libcli/lsarpc: let trust_forest_{record_lsa_1to2,info_from_lsa}() handle BINARY and SCANNER records
The tricky part is that it's all based on the sub_type within
the binary data, if it's FOREST_TRUST_SCANNER_INFO the
record is upgraded to an LSA_FOREST_TRUST_SCANNER_INFO,
otherwise it's downgraded to a LSA_FOREST_TRUST_BINARY_DATA
record.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Note for now these will fail for FOREST_TRUST_BINARY_DATA and
FOREST_TRUST_SCANNER_INFO.
But this will still make the transition from
lsa_ForestTrustInformation to lsa_ForestTrustInformation2
easier.
Support for will FOREST_TRUST_BINARY_DATA and FOREST_TRUST_SCANNER_INFO
will be added before we implement the forest trust background scanner
job and the lsaRSetForestTrustInformation2 function.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
s4:rpc_server/lsa: always add msDS-TrustForestTrustInfo if FOREST_TRANSITIVE is set
Windows (at least server 2025) always creates the default
msDS-TrustForestTrustInfo, with just a TOP_LEVEL_NAME and DOMAIN_INFO
representing the forest root domain of the trust.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Samuel Cabrero [Fri, 7 Feb 2025 15:10:47 +0000 (16:10 +0100)]
winbind:varlink: Always reply with the requested username
The service io.systemd.Multiplexer will drop responses if the username in the
response does not match the requested name. This happens when the requested
username is an UPN and the response is a down-level user name (DOMAIN\user).
Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Feb 20 09:05:46 UTC 2025 on atb-devel-224
If the connection is closed by the client the ongoing tevent_req must be
cancelled, otherwise winbindd receives a SIGBUS when trying to write in
the closed stream.
[2023/02/08 12:56:41.308393, 0] ../../lib/util/fault.c:173(smb_panic_log)
===============================================================
[2023/02/08 12:56:41.308438, 0] ../../lib/util/fault.c:174(smb_panic_log)
INTERNAL ERROR: Signal 7: Bus error in pid 24407 (4.19.0pre1-DEVELOPERBUILD)
[2023/02/08 12:56:41.308451, 0] ../../lib/util/fault.c:178(smb_panic_log)
If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting
[2023/02/08 12:56:41.308463, 0] ../../lib/util/fault.c:183(smb_panic_log)
===============================================================
[2023/02/08 12:56:41.308473, 0] ../../lib/util/fault.c:184(smb_panic_log)
PANIC (pid 24407): Signal 7: Bus error in 4.19.0pre1-DEVELOPERBUILD
Backtrace:
#0 0x00007f0e76853997 in wait4 () from /lib64/libc.so.6
#1 0x00007f0e767c591b in do_system () from /lib64/libc.so.6
#2 0x00007f0e7785ce43 in smb_panic_s3 (why=0x7ffe41b4e110 "Signal 7: Bus error")
at ../../source3/lib/util.c:698
#3 0x00007f0e76ce59f1 in smb_panic (why=0x7ffe41b4e110 "Signal 7: Bus error")
at ../../lib/util/fault.c:198
#4 0x00007f0e76ce54d0 in fault_report (sig=7) at ../../lib/util/fault.c:82
#5 0x00007f0e76ce54e5 in sig_fault (sig=7) at ../../lib/util/fault.c:93
#6 <signal handler called>
#7 varlink_stream_write (stream=0x656d614e72657375, message=<optimized out>) at ../lib/stream.c:303
#8 0x00007f0e76c5aa35 in varlink_call_reply (call=0x561c51aafe60, parameters=<optimized out>, flags=1)
at ../lib/service.c:651
#9 0x0000561c506a7e5b in membership_reply (call=0x561c51aafe60,
username=0x561c51aaa860 "AFOREST+buser1", groupname=0x561c51acae58 "AFOREST+bgroup453",
continues=true) at ../../source3/winbindd/winbindd_varlink_getmemberships.c:36
#10 0x0000561c506a9793 in memberships_by_user_getgrgid_done (req=0x0)
at ../../source3/winbindd/winbindd_varlink_getmemberships.c:481
#11 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab2d30,
location=0x561c5075b870 "../../source3/winbindd/winbindd_getgrgid.c:110")
at ../../lib/tevent/tevent_req.c:151
#12 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab2d30, state=TEVENT_REQ_DONE,
location=0x561c5075b870 "../../source3/winbindd/winbindd_getgrgid.c:110")
at ../../lib/tevent/tevent_req.c:203
#13 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab2d30,
