]> git.ipfire.org Git - ipfire-2.x.git/blame - src/patches/samba/samba-3.6.99-fix_usergroup_cache_lookup.patch
projects / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
[ipfire-2.x.git] / src / patches / samba / samba-3.6.99-fix_usergroup_cache_lookup.patch
CommitLineData
1d13e637
AF		 1From 72494e601ee6027873494f7ee7aff03d9170e3eb Mon Sep 17 00:00:00 2001
2From: Jeremy Allison <jra@samba.org>
3Date: Mon, 16 Jun 2014 22:49:29 -0700
4Subject: [PATCH 1/5] PATCHSET21: s3: auth: Add some const to the struct
5 netr_SamInfo3 * arguments of copy_netr_SamInfo3() and
6 make_server_info_info3()
7
8Both functions only read from the struct netr_SamInfo3 * argument.
9
10Signed-off-by: Jeremy Allison <jra@samba.org>
11Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
12Reviewed-by: Simo Sorce <idra@samba.org>
13(cherry picked from commit c2411767adb5ce48a4619349075f6f8faae41aab)
14
15Conflicts:
16 source3/auth/proto.h
17---
18 source3/auth/auth_util.c | 2 +-
19 source3/auth/proto.h | 4 ++--
20 source3/auth/server_info.c | 2 +-
21 3 files changed, 4 insertions(+), 4 deletions(-)
22
23diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
24index 1f1fed9..a548b7b 100644
25--- a/source3/auth/auth_util.c
26+++ b/source3/auth/auth_util.c
27@@ -1195,7 +1195,7 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
28 const char *sent_nt_username,
29 const char *domain,
30 struct auth_serversupplied_info **server_info,
31- struct netr_SamInfo3 *info3)
32+ const struct netr_SamInfo3 *info3)
33 {
34 static const char zeros[16] = {0, };
35
36diff --git a/source3/auth/proto.h b/source3/auth/proto.h
37index fccabc4..c851722 100644
38--- a/source3/auth/proto.h
39+++ b/source3/auth/proto.h
40@@ -173,7 +173,7 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
41 const char *sent_nt_username,
42 const char *domain,
43 struct auth_serversupplied_info **server_info,
44- struct netr_SamInfo3 *info3);
45+ const struct netr_SamInfo3 *info3);
46 struct wbcAuthUserInfo;
47 NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
48 const char *sent_nt_username,
49@@ -233,7 +233,7 @@ NTSTATUS passwd_to_SamInfo3(TALLOC_CTX *mem_ctx,
50 const struct passwd *pwd,
51 struct netr_SamInfo3 **pinfo3);
52 struct netr_SamInfo3 *copy_netr_SamInfo3(TALLOC_CTX *mem_ctx,
53- struct netr_SamInfo3 *orig);
54+ const struct netr_SamInfo3 *orig);
55 struct netr_SamInfo3 *wbcAuthUserInfo_to_netr_SamInfo3(TALLOC_CTX *mem_ctx,
56 const struct wbcAuthUserInfo *info);
57
58diff --git a/source3/auth/server_info.c b/source3/auth/server_info.c
59index e627892..63b4989 100644
60--- a/source3/auth/server_info.c
61+++ b/source3/auth/server_info.c
62@@ -632,7 +632,7 @@ done:
63 } } while(0)
64
65 struct netr_SamInfo3 *copy_netr_SamInfo3(TALLOC_CTX *mem_ctx,
66- struct netr_SamInfo3 *orig)
67+ const struct netr_SamInfo3 *orig)
68 {
69 struct netr_SamInfo3 *info3;
70 unsigned int i;
71--
722.1.0
73
74
75From 1afd41a9cc31acdff66ab084ba89913c8a239a0f Mon Sep 17 00:00:00 2001
76From: Jeremy Allison <jra@samba.org>
77Date: Mon, 16 Jun 2014 22:54:45 -0700
78Subject: [PATCH 2/5] PATCHSET21: s3: auth: Change make_server_info_info3() to
79 take a const struct netr_SamInfo3 pointer instead of a struct PAC_LOGON_INFO.
80
81make_server_info_info3() only reads from the info3 pointer.
