diff options
author | Andrew Bartlett <abartlet@samba.org> | 2003-03-23 13:03:25 +0000 |
---|---|---|
committer | Andrew Bartlett <abartlet@samba.org> | 2003-03-23 13:03:25 +0000 |
commit | 1f5e93e2e7dccb16da3b733fffd401867b2ea3b9 (patch) | |
tree | 9e5d52a4f60ee97e1d15613290a22a378e05aa1b /source3/nsswitch/winbindd.c | |
parent | b6520a4d48606589d3e2eedf954415f4c86dd04f (diff) | |
download | samba-1f5e93e2e7dccb16da3b733fffd401867b2ea3b9.tar.gz samba-1f5e93e2e7dccb16da3b733fffd401867b2ea3b9.tar.bz2 samba-1f5e93e2e7dccb16da3b733fffd401867b2ea3b9.zip |
NTLM Authentication:
- Add a 'privileged' mode to Winbindd. This is achieved by means of a directory
under lockdir, that the admin can change the group access for.
- This mode is now required to access with 'CRAP' authentication feature.
- This *will* break the current SQUID helper, so I've fixed up our ntlm_auth
replacement:
- Update our NTLMSSP code to cope with 'datagram' mode, where we don't get a
challenge.
- Use this to make our ntlm_auth utility suitable for use in current Squid 2.5
servers.
- Tested - works for Win2k clients, but not Win9X at present. NTLMSSP updates
are needed.
- Now uses fgets(), not x_fgets() to cope with Squid environment (I think
somthing to do with non-blocking stdin).
- Add much more robust connection code to wb_common.c - it will not connect to
a server of a different protocol version, and it will automatically try and
reconnect to the 'privileged' pipe if possible.
- This could help with 'privileged' idmap operations etc in future.
- Add a generic HEX encode routine to util_str.c,
- fix a small line of dodgy C in StrnCpy_fn()
- Correctly pull our 'session key' out of the info3 from th the DC. This is
used in both the auth code, and in for export over the winbind pipe to
ntlm_auth.
- Given the user's challenge/response and access to the privileged pipe,
allow external access to the 'session key'. To be used for MSCHAPv2
integration.
Andrew Bartlett
(This used to be commit dcdc75ebd89f504a0f6e3a3bc5b43298858d276b)
Diffstat (limited to 'source3/nsswitch/winbindd.c')
-rw-r--r-- | source3/nsswitch/winbindd.c | 30 |
1 files changed, 25 insertions, 5 deletions
diff --git a/source3/nsswitch/winbindd.c b/source3/nsswitch/winbindd.c index 921f7d2864..4033952a6e 100644 --- a/source3/nsswitch/winbindd.c +++ b/source3/nsswitch/winbindd.c @@ -259,6 +259,7 @@ static struct dispatch_table dispatch_table[] = { { WINBINDD_INTERFACE_VERSION, winbindd_interface_version, "INTERFACE_VERSION" }, { WINBINDD_DOMAIN_NAME, winbindd_domain_name, "DOMAIN_NAME" }, { WINBINDD_NETBIOS_NAME, winbindd_netbios_name, "NETBIOS_NAME" }, + { WINBINDD_PRIV_PIPE_DIR, winbindd_priv_pipe_dir, "WINBINDD_PRIV_PIPE_DIR" }, /* WINS functions */ @@ -305,7 +306,7 @@ static void process_request(struct winbindd_cli_state *state) /* Process a new connection by adding it to the client connection list */ -static void new_connection(int listen_sock) +static void new_connection(int listen_sock, BOOL privilaged) { struct sockaddr_un sunaddr; struct winbindd_cli_state *state; @@ -336,6 +337,8 @@ static void new_connection(int listen_sock) state->last_access = time(NULL); + state->privilaged = privilaged; + /* Add to connection list */ winbindd_add_client(state); @@ -547,7 +550,7 @@ static void process_loop(void) while (1) { struct winbindd_cli_state *state; fd_set r_fds, w_fds; - int maxfd, listen_sock, selret; + int maxfd, listen_sock, listen_priv_sock, selret; struct timeval timeout; /* Handle messages */ @@ -566,17 +569,19 @@ static void process_loop(void) /* Initialise fd lists for select() */ listen_sock = open_winbindd_socket(); + listen_priv_sock = open_winbindd_priv_socket(); - if (listen_sock == -1) { + if (listen_sock == -1 || listen_priv_sock == -1) { perror("open_winbind_socket"); exit(1); } - maxfd = listen_sock; + maxfd = MAX(listen_sock, listen_priv_sock); FD_ZERO(&r_fds); FD_ZERO(&w_fds); FD_SET(listen_sock, &r_fds); + FD_SET(listen_priv_sock, &r_fds); timeout.tv_sec = WINBINDD_ESTABLISH_LOOP; timeout.tv_usec = 0; @@ -653,7 +658,22 @@ static void process_loop(void) break; } } - new_connection(listen_sock); + /* new, non-privilaged connection */ + new_connection(listen_sock, False); + } + + if (FD_ISSET(listen_priv_sock, &r_fds)) { + while (winbindd_num_clients() > WINBINDD_MAX_SIMULTANEOUS_CLIENTS - 1) { + DEBUG(5,("winbindd: Exceeding %d client connections, removing idle connection.\n", + WINBINDD_MAX_SIMULTANEOUS_CLIENTS)); + if (!remove_idle_client()) { + DEBUG(0,("winbindd: Exceeding %d client connections, no idle connection found\n", + WINBINDD_MAX_SIMULTANEOUS_CLIENTS)); + break; + } + } + /* new, privilaged connection */ + new_connection(listen_priv_sock, True); } /* Process activity on client connections */ |