The branch, master has been updated via 3b73cdb41201dd545e019e8e8313f6b8c51c7226 (commit) via 431fc718c13d259748ac20019997241981639c95 (commit) via 593ab6ac00c217f6d661b4babface40a0b0dd4ce (commit) via 6ef1442360a35284e4aaaa98eea701fc2eab43c5 (commit) via 66dc53ee017d74a6f610bbe04337f064901fe2a1 (commit) from 62ab39dde37f5570b336b9db5b4e3c2e4640e877 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 3b73cdb41201dd545e019e8e8313f6b8c51c7226 Author: Stefan Metzmacher <me...@samba.org> Date: Wed Jan 28 10:10:12 2009 +0100 s3:nmbd: implement a MAILSLOT => CLDAP proxy for NETLOGON_SAMLOGON requests This will be used as part a the franky setup, where nmbd will forward the MAILSLOT requests to the local samba4 CLDAP server. "nmbd_proxy_logon:cldap_server = 127.0.0.1" would configure and activate this feature. metze commit 431fc718c13d259748ac20019997241981639c95 Author: Stefan Metzmacher <me...@samba.org> Date: Fri Mar 20 16:18:47 2009 +0100 selftest/Samba3: always use the same timeout for all servers metze commit 593ab6ac00c217f6d661b4babface40a0b0dd4ce Author: Stefan Metzmacher <me...@samba.org> Date: Fri Mar 20 16:11:14 2009 +0100 s4:selftest: rename SMBD_VALGRIND => SAMBA_VALGRIND metze commit 6ef1442360a35284e4aaaa98eea701fc2eab43c5 Author: Stefan Metzmacher <me...@samba.org> Date: Fri Mar 20 15:13:39 2009 +0100 s4:smbd: the name of the binary is "samba" now metze commit 66dc53ee017d74a6f610bbe04337f064901fe2a1 Author: Stefan Metzmacher <me...@samba.org> Date: Fri Mar 20 16:27:17 2009 +0100 socket_wrapper: fix connect() for dgram sockets, if the destination isn't there yet metze ----------------------------------------------------------------------- Summary of changes: lib/socket_wrapper/socket_wrapper.c | 10 +- selftest/target/Samba3.pm | 32 +++--- selftest/target/Samba4.pm | 8 +- source3/include/proto.h | 2 + source3/nmbd/nmbd.c | 6 + source3/nmbd/nmbd_processlogon.c | 238 +++++++++++++++++++++++++++++++++++ source3/samba4.mk | 12 +- source4/selftest/config.mk | 12 +- source4/smbd/server.c | 2 +- 9 files changed, 285 insertions(+), 37 deletions(-) Changeset truncated at 500 lines: diff --git a/lib/socket_wrapper/socket_wrapper.c b/lib/socket_wrapper/socket_wrapper.c index 44082e7..1d35c8d 100644 --- a/lib/socket_wrapper/socket_wrapper.c +++ b/lib/socket_wrapper/socket_wrapper.c @@ -1686,10 +1686,14 @@ _PUBLIC_ int swrap_connect(int s, const struct sockaddr *serv_addr, socklen_t ad ret = sockaddr_convert_to_un(si, (const struct sockaddr *)serv_addr, addrlen, &un_addr, 0, NULL); if (ret == -1) return -1; - swrap_dump_packet(si, serv_addr, SWRAP_CONNECT_SEND, NULL, 0); + if (si->type == SOCK_DGRAM) { + ret = 0; + } else { + swrap_dump_packet(si, serv_addr, SWRAP_CONNECT_SEND, NULL, 0); - ret = real_connect(s, (struct sockaddr *)&un_addr, - sizeof(struct sockaddr_un)); + ret = real_connect(s, (struct sockaddr *)&un_addr, + sizeof(struct sockaddr_un)); + } /* to give better errors */ if (ret == -1 && errno == ENOENT) { diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index 2b96226..78aafa7 100644 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -126,9 +126,8 @@ sub setup_dc($$) $dc_options); $self->check_or_start($vars, - ($ENV{NMBD_MAXTIME} or 2700), - ($ENV{WINBINDD_MAXTIME} or 2700), - ($ENV{SMBD_MAXTIME} or 2700)); + ($ENV{SMBD_MAXTIME} or 2700), + "yes", "yes", "yes"); $self->wait_for_start($vars); @@ -163,9 +162,8 @@ sub setup_member($$$) system($cmd) == 0 or die("Join