82
83Signed-off-by: Jeremy Allison <jra@samba.org>
84Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
85Reviewed-by: Simo Sorce <idra@samba.org>
86(cherry picked from commit 527f7b54388713acaaf7b66c718cc0f7114fc368)
87
88Conflicts:
89 source3/auth/auth_generic.c
90 source3/auth/proto.h
91 source3/auth/user_krb5.c
92---
93 source3/auth/proto.h | 2 +-
94 source3/auth/user_krb5.c | 8 ++++----
95 2 files changed, 5 insertions(+), 5 deletions(-)
96
97diff --git a/source3/auth/proto.h b/source3/auth/proto.h
98index c851722..0ab32a7 100644
99--- a/source3/auth/proto.h
100+++ b/source3/auth/proto.h
101@@ -305,7 +305,7 @@ NTSTATUS make_server_info_krb5(TALLOC_CTX *mem_ctx,
102 char *ntdomain,
103 char *username,
104 struct passwd *pw,
105- struct PAC_LOGON_INFO *logon_info,
106+ const struct netr_SamInfo3 *info3,
107 bool mapped_to_guest,
108 struct auth_serversupplied_info **server_info);
109
110diff --git a/source3/auth/user_krb5.c b/source3/auth/user_krb5.c
111index 1e5254e..fde2f48 100644
112--- a/source3/auth/user_krb5.c
113+++ b/source3/auth/user_krb5.c
114@@ -184,7 +184,7 @@ NTSTATUS make_server_info_krb5(TALLOC_CTX *mem_ctx,
115 char *ntdomain,
116 char *username,
117 struct passwd *pw,
118- struct PAC_LOGON_INFO *logon_info,
119+ const struct netr_SamInfo3 *info3,
120 bool mapped_to_guest,
121 struct auth_serversupplied_info **server_info)
122 {
123@@ -198,14 +198,14 @@ NTSTATUS make_server_info_krb5(TALLOC_CTX *mem_ctx,
124 return status;
125 }
126
127- } else if (logon_info) {
128+ } else if (info3) {
129 /* pass the unmapped username here since map_username()
130 will be called again in make_server_info_info3() */
131
132 status = make_server_info_info3(mem_ctx,
133 ntuser, ntdomain,
134 server_info,
135- &logon_info->info3);
136+ info3);
137 if (!NT_STATUS_IS_OK(status)) {
138 DEBUG(1, ("make_server_info_info3 failed: %s!\n",
139 nt_errstr(status)));
140@@ -284,7 +284,7 @@ NTSTATUS make_server_info_krb5(TALLOC_CTX *mem_ctx,
141 char *ntdomain,
142 char *username,
143 struct passwd *pw,
144- struct PAC_LOGON_INFO *logon_info,
145+ const struct netr_SamInfo3 *info3,
146 bool mapped_to_guest,
147 struct auth_serversupplied_info **server_info)
148 {
149--
1502.1.0
151
152
153From 08bf07ec03537aedbd7beb359cf9274be2882edf Mon Sep 17 00:00:00 2001
154From: Jeremy Allison <jra@samba.org>
155Date: Mon, 16 Jun 2014 23:11:58 -0700
156Subject: [PATCH 3/5] PATCHSET21: s3: auth: Add
157 create_info3_from_pac_logon_info() to create a new info3 and merge resource
158 group SIDs into it.
159
160Originally written by Richard Sharpe Richard Sharpe <realrichardsharpe@gmail.com>.
