summaryrefslogtreecommitdiffstats
path: root/source3/winbindd
Commit message (Collapse)AuthorAgeFilesLines
* Fix denial of service - memory corruption.Jeremy Allison2011-02-272-0/+13
| | | | | | | | | | | | | | | | | | | | | | CVE-2011-0719 Fix bug #7949 (DoS in Winbind and smbd with many file descriptors open). All current released versions of Samba are vulnerable to a denial of service caused by memory corruption. Range checks on file descriptors being used in the FD_SET macro were not present allowing stack corruption. This can cause the Samba code to crash or to loop attempting to select on a bad file descriptor set. A connection to a file share, or a local account is needed to exploit this problem, either authenticated or unauthenticated (guest connection). Currently we do not believe this flaw is exploitable beyond a crash or causing the code to loop, but on the advice of our security reviewers we are releasing fixes in case an exploit is discovered at a later date.
* s3: Use smbsock_any_connect in winbindVolker Lendecke2011-01-131-45/+13
| | | | | The last 8 patches address bug #7881 (winbind flaky against w2k8). (cherry picked from commit 1a929d8f4c6bae302e5cc53d81117a05eae5fede)
* Fix bug 7636 - winbind internal error, backtrace.Jeremy Allison2011-01-131-0/+1
| | | | | Jeremy. (cherry picked from commit 995e7e500327e662b7ef2b37c83c92e75f2360bf)
* s3-winbind: Fix Bug #7568: Make sure cm_connect_lsa_tcp does not reset the ↵Günther Deschner2011-01-131-7/+13
| | | | | | | | | | | | | | | | | | | | | secure channel. This is an important fix as the following could and is happening: * winbind authenticates a user via schannel secured netlogon samlogonex call, current secure channel cred state is stored in winbind state, winbind sucessfully decrypts session key from the info3 * winbind sets up a new schannel ncacn_ip_tcp lsa pipe (and thereby resets the secure channel on the dc) * subsequent samlogonex calls use the new secure channel creds on the dc to encrypt info3 session key, while winbind tries to use old schannel creds for decryption Guenther (cherry picked from commit be396411a4e1f3a174f8a44b6c062d834135e70a) (cherry picked from commit e647f5b5409502ec329e24f09202b036cfb357ae)
* s3-kerberos: pass down kdc_name to create_local_private_krb5_conf_for_domain().Günther Deschner2011-01-131-2/+4
| | | | | | Guenther (cherry picked from commit e3bdff3d67b46277ee59685218bd90f3788b487d) (cherry picked from commit 69e1fc797dc34be03d771ec017ef27c6aa87a155)
* s3-winbind: make the getpeername() checks in cm_prepare_connection IPv6 aware.Günther Deschner2011-01-131-5/+25
| | | | | | | | | | | | | Note that this failure was hard to track, as winbind did only log a super helpful "cm_prepare_connection: Success" debug message. IPv6 gurus, please check Successfully tested in two independent IPv6 networks now. Guenther (cherry picked from commit 14ac2bb36ee22be6133ca1d069dc5de6c1891f47) (cherry picked from commit 43e4323d4a009c2b18be090f183dfd8c9f561fed)
* s3:winbind: Fix bug 5626Volker Lendecke2010-05-063-29/+23
| | | | | Apparently the AIX compiler can't deal with sizeless array declarations (cherry picked from commit 5444adaf59bc6b9bd8f339de21ab66da9e684073)
* s3:winbindd: make sure we don't try rpc requests against unaccessable domainsStefan Metzmacher2010-05-061-5/+28
| | | | | | | | | | | | This makes sure we don't crash while trying to dereference domain->conn.cli->foo while trying to establish a rpc connection to the server. This fixes bug #7316. metze (cherry picked from commit d930904b997d310aeff781bde1e7e3ce47dde8a1) (cherry picked from commit 01b60b113869f526dcf3bb478d70df21dbb207c8) (cherry picked from commit edb02e57a3ef83a16bdbd158da4c1290d4ab8240)
* s3:winbindd: never mark external domains as internal!Stefan Metzmacher2010-05-061-4/+1
