summaryrefslogtreecommitdiff
path: root/source3/winbindd/winbindd_cm.c
AgeCommit message (Collapse)AuthorFilesLines
2009-08-23s3:winbind: For internal domains it is pointless to connect to a DCVolker Lendecke1-0/+6
2009-07-28Added prefer_ipv4 bool parameter to resolve_name().Jeremy Allison1-2/+2
W2K3 DC's can have IPv6 addresses but won't serve krb5/ldap or cldap on those addresses. Make sure when we're asking for DC's we prefer IPv4. If you have an IPv6-only network this prioritizing code will be a no-op. And if you have a mixed network then you need to prioritize IPv4 due to W2K3 DC's. Jeremy.
2009-07-27Fix a typoVolker Lendecke1-1/+1
2009-05-07Fix some type-punned warningsVolker Lendecke1-2/+5
2009-04-21s3-secdesc: use SEC_FLAG_MAXIMUM_ALLOWED instead of SEC_RIGHTS_MAXIMUM_ALLOWED.Günther Deschner1-9/+9
Guenther
2009-04-20Fix to use modified cli_rpc_pipe_open_schannel_with_key APIAndrew Bartlett1-2/+2
2009-04-20Remove use of talloc_reference in cli_rpc_pipe_open_schannel_with_key()Andrew Bartlett1-1/+1
2009-04-14s3: Fix ntlm_auth and winbindd to use new common libcli/auth APIsAndrew Bartlett1-9/+9
2009-04-14Rework Samba3 to use new libcli/auth code (partial)Andrew Bartlett1-0/+1
This commit is mostly to cope with the removal of SamOemHash (replaced by arcfour_crypt()) and other collisions (such as changed function arguments compared to Samba3). We still provide creds_hash3 until Samba3 uses the credentials code in netlogon server Andrew Bartlett
2009-03-18s3: remove POLICY_HND.Günther Deschner1-3/+3
Guenther
2009-03-17Fix a valgrind errorVolker Lendecke1-1/+1
Found in "make test" -- if we can't connect at all, "cli" is uninitialized
2009-03-13Remove pwd_cache.c, it was doing nothing. Make user_name, domain, andJeremy Allison1-14/+25
password talloc'ed strings within the cli_struct. Jeremy.
2009-03-06s3:winbindd_cm: remove useless cli_setup_signing_state(*cli, Undefined) callStefan Metzmacher1-2/+0
cli_setup_signing_state() with Undefined is a noop. metze
2009-01-30Make cli_tcon_andx asyncVolker Lendecke1-7/+2
2009-01-14Fix bug in get_dc_name_via_netlogon(), null pointer refrence.Bo Yang1-1/+1
2009-01-13From boyang - ensure we never "return" from a forked child, always _exit().Jeremy Allison1-3/+3
Jeremy.
2009-01-06Make winbindd_cm.c use winbindd_reinit_after_fork().Jeremy Allison1-14/+10
Jeremy.
2009-01-05s3:events: change event_add_timed() prototype to match samba4Stefan Metzmacher1-4/+2
metze
2009-01-05s3:winbindd: regain tickets for all ccache entries, when we go onlineStefan Metzmacher1-7/+1
set_event_dispatch_time() is stupid by design and only handles the first event with a given name. metze
2009-01-05s3:winbindd: recreate the per domain check_online_event without relying on ↵Stefan Metzmacher1-19/+20
global state set_event_dispatch_time() is stupid by design and just picks the first event with the given name. metze
2009-01-05Fix broken krb5 refresh chainBo Yang1-0/+2
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2009-01-05clean event context after child is forked.Bo Yang1-1/+2
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2008-12-19Make cli_negprot return NTSTATUS instead of boolVolker Lendecke1-3/+4
2008-12-03s3: Change sockaddr util function names for consistencyTim Prouty1-1/+1
Also eliminates name conflicts with OneFS system libraries
2008-11-03s3: fix a few "shadows a global declaration" warningsTim Prouty1-4/+4
2008-11-01Rename dos_errstr() to win_errstr() for consistency with Samba 4.Jelmer Vernooij1-1/+1
2008-10-23s3: fix simple "incompatible pointer type" build warningTim Prouty1-1/+1
2008-10-23Use sockaddr_storage only where we rely on the size, use sockaddrJelmer Vernooij1-1/+1
otherwise (to clarify we can also pass in structs smaller than sockaddr_storage, such as sockaddr_in).
