Attachment 12984 Details for Bug 12598 – Patches for v4-6-test

[patch] Patches for v4-6-test

tmp46.diff.txt (text/plain), 13.29 KB, created by Stefan Metzmacher on 2017-02-27 19:19:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Metzmacher

Created: 2017-02-27 19:19:38 UTC

Size: 13.29 KB

patch

obsolete

>From 60179b91912862ad9469b7b833c1eb7f9cd0029f Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 22 Feb 2017 20:07:25 +0100
>Subject: [PATCH 1/6] s3:passdb: use cli_credentials_set_kerberos_state() for
> trusts in pdb_get_trust_credentials()
>
>Trust accounts can only use kerberos when contacting other AD domains,
>using NTLMSSP will fail.
>
>At the same time it doesn't make sense to try kerberos for NT4 domains,
>still NTLMSSP will fail, but the callers has to deal with that
>case and just fallback to an anonymous SMB connection.
>
>In all cases we should be able to use NETLOGON SCHANNEL
>over any anonymous smb or tcp transport.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit d961ae9d14b46708d2693ca91ace04f9f1a53ca2)
>---
> source3/passdb/passdb.c | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
>
>diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
>index f48c317..e7a9b43 100644
>--- a/source3/passdb/passdb.c
>+++ b/source3/passdb/passdb.c
>@@ -2621,6 +2621,19 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
> 			status = NT_STATUS_NO_MEMORY;
> 			goto fail;
> 		}
>+
>+		/*
>+		 * It's not possible to use NTLMSSP with a domain trust account.
>+		 */
>+		cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS);
>+	} else {
>+		/*
>+		 * We can't use kerberos against an NT4 domain.
>+		 *
>+		 * We should have a mode that also disallows NTLMSSP here,
>+		 * as only NETLOGON SCHANNEL is possible.
>+		 */
>+		cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS);
> 	}
> 
> 	ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED);
>@@ -2635,6 +2648,10 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
> 			status = NT_STATUS_NO_MEMORY;
> 			goto fail;
> 		}
>+		/*
>+		 * We currently can't do kerberos just with an NTHASH.
>+		 */
>+		cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS);
> 		goto done;
> 	}
> 
>-- 
>1.9.1
>
>
>From ce627193164c843cbbbd36ce069d17d6565be3ec Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Thu, 23 Feb 2017 11:54:21 +0100
>Subject: [PATCH 2/6] s3:winbindd: add more debugging to
> cm_prepare_connection()
>
>Any fallbacks to other authentication methods should be logged.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit ba9d139ec3d71af184a24daf24356304c2e49144)
>---
> source3/winbindd/winbindd_cm.c | 23 ++++++++++++++++-------
> 1 file changed, 16 insertions(+), 7 deletions(-)
>
>diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
>index 3b4e46d..524c60b 100644
>--- a/source3/winbindd/winbindd_cm.c
>+++ b/source3/winbindd/winbindd_cm.c
>@@ -1118,6 +1118,11 @@ static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
> 		goto session_setup_done;
> 	}
> 
>+	DEBUG(1, ("authenticated session setup to %s using %s failed with %s\n",
>+		  controller,
>+		  cli_credentials_get_unparsed_name(creds, talloc_tos()),
>+		  nt_errstr(result)));
>+
> 	/*
> 	 * If we are not going to validiate the conneciton
> 	 * with SMB signing, then allow us to fall back to
>@@ -1140,9 +1145,6 @@ static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
> 		goto anon_fallback;
> 	}
> 
>-	DEBUG(4, ("authenticated session setup failed with %s\n",
>-		nt_errstr(result)));
>-
> 	goto done;
> 
>  ipc_fallback:
>@@ -1169,6 +1171,11 @@ static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
> 		goto session_setup_done;
> 	}
> 
>+	DEBUG(1, ("authenticated session setup to %s using %s failed with %s\n",
>+		  controller,
