- Add support to auth/ for the new modules system

[nivanova/samba-autobuild/.git] / source3 / auth / auth_server.c

diff --git a/source3/auth/auth_server.c b/source3/auth/auth_server.c
index b31bf7d996042631665fb31094796185ef068435..a311f01dc3f15293fdc978d4e7900cdc7bdad30e 100644 (file)
--- a/source3/auth/auth_server.c
+++ b/source3/auth/auth_server.c
@@ -24,7 +24,6 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
 
-extern pstring global_myname;
 extern userdom_struct current_user_info;
 
 /****************************************************************************
@@ -36,7 +35,8 @@ static struct cli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
        struct cli_state *cli = NULL;
        fstring desthost;
        struct in_addr dest_ip;
-       char *p, *pserver;
+       const char *p;
+       char *pserver;
        BOOL connected_ok = False;
 
        if (!(cli = cli_initialise(cli)))
@@ -49,7 +49,7 @@ static struct cli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
        p = pserver;
 
         while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
-               standard_sub_basic(current_user_info.smb_name, desthost);
+               standard_sub_basic(current_user_info.smb_name, desthost, sizeof(desthost));
                strupper(desthost);
 
                if(!resolve_name( desthost, &dest_ip, 0x20)) {
@@ -62,6 +62,15 @@ static struct cli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
                        continue;
                }
 
+               /* we use a mutex to prevent two connections at once - when a 
+                  Win2k PDC get two connections where one hasn't completed a 
+                  session setup yet it will send a TCP reset to the first 
+                  connection (tridge) */
+
+               if (!grab_server_mutex(desthost)) {
+                       return NULL;
+               }
+
                if (cli_connect(cli, desthost, &dest_ip)) {
                        DEBUG(3,("connected to password server %s\n",desthost));
                        connected_ok = True;
@@ -70,13 +79,19 @@ static struct cli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
        }
 
        if (!connected_ok) {
+               release_server_mutex();
                DEBUG(0,("password server not available\n"));
                cli_shutdown(cli);
                return NULL;
        }
-
-       if (!attempt_netbios_session_request(cli, global_myname, desthost, &dest_ip))
+       
+       if (!attempt_netbios_session_request(cli, global_myname(), 
+                                            desthost, &dest_ip)) {
+               release_server_mutex();
+               DEBUG(1,("password server fails session request\n"));
+               cli_shutdown(cli);
                return NULL;
+       }
        
        if (strequal(desthost,myhostname())) {
                exit_server("Password server loop!");
@@ -86,19 +101,37 @@ static struct cli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
 
        if (!cli_negprot(cli)) {
                DEBUG(1,("%s rejected the negprot\n",desthost));
+               release_server_mutex();
                cli_shutdown(cli);
                return NULL;
        }
 
        if (cli->protocol < PROTOCOL_LANMAN2 ||
-           !(cli->sec_mode & 1)) {
+           !(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
                DEBUG(1,("%s isn't in user level security mode\n",desthost));
+               release_server_mutex();
                cli_shutdown(cli);
                return NULL;
        }
 
-       DEBUG(3,("password server OK\n"));
+       /* Get the first session setup done quickly, to avoid silly 
+          Win2k bugs.  (The next connection to the server will kill
+          this one... 
+       */
 
+       if (!cli_session_setup(cli, "", "", 0, "", 0,
+                              "")) {
+               DEBUG(0,("%s rejected the initial session setup (%s)\n",
+                        desthost, cli_errstr(cli)));
+               release_server_mutex();
+               cli_shutdown(cli);
+               return NULL;
+       }
+       
+       release_server_mutex();
+       
+       DEBUG(3,("password server OK\n"));
+       
        return cli;
 }
 
@@ -145,7 +178,7 @@ static DATA_BLOB auth_get_challenge_server(const struct auth_context *auth_conte
        if (cli) {
                DEBUG(3,("using password server validation\n"));
 
-               if ((cli->sec_mode & 2) == 0) {
+               if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
                        /* We can't work with unencrypted password servers
                           unless 'encrypt passwords = no' */
                        DEBUG(5,("make_auth_info_server: Server is unencrypted, no challenge available..\n"));
@@ -198,7 +231,7 @@ static NTSTATUS check_smbserver_security(const struct auth_context *auth_context
         * password file.
         */
 
-       if(is_netbios_alias_or_name(user_info->domain.str)) {
+       if(is_myname(user_info->domain.str)) {
                DEBUG(3,("check_smbserver_security: Requested domain was for this machine.\n"));
                return NT_STATUS_LOGON_FAILURE;
        }
@@ -216,7 +249,7 @@ static NTSTATUS check_smbserver_security(const struct auth_context *auth_context
                return NT_STATUS_LOGON_FAILURE;
        }  
        
-       if ((cli->sec_mode & 2) == 0) {
+       if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
                if (user_info->encrypted) {
                        DEBUG(1,("password server %s is plaintext, but we are encrypted. This just can't work :-(\n", cli->desthost));
                        return NT_STATUS_LOGON_FAILURE;         
@@ -242,7 +275,7 @@ static NTSTATUS check_smbserver_security(const struct auth_context *auth_context
 
        if(baduser[0] == 0) {
                fstrcpy(baduser, INVALID_USER_PREFIX);
-               fstrcat(baduser, global_myname);
+               fstrcat(baduser, global_myname());
        }
 
        /*
@@ -252,7 +285,7 @@ static NTSTATUS check_smbserver_security(const struct auth_context *auth_context
         * need to detect this as some versions of NT4.x are broken. JRA.
         */
 
-       /* I sure as hell hope that there arn't servers out there that take 
+       /* I sure as hell hope that there aren't servers out there that take 
         * NTLMv2 and have this bug, as we don't test for that... 
         *  - abartlet@samba.org
         */
@@ -342,9 +375,7 @@ use this machine as the password server.\n"));
        if NT_STATUS_IS_OK(nt_status) {
                struct passwd *pass = Get_Pwnam(user_info->internal_username.str);
                if (pass) {
-                       if (!make_server_info_pw(server_info, pass)) { 
-                               nt_status = NT_STATUS_NO_MEMORY;
-                       }
+                       nt_status = make_server_info_pw(server_info, pass);
                } else {
                        nt_status = NT_STATUS_NO_SUCH_USER;
                }
@@ -369,3 +400,8 @@ NTSTATUS auth_init_smbserver(struct auth_context *auth_context, const char* para
        (*auth_method)->free_private_data = free_server_private_data;
        return NT_STATUS_OK;
 }
+
+int auth_server_init(void)
+{
+       return smb_register_auth("smbserver", auth_init_smbserver, AUTH_INTERFACE_VERSION);
+}