6ae..32bc641b6a6143e8b21ee2d0a777e61c09ea2f25 100644 (file)
--- a/source/nsswitch/winbindd_ads.c
+++ b/source/nsswitch/winbindd_ads.c
@@ -68,11 +68,39 @@ static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
        }
 
        /* the machine acct password might have change - fetch it every time */
-       SAFE_FREE(ads->auth.password);
-       ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 
+       SAFE_FREE(ads->auth.password);
        SAFE_FREE(ads->auth.realm);
-       ads->auth.realm = SMB_STRDUP(lp_realm());
+
+       if ( IS_DC ) {
+               DOM_SID sid;
+               time_t last_set_time;
+
+               if ( !secrets_fetch_trusted_domain_password( domain->name, &ads->auth.password, &sid, &last_set_time ) ) {
+                       ads_destroy( &ads );
+                       return NULL;
+               }
+               ads->auth.realm = SMB_STRDUP( ads->server.realm );
+               strupper_m( ads->auth.realm );
+       }
+       else {
+               struct winbindd_domain *our_domain = domain;
+
+               ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
+
+               /* always give preference to the alt_name in our 
+                  primary domain if possible */
+
+               if ( !domain->primary )
+                       our_domain = find_our_domain();
+
+               if ( our_domain->alt_name[0] != '\0' ) {
+                       ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
+                       strupper_m( ads->auth.realm );
+               }
+               else
+                       ads->auth.realm = SMB_STRDUP( lp_realm() );
+       }
 
        status = ads_connect(ads);
        if (!ADS_ERR_OK(status) || !ads->config.realm) {

diff --git a/source/nsswitch/winbindd_cache.c b/source/nsswitch/winbindd_cache.c
index 9164a135c5bab351dd8b819c351c80ed3f777a06..83ded01d4ea90a6923723fdca933328fda60e797 100644 (file)
--- a/source/nsswitch/winbindd_cache.c
+++ b/source/nsswitch/winbindd_cache.c
@@ -100,43 +100,52 @@ void winbindd_check_cache_size(time_t t)
 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 {
        struct winbind_cache *ret = wcache;
+       struct winbindd_domain *our_domain = domain;
 
        /* we have to know what type of domain we are dealing with first */
 
        if ( !domain->initialized )
                set_dc_type_and_flags( domain );
 
+       /* 
+          OK.  listen up becasue I'm only going to say this once.
+          We have the following scenarios to consider
+          (a) trusted AD domains on a Samba DC,
+          (b) trusted AD domains and we are joined to a non-kerberos domain
+          (c) trusted AD domains and we are joined to a kerberos (AD) domain
+
+          For (a) we can always contact the trusted domain using krb5 
+          since we have the domain trust account password
+
+          For (b) we can only use RPC since we have no way of 
+          getting a krb5 ticket in our own domain
+
+          For (c) we can always use krb5 since we have a kerberos trust
+
+          --jerry
+        */
+
        if (!domain->backend) {
                extern struct winbindd_methods reconnect_methods;
-               switch (lp_security()) {
 #ifdef HAVE_ADS
-               case SEC_ADS: {
-                       extern struct winbindd_methods ads_methods;
-                       /* always obey the lp_security parameter for our domain */
-                       if (domain->primary) {
-                               domain->backend = &ads_methods;
-                               break;
-                       }
+               extern struct winbindd_methods ads_methods;
 
-                       /* only use ADS for native modes at the momment.
-                          The problem is the correct detection of mixed 
-                          mode domains from NT4 BDC's    --jerry */
-                       
-                       if ( domain->native_mode ) {
-                               DEBUG(5,("get_cache: Setting ADS methods for domain %s\n",
-                                       domain->name));
-                               domain->backend = &ads_methods;
-                               break;
-                       }
+               /* find our domain first so we can figure out if we 
+                  are joined to a kerberized domain */
 
-                       /* fall through */
-               }       
-#endif
-               default:
-                       DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n",
-                               domain->name));
+               if ( !domain->primary )
+                       our_domain = find_our_domain();
+
+               if ( (our_domain->active_directory || IS_DC) && domain->active_directory ) {
+                       DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
+                       domain->backend = &ads_methods;
+               } else {
+#endif /* HAVE_ADS */
+                       DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
                        domain->backend = &reconnect_methods;
+#ifdef HAVE_ADS
                }
+#endif /* HAVE_ADS */
        }
 
        if (ret)
@@ -1064,6 +1073,18 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
 
        centry = wcache_fetch(cache, domain, "U/%s", sid_string_static(user_sid));
        