161
162Signed-off-by: Jeremy Allison <jra@samba.org>
163Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
164Reviewed-by: Simo Sorce <idra@samba.org>
165(cherry picked from commit db775c68ccbed0252abf092b5cb811e8f5fa9bb6)
166---
167 source3/auth/proto.h | 5 ++-
168 source3/auth/server_info.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++
169 2 files changed, 82 insertions(+), 1 deletion(-)
170
171diff --git a/source3/auth/proto.h b/source3/auth/proto.h
172index 0ab32a7..4335cf8 100644
173--- a/source3/auth/proto.h
174+++ b/source3/auth/proto.h
175@@ -209,6 +209,7 @@ NTSTATUS auth_winbind_init(void);
176 struct netr_SamInfo2;
177 struct netr_SamInfo3;
178 struct netr_SamInfo6;
179+struct PAC_LOGON_INFO;
180
181 struct auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx);
182 NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
183@@ -223,6 +224,9 @@ NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
184 uint8_t *pipe_session_key,
185 size_t pipe_session_key_len,
186 struct netr_SamInfo6 *sam6);
187+NTSTATUS create_info3_from_pac_logon_info(TALLOC_CTX *mem_ctx,
188+ const struct PAC_LOGON_INFO *logon_info,
189+ struct netr_SamInfo3 **pp_info3);
190 NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
191 struct samu *samu,
192 const char *login_server,
193@@ -289,7 +293,6 @@ bool user_in_netgroup(TALLOC_CTX *ctx, const char *user, const char *ngname);
194 bool user_in_list(TALLOC_CTX *ctx, const char *user,const char **list);
195
196 /* The following definitions come from auth/user_krb5.c */
197-struct PAC_LOGON_INFO;
198 NTSTATUS get_user_from_kerberos_info(TALLOC_CTX *mem_ctx,
199 const char *cli_name,
200 const char *princ_name,
201diff --git a/source3/auth/server_info.c b/source3/auth/server_info.c
202index 63b4989..1fd9317 100644
203--- a/source3/auth/server_info.c
204+++ b/source3/auth/server_info.c
205@@ -21,6 +21,7 @@
206 #include "auth.h"
207 #include "../lib/crypto/arcfour.h"
208 #include "../librpc/gen_ndr/netlogon.h"
209+#include "../librpc/gen_ndr/krb5pac.h"
210 #include "../libcli/security/security.h"
211 #include "rpc_client/util_netlogon.h"
212 #include "nsswitch/libwbclient/wbclient.h"
213@@ -293,6 +294,83 @@ static NTSTATUS group_sids_to_info3(struct netr_SamInfo3 *info3,
214 return NT_STATUS_OK;
215 }
216
217+/*
218+ * Merge resource SIDs, if any, into the passed in info3 structure.
219+ */
220+
221+static NTSTATUS merge_resource_sids(const struct PAC_LOGON_INFO *logon_info,
222+ struct netr_SamInfo3 *info3)
223+{
224+ uint32_t i = 0;
225+
226+ if (!(logon_info->info3.base.user_flags & NETLOGON_RESOURCE_GROUPS)) {
227+ return NT_STATUS_OK;
228+ }
229+
230+ /*
231+ * If there are any resource groups (SID Compression) add
232+ * them to the extra sids portion of the info3 in the PAC.
233+ *
234+ * This makes the info3 look like it would if we got the info
235+ * from the DC rather than the PAC.
236+ */
237+
238+ /*
239+ * Construct a SID for each RID in the list and then append it
240+ * to the info3.
241+ */
242+ for (i = 0; i < logon_info->res_groups.count; i++) {
243+ NTSTATUS status;
244+ struct dom_sid new_sid;
245+ uint32_t attributes = logon_info->res_groups.rids[i].attributes;
246+
247+ sid_compose(&new_sid,
248+ logon_info->res_group_dom_sid,
249+ logon_info->res_groups.rids[i].rid);
250+
251+ DEBUG(10, ("Adding SID %s to extra SIDS\n",
252+ sid_string_dbg(&new_sid)));
253+
254+ status = append_netr_SidAttr(info3, &info3->sids,
255+ &info3->sidcount,
256+ &new_sid,
257+ attributes);
258+ if (!NT_STATUS_IS_OK(status)) {
259+ DEBUG(1, ("failed to append SID %s to extra SIDS: %s\n",
260+ sid_string_dbg(&new_sid),
261+ nt_errstr(status)));
262+ return status;
263+ }
264+ }
265+
266+ return NT_STATUS_OK;
267+}
268+
269+/*
270+ * Create a copy of an info3 struct from the struct PAC_LOGON_INFO,
271+ * then merge resource SIDs, if any, into it. If successful return
272+ * the created info3 struct.
273+ */
274+
275+NTSTATUS create_info3_from_pac_logon_info(TALLOC_CTX *mem_ctx,
276+ const struct PAC_LOGON_INFO *logon_info,
277+ struct netr_SamInfo3 **pp_info3)
278+{
279+ NTSTATUS status;
280+ struct netr_SamInfo3 *info3 = copy_netr_SamInfo3(mem_ctx,
281+ &logon_info->info3);
282+ if (info3 == NULL) {
283+ return NT_STATUS_NO_MEMORY;
284+ }
285+ status = merge_resource_sids(logon_info, info3);
286+ if (!NT_STATUS_IS_OK(status)) {
287+ TALLOC_FREE(info3);
288+ return status;
289+ }
290+ *pp_info3 = info3;
291+ return NT_STATUS_OK;
292+}
293+
294 #define RET_NOMEM(ptr) do { \
295 if (!ptr) { \
296 TALLOC_FREE(info3); \
297--
2982.1.0
299
300
301From 86d58108db53958f05d559b2d2a20185ef2deb55 Mon Sep 17 00:00:00 2001
302From: Andreas Schneider <asn@cryptomilk.org>
303Date: Wed, 4 Mar 2015 17:45:39 +0100
304Subject: [PATCH 4/5] PATCHSET21: s3-winbind: Merge resource groups from a
305 trusted PAC into the sid array.