location=0x561c5075b870 "../../source3/winbindd/winbindd_getgrgid.c:110")
at ../../lib/tevent/tevent_req.c:209
#14 0x0000561c50713770 in winbindd_getgrgid_done (subreq=0x0)
at ../../source3/winbindd/winbindd_getgrgid.c:110
#15 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51a98c50,
location=0x561c507559b0 "../../source3/winbindd/wb_getgrsid.c:201")
at ../../lib/tevent/tevent_req.c:151
#16 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51a98c50, state=TEVENT_REQ_DONE,
location=0x561c507559b0 "../../source3/winbindd/wb_getgrsid.c:201")
at ../../lib/tevent/tevent_req.c:203
#17 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51a98c50,
location=0x561c507559b0 "../../source3/winbindd/wb_getgrsid.c:201")
at ../../lib/tevent/tevent_req.c:209
#18 0x0000561c50708d22 in wb_getgrsid_got_members (subreq=0x0)
at ../../source3/winbindd/wb_getgrsid.c:201
#19 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51aa9e80,
location=0x561c50755310 "../../source3/winbindd/wb_group_members.c:463")
at ../../lib/tevent/tevent_req.c:151
#20 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51aa9e80, state=TEVENT_REQ_DONE,
location=0x561c50755310 "../../source3/winbindd/wb_group_members.c:463")
at ../../lib/tevent/tevent_req.c:203
#21 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51aa9e80,
location=0x561c50755310 "../../source3/winbindd/wb_group_members.c:463")
at ../../lib/tevent/tevent_req.c:209
#22 0x0000561c507082a6 in wb_group_members_done (subreq=0x0)
at ../../source3/winbindd/wb_group_members.c:463
#23 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab1e00,
location=0x561c50754f18 "../../source3/winbindd/wb_group_members.c:252")
at ../../lib/tevent/tevent_req.c:151
#24 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab1e00, state=TEVENT_REQ_DONE,
location=0x561c50754f18 "../../source3/winbindd/wb_group_members.c:252")
at ../../lib/tevent/tevent_req.c:203
#25 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab1e00,
location=0x561c50754f18 "../../source3/winbindd/wb_group_members.c:252")
at ../../lib/tevent/tevent_req.c:209
#26 0x0000561c50707903 in wb_groups_members_done (subreq=0x0)
at ../../source3/winbindd/wb_group_members.c:252
#27 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51aafad0,
location=0x561c50754bf0 "../../source3/winbindd/wb_group_members.c:102")
at ../../lib/tevent/tevent_req.c:151
#28 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51aafad0, state=TEVENT_REQ_DONE,
location=0x561c50754bf0 "../../source3/winbindd/wb_group_members.c:102")
at ../../lib/tevent/tevent_req.c:203
#29 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51aafad0,
location=0x561c50754bf0 "../../source3/winbindd/wb_group_members.c:102")
at ../../lib/tevent/tevent_req.c:209
#30 0x0000561c5070732e in wb_lookupgroupmem_done (subreq=0x0)
at ../../source3/winbindd/wb_group_members.c:102
#31 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab66a0,
location=0x7f0e77bc5f18 "librpc/gen_ndr/ndr_winbind_c.c:2888") at ../../lib/tevent/tevent_req.c:151
#32 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab66a0, state=TEVENT_REQ_DONE,
location=0x7f0e77bc5f18 "librpc/gen_ndr/ndr_winbind_c.c:2888") at ../../lib/tevent/tevent_req.c:203
#33 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab66a0,
location=0x7f0e77bc5f18 "librpc/gen_ndr/ndr_winbind_c.c:2888") at ../../lib/tevent/tevent_req.c:209
#34 0x00007f0e77bba4a7 in dcerpc_wbint_LookupGroupMembers_done (subreq=0x0)
at librpc/gen_ndr/ndr_winbind_c.c:2888
#35 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51aa1dc0,
location=0x7f0e77bc5d28 "librpc/gen_ndr/ndr_winbind_c.c:2773") at ../../lib/tevent/tevent_req.c:151
#36 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51aa1dc0, state=TEVENT_REQ_DONE,
location=0x7f0e77bc5d28 "librpc/gen_ndr/ndr_winbind_c.c:2773") at ../../lib/tevent/tevent_req.c:203
#37 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51aa1dc0,
location=0x7f0e77bc5d28 "librpc/gen_ndr/ndr_winbind_c.c:2773") at ../../lib/tevent/tevent_req.c:209
#38 0x00007f0e77bba0ef in dcerpc_wbint_LookupGroupMembers_r_done (subreq=0x0)