failed\n$cmd"); $self->check_or_start($ret, - ($ENV{NMBD_MAXTIME} or 2700), - ($ENV{WINBINDD_MAXTIME} or 2700), - ($ENV{SMBD_MAXTIME} or 2700)); + ($ENV{SMBD_MAXTIME} or 2700), + "yes", "yes", "yes"); $self->wait_for_start($ret); @@ -212,8 +210,8 @@ sub read_pid($$) return $pid; } -sub check_or_start($$$$) { - my ($self, $env_vars, $nmbd_maxtime, $winbindd_maxtime, $smbd_maxtime) = @_; +sub check_or_start($$$$$) { + my ($self, $env_vars, $maxtime, $nmbd, $winbindd, $smbd) = @_; unlink($env_vars->{NMBD_TEST_LOG}); print "STARTING NMBD..."; @@ -229,13 +227,13 @@ sub check_or_start($$$$) { $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD}; $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP}; - if ($nmbd_maxtime eq "skip") { + if ($nmbd ne "yes") { $SIG{USR1} = $SIG{ALRM} = $SIG{INT} = $SIG{QUIT} = $SIG{TERM} = sub { my $signame = shift; print("Skip nmbd received signal $signame"); exit 0; }; - sleep(999999); + sleep($maxtime); exit 0; } @@ -246,7 +244,7 @@ sub check_or_start($$$$) { $ENV{MAKE_TEST_BINARY} = $self->binpath("nmbd"); - my @preargs = ($self->binpath("timelimit"), $nmbd_maxtime); + my @preargs = ($self->binpath("timelimit"), $maxtime); if(defined($ENV{NMBD_VALGRIND})) { @preargs = split(/ /, $ENV{NMBD_VALGRIND}); } @@ -270,13 +268,13 @@ sub check_or_start($$$$) { $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD}; $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP}; - if ($winbindd_maxtime eq "skip") { + if ($winbindd ne "yes") { $SIG{USR1} = $SIG{ALRM} = $SIG{INT} = $SIG{QUIT} = $SIG{TERM} = sub { my $signame = shift; print("Skip winbindd received signal $signame"); exit 0; }; - sleep(999999); + sleep($maxtime); exit 0; } @@ -287,7 +285,7 @@ sub check_or_start($$$$) { $ENV{MAKE_TEST_BINARY} = $self->binpath("winbindd"); - my @preargs = ($self->binpath("timelimit"), $winbindd_maxtime); + my @preargs = ($self->binpath("timelimit"), $maxtime); if(defined($ENV{WINBINDD_VALGRIND})) { @preargs = split(/ /, $ENV{WINBINDD_VALGRIND}); } @@ -311,13 +309,13 @@ sub check_or_start($$$$) { $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD}; $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP}; - if ($smbd_maxtime eq "skip") { + if ($smbd ne "yes") { $SIG{USR1} = $SIG{ALRM} = $SIG{INT} = $SIG{QUIT} = $SIG{TERM} = sub { my $signame = shift; print("Skip smbd received signal $signame"); exit 0; }; - sleep(999999); + sleep($maxtime); exit 0; } @@ -326,7 +324,7 @@ sub check_or_start($$$$) { if (defined($ENV{SMBD_OPTIONS})) { @optargs = split(/ /, $ENV{SMBD_OPTIONS}); } - my @preargs = ($self->binpath("timelimit"), $smbd_maxtime); + my @preargs = ($self->binpath("timelimit"), $maxtime); if(defined($ENV{SMBD_VALGRIND})) { @preargs = split(/ /,$ENV{SMBD_VALGRIND}); } diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm index 71dddf6..1058ac6 100644 --- a/selftest/target/Samba4.pm +++ b/selftest/target/Samba4.pm @@ -103,8 +103,8 @@ sub check_or_start($$$) SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE}); my $valgrind = ""; - if (defined($ENV{SMBD_VALGRIND})) { - $valgrind = $ENV{SMBD_VALGRIND}; + if (defined($ENV{SAMBA_VALGRIND})) { + $valgrind = $ENV{SAMBA_VALGRIND}; } $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG}; @@ -122,8 +122,8 @@ sub check_or_start($$$) if (defined($max_time)) { $optarg = "--maximum-runtime=$max_time "; } - if (defined($ENV{SMBD_OPTIONS})) { - $optarg.= " $ENV{SMBD_OPTIONS}"; + if (defined($ENV{SAMBA_OPTIONS})) { + $optarg.