The Samba-Bugzilla – Attachment 11314 Details for
Bug 11291
NetApp joined to a Samba/ADDC cannot resolve SIDs
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
0001-s4-rpc_server-netlogon-Fix-for-NetApp.patch
0001-s4-rpc_server-netlogon-Fix-for-NetApp.patch (text/plain), 2.86 KB, created by
Arvid Requate
on 2015-08-06 13:04:00 UTC
(
hide
)
Description:
0001-s4-rpc_server-netlogon-Fix-for-NetApp.patch
Filename:
MIME Type:
Creator:
Arvid Requate
Created:
2015-08-06 13:04:00 UTC
Size:
2.86 KB
patch
obsolete
>From 31ea01b83b8bb3075e62c1ed43d116bc96ce9f28 Mon Sep 17 00:00:00 2001 >From: Arvid Requate <requate@univention.de> >Date: Thu, 6 Aug 2015 15:00:25 +0200 >Subject: [PATCH] s4:rpc_server/netlogon: Fix for NetApp > >This patch fixes an issue where NetApp filers joined to a >Samba/ADDC cannot resolve SIDs. Without this patch the issue >can only be avoided by setting "allow nt4 crypto = yes" in smb.conf. > >The issue is triggered by NetApp filers in three steps: > >1. The client calls netr_ServerReqChallenge to set up challenge tokens > >2. Next it calls netr_ServerAuthenticate2 with NETLOGON_NEG_STRONG_KEYS > set to 0. Native AD and Samba respond to this with > NT_STATUS_DOWNGRADE_DETECTED. At this point Samba throws away > the challenge token negotiated in the first step. > >3. Next the client calls netr_ServerAuthenticate2 again, this time with > NETLOGON_NEG_STRONG_KEYS set to 1. > Samba returns NT_STATUS_ACCESS_DENIED as it has lost track > of the challenge and denies logon with the message > > No challenge requested by client [CLNT1/CLNT1$], cannot authenticate > >Git commit 321ebc99b5a00f82265aee741a48aa84b214d6e8 introduced >a workaround for a different but related issue. This patch makes a minor >adjustment to that commit to delay flushing the cached challenge until >it's clear that we are not in a NT_STATUS_DOWNGRADE_DETECTED >situation. > >Signed-off-by: Arvid Requate <requate@univention.de> >--- > source4/rpc_server/netlogon/dcerpc_netlogon.c | 22 +++++++++++----------- > 1 file changed, 11 insertions(+), 11 deletions(-) > >diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c >index b47ccf4..49b5b2f 100644 >--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c >+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c >@@ -172,17 +172,6 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3(struct dcesrv_call_state *dce_ca > } > } > >- /* >- * At this point we can cleanup the cache entry, >- * if we fail the client needs to call netr_ServerReqChallenge >- * again. >- * >- * Note: this handles global_challenge_table == NULL >- * and also a non existing record just fine. >- */ >- memcache_delete(global_challenge_table, >- SINGLETON_CACHE, challenge_key); >- > server_flags = NETLOGON_NEG_ACCOUNT_LOCKOUT | > NETLOGON_NEG_PERSISTENT_SAMREPL | > NETLOGON_NEG_ARCFOUR | >@@ -229,6 +218,17 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3(struct dcesrv_call_state *dce_ca > } > > /* >+ * At this point we can cleanup the cache entry, >+ * if we fail the client needs to call netr_ServerReqChallenge >+ * again. >+ * >+ * Note: this handles global_challenge_table == NULL >+ * and also a non existing record just fine. >+ */ >+ memcache_delete(global_challenge_table, >+ SINGLETON_CACHE, challenge_key); >+ >+ /* > * According to Microsoft (see bugid #6099) > * Windows 7 looks at the negotiate_flags > * returned in this structure *even if the >-- >2.1.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 11291
:
11089
| 11314 |
11318
|
11319