From: Garming Sam Date: Wed, 23 Jan 2019 03:16:16 +0000 (+1300) Subject: cracknames: Change search filter to use the smaller index X-Git-Tag: ldb-1.6.1~248 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f00362fb3d02f01346504ebe8d1ad8eb0dd5bb47;p=thirdparty%2Fsamba.git cracknames: Change search filter to use the smaller index In large domains with many users, '(objectClass=User)' may as well not be specified because it's iterating over the entire database. Signed-off-by: Garming Sam Reviewed-by: Andrew Bartlett --- diff --git a/source4/dsdb/samdb/cracknames.c b/source4/dsdb/samdb/cracknames.c index 3360d9a48a5..b4bd9d8f9c9 100644 --- a/source4/dsdb/samdb/cracknames.c +++ b/source4/dsdb/samdb/cracknames.c @@ -339,7 +339,7 @@ static WERROR DsCrackNameUPN(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, } /* This may need to be extended for more userPrincipalName variations */ - result_filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(samAccountName=%s))", + result_filter = talloc_asprintf(mem_ctx, "(&(samAccountName=%s)(objectClass=user))", ldb_binary_encode_string(mem_ctx, unparsed_name_short)); domain_filter = talloc_asprintf(mem_ctx, "(distinguishedName=%s)", ldb_dn_get_linearized(domain_res->msgs[0]->dn)); @@ -706,7 +706,7 @@ WERROR DsCrackNameOneName(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, krb5_free_principal(smb_krb5_context->krb5_context, principal); /* The ldb_binary_encode_string() here avoid LDAP filter injection attacks */ - result_filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(userPrincipalName=%s))", + result_filter = talloc_asprintf(mem_ctx, "(&(userPrincipalName=%s)(objectClass=user))", ldb_binary_encode_string(mem_ctx, unparsed_name)); free(unparsed_name);