306
307This is a backport of db775c68ccbed0252abf092b5cb811e8f5fa9bb6.
308---
309 source3/winbindd/winbindd_pam.c | 10 +++++++++-
310 1 file changed, 9 insertions(+), 1 deletion(-)
311
312diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
313index 5316232..b1838a6 100644
314--- a/source3/winbindd/winbindd_pam.c
315+++ b/source3/winbindd/winbindd_pam.c
316@@ -546,6 +546,7 @@ static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
317 time_t time_offset = 0;
318 const char *user_ccache_file;
319 struct PAC_LOGON_INFO *logon_info = NULL;
320+ struct netr_SamInfo3 *info3_copy = NULL;
321
322 *info3 = NULL;
323
324@@ -624,7 +625,14 @@ static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
325 goto failed;
326 }
327
328- *info3 = &logon_info->info3;
329+ result = create_info3_from_pac_logon_info(mem_ctx,
330+ logon_info,
331+ &info3_copy);
332+ if (!NT_STATUS_IS_OK(result)) {
333+ return result;
334+ }
335+
336+ *info3 = info3_copy;
337
338 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
339 principal_s));
340--
3412.1.0
342
343
344From 40731d512ba1ee0502bdbdd831c4154f967d9f3e Mon Sep 17 00:00:00 2001
345From: Michael Adam <obnox@samba.org>
346Date: Mon, 9 Mar 2015 15:15:37 +0100
347Subject: [PATCH 5/5] PATCHSET21: s3-winbind: Fix chached user group lookup of
348 trusted domains.
349
350If a user group lookup has aleady been done before with a machine
351account we did always return the incomplete information from the cache.
352This patch makes sure we return the correct group information from the
353netsamlogon cache.
354
355BUG: https://bugzilla.samba.org/show_bug.cgi?id=11143
356
357Pair-Programmed-With: Andreas Schneider <asn@samba.org>
358Signed-off-by: Michael Adam <obnox@samba.org>
359Signed-off-by: Andreas Schneider <asn@samba.org>
360Reviewed-by: Volker Lendecke <vl@samba.org>
361
362(cherry picked from commit f5d0204bfa1eb641fe7697613c1f773b6a7e65de)
363---
364 source3/winbindd/wb_lookupusergroups.c | 11 +++++++++++
365 1 file changed, 11 insertions(+)
366
367diff --git a/source3/winbindd/wb_lookupusergroups.c b/source3/winbindd/wb_lookupusergroups.c
368index aeffc17..1bb7081 100644
369--- a/source3/winbindd/wb_lookupusergroups.c
370+++ b/source3/winbindd/wb_lookupusergroups.c
371@@ -37,6 +37,7 @@ struct tevent_req *wb_lookupusergroups_send(TALLOC_CTX *mem_ctx,
372 {
373 struct tevent_req *req, *subreq;
374 struct wb_lookupusergroups_state *state;
375+ NTSTATUS status;
376
377 req = tevent_req_create(mem_ctx, &state,
378 struct wb_lookupusergroups_state);
379@@ -45,6 +46,16 @@ struct tevent_req *wb_lookupusergroups_send(TALLOC_CTX *mem_ctx,
380 }
381 sid_copy(&state->sid, sid);
382
383+ status = lookup_usergroups_cached(NULL,
384+ state,
385+ &state->sid,
386+ &state->sids.num_sids,
387+ &state->sids.sids);
388+ if (NT_STATUS_IS_OK(status)) {
389+ tevent_req_done(req);
390+ return tevent_req_post(req, ev);
391+ }
392+
393 subreq = dcerpc_wbint_LookupUserGroups_send(
394 state, ev, dom_child_handle(domain), &state->sid, &state->sids);
395 if (tevent_req_nomem(subreq, req)) {
396--
3972.1.0
IPFire 2.x development tree