| | | | | | | | | | | This way we can endup with silently using builtin_passdb_methods for an ad domain without an inbound trust. This fixes bug #7170. metze (cherry picked from commit f924b7749280b31ece19885de1c3ad1bd71942ac) (cherry picked from commit 1ea768baa9bb38533d4bd273d6c4e7b1f5fd12bd)
* Fix one of the valgrind warnings from bug #6814 - Fixes for problems ↵Roel van Meer2010-05-062-0/+17
| | | | | | | | reported by valgrind The timeval passed to event_add_to_select_args() must be initialized as event_add_to_select_args() uses a timeval_min() on this and next_event. (cherry picked from commit a0254fa053cbaa8689de4f13893c50014085f7c8)
* s3:winbindd: make "smbcontrol winbindd validate-cache" reliable againStefan Metzmacher2010-05-061-0/+3
| | | | | | | | | | commit 73577205cf81644e7fe853eaf3e6459f7f443096 (s3:winbindd: fix problems with SIGCHLD handling (bug #7317)) broke this. metze (cherry picked from commit eb9b7d0363669574de8ec380089407890f15eac2) (cherry picked from commit 7f8741da4e713f657e876f66c3f31455aea8a729)
* s3:winbindd: remove unused variablesStefan Metzmacher2010-05-061-2/+0
| | | | | | | metze (cherry picked from commit e18ddb6036f5e0a2211e89a7c9b5514c30a653cf) (cherry picked from commit c64c867c307d32b8ec17d6e079395e0e9b604f00) (cherry picked from commit 18f8b48a1143f7b39572de63362b6c30b81709cb)
* s3:winbindd: fix problems with SIGCHLD handling (bug #7317)Stefan Metzmacher2010-05-063-17/+6
| | | | | | | | | | | | | | | | | | | | | | | | The main problem is that we call CatchChild() within the parent winbindd, which overwrites the signal handler that was registered by winbindd_setup_sig_chld_handler(). That means winbindd_sig_chld_handler() and winbind_child_died() are never triggered when a winbindd domain child dies. As a result will get "broken pipe" for all requests to that domain. To reduce the risk of similar bugs in future we call CatchChild() in winbindd_reinit_after_fork() now. We also use a full winbindd_reinit_after_fork() in the cache validation child now instead instead of just resetting the SIGCHLD handler by hand. This will also fix possible tdb problems on systems without pread/pwrite and disabled mmap as we now correctly reopen the tdb handle for the child. metze (cherry picked from commit 73577205cf81644e7fe853eaf3e6459f7f443096) (cherry picked from commit e0ece652956292cc67383535a0fa174b5015d91e) (cherry picked from commit 26bdc249310b71dc45e087347e456c9f5b0f4f9b)
* s3:winbindd: correctly retry if the netlogon pipe gets disconnected during a ↵Stefan Metzmacher2010-05-061-2/+2
| | | | | | | | | | | | | logon call This fixes hopefully the last part of bug #7295. metze (cherry picked from commit 4c6cde99c0751a073120d8bc36d40922d8027344) (cherry picked from commit 482518fcafb18bda1f084ebf1906a2ad02436b80) Signed-off-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 6d24f28f52fb0e21943a1639c426cf7f825d15e7)
* s3:winbindd_reconnect: don't only reconnect on NT_STATUS_UNSUCCESSFULStefan Metzmacher2010-05-061-14/+59
| | | | | | | | | metze (cherry picked from commit 6bd5a2a3739938f95fce23ab2da652c9b5a48111) (cherry picked from commit 169628fcb656ba5987a99bd50c7f588b731eae51) Signed-off-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 30c048c124ece9648e0ec00991780b57af90201e)
* s3:winbindd_cm: invalidate connection if cm_connect_netlogon() failsStefan Metzmacher2010-05-061-2/+2
| | | | | | | | | metze (cherry picked from commit 94a4bcd2f0c0464e192556679c6636639cb307ea) (cherry picked from commit c046ae8428fb62ff2749689e7c738f1a2e8f8251) Signed-off-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 61a353807ccefef98fa83e5abcebfe879cdf4337)
* s3:winbindd: consistently use TALLOC_FREE(conn->foo_pipe) is we create a new ↵Stefan Metzmacher2010-05-061-0/+5
| | | | | | | | | | | connection metze (cherry picked from commit 4f391fedac7111683d13f2d79fee7c0dbc27f86e) (cherry picked from commit c462e54142c00fdd81c2847d16a75119b1cc89fc) Signed-off-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 4ef6370eaaa307ccfd74012a4b9397312ff747eb)