= " $ENV{SAMBA_OPTIONS}"; } my $samba = $self->bindir_path("samba"); my $ret = system("$valgrind $samba $optarg $env_vars->{CONFIGURATION} -M single -i --leak-report-full"); diff --git a/source3/include/proto.h b/source3/include/proto.h index dc26f6d..c84b1cb 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -3779,6 +3779,8 @@ bool send_mailslot(bool unique, const char *mailslot,char *buf, size_t len, /* The following definitions come from nmbd/nmbd_processlogon.c */ +bool initialize_nmbd_proxy_logon(void); + void process_logon_packet(struct packet_struct *p, char *buf,int len, const char *mailslot); diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c index 3279466..daf4c29 100644 --- a/source3/nmbd/nmbd.c +++ b/source3/nmbd/nmbd.c @@ -988,6 +988,12 @@ static bool open_sockets(bool isdaemon, int port) exit(1); } + if (!initialize_nmbd_proxy_logon()) { + DEBUG(0,("ERROR: Failed setup nmbd_proxy_logon.\n")); + kill_async_dns_child(); + exit(1); + } + TALLOC_FREE(frame); process(); diff --git a/source3/nmbd/nmbd_processlogon.c b/source3/nmbd/nmbd_processlogon.c index 59a2ca4..8173337 100644 --- a/source3/nmbd/nmbd_processlogon.c +++ b/source3/nmbd/nmbd_processlogon.c @@ -24,6 +24,9 @@ */ #include "includes.h" +#include "../libcli/netlogon.h" +#include "../libcli/cldap/cldap.h" +#include "../lib/tsocket/tsocket.h" struct sam_database_info { uint32 index; @@ -65,6 +68,235 @@ static void delayed_init_logon_handler(struct event_context *event_ctx, TALLOC_FREE(te); } +struct nmbd_proxy_logon_context { + struct cldap_socket *cldap_sock; +}; + +static struct nmbd_proxy_logon_context *global_nmbd_proxy_logon; + +bool initialize_nmbd_proxy_logon(void) +{ + const char *cldap_server = lp_parm_const_string(-1, "nmbd_proxy_logon", + "cldap_server", NULL); + struct nmbd_proxy_logon_context *ctx; + NTSTATUS status; + struct in_addr addr; + char addrstr[INET_ADDRSTRLEN]; + const char *server_str; + int ret; + struct tsocket_address *server_addr; + + if (!cldap_server) { + return true; + } + + addr = interpret_addr2(cldap_server); + server_str = inet_ntop(AF_INET, &addr, + addrstr, sizeof(addrstr)); + if (!server_str || strcmp("0.0.0.0", server_str) == 0) { + DEBUG(0,("Failed to resolve[%s] for nmbd_proxy_logon\n", + cldap_server)); + return false; + } + + ctx = talloc_zero(nmbd_event_context(), + struct nmbd_proxy_logon_context); + if (!ctx) { + return false; + } + + ret = tsocket_address_inet_from_strings(ctx, "ipv4", + server_str, LDAP_PORT, + &server_addr); + if (ret != 0) { + TALLOC_FREE(ctx); + status = map_nt_error_from_unix(errno); + DEBUG(0,("Failed to create cldap tsocket_address for %s - %s\n", + server_str, nt_errstr(status))); + return false; + } + + /* we create a connected udp socket */ + status = cldap_socket_init(ctx, nmbd_event_context(), NULL, + server_addr, &ctx->cldap_sock); + TALLOC_FREE(server_addr); + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(ctx); + DEBUG(0,("failed to create cldap socket for %s: %s\n", + server_str, nt_errstr(status))); + return false; + } + + global_nmbd_proxy_logon = ctx; + return true; +} + +struct nmbd_proxy_logon_state { + struct in_addr local_ip; + struct packet_struct *p; + const char *remote_name; + uint8_t remote_name_type; + const char *remote_mailslot; + struct nbt_netlogon_packet req; + struct nbt_netlogon_response resp; + struct cldap_netlogon io; +}; + +static int nmbd_proxy_logon_state_destructor(struct nmbd_proxy_logon_state *s) +{ + s->p->locked = false; + free_packet(s->p); + return 0; +} + +static void nmbd_proxy_logon_done(struct tevent_req *subreq); + +static void nmbd_proxy_logon(struct nmbd_proxy_logon_context *ctx, + struct in_addr local_ip, + struct packet_struct *p, + uint8_t *buf, + uint32_t len) +{ + struct nmbd_proxy_logon_state *state; + enum ndr_err_code ndr_err; + DATA_BLOB blob = data_blob_const(buf, len); + const char *computer_name = NULL; + const char *mailslot_name = NULL; + const char *user_name = NULL; + const char *domain_sid = NULL; + uint32_t acct_control = 0; + uint32_t nt_version = 0; + struct tevent_req *subreq; + fstring source_name; + struct dgram_packet *dgram = &p->packet.dgram; + + state = TALLOC_ZERO_P(ctx, struct nmbd_proxy_logon_state); + if (!state) { + DEBUG(0,("failed to allocate nmbd_proxy_logon_state\n")); + return; + } + + pull_ascii_nstring(source_name, sizeof(source_name), dgram->source_name.name); + state->remote_name = talloc_strdup(state, source_name); + state->remote_name_type = dgram->source_name.name_type, + state->local_ip = local_ip; + state->p = p; + + ndr_err = ndr_pull_struct_blob( + &blob, state, NULL, &state->req, + (ndr_pull_flags_fn_t)ndr_pull_nbt_netlogon_packet); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + NTSTATUS status = ndr_map_error2ntstatus(ndr_err); + DEBUG(0,("failed parse nbt_letlogon_packet: %s\n", + nt_errstr(status))); + TALLOC_FREE(state); + return; + } + + if (DEBUGLEVEL >= 10) { + DEBUG(10, ("nmbd_proxy_logon:\n")); + NDR_PRINT_DEBUG(nbt_netlogon_packet, &state->req); + } + + switch (state->req.command) { + case LOGON_SAM_LOGON_REQUEST: + computer_name = state->req.req.logon.computer_name; + user_name = state->req.req.logon.user_name; + mailslot_name = state->req.req.logon.mailslot_name; + acct_control = state->req.req.logon.acct_control; + if (state->req.req.logon.sid_size > 0) { + domain_sid = dom_sid_string(state, + &state->req.req.logon.sid); + if (!domain_sid) { + DEBUG(0,("failed to get a string for sid\n")); + TALLOC_FREE(state); + return; + } + } + nt_version = state->req.req.logon.nt_version; + break; + + default: + /* this can't happen as the caller already checks the command */ + break; + } + + state->remote_mailslot = mailslot_name; + + if (user_name && strlen(user_name) == 0) { + user_name = NULL; + } + + if (computer_name && strlen(computer_name) == 0) { + computer_name = NULL; + } + + /* + * as the socket is connected, + * we don't need to specify the destination + */ + state->io.in.dest_address = NULL; + state->io.in.dest_port = 0; + state->io.in.realm = NULL; + state->io.in.host = computer_name; + state->io.in.user = user_name; + state->io.in.domain_guid = NULL; + state->io.in.domain_sid = domain_sid; + state->io.in.acct_control = acct_control; + state->io.in.version = nt_version; + state->io.in.map_response = false; + + subreq = cldap_netlogon_send(state, + ctx->cldap_sock, + &state->io); + if (!subreq) { + DEBUG(0,("failed to send cldap netlogon call\n")); + TALLOC_FREE(state); + return; + } + tevent_req_set_callback(subreq, nmbd_proxy_logon_done, state); + + /* we reply async */ + state->p->locked = true; + talloc_set_destructor(state, nmbd_proxy_logon_state_destructor); +} + +static void nmbd_proxy_logon_done(struct tevent_req *subreq) +{ + struct nmbd_proxy_logon_state *state = + tevent_req_callback_data(subreq, + struct nmbd_proxy_logon_state); + NTSTATUS status; + DATA_BLOB response; + + status = cldap_netlogon_recv(subreq, NULL, state, &state->io); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("failed to recv cldap netlogon call: %s\n", + nt_errstr(status))); + TALLOC_FREE(state); + return; + } + + status = push_netlogon_samlogon_response(&response, state, NULL, + &state->io.out.netlogon); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("failed to push netlogon_samlogon_response: %s\n", + nt_errstr(status))); + TALLOC_FREE(state); + return; + } + + send_mailslot(true, state->remote_mailslot, + (char *)response.data, response.length, + global_myname(), 0x0, + state->remote_name, + state->remote_name_type, + state->p->ip, + state->local_ip, + state->p->port); + TALLOC_FREE(state); +} + /**************************************************************************** Process a domain logon packet **************************************************************************/ @@ -318,6 +550,12 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", char *q = buf + 2; fstring asccomp; + if (global_nmbd_proxy_logon) { + nmbd_proxy_logon(global_nmbd_proxy_logon, + ip, p, (uint8_t *)buf, len); + return; + } + q += 2; if (PTR_DIFF(q, buf) >= len) { diff --git a/source3/samba4.mk b/source3/samba4.mk index 7e7690a..3f661bd 100644 --- a/source3/samba4.mk +++ b/source3/samba4.mk @@ -225,32 +225,32 @@ test4-%:: valgrindtest4:: valgrindtest-all valgrindtest4-quick:: all - SMBD_VALGRIND="xterm -n server -e $(selftestdir)/valgrind_run $(LD_LIBPATH_OVERRIDE)" \ + SAMBA_VALGRIND="xterm -n server -e $(selftestdir)/valgrind_run $(LD_LIBPATH_OVERRIDE)" \ VALGRIND="valgrind -q --num-callers=30 --log-file=${selftest_prefix}/valgrind.log" \ $(SELFTEST4) $(SELFTEST4_QUICK_OPTS) --immediate --socket-wrapper $(TESTS) valgrindtest4-all:: everything - SMBD_VALGRIND="xterm -n server -e $(selftestdir)/valgrind_run $(LD_LIBPATH_OVERRIDE)" \ + SAMBA_VALGRIND="xterm -n server -e $(selftestdir)/valgrind_run $(LD_LIBPATH_OVERRIDE)" \ VALGRIND="valgrind -q --num-callers=30 --log-file=${selftest_prefix}/valgrind.log" \ $(SELFTEST4) $(SELFTEST4_NOSLOW_OPTS) --immediate --socket-wrapper $(TESTS) valgrindtest4-env:: everything - SMBD_VALGRIND="xterm -n server -e $(selftestdir)/valgrind_run $(LD_LIBPATH_OVERRIDE)" \ + SAMBA_VALGRIND="xterm -n server -e $(selftestdir)/valgrind_run $(LD_LIBPATH_OVERRIDE)" \ VALGRIND="valgrind -q --num-callers=30 --log-file=${selftest_prefix}/valgrind.log" \ $(SELFTEST4) $(SELFTEST4_NOSLOW_OPTS) --socket-wrapper --testenv gdbtest4:: gdbtest4-all gdbtest4-quick:: all - SMBD_VALGRIND="xterm -n server -e $(selftestdir)/gdb_run $(LD_LIBPATH_OVERRIDE)" \ + SAMBA_VALGRIND="xterm -n server -e $(selftestdir)/gdb_run $(LD_LIBPATH_OVERRIDE)" \ $(SELFTEST4) $(SELFTEST4_QUICK_OPTS) --immediate --socket-wrapper $(TESTS) gdbtest4-all:: everything - SMBD_VALGRIND="xterm -n server -e $(selftestdir)/gdb_run $(LD_LIBPATH_OVERRIDE)" \ + SAMBA_VALGRIND="xterm -n server -e $(selftestdir)/gdb_run $(LD_LIBPATH_OVERRIDE)" \ $(SELFTEST4) $(SELFTEST4_NOSLOW_OPTS) --immediate --socket-wrapper $(TESTS) gdbtest4-env:: everything - SMBD_VALGRIND="xterm -n server -e $(selftestdir)/gdb_run $(LD_LIBPATH_OVERRIDE)" \ + SAMBA_VALGRIND="xterm -n server -e $(selftestdir)/gdb_run $(LD_LIBPATH_OVERRIDE)" \ $(SELFTEST4) $(SELFTEST4_NOSLOW_OPTS) --socket-wrapper --testenv plugins: $(PLUGINS) diff --git a/source4/selftest/config.mk b/source4/selftest/config.mk index 324532c..1838a0b 100644 -- Samba Shared Repository