summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source4/auth/gensec/config.mk2
-rw-r--r--source4/auth/gensec/schannel_state.c65
2 files changed, 61 insertions, 6 deletions
diff --git a/source4/auth/gensec/config.mk b/source4/auth/gensec/config.mk
index 3c2fa51f78..3d13ce7f6d 100644
--- a/source4/auth/gensec/config.mk
+++ b/source4/auth/gensec/config.mk
@@ -78,7 +78,7 @@ $(eval $(call proto_header_template,$(gensecsrcdir)/schannel_proto.h,$(gensec_sc
################################################
# Start SUBSYSTEM SCHANNELDB
[SUBSYSTEM::SCHANNELDB]
-PRIVATE_DEPENDENCIES = LDB_WRAP SAMDB
+PRIVATE_DEPENDENCIES = LDB_WRAP
# End SUBSYSTEM SCHANNELDB
################################################
diff --git a/source4/auth/gensec/schannel_state.c b/source4/auth/gensec/schannel_state.c
index d86b1f2b9c..ca8537cac9 100644
--- a/source4/auth/gensec/schannel_state.c
+++ b/source4/auth/gensec/schannel_state.c
@@ -20,10 +20,8 @@
*/
#include "includes.h"
-#include "lib/events/events.h"
#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_errors.h"
-#include "dsdb/samdb/samdb.h"
+#include "librpc/gen_ndr/ndr_security.h"
#include "ldb_wrap.h"
#include "../lib/util/util_ldb.h"
#include "libcli/auth/libcli_auth.h"
@@ -31,6 +29,45 @@
#include "param/param.h"
#include "auth/gensec/schannel_state.h"
+static struct ldb_val *schannel_dom_sid_ldb_val(TALLOC_CTX *mem_ctx,
+ struct smb_iconv_convenience *smbiconv,
+ struct dom_sid *sid)
+{
+ enum ndr_err_code ndr_err;
+ struct ldb_val *v;
+
+ v = talloc(mem_ctx, struct ldb_val);
+ if (!v) return NULL;
+
+ ndr_err = ndr_push_struct_blob(v, mem_ctx, smbiconv, sid,
+ (ndr_push_flags_fn_t)ndr_push_dom_sid);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ talloc_free(v);
+ return NULL;
+ }
+
+ return v;
+}
+
+static struct dom_sid *schannel_ldb_val_dom_sid(TALLOC_CTX *mem_ctx,
+ const struct ldb_val *v)
+{
+ enum ndr_err_code ndr_err;
+ struct dom_sid *sid;
+
+ sid = talloc(mem_ctx, struct dom_sid);
+ if (!sid) return NULL;
+
+ ndr_err = ndr_pull_struct_blob(v, sid, NULL, sid,
+ (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ talloc_free(sid);
+ return NULL;
+ }
+ return sid;
+}
+
+
/**
connect to the schannel ldb
*/
@@ -77,6 +114,8 @@ NTSTATUS schannel_store_session_key_ldb(TALLOC_CTX *mem_ctx,
{
struct ldb_message *msg;
struct ldb_val val, seed, client_state, server_state;
+ struct smb_iconv_convenience *smbiconv;
+ struct ldb_val *sid_val;
char *f;
char *sct;
int ret;
@@ -103,6 +142,12 @@ NTSTATUS schannel_store_session_key_ldb(TALLOC_CTX *mem_ctx,
return NT_STATUS_NO_MEMORY;
}
+ smbiconv = lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm"));
+ sid_val = schannel_dom_sid_ldb_val(msg, smbiconv, creds->sid);
+ if (sid_val == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
val.data = creds->session_key;
val.length = sizeof(creds->session_key);
@@ -124,7 +169,7 @@ NTSTATUS schannel_store_session_key_ldb(TALLOC_CTX *mem_ctx,
ldb_msg_add_string(msg, "accountName", creds->account_name);
ldb_msg_add_string(msg, "computerName", creds->computer_name);
ldb_msg_add_string(msg, "flatname", creds->domain);
- samdb_msg_add_dom_sid(ldb, mem_ctx, msg, "objectSid", creds->sid);
+ ldb_msg_add_value(msg, "objectSid", sid_val, NULL);
ldb_delete(ldb, msg->dn);
@@ -265,7 +310,17 @@ NTSTATUS schannel_fetch_session_key_ldb(TALLOC_CTX *mem_ctx,
return NT_STATUS_NO_MEMORY;
}
- (*creds)->sid = samdb_result_dom_sid(*creds, res->msgs[0], "objectSid");
+ val = ldb_msg_find_ldb_val(res->msgs[0], "objectSid");
+ if (val == NULL) {
+ DEBUG(1,("schannel: missing ObjectSid for client: %s\n", computer_name));
+ talloc_free(res);
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+ (*creds)->sid = schannel_ldb_val_dom_sid(*creds, val);
+ if ((*creds)->sid == NULL) {
+ talloc_free(res);
+ return NT_STATUS_INTERNAL_ERROR;
+ }
talloc_free(res);
return NT_STATUS_OK;