* s3:winbindd_cm: use rpccli_is_connected() helper functionStefan Metzmacher2010-05-061-4/+5
| | | | | | | | | metze (cherry picked from commit d980c06a994d032a833adc8d56d2f2c037f8fdaf) (cherry picked from commit aa7d54ed04585a183a88363406ed7f3244b24d85) Signed-off-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit ff9277fb804e7d99a7e80d67c70b962b6199a4e3)
* s3:winbindd_cm: use cli_state_is_connected() helper functionStefan Metzmacher2010-05-061-14/+4
| | | | | | | | | metze (cherry picked from commit 408a3eb35a0e61b5d66a3b48ebbd1a6796672d0f) (cherry picked from commit 00a93190d2cae31cd2213b810ea348c055670399) Signed-off-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 21afa222ab9502ecb33decd16fe540d6d855ff13)
* Prevent NULL dereference if group has no membersJim McDonough2010-01-041-4/+4
| | | | | Fix bug #7014 (domain mode winbind crashes retriveing empty group members). (cherry picked from commit 7ea471ba8db84b4fb2f02672e59a9f2a9932b4fa)
* s3-kerberos: only use krb5 headers where required.Günther Deschner2009-12-232-0/+4
| | | | | | | | This seems to be the only way to deal with mixed heimdal/MIT setups during merged build. Guenther (cherry picked from commit 41fb263aacc5dce50d3554598d08cb497ffd929f)
* s3:idmap_ldap: trim the " chars from the location string in idmap_ldap_db_initMichael Adam2009-12-231-0/+2
| | | | | | | | | | | | | Fix bug #6910 (idmap_ldap stumbles over idmap backend = ldap:"ldap://ldap1 ldap://ldap2"=. When idmap backend is specified as idmap backend = ldap:"ldap://server1 ldap://server2" then currently "ldap://server1 ldap://server2" was passed to ldap_initialize including the quotes, leading to an ldap error. Michael (cherry picked from commit 5d6ea139d413cb05370137e4d04c4db391a06ac1)
* s3:idmap_ldap: trim the " chars from the location string in ↵Michael Adam2009-12-231-0/+2
| | | | | | | | | | | | idmap_ldap_alloc_init When idmap alloc backend is specified as idmap alloc backend = ldap:"ldap://server1 ldap://server2" then currently "ldap://server1 ldap://server2" was passed to ldap_initialize including the quotes, leading to an ldap error. Michael (cherry picked from commit 210fc5a8cf384eea62cd51d398523d37723f72fb)
* Final part of fix for bug 6793 - winbindd crash with "INTERNAL ERROR: Signal ↵Jeremy Allison2009-10-201-0/+2
| | | | | | 6" Don't use mapped_user uninitialized. Jeremy. (cherry picked from commit 85ee2971db36455d908066eae2630925081792c9)
* s3:winbind: Fix a double-freeVolker Lendecke2009-10-201-1/+0
| | | | | Part of a fix for bug #6793. (cherry picked from commit 0fc64947526f4eea896fd83b01194e40416d15f4)
* s3:winbind: Fix bug 6793 -- segfault in winbindd_pam_authVolker Lendecke2009-10-201-7/+6
| | | | (cherry picked from commit 2e478cc8c31bc60325a8e01885222d1db29ca21c)
* s3:winbind: Only ever handle one event after a select callVolker Lendecke2009-10-201-3/+9
| | | | | | | | While handling an fd event, the situation with other fds can change. I've just seen a winbind stuck in the accept() call on the privileged pipe. I can only imagine this happen because under high load we first handled other requests and meanwhile the client on the privileged pipe went away. (cherry picked from commit 8ef4a183da8bdc9997c198678a931b111396c104)
* s3:winbindd: only notify the client when we exist, if the connection isn't ↵Stefan Metzmacher2009-10-201-5/+7
| | | | | | | | | dead already This is similar to commit 83edf3e43e86781872a07d8eb53084f59ad7384c. metze (cherry picked from commit 722ba568d79451a527976181b360de82b87b68e8)
* s3:winbindd_cm: don't invalidate the whole connection when just samr gave ↵Stefan Metzmacher2009-10-201-1/+12
| | | | | | | | ACCCESS_DENIED metze (cherry picked from commit bfd3a6f13aa935950142a24bf331feb98f987bde) (cherry picked from commit 53a426986a0ead7903ff6cf576b3d5501210e379)
* s3:winbind: Fix an uninitialized variable (cherry picked from commit ↵Volker Lendecke2009-10-201-1/+1
| | | | | | 0724649a8a7c04d015317d9dc2ae43ee87c1bd25) (cherry picked from commit d6af2a5ff4e4f723e521a3f708751b3155f870fc)
