| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
call :
CatchChild();
*before* we fork the domain child. This call establishes a signal handler that
eats SIGCLD signals and doesn't call sys_select_signal() as the main daemon
SIGCLD handler should do. This causes the parent to ignore dead children and
time out, instead of calling winbind_child_died() on receipt of the signal. The
correct fix is to move the CatchChild call into the child code after the fork.
Jeremy.
(This used to be commit 8d701a142be2b75dc30ad215bc178af902eb4af9)
|
|
in particular closing and reopening logs on SIGHUP.
Conflicts:
source/winbindd/winbindd.c
(This used to be commit 0f7b11accec7df1c0e9a9dc0828a5e0c5ddec4cb)
|
|
The wbcLookupDomainController() call supports a set of flags
defined in wbclient.h. Add a mapping function between these
flags and the original DS_XXX flags in order to prevent having
to include the generated RPC headers in wbclient.h.
(This used to be commit 31614cd5e08dd6389c66e6ddf9f2d5429c6ab033)
|
|
Guenther
(This used to be commit 7889516a384c155a9045aad4409c041fddd0d98d)
|
|
Guenther
(This used to be commit 82cbb3269b2e764c9c2a2fbcbe9c29feae07fb62)
|
|
everywhere.
Guenther
(This used to be commit fe904ee77a7fec1674e9db660978c40c17897f77)
|
|
Guenther
(This used to be commit b261f063125f8454d8f4e8f6b6f8aa5bc393ea34)
|
|
Thanks to Glenn Curtis and Kyle Stemen @ Likewise. Their explanation is:
In winbindd_dual.c, there is a list of children processes that
is maintained using macros DTLIST_ADD and DTLIST_REMOVE. In the
case when a scheduled_async_request fails, the particular child
was located in the list, and its attributes were cleared out
and it was reused for a subsequent async request. The bug was that
the new request would queue the same node into the doubly-linked
list and would result in list->next pointing to the same node as
list itself. This would set up an infinite loop in the processing of
the for loop when the list of children was referenced.
Solution was to fully remove the child node from the list, such that
it could be inserted without risk of being inserted twice.
Note that the child is re-added to the list in fork_domain_child() again.
(This used to be commit b379b5b5d8a6daccc69aaf2be6d9a6e276e7dd78)
|
|
Guenther
(This used to be commit 2b178dcae608ecc05f62593a7a0c2a127b8b7ca2)
|
|
Guenther
(This used to be commit ce3728191b23badfd5eb92701e4cebf84273b61e)
|
|
We now open messages.tdb even before we do the become_daemon. become_daemon()
involves a fork and an immediate exit of the parent, thus the
parent_is_longlived argument must be set to false in this case. The parent is
not really long lived :-)
(This used to be commit 4f4781c6d17fe2db34dd5945fec52a7685448aec)
|
|
Use the existing domain_flags fiueld in wbcDomainInfo to set a bit if the
domain is marked as offline by Winbind.
(This used to be commit 59cfba2c3d6d4594f08cbe3b7295ab36a7cfb044)
|
|
This reduces indentation by combining common code paths,
and wraps long lines.
Holger: sorry, I could not resist. I think it is much easier to
understand what is going on when we only have one check and
determine the max allowed key length in advance.
Michael
(This used to be commit e489f3d988feafe35b486b31a9e60c2399e6a6e7)
|
|
UA keys consist of a potientally large number of concatenated SID strings which
can grow much larger than 1024 bytes in complex environments. We catch those keys
and allow them exclusivly to be larger.
(This used to be commit fcd35232e111f9b046ae35d939d08c29d0d43438)
|
|
In getgrsid_lookupsid_recv() we use parse_domain_user which itself looks at
lp_winbind_separator(). Thus when building up that group name we should better
use it as well.
(This used to be commit 5df75578ef1da41164936cd11b14114889201d47)
|
|
Guenther
(This used to be commit 538eefe22ad69540b9f73ffaa613d6be045de199)
|
|
Guenther
(This used to be commit 675bf42cfff89b05f21d77ca74eba20c4a24d44c)
|
|
Andrew Bartlett
(This used to be commit 87232351b5e66728f8d602259961909e8c1dfcb6)
|
|
Guenther
(This used to be commit 2d6a1c5da64195784b0b102edb268356a24d84b5)
|
|
(This used to be commit 99fc3283c4ecc791f5a242bd1983b4352ce3e6cf)
|
|
Reduce dependency on "cli" member of rpc_pipe_client struct
(This used to be commit 2e4c1ba38963cffe4c3f25ab24bc28975f2fc291)
|
|
This reduces the dependency on cli_state
(This used to be commit 783afab9c891dd7bcb78895b2a639b6f3a0edf5b)
|
|
metze
(This used to be commit 2e1b9130635235efdbf49d0b92a43b342114246c)
|
|
metze
(This used to be commit 8e9fdef792e612e414444e7714a2fd4513892248)
|
|
Guenther
(This used to be commit b003ba65e34bb92bf71a7943957715cd7acbcce0)
|
|
metze
(This used to be commit 64450cc1e441355aa8925b7183e90872eeab20b1)
|
|
originally, the cache was cleared before calling validate, but
this way, we skipt the validation of the database when not in
offline logon mode.