2008-09-23s3: fix NETLOGON_NT_VERSION version flags.Günther Deschner1-1/+1
Guenther
2008-09-04Cleanup of DC enumeration in get_dcs()Steven Danneman1-24/+74
This is a fix for a few small inefficiencies/bugs in the get_dcs() path. * because the third add_one_dc_unique() loop was outside the ADS check all DCs returned from the non-sitename lookup were being tacked onto the dc_name_ip list twice. * add_one_dc_unique() now checks if the given IP address already exists before adding it to the list, making the returned list actually unique * added more thorough doxygen comment headers (This used to be commit cb2d488e1dbd90953c496c5e25d648977884f7e3)
2008-08-23Fix some nonempty blank linesVolker Lendecke1-26/+26
(This used to be commit 541e088656773d2b3b56a5a8bdc8dea6c9edec86)
2008-08-22Don't re-initialize a token when we already have one. This fixes the build ↵Jeremy Allison1-0/+3
farm failures when winbindd connects as guest. This one took a *lot* of tracking down :-). Jeremy. (This used to be commit dca827791276906436452c650062164eb819dfe0)
2008-08-22winbindd: Fix crash in cm_connect_sam()Gerald (Jerry) Carter1-2/+7
Fix segv when talking to parent DC (joined to child domain). The root cause was (a) storing the parent domain in the cli_state struct caused the NTLMSSP pipe bind to fail which made us fallover to the schannel code path (b) the dcinfo pointer in cm_get_schannel_dcinfo() was returning NULL even though the function indicated success. (This used to be commit 5ce4a2ae6697970ea37d0078a506615b4b7a9a9c)
2008-08-20Here is a re-working of the winbinddJeremy Allison1-8/+31
reconnect code to cope with rebooting a DC. This replaces the code I asked Volker to revert. The logic is pretty simple. It adds a new parameter, "winbind reconnect delay", set to 30 seconds by default, which determines how long to wait between connection attempts. To avoid overwhelming the box with DC-probe forked children, the code now keeps track of the DC probe child per winbindd_domain struct and only starts a new one if the existing one has died. I also added a little logic to make sure the dc probe child always sends a message whatever the reason for exit so we will always reschedule another connect attempt. Also added documentation. Jeremy. (This used to be commit 8027197635b988b3dcf9d3d00126a024e768fa62)
2008-08-14Revert "Add winbind:online check timeout parameter"Volker Lendecke1-16/+0
This reverts commit 9920473cc165e75ee9aa5cbb9e568eb5fb67e9e6. (This used to be commit 34a32db9060e7b60455774f923f61b7367ee3fcf)
2008-08-13Add winbind:online check timeout parameterVolker Lendecke1-0/+16
This is a band-aid for the rather convoluted offline/online mess in winbind right now. Winbind re-uses the offline functionality that is targeted at domain client installations on laptops to not overload disfunctional DCs. It uses the winbind cache timeout as the retry timeout after a DC reboot. I am using a parametric options because when this mess is cleaned up, that parameter needs to go away again. I'd recommend to use something like winbind:online check timeout = 30 in typical LAN environments. This means a reconnect is attempted every 30 seconds. Volker (This used to be commit 9920473cc165e75ee9aa5cbb9e568eb5fb67e9e6)
2008-08-06fixed a fd leak when trying to regain contact to a domain controllerAndrew Tridgell1-0/+1
in winbind When a w2k3 DC is rebooted the 139/445 ports come up before the udp/389 cldap port. During this brief period, winbind manages to connect to 139/445 but not to udp 389. It then enters a tight loop where it leaks one fd each time. In a couple of seconds it runs out of file descriptors, and leaves winbind crippled after the DC does finally come up (This used to be commit 57187cafbcc053e75bb54750494df9feabe3a738)
2008-07-20Refactoring: Change calling conventions for cli_rpc_pipe_open_schannel_with_keyVolker Lendecke1-16/+14
Pass in ndr_syntax_id instead of pipe_idx, return NTSTATUS (This used to be commit 78e9c937ff2d2e1b70cfed4121e17feb6efafda1)
2008-07-20Refactoring: Change calling conventions for cli_rpc_pipe_open_ntlmsspVolker Lendecke1-11/+14
Pass in ndr_syntax_id instead of pipe_idx, return NTSTATUS (This used to be commit a13f0599551609394904b99e4014d580ec65c506)
2008-07-20Refactoring: Change calling conventions for cli_rpc_pipe_open_noauthVolker Lendecke1-15/+18
Pass in ndr_syntax_id instead of pipe_idx, return NTSTATUS (This used to be commit 9abc9dc4dc13bd3e42f98eff64eacf24b51f5779)