* s3-winbindd: Fix Bug #6711: trusts to windows 2008 (2008 r2) not working.Günther Deschner2009-10-203-5/+63
| | | | | | | | | | | | | Winbindd should always try to use LSA via an schannel authenticated ncacn_ip_tcp connection when talking to AD for LSA lookup calls. In Samba <-> W2k8 interdomain trust scenarios, LookupSids3 and LookupNames4 via an schannel ncacn_ip_tcp LSA connection are the *only* options to successfully resolve sids and names. Guenther (cherry picked from commit 6a8ef6c424c52be861ed2a9806f917a64ec892a6) (cherry picked from commit 3bd36630e402b6215a46f8b0ba98e9e2b18b44eb)
* s3-winbindd: add cm_connect_lsa_tcp().Günther Deschner2009-10-203-0/+63
| | | | | | Guenther (cherry picked from commit 58f2deb94024f002e3c3df47f45454edc97f47e1) (cherry picked from commit b35d5cf97fd610874583f0d03c6cda4def0cf0f5)
* s3-winbindd: add and use winbindd_lookup_names().Günther Deschner2009-10-202-20/+47
| | | | | | Guenther (cherry picked from commit 99c3fc19587431efda1ae6161453d84673b32071) (cherry picked from commit 6bcf24a2affb4798840e5cc49aeeb6c78d0265d0)
* s3-winbindd: add and use winbindd_lookup_sids().Günther Deschner2009-10-203-96/+78
| | | | | | Guenther (cherry picked from commit f0b52b8c3133e3696db361d9d0e7d1fff0fab991) (cherry picked from commit faa6a8de595ea38d3291dc7fb80d314a3b3f05cc)
* s3-rpc_client: add dcerpc_transport_t to cli_rpc_pipe_open_schannel().Günther Deschner2009-10-201-3/+4
| | | | | | Guenther (cherry picked from commit bea8e5fa6038d5abd2ec1e12f9005c4a04abb79f) (cherry picked from commit 5b44f54a18b60fe3814623f351025335a0273916)
* s3-rpc_client: add dcerpc_transport_t to cli_rpc_pipe_open_spnego_ntlmssp ↵Günther Deschner2009-10-201-1/+2
| | | | | | | | and cli_rpc_pipe_open_ntlmssp. Guenther (cherry picked from commit 032e01e7c13724d057b5744d7d79613449c2f24f) (cherry picked from commit cd8874214dba810e60faca155611dbcf2f1351f7)
* s3-winbindd: Fix Bug #6700: Use dns domain name when needing to guess server ↵Günther Deschner2009-09-091-1/+1
| | | | | | | | | | | principal. Patch from Robert LeBlanc <robert@leblancnet.us>. Thanks! Guenther (cherry picked from commit 1f6f0fc92b1bb487fb99ac1e9c96f8f09adb9fbc)
* s3:winbindd: raise the timeout for lsa_Lookup*() calls from 10 to 35 seconds.Stefan Metzmacher2009-08-132-1/+57
| | | | | | | | metze (cherry picked from commit 1e1445bc7672b17a1d689fa0f0732b05b6e04da5) Fixes bug #6627. (cherry picked from commit 536946c706b66d432d60c990f28ff0ed5861fa44)
* s3: To correctly handle upnBo Yang2009-08-132-1/+7
| | | | | | | | | | lookupname failed, cannot find domain when attempt to change password. This addresses bug #6560. Signed-off-by: Bo Yang <boyang@samba.org> (cherry picked from commit 9acc670541031414d0cb5df39d18866c4c96b37c)
* Fix bug 4699: Remove pidfile on clean shutdownVolker Lendecke2009-06-191-0/+4
| | | | | (cherry picked from commit 5a9ca3db032af5938e9709f3355a1f45b1e08d27) (cherry picked from commit 9424e91ecdcf2e5dbdd06e9d97693dd193608324)
* s3:idmap_ldap: filter out of range mappings in default idmap configMichael Adam2009-05-291-16/+55
| | | | | | | | This fixes bug #6417 Michael (cherry picked from commit e381c13b023f2b512b3f6aec133db9f323bc8132) (cherry picked from commit 4ca03e3bb96518665c296ba2cf5aa1d91916897e)
* s3:idmap: fix a comment typoMichael Adam2009-05-291-1/+1
| | | | | | Michael (cherry picked from commit 3fe9859342c28fe9da7011fb18a5fb5de8b29fa6) (cherry picked from commit df4a0fabff06ea31149aac45d6477564cf96179b)
* s3:idmap_tdb2: filter out of range mappings in default idmap configMichael Adam2009-05-291-12/+49
| | | | | | | | This fixes bug #6416 Michael (cherry picked from commit e12670a1053edf57af137026bd3fdb9fc7dfb0b2) (cherry picked from commit b369902cddd55fab74ca6e0743e15e0f8cbfc4cc)
* s3:idmap_tdb: filter out of range mappings in default idmap configMichael Adam2009-05-291-16/+57
