winbind: check for allowed domains in winbindd_dual_pam_auth_crap()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/selftest/knownfail.d/samba3.blackbox.winbind_ignore_domain b/selftest/knownfail.d/samba3.blackbox.winbind_ignore_domain
index e20ea025655262a92e7d2b6aa49a4316198ebe90..e1eedc9aa2a0c5106d82b2694a30b2bf7dc2479b 100644 (file)
--- a/selftest/knownfail.d/samba3.blackbox.winbind_ignore_domain
+++ b/selftest/knownfail.d/samba3.blackbox.winbind_ignore_domain
@@ -1,3 +1,2 @@
-^samba3.blackbox.winbind_ignore_domain.test_winbind_ignore_domains_fail_ntlm_ip\(ad_member_idmap_ad:local\)
 ^samba3.blackbox.winbind_ignore_domain.test_winbind_ignore_domains_fail_ntlm_fqdn\(ad_member_idmap_ad:local\)
 ^samba3.blackbox.winbind_ignore_domain.test_winbind_ignore_domains_fail_krb5\(ad_member_idmap_ad:local\)

diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index 560a2b992a841e9a49270b3ca875aad02f128ce1..25ebd82c638a641582378e60e27a16e9a8912e73 100644 (file)
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -2767,6 +2767,16 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                        goto done;
                }
 
+               if (!is_allowed_domain(info3->base.logon_domain.string)) {
+                       DBG_NOTICE("Authentication failed for user [%s] "
+                                  "from firewalled domain [%s]\n",
+                                  info3->base.account_name.string,
+                                  info3->base.logon_domain.string);
+                       state->response->data.auth.authoritative = true;
+                       result = NT_STATUS_AUTHENTICATION_FIREWALL_FAILED;
+                       goto done;
+               }
+
                result = append_auth_data(state->mem_ctx, state->response,
                                          state->request->flags,
                                          validation_level,