at librpc/gen_ndr/ndr_winbind_c.c:2773
#39 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab51f0,
location=0x7f0e7810b4d0 "../../librpc/rpc/binding_handle.c:520") at ../../lib/tevent/tevent_req.c:151
#40 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab51f0, state=TEVENT_REQ_DONE,
location=0x7f0e7810b4d0 "../../librpc/rpc/binding_handle.c:520") at ../../lib/tevent/tevent_req.c:203
#41 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab51f0,
location=0x7f0e7810b4d0 "../../librpc/rpc/binding_handle.c:520") at ../../lib/tevent/tevent_req.c:209
#42 0x00007f0e780f6bec in dcerpc_binding_handle_call_done (subreq=0x0)
at ../../librpc/rpc/binding_handle.c:520
#43 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51aaacf0,
location=0x7f0e7810b090 "../../librpc/rpc/binding_handle.c:203") at ../../lib/tevent/tevent_req.c:151
#44 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51aaacf0, state=TEVENT_REQ_DONE,
location=0x7f0e7810b090 "../../librpc/rpc/binding_handle.c:203") at ../../lib/tevent/tevent_req.c:203
#45 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51aaacf0,
location=0x7f0e7810b090 "../../librpc/rpc/binding_handle.c:203") at ../../lib/tevent/tevent_req.c:209
#46 0x00007f0e780f60d2 in dcerpc_binding_handle_raw_call_done (subreq=0x0)
at ../../librpc/rpc/binding_handle.c:203
#47 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab78b0,
location=0x561c50745ef0 "../../source3/winbindd/winbindd_dual_ndr.c:209")
at ../../lib/tevent/tevent_req.c:151
#48 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab78b0, state=TEVENT_REQ_DONE,
location=0x561c50745ef0 "../../source3/winbindd/winbindd_dual_ndr.c:209")
at ../../lib/tevent/tevent_req.c:203
#49 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab78b0,
location=0x561c50745ef0 "../../source3/winbindd/winbindd_dual_ndr.c:209")
at ../../lib/tevent/tevent_req.c:209
#50 0x0000561c506e7782 in wbint_bh_raw_call_domain_done (subreq=0x0)
at ../../source3/winbindd/winbindd_dual_ndr.c:209
#51 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51a98750,
location=0x561c50743390 "../../source3/winbindd/winbindd_dual.c:745")
at ../../lib/tevent/tevent_req.c:151
#52 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51a98750, state=TEVENT_REQ_DONE,
location=0x561c50743390 "../../source3/winbindd/winbindd_dual.c:745")
at ../../lib/tevent/tevent_req.c:203
#53 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51a98750,
location=0x561c50743390 "../../source3/winbindd/winbindd_dual.c:745")
at ../../lib/tevent/tevent_req.c:209
#54 0x0000561c506e30d3 in wb_domain_request_done (subreq=0x0)
at ../../source3/winbindd/winbindd_dual.c:745
#55 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab1a90,
location=0x561c507429f8 "../../source3/winbindd/winbindd_dual.c:306")
at ../../lib/tevent/tevent_req.c:151
#56 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab1a90, state=TEVENT_REQ_DONE,
location=0x561c507429f8 "../../source3/winbindd/winbindd_dual.c:306")
at ../../lib/tevent/tevent_req.c:203
#57 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab1a90,
location=0x561c507429f8 "../../source3/winbindd/winbindd_dual.c:306")
at ../../lib/tevent/tevent_req.c:209
#58 0x0000561c506e1f8d in wb_child_request_done (subreq=0x561c51ab3ca0)
at ../../source3/winbindd/winbindd_dual.c:306
#59 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab3ca0,
location=0x561c50723d98 "../../nsswitch/wb_reqtrans.c:432") at ../../lib/tevent/tevent_req.c:151
#60 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab3ca0, state=TEVENT_REQ_DONE,
location=0x561c50723d98 "../../nsswitch/wb_reqtrans.c:432") at ../../lib/tevent/tevent_req.c:203
#61 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab3ca0,
location=0x561c50723d98 "../../nsswitch/wb_reqtrans.c:432") at ../../lib/tevent/tevent_req.c:209
#62 0x0000561c50696101 in wb_simple_trans_read_done (subreq=0x0) at ../../nsswitch/wb_reqtrans.c:432
#63 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab6a20,
location=0x561c50723a20 "../../nsswitch/wb_reqtrans.c:275") at ../../lib/tevent/tevent_req.c:151