This is put into a new wrapper function winbindd_cache_validate_and_initialize()
which is now called in winbindd.c instead calling validate and
initialize functions separately.
Michael
(This used to be commit 641b5e3fecfce9581536de8daf6d7e6ecbefaf34)
|
|
My NT4SP6 which my DC here trusts sends 0x15 instead of 0x13, from looking at
the sniff at least the DC name is at the same place.
(This used to be commit 79bc6796b81395d591fc6ef389f153dd981fe68b)
|
|
... if there's no trust password
Attempt to fix bug 5350
(This used to be commit 99f6b63f3c637457fdda7ed930c6666171b25b61)
|
|
if (!&new_glist) would always be skipped, if (new_glist == NULL) is
what must have been meant...
Michael
(This used to be commit c1b60cdecff2a53f0a75a432a1ad7730eb734908)
|
|
cannot login until the cache expires even if a connection
to a DC has been restored.
(This used to be commit 8671f9767d7d93a86712741303d6046937c3aae8)
|
|
Guenther
(This used to be commit 65b4cb20ea3fb806cfd50281e08f32bea70fafce)
|
|
default backend therefore on IDs were mapped by default.
(This used to be commit f6069126e5e6d239b1ae00e897a420227f923e3f)
|
|
In order to avoid receiving NT_STATUS_DOWNGRADE_DETECTED from a w2k8
netr_ServerAuthenticate2 reply, we need to start with the AD netlogon negotiate
flags everywhere (not only when running in security=ads). Only for NT4 we need
to do a downgrade to the returned negotiate flags.
Tested with w2k8, w2ksp4, w2k3r2 and nt4sp6.
Guenther
(This used to be commit 0970369ca0cb9ae465cff40e5c75739824daf1d0)
|
|
Do not overwrite the domain->domain_flags when setting infomation
in set_dc_type_and_flags_connect().
(This used to be commit 3414eac439b731ad7204b821ddc4fec54fe4435d)
|
|
direction, and transitivty of trusts.
* added several helper functions to convert the trust_flags field in the
winbindd_tdc_domain to more useful administrator ideas of trust type, trust
direction, and trust transitivity.
* converted winbindd_list_trusted_domains() to enumerate the trusted domain
cache, instead of the domain list, and return additional trust information to
the calling process
* modified wbinfo to pretty print this additional trust information when a new
--verbose switch is given with -m. Thus "wbinfo -m" and "wbinfo -all-domains"
output as before, but "wbinfo --verbose -m" prints extra trust info.
* updated some comments and fixed typos
(This used to be commit e7827bb6afa264c12ecdc0858f49707ca3d6104f)
|
|
* changed the behavior of winbind_ads.c:trusted_domains() to not overwrite
existing trust information if we're joined to a child domain, and querying the
forest root domain. Previously if we were joined to a child domain, we'd
request all known trust information from this child domain (our primary domain)
and store it in the tdc. We'd then request all trust information from our tree
root (to get the forests we transitively trust) and overwrite the existing trust
information we already had from the perspective of the tree root.
* updated several comments and fixed typos
(This used to be commit 6aac972d790ad5ca65096cb2e85e6819b60a5413)
|
|
Michael
(This used to be commit 6d3fc63bfab06346fa57719e8747397873a3c46d)
|
|
Guenther
(This used to be commit 6a576cfe9b87e69af6acbe9abc04124b8b743fd3)
|
|
(This used to be commit e04fc36f223d8d905a930c077a6cf6c48ee57af7)
|
|
Guenther
(This used to be commit fed644372916a5e565e4f5352aab61b39a3a42a0)
|
|
The samr connects will fail. This is not independent of the CONTACT_TRUSTDOM
flag neede by krb5 logins.
(This used to be commit 4de4949e3bfcfb2169c329f19cb76936d9043d50)
|
|
Winbind can't be allowed to connect to the local smbd.
(This used to be commit 0d617f639a3c9c52e4327aed4bd02d9e8e7312a2)
|
|
Guenther
(This used to be commit fa64c76ac8e54f385f277b5b39be70075b2eeee0)
|
|
Guenther
(This used to be commit 2586dc34e0f72204749f5bf10c8135cd3a753a42)
|
|
When we get a NT_STATUS_WRONG_PASSWORD for example, my_info3 is not initialized
at all. So first check that we have NT_STATUS_IS_OK(status) before we
dereference my_info3.
(This used to be commit 559cd9e5a7fac3ce3769d457132cdcb28569b93d)
|
|
(This used to be commit 38683a73013865695e1b04f5f6a974bd0c5c1cac)
|
|
NetSamLogonEx has the advantage that it does not use the credential chain
(This used to be commit cfceb063f559f8549b8f24ce347be213c89303b0)
|
|
(This used to be commit 32fc759d942abb36d7dd351eff82925b6788dd28)
|
|
Another preparation to convert secrets.c to dbwrap: The dbwrap API does not
provide a sane tdb_lock_with_timeout abstraction. In the clustered case the DC
mutex is needed per-node anyway, so it is perfectly fine to use a local mutex
only.
(This used to be commit f94a63cd8f94490780ad9331da229c0bcb2ca5d6)
|