2008-06-27libads: Add API call to connect to a global catalog server.Gerald W. Carter1-2/+4
Extends ads_connect() to a new call ads_connect_gc() which connects on port 3268 rather than port 389. Also makes ads_try_connect() static and only used internally to ldap.c (This used to be commit f4c37dbe2c986fb7bfe510cdff3b4a9fbc06d079)
2008-06-17Revert "Fix a memleak caused by a crappy get_sorted_dc_list() API"Volker Lendecke1-14/+1
This reverts commit 2ea03a1e95a30e321e390bef9408a1215711de07. (This used to be commit 80c2e8295a00c3d88372b55b81d03b455feb69b2)
2008-06-08Bugfix noticed by Herb. On using the again: tag as aJeremy Allison1-0/+15
goto target we were not reinitializing the array counts. From Herb: This is in the file nsswitch/winbindd_cm.c (samba-3.0.30) line 1236 We have a label again: where we keep trying to find the name of the DC from the list of IPs returned by get_dcs. If we fail to figure out the name we do a goto again at the end of the function. The problem is we don't reset the num_dcs, num_addrs, etc and free the memory in the various arrays. This seems wrong to me. I have a winbindd core where I have 9 IPs returned for the DCs but at the time of the crash num_dcs is 87 and if I look through the array dcs it keeps repeating entries from the same group of 9 Jerry, Volker and Guenther please check. Jeremy. (This used to be commit 15f464321a7c71a86b747918343746050d286655)
2008-06-05Fix a memleak caused by a crappy get_sorted_dc_list() APIVolker Lendecke1-1/+14
(This used to be commit 2ea03a1e95a30e321e390bef9408a1215711de07)
2008-06-03winbindd_cm: Replace the use of lp_realm() with our_domain->alt_name.Gerald W. Carter1-1/+7
Reduce the use of config parameters with run time information after discussion with Guenther. (This used to be commit 57d596395db287301eefd34e62c9aaf857c34c69)
2008-05-26winbind: correctly omit check for trusted domain support in ↵Michael Adam1-1/+1
cm_prepare_connection when checking for a trusted domain situation. This is how it was meant to be: Otherwise, with a dc-trusted-domain situation but trusted domains disabled, we would attempt to do a session setup and fail (wouldn't even get a trust password). Michael (This used to be commit a5a51ca8e5971992d9b060d66201b808bd2b7a53)
2008-05-23Manually merge Steven Danneman's patch for SPNEGO auth to a trustedGerald W. Carter1-5/+7
Win2008 domain (merged from v3-0-test). commit 8dc4e979776aae0ecaa74b51dc1eac78a7631405 Author: Steven Danneman <sdanneman@isilon.com> Date: Wed May 7 13:34:26 2008 -0700 spnego SPN fix when contacting trusted domains cli_session_setup_spnego() was not taking into consideration the situation where we're connecting to a trusted domain, specifically one (like W2K8) which doesn't return a SPN in the NegTokenInit. This caused two problems: 1) When guessing the SPN using kerberos_get_default_realm_from_ccache() we were always using our default realm, not the realm of the domain we're connecting to. 2) When falling back on NTLMSSP for authentication we were passing the name of the domain we're connecting to for use in our credentials when we should be passing our own workgroup name. The fix for both was to split the single "domain" parameter into "user_domain" and "dest_realm" parameters. We use the "user_domain" parameter to pass into the NTLM call, and we used "dest_realm" to create an SPN if none was returned in the NegTokenInit2 packet. If no "dest_realm" is provided we assume we're connecting to our own domain and use the credentials cache to build the SPN. Since we have a reasonable guess at the SPN, I removed the check that defaults us directly to NTLM when negHint is empty. (This used to be commit b78b14c88e8354aadf9ba7644bdb1c29245fe419)
2008-05-23Manually port Steven Dannenman fix for using the correct machine domain whenGerald W. Carter1-3/+3
looking up trust credentials in our tdb. commit fd0ae47046d37ec8297396a2733209c4d999ea91 Author: Steven Danneman <sdanneman@isilon.com> Date: Thu May 8 13:34:49 2008 -0700 Use machine account and machine password from our domain when contacting trusted domains. (This used to be commit 69b37ae60757075a0712149c5f97f17ee22c2e41)
2008-05-09Use strip_hostname after dsgetdcname/getdcname calls.Günther Deschner1-7/+1
Guenther (This used to be commit 82cbb3269b2e764c9c2a2fbcbe9c29feae07fb62)
2008-05-09dsgetdcname: mailslot replies are identical to the cldap ones, use cldap ↵Günther Deschner1-0/+1
everywhere. Guenther (This used to be commit fe904ee77a7fec1674e9db660978c40c17897f77)