Fix for bug #5551, smbd recursing back into winbindd from a winbindd call.

Jeremy.

diff --git a/source/auth/auth_util.c b/source/auth/auth_util.c
index b3a3d3992420196752c9b2acb30a657e69d5d8a4..7897a921efdee8002027d1b871cf4017cdcdbd2d 100644 (file)
--- a/source/auth/auth_util.c
+++ b/source/auth/auth_util.c
@@ -545,6 +545,30 @@ static auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
        return result;
 }
 
+/***************************************************************************
+ Is the incoming username our own machine account ?
+ If so, the connection is almost certainly from winbindd.
+***************************************************************************/
+
+static BOOL is_our_machine_account(const char *username)
+{
+       BOOL ret;
+       char *truncname = NULL;
+       size_t ulen = strlen(username);
+
+       if (ulen == 0 || username[ulen-1] != '$') {
+               return False;
+       }
+       truncname = SMB_STRDUP(username);
+       if (!truncname) {
+               return False;
+       }
+       truncname[ulen-1] = '\0';
+       ret = strequal(truncname, global_myname());
+       SAFE_FREE(truncname);
+       return ret;
+}
+
 /***************************************************************************
  Make (and fill) a user_info struct from a struct samu
 ***************************************************************************/
@@ -552,18 +576,17 @@ static auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
 NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info, 
                              struct samu *sampass)
 {
-       NTSTATUS status;
        struct passwd *pwd;
        gid_t *gids;
        auth_serversupplied_info *result;
        int i;
        size_t num_gids;
        DOM_SID unix_group_sid;
-       
+       const char *username = pdb_get_username(sampass);
 
-       if ( !(pwd = getpwnam_alloc(NULL, pdb_get_username(sampass))) ) {
+       if ( !(pwd = getpwnam_alloc(NULL, username)) ) {
                DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
-                         pdb_get_username(sampass)));
+                         username));
                return NT_STATUS_NO_SUCH_USER;
        }
 
@@ -579,18 +602,47 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
        
        TALLOC_FREE(pwd);
 
-       status = pdb_enum_group_memberships(result, sampass,
+       if (IS_DC && is_our_machine_account(username)) {
+               /*
+                * Ensure for a connection from our own
+                * machine account (from winbindd on a DC)
+                * there are no supplementary groups.
+                * Prevents loops in calling gid_to_sid().
+                */
+               result->sids = NULL;
+               gids = NULL;
+               result->num_sids = 0;
+
+               /*
+                * This is a hack of monstrous proportions.
+                * If we know it's winbindd talking to us,
+                * we know we must never recurse into it,
+                * so turn off contacting winbindd for this
+                * entire process. This will get fixed when
+                * winbindd doesn't need to talk to smbd on
+                * a PDC. JRA.
+                */
+
+               winbind_off();
+
+               DEBUG(10, ("make_server_info_sam: our machine account %s "
+                       "setting supplementary group list empty and "
+                       "turning off winbindd requests.\n",
+                          username));
+       } else {
+               NTSTATUS status = pdb_enum_group_memberships(result, sampass,
                                            &result->sids, &gids,
                                            &result->num_sids);
 
-       if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
-                          nt_errstr(status)));
-               result->sam_account = NULL; /* Don't free on error exit. */
-               TALLOC_FREE(result);
-               return status;
+               if (!NT_STATUS_IS_OK(status)) {
+                       DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
+                                  nt_errstr(status)));
+                       result->sam_account = NULL; /* Don't free on error exit. */
+                       TALLOC_FREE(result);
+                       return status;
+               }
        }
-       
+
        /* Add the "Unix Group" SID for each gid to catch mapped groups
           and their Unix equivalent.  This is to solve the backwards 
           compatibility problem of 'valid users = +ntadmin' where