From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 16 Jan 2012 14:32:21 +0000 (+0100)
Subject: s4:dsdb/password_hash: require a "Primary:Kerberos" blob in supplementalCredentials
X-Git-Tag: tevent-0.9.15~363
X-Git-Url: http://git.samba.org/?p=samba.git;a=commitdiff_plain;h=13182e792a78c4b32eea95f14c3bc84ca340ef72

s4:dsdb/password_hash: require a "Primary:Kerberos" blob in supplementalCredentials

If this is missing a w2k8r2 server will reboot, when someone tries to
change a password.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Mon Jan 16 17:10:07 CET 2012 on sn-devel-104
---

diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index bf94ba3dc32..553cd686a4b 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -301,6 +301,22 @@ static int password_hash_bypass(struct ldb_module *module, struct ldb_request *r
 			data_blob_free(&subblob);
 		}
 
+		if (scpp == NULL) {
+			return ldb_error(ldb,
+					 LDB_ERR_CONSTRAINT_VIOLATION,
+					 "Primary:Packages missing");
+		}
+
+		if (scpk == NULL) {
+			/*
+			 * If Primary:Kerberos is missing w2k8r2 reboots
+			 * when a password is changed.
+			 */
+			return ldb_error(ldb,
+					 LDB_ERR_CONSTRAINT_VIOLATION,
+					 "Primary:Kerberos missing");
+		}
+
 		if (scpp) {
 			struct package_PackagesBlob *p;
 			uint32_t n;