#64 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab6a20, state=TEVENT_REQ_DONE,
location=0x561c50723a20 "../../nsswitch/wb_reqtrans.c:275") at ../../lib/tevent/tevent_req.c:203
#65 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab6a20,
location=0x561c50723a20 "../../nsswitch/wb_reqtrans.c:275") at ../../lib/tevent/tevent_req.c:209
#66 0x0000561c50695adf in wb_resp_read_done (subreq=0x0) at ../../nsswitch/wb_reqtrans.c:275
#67 0x00007f0e780cb413 in _tevent_req_notify_callback (req=0x561c51ab6d70,
location=0x7f0e7786fec8 "../../lib/async_req/async_sock.c:568") at ../../lib/tevent/tevent_req.c:151
#68 0x00007f0e780cb577 in tevent_req_finish (req=0x561c51ab6d70, state=TEVENT_REQ_DONE,
location=0x7f0e7786fec8 "../../lib/async_req/async_sock.c:568") at ../../lib/tevent/tevent_req.c:203
#69 0x00007f0e780cb5a3 in _tevent_req_done (req=0x561c51ab6d70,
location=0x7f0e7786fec8 "../../lib/async_req/async_sock.c:568") at ../../lib/tevent/tevent_req.c:209
#70 0x00007f0e778255eb in read_packet_handler (ev=0x561c51a86670, fde=0x561c51b982a0, flags=1,
private_data=0x561c51ab6d70) at ../../lib/async_req/async_sock.c:568
#71 0x00007f0e780c9651 in tevent_common_invoke_fd_handler (fde=0x561c51b982a0, flags=1, removed=0x0)
at ../../lib/tevent/tevent_fd.c:142
#72 0x00007f0e780d448c in epoll_event_loop (epoll_ev=0x561c51a96380, tvalp=0x7ffe41b4f6f0)
at ../../lib/tevent/tevent_epoll.c:737
#73 0x00007f0e780d4aec in epoll_event_loop_once (ev=0x561c51a86670,
location=0x561c50726a70 "../../source3/winbindd/winbindd.c:1734")
at ../../lib/tevent/tevent_epoll.c:938
#74 0x00007f0e780d1408 in std_event_loop_once (ev=0x561c51a86670,
location=0x561c50726a70 "../../source3/winbindd/winbindd.c:1734")
at ../../lib/tevent/tevent_standard.c:110
#75 0x00007f0e780c8239 in _tevent_loop_once (ev=0x561c51a86670,
location=0x561c50726a70 "../../source3/winbindd/winbindd.c:1734") at ../../lib/tevent/tevent.c:823
#76 0x0000561c5069c4a3 in main (argc=1, argv=0x7ffe41b4fb28) at ../../source3/winbindd/winbindd.c:1734
Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Samuel Cabrero [Mon, 6 Feb 2023 17:58:25 +0000 (18:58 +0100)]
winbind:varlink: Implement memberships by user
$> userdbctl -s org.samba.winbind groups-of-user AFOREST+user1
Enabled services: org.samba.winbind
USER GROUP
AFOREST+user1 AFOREST+domain users
AFOREST+user1 AFOREST+user1
2 memberships listed.
$> SYSTEMD_LOG_LEVEL=7 getent -sinitgroups:systemd initgroups "AFOREST+domain users"
varlink: Setting state idle-client
/run/systemd/userdb/org.samba.winbind: Sending message: {"method":"io.systemd.UserDatabase.GetMemberships","parameters":{"userName":"AFOREST+domain users","service":"org.samba.winbind"},"more":true}
/run/systemd/userdb/org.samba.winbind: Changing state idle-client → awaiting-reply-more
/run/systemd/userdb/org.samba.winbind: New incoming message: {"continues":true,"parameters":{"groupName":"AFOREST+domain users","userName":"AFOREST+domain users"}}
/run/systemd/userdb/org.samba.winbind: Changing state awaiting-reply-more → processing-reply
/run/systemd/userdb/org.samba.winbind: Changing state processing-reply → awaiting-reply-more
Failed to connect to /run/systemd/userdb/io.systemd.Multiplexer: No such file or directory
Unable to connect to /run/systemd/userdb/io.systemd.Multiplexer: No such file or directory
varlink: Setting state idle-client
/run/systemd/userdb/org.samba.winbind: Sending message: {"method":"io.systemd.UserDatabase.GetGroupRecord","parameters":{"groupName":"AFOREST+domain users","service":"org.samba.winbind"}}
/run/systemd/userdb/org.samba.winbind: Changing state idle-client → awaiting-reply
/run/systemd/userdb/org.samba.winbind: New incoming message: {"parameters":{"incomplete":false,"record":{"gid":20513,"groupName":"AFOREST+domain users","members":["AFOREST+administrator","AFOREST+user1","AFOREST+krbtgt"],"service":"org.samba.winbind"}}}
/run/systemd/userdb/org.samba.winbind: Changing state awaiting-reply → processing-reply
/run/systemd/userdb/org.samba.winbind: Changing state processing-reply → idle-client
