dsdb: Allow the disable of the Windows server site fallback
authorGarming Sam <garming@catalyst.net.nz>
Mon, 26 Mar 2018 01:25:45 +0000 (14:25 +1300)
committerGarming Sam <garming@samba.org>
Fri, 4 May 2018 04:12:10 +0000 (06:12 +0200)
A usage in GetDCNameEx2 could return the wrong result. This may need to
be fixed in other places.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13365

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
dfs_server/dfs_server_ad.c
source4/dsdb/common/util.c
source4/dsdb/samdb/ldb_modules/netlogon.c
source4/rpc_server/netlogon/dcerpc_netlogon.c

index 04aa7e0..84a19bd 100644 (file)
@@ -602,7 +602,7 @@ static NTSTATUS dodc_referral(struct loadparm_context *lp_ctx,
                }
        }
 
-       site_name = samdb_client_site_name(sam_ctx, r, client_str, NULL);
+       site_name = samdb_client_site_name(sam_ctx, r, client_str, NULL, true);
 
        status = get_dcs(r, sam_ctx, site_name, need_fqdn, &set, 0);
        if (!NT_STATUS_IS_OK(status)) {
@@ -713,7 +713,7 @@ static NTSTATUS dosysvol_referral(struct loadparm_context *lp_ctx,
                }
        }
 
-       site_name = samdb_client_site_name(sam_ctx, r, client_str, NULL);
+       site_name = samdb_client_site_name(sam_ctx, r, client_str, NULL, true);
 
        status = get_dcs(r, sam_ctx, site_name, need_fqdn, &set, 0);
        if (!NT_STATUS_IS_OK(status)) {
index 3b41605..ed91bc7 100644 (file)
@@ -1825,9 +1825,13 @@ const char *samdb_server_site_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
 /*
  * Finds the client site by using the client's IP address.
  * The "subnet_name" returns the name of the subnet if parameter != NULL
+ *
+ * Has a Windows-based fallback to provide the only site available, or an empty
+ * string if there are multiple sites.
  */
 const char *samdb_client_site_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
-                                  const char *ip_address, char **subnet_name)
+                                  const char *ip_address, char **subnet_name,
+                                  bool fallback)
 {
        const char *attrs[] = { "cn", "siteObject", NULL };
        struct ldb_dn *sites_container_dn, *subnets_dn, *sites_dn;
@@ -1896,7 +1900,7 @@ const char *samdb_client_site_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
                }
        }
 
-       if (site_name == NULL) {
+       if (site_name == NULL && fallback) {
                /* This is the Windows Server fallback rule: when no subnet
                 * exists and we have only one site available then use it (it
                 * is for sure the same as our server site). If more sites do
index 80599b8..1e74d1b 100644 (file)
@@ -314,7 +314,8 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
        server_site      = samdb_server_site_name(sam_ctx, mem_ctx);
        NT_STATUS_HAVE_NO_MEMORY(server_site);
        client_site      = samdb_client_site_name(sam_ctx, mem_ctx,
-                                                 src_address, NULL);
+                                                 src_address, NULL,
+                                                 true);
        NT_STATUS_HAVE_NO_MEMORY(client_site);
        if (strcasecmp(server_site, client_site) == 0) {
                server_type |= DS_SERVER_CLOSEST;
index cab27d2..6420d57 100644 (file)
@@ -3080,7 +3080,8 @@ static WERROR dcesrv_netr_DsRAddressToSitenamesExW(struct dcesrv_call_state *dce
                ctr->sitename[i].string   = samdb_client_site_name(sam_ctx,
                                                                   mem_ctx,
                                                                   addr_str,
-                                                                  &subnet_name);
+                                                                  &subnet_name,
+                                                                  true);
                W_ERROR_HAVE_NO_MEMORY(ctr->sitename[i].string);
                ctr->subnetname[i].string = subnet_name;
        }