+       /* If we have an access denied cache entry and a cached info3 in the
+           samlogon cache then do a query.  This will force the rpc back end
+           to return the info3 data. */
+
+       if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
+           netsamlogon_cache_have(user_sid)) {
+               DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
+               domain->last_status = NT_STATUS_OK;
+               centry_free(centry);
+               goto do_query;
+       }
+       
        if (!centry)
                goto do_query;
 
@@ -1119,6 +1140,18 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 
        centry = wcache_fetch(cache, domain, "UG/%s", sid_to_string(sid_string, user_sid));
        
+       /* If we have an access denied cache entry and a cached info3 in the
+           samlogon cache then do a query.  This will force the rpc back end
+           to return the info3 data. */
+
+       if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
+           netsamlogon_cache_have(user_sid)) {
+               DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
+               domain->last_status = NT_STATUS_OK;
+               centry_free(centry);
+               goto do_query;
+       }
+       
        if (!centry)
                goto do_query;
 
@@ -1392,6 +1425,20 @@ static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
        return 0;
 }
 
+/* Invalidate the getpwnam and getgroups entries for a winbindd domain */
+
+void wcache_invalidate_samlogon(struct winbindd_domain *domain, 
+                               NET_USER_INFO_3 *info3)
+{
+       struct winbind_cache *cache;
+       
+       if (!domain)
+               return;
+
+       cache = get_cache(domain);
+       netsamlogon_clear_cached_user(cache->tdb, info3);
+}
+
 void wcache_invalidate_cache(void)
 {
        struct winbindd_domain *domain;

diff --git a/source/nsswitch/winbindd_pam.c b/source/nsswitch/winbindd_pam.c
index 3571142c5846d27aca893aa6ed5e273bbab50628..4582eced0e5319a42d9b6cdf6951a21175763918 100644 (file)
--- a/source/nsswitch/winbindd_pam.c
+++ b/source/nsswitch/winbindd_pam.c
@@ -382,6 +382,9 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
        } while ( (attempts < 2) && retry );
 
        if (NT_STATUS_IS_OK(result)) {
+               netsamlogon_cache_store(name_user, &info3);
+               wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3);
+
                /* Check if the user is in the right group */
 
                if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3,
@@ -527,8 +530,9 @@ void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
 
  done:
        set_auth_errors(&state->response, result);
-       DEBUG(5, ("CRAP authentication for %s returned %s (PAM: %d)\n",
-                 state->request.data.auth.user, 
+       DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
+                 state->request.data.auth_crap.domain,
+                 state->request.data.auth_crap.user, 
                  state->response.data.auth.nt_status_string,
                  state->response.data.auth.pam_error));
        request_error(state);
@@ -664,6 +668,11 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
        } while ( (attempts < 2) && retry );
 
        if (NT_STATUS_IS_OK(result)) {
+               netsamlogon_cache_store(name_user, &info3);
+               wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3);
+
+               /* Check if the user is in the right group */
+
                if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3,
                                                        state->request.data.auth_crap.require_membership_of_sid))) {
                        DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",

diff --git a/source/nsswitch/winbindd_rpc.c b/source/nsswitch/winbindd_rpc.c
index b3bed2e0beef52898b1e0c1f975e7a03a9744d1b..63e24877008d2e8bdfc27acb3f31968d455bbda1 100644 (file)
--- a/source/nsswitch/winbindd_rpc.c
+++ b/source/nsswitch/winbindd_rpc.c
@@ -329,6 +329,7 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
        SAM_USERINFO_CTR *ctr;
        fstring sid_string;
        uint32 user_rid;
+       NET_USER_INFO_3 *user;
        struct rpc_pipe_client *cli;
 
        DEBUG(3,("rpc: query_user rid=%s\n",
@@ -337,6 +338,33 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
        if (!sid_peek_check_rid(&domain->sid, user_sid, &user_rid))
                return NT_STATUS_UNSUCCESSFUL;
        
+       /* try netsamlogon cache first */
+                       
+       if ( (user = netsamlogon_cache_get( mem_ctx, user_sid )) != NULL ) 
+       {
+                               
+               DEBUG(5,("query_user: Cache lookup succeeded for %s\n", 
+                       sid_string_static(user_sid)));
+
+               sid_compose(&user_info->user_sid, &domain->sid, user_rid);
+               sid_compose(&user_info->group_sid, &domain->sid,
+                           user->group_rid);
+                               
+               user_info->acct_name = unistr2_tdup(mem_ctx,
+                                                   &user->uni_user_name);
+               user_info->full_name = unistr2_tdup(mem_ctx,
+                                                   &user->uni_full_name);
+               
+               user_info->homedir = NULL;
+               user_info->shell = NULL;
+                                               
+               SAFE_FREE(user);
+                               
+               return NT_STATUS_OK;
+       }
+       
+       /* no cache; hit the wire */
+               
        result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
        if (!NT_STATUS_IS_OK(result))
                return result;
@@ -384,6 +412,7 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
        unsigned int i;
        fstring sid_string;
        uint32 user_rid;
+       NET_USER_INFO_3 *user;
        struct rpc_pipe_client *cli;
 