/run/systemd/userdb/org.samba.winbind: New incoming message: {"parameters":{"groupName":"AFOREST+domain users","userName":"AFOREST+domain users"}}
/run/systemd/userdb/org.samba.winbind: Changing state awaiting-reply-more → processing-reply
/run/systemd/userdb/org.samba.winbind: Changing state processing-reply → idle-client
Failed to connect to /run/systemd/userdb/io.systemd.Multiplexer: No such file or directory
Unable to connect to /run/systemd/userdb/io.systemd.Multiplexer: No such file or directory
varlink: Setting state idle-client
/run/systemd/userdb/org.samba.winbind: Sending message: {"method":"io.systemd.UserDatabase.GetGroupRecord","parameters":{"groupName":"AFOREST+domain users","service":"org.samba.winbind"}}
/run/systemd/userdb/org.samba.winbind: Changing state idle-client → awaiting-reply
/run/systemd/userdb/org.samba.winbind: New incoming message: {"parameters":{"incomplete":false,"record":{"gid":20513,"groupName":"AFOREST+domain users","members":["AFOREST+administrator","AFOREST+user1","AFOREST+krbtgt"],"service":"org.samba.winbind"}}}
/run/systemd/userdb/org.samba.winbind: Changing state awaiting-reply → processing-reply
/run/systemd/userdb/org.samba.winbind: Changing state processing-reply → idle-client
AFOREST+domain users 20513 20513
Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Signed-off-by: yogita72 <yogita.bijani@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Günther Deschner <gd@samba.org>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Wed Feb 19 02:43:44 UTC 2025 on atb-devel-224
Pair-Programmed-With: Andreas Schneider <asn@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Feb 17 18:33:15 UTC 2025 on atb-devel-224
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Sat Feb 15 19:21:56 UTC 2025 on atb-devel-224
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Björn Baumbach <bb@sernet.de>
Autobuild-Date(master): Fri Feb 14 16:18:19 UTC 2025 on atb-devel-224
Volker Lendecke [Wed, 12 Feb 2025 12:45:42 +0000 (13:45 +0100)]
pysmbd: Fix interactive samba-tool use after 0bb35e246141
samba-tool ntacl also calls into pysmbd, and 0bb35e246141 broke
relative path names. Thanks to Björn Baumbach <bb@sernet.de> for
testing interactively!!
Bug: https://bugzilla.samba.org/show_bug.cgi?id=15806 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
s4:kdc: pass the full samba_kdc_db_context to most helper functions
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Feb 14 15:19:24 UTC 2025 on atb-devel-224
s4:kdc: always go through samba_kdc_get_device_info_blob()
This means we always go through samba_kdc_get_user_info_dc()
both for client and also device pac.
It means we use the same logic regarding samba_krb5_pac_is_trusted()
and calling authsam_update_user_info_dc().
It means we do all logic on struct auth_user_info_dc
and only convert to PAC_DEVICE_INFO at the end.
Before we tried a mix of calling authsam_update_user_info_dc()
on a half constructed auth_user_info_dc,
while trying to apply the diff on auth_user_info_dc
to the also half constructed PAC_DEVICE_INFO.
Which can't work once auth_user_info_dc() will
apply sid filtering and the number of sids
may shrink.
Now we use authsam_update_user_info_dc()
followed by auth_convert_user_info_dc_saminfo3()
and samba_kdc_make_device_info().
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
So far the conversion from TGT PAC to
struct auth_user_info_dc back to TGS PAC
looses the information in what part of
the PAC_LOGON_INFO a sid was stored.
With this change we let
make_user_info_dc_{netlogon_validation,pac}()
remember this, so that
auth_convert_user_info_dc_sam{baseinfo,info6}()
can rebuild the information into the desired
parts of the PAC_LOGON_INFO.
This was found and fixed for sid filter related
tests, but it turns out that it already
fixes a few tests from samba.tests.krb5.device_tests.
All other places get an implicit AUTH_SID_ORIGIN_UNKNOWN (=0),
which means we use the same logic as before.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
projects / thirdparty / samba.git / log