| | | | | | | | This fixes bug #6415 Michael (cherry picked from commit 3d3f39838261ddc401053dadcc5bd8e6317a3a8e) (cherry picked from commit 34500d59b6f35de2c3d273d3523708ec22df59ce)
* s3: Allow child processes to exit gracefully if we are out of fdsMarc VanHeyningen2009-05-292-4/+6
| | | | | | | | | | | When we run out of file descriptors for some reason, every new connection forks a child that immediately panics causing smbd to coredump. This seems unnecessarily harsh; with this code change we now catch that error and merely log a message about it and exit without the core dump. Signed-off-by: Tim Prouty <tprouty@samba.org> (cherry picked from commit 1c8f9892010ce8cc754089b25313c6bc8e622165)
* s3:winbind:idmap_ldap: warn about duplicate SID->XID mappings (bug #6387)Michael Adam2009-05-261-2/+11
| | | | | | | | | | With the current infrastructure, we should not return error on duplicate mappings but just warn instead (because an error would trigger the attempt to create yet another mapping). Michael (cherry picked from commit 3111d78001f458cfcaf81123a1d1c23d5927a6c2) (cherry picked from commit 5328f600bbc6535d8880b1b0c74bcfbd9b7a162a)
* s3:winbind:idmap_ldap: warn about duplicate XID->SID mappings (bug #6387)Michael Adam2009-05-261-0/+8
| | | | | | | | | | With the current infrastructure, we should not return error on duplicate mappings but just warn instead (because an error would trigger the attempt to create yet another mapping). Michael (cherry picked from commit 35c3f4162d15f9846a645444e623178b78c52994) (cherry picked from commit 751b6b07c5ea25809b1766a01fc859d580304ae9)
* Fix a race condition in winbind leading to a panicVolker Lendecke2009-05-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | In winbind, we do multiple events in one select round. This needs fixing, but as long as we're still using it, for efficiency reasons we need to do that. What can happen is the following: We have outgoing data pending for a client, thus state->fd_event.flags == EVENT_FD_WRITE Now a new client comes in, we go through the list of clients to find an idle one. The detection for idle clients in remove_idle_client does not take the pending data into account. We close the socket that has pending outgoing data, the accept(2) one syscall later gives us the same socket. In new_connection(), we do a setup_async_read, setting up a read fde. The select from before however had found the socket (that we had already closed!!) to be writable. In rw_callback we only want to see a readable flag, and we panic in the SMB_ASSERT(flags == EVENT_FD_READ). Found using bin/smbtorture //127.0.0.1/tmp -U% -N 500 -o 2 local-wbclient Volker (cherry picked from commit bfeab3a0f621dbea50f43c98ba70b0ccd8323bff)
* s3:winbind:idmap_ldap: fix a crash bug in idmap_ldap_unixids_to_sids (#6387)Michael Adam2009-05-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This fixes a crash bug hit when multiple mappings were found by the ldap search. This crash was caused by an ldap asssertion in ldap_next_entry because was set to NULL in each iteration. The corresponding fix was applied to the idmap_ldap_sids_to_unixids() by Jerry in 2007 (b066668b74768d9ed547f16bf7b6ba6aea5df20a). This fixes the crash part of bug #6387. There is a logic part, too: The problem currently only occurs when multiple mappings are found for one given unixid. Now winbindd does not crash any more but it does not correctly handle this situation. It just returns the last mapping from the ldap search results. This needs fixing. Michael (cherry picked from commit e9010fa366746ec1ae948dbcf3493d446e23b14c) Signed-off-by: Michael Adam <obnox@samba.org> (cherry picked from commit 2b6dbddb9cc723fcbd2e4e22a9404d6b4ff805d7)
* Fix a bunch of compiler warnings about wrong format types.Jeremy Allison2009-05-265-11/+14
| | | | | | Should make Solaris 10 builds look cleaner. Jeremy. (cherry picked from commit b5947b876f3c777e075879d305b6672a6c8d8abd)
generated by cgit (git 2.34.1) at 2025-08-28 23:46:45 +0000