        DEBUG(3,("rpc: lookup_usergroups sid=%s\n",
@@ -394,6 +423,29 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 
        *num_groups = 0;
        *user_grpsids = NULL;
+
+       /* so lets see if we have a cached user_info_3 */
+       
+       if ( (user = netsamlogon_cache_get( mem_ctx, user_sid )) != NULL )
+       {
+               DEBUG(5,("query_user: Cache lookup succeeded for %s\n", 
+                       sid_string_static(user_sid)));
+                       
+               *num_groups = user->num_groups;
+                               
+               (*user_grpsids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_groups);
+               for (i=0;i<(*num_groups);i++) {
+                       sid_copy(&((*user_grpsids)[i]), &domain->sid);
+                       sid_append_rid(&((*user_grpsids)[i]),
+                                      user->gids[i].g_rid);
+               }
+                               
+               SAFE_FREE(user);
+                               
+               return NT_STATUS_OK;
+       }
+
+       /* no cache; hit the wire */
        
        result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
        if (!NT_STATUS_IS_OK(result))

diff --git a/source/rpc_server/srv_netlog_nt.c b/source/rpc_server/srv_netlog_nt.c
index 91566d325cfbc9101f6935def994838ceb4d4c93..7903adff6d59a91185ae4f26371565a7d3f4de5b 100644 (file)
--- a/source/rpc_server/srv_netlog_nt.c
+++ b/source/rpc_server/srv_netlog_nt.c
@@ -633,7 +633,7 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *
 
        /* checks and updates credentials.  creates reply credentials */
        if (!creds_server_step(p->dc, &q_u->sam_id.client.cred,  &r_u->srv_creds)) {
-               DEBUG(0,("_net_sam_logoff: creds_server_step failed. Rejecting auth "
+               DEBUG(0,("_net_sam_logon: creds_server_step failed. Rejecting auth "
                        "request from client %s machine account %s\n",
                        p->dc->remote_machine, p->dc->mach_acct ));
                return NT_STATUS_ACCESS_DENIED;

diff --git a/source/smbd/dir.c b/source/smbd/dir.c
index c993012a2548891435e678e1d7ffb4beb9e8fc25..0635db22dbd13d9901d54bf77824fb4a428fa159 100644 (file)
--- a/source/smbd/dir.c
+++ b/source/smbd/dir.c
@@ -802,7 +802,7 @@ BOOL get_dir_entry(connection_struct *conn,char *mask,uint32 dirtype, pstring fn
                        *mode = dos_mode(conn,pathreal,&sbuf);
 
                        if (!dir_check_ftype(conn,*mode,dirtype)) {
-                               DEBUG(5,("[%s] attribs didn't match %x\n",filename,(unsigned int)dirtype));
+                               DEBUG(5,("[%s] attribs 0x%x didn't match 0x%x\n",filename,(unsigned int)*mode,(unsigned int)dirtype));
                                continue;
                        }
 

diff --git a/source/smbd/sesssetup.c b/source/smbd/sesssetup.c
index 34b161c92ff968393d30527fc3844b5d8a4acb18..2c9676016783c611a43082bbca6fe516217df129 100644 (file)
--- a/source/smbd/sesssetup.c
+++ b/source/smbd/sesssetup.c
@@ -180,10 +180,6 @@ static int reply_spnego_kerberos(connection_struct *conn,
                return ERROR_NT(NT_STATUS_LOGON_FAILURE);
        }
 
-       if (pac_data) {
-               logon_info = get_logon_info_from_pac(pac_data);
-       }
-
        DEBUG(3,("Ticket name is [%s]\n", client));
 
        p = strchr_m(client, '@');
@@ -196,6 +192,14 @@ static int reply_spnego_kerberos(connection_struct *conn,
        }
 
        *p = 0;
+
+       /* save the PAC data if we have it */
+
+       if (pac_data) {
+               logon_info = get_logon_info_from_pac(pac_data);
+               netsamlogon_cache_store( client, &logon_info->info3 );
+       }
+
        if (!strequal(p+1, lp_realm())) {
                DEBUG(3,("Ticket for foreign realm %s@%s\n", client, p+1));
                if (!lp_allow_trusted_domains()) {
@@ -954,9 +958,6 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,
                        return ERROR_NT(NT_STATUS_LOGON_FAILURE);
                }
                fstrcpy(sub_user, user);
-
-               /* setup the string used by %U */
-               sub_set_smb_name(user);
        } else {
                fstrcpy(sub_user, lp_guestaccount());
        }