>+		  cli_credentials_get_unparsed_name(creds, talloc_tos()),
>+		  nt_errstr(result)));
>+
> 	/*
> 	 * If we are not going to validiate the conneciton
> 	 * with SMB signing, then allow us to fall back to
>@@ -1183,9 +1190,6 @@ static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
> 		goto anon_fallback;
> 	}
> 
>-	DEBUG(4, ("authenticated session setup failed with %s\n",
>-		nt_errstr(result)));
>-
> 	goto done;
> 
>  anon_fallback:
>@@ -1196,7 +1200,7 @@ static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
> 	}
> 
> 	/* Fall back to anonymous connection, this might fail later */
>-	DEBUG(10,("cm_prepare_connection: falling back to anonymous "
>+	DEBUG(5,("cm_prepare_connection: falling back to anonymous "
> 		"connection for DC %s\n",
> 		controller ));
> 
>@@ -1206,6 +1210,9 @@ static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
> 		goto session_setup_done;
> 	}
> 
>+	DEBUG(1, ("anonymous session setup to %s failed with %s\n",
>+		  controller, nt_errstr(result)));
>+
> 	/* We can't session setup */
> 	goto done;
> 
>@@ -1253,6 +1260,8 @@ static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
> 	}
> 
> 	if (!NT_STATUS_IS_OK(result)) {
>+		DEBUG(1, ("Failed to prepare SMB connection to %s: %s\n",
>+			  controller, nt_errstr(result)));
> 		winbind_add_failed_connection_entry(domain, controller, result);
> 		if ((*cli) != NULL) {
> 			cli_shutdown(*cli);
>-- 
>1.9.1
>
>
>From 1c0aade28c82d267f0e1804fceefa58c392b97fe Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 22 Feb 2017 20:07:25 +0100
>Subject: [PATCH 3/6] s3:winbindd: rely on the kerberos_state from
> pdb_get_trust_credentials()
>
>The implementation of pdb_get_trust_credentials() should have all
>the details to set the kerberos_state to a useful value.
>
>This should enable the fallback to NTLMSSP again, when using our
>machine account against trusted domains.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit 51caeb7c538b7546e5feccf27a735bb803c78a0b)
>---
> source3/winbindd/winbindd_cm.c | 11 -----------
> 1 file changed, 11 deletions(-)
>
>diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
>index 524c60b..686bf9f 100644
>--- a/source3/winbindd/winbindd_cm.c
>+++ b/source3/winbindd/winbindd_cm.c
>@@ -936,17 +936,6 @@ static NTSTATUS get_trust_credentials(struct winbindd_domain *domain,
> 		goto ipc_fallback;
> 	}
> 
>-	if (domain->primary && lp_security() == SEC_ADS) {
>-		cli_credentials_set_kerberos_state(creds,
>-						   CRED_AUTO_USE_KERBEROS);
>-	} else if (domain->active_directory) {
>-		cli_credentials_set_kerberos_state(creds,
>-						   CRED_MUST_USE_KERBEROS);
>-	} else {
>-		cli_credentials_set_kerberos_state(creds,
>-						   CRED_DONT_USE_KERBEROS);
>-	}
>-
> 	if (creds_domain != domain) {
> 		/*
> 		 * We can only use schannel against a direct trust
>-- 
>1.9.1
>
>
>From 3d3f60b05c13ae5256f3d35173964894d0525d92 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Thu, 23 Feb 2017 11:54:21 +0100
>Subject: [PATCH 4/6] s3:libads: add more debugging to ads_sasl_spnego_bind()
>
>Any fallbacks to other authentication methods should be logged.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit ea0bc12ba52166032d5112ee22ab53d831c13e86)
>---
> source3/libads/sasl.c | 26 +++++++++++++++++++++++++-
> 1 file changed, 25 insertions(+), 1 deletion(-)
>
>diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
>index 39c60c3..8570788 100644
>--- a/source3/libads/sasl.c
>+++ b/source3/libads/sasl.c
>@@ -703,6 +703,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
> #ifdef HAVE_KRB5
> 	bool got_kerberos_mechanism = False;
> #endif
>+	const char *mech = NULL;
> 
> 	rc = ldap_sasl_bind_s(ads->ldap.ld, NULL, "GSS-SPNEGO", NULL, NULL, NULL, &scred);
> 
>@@ -749,6 +750,8 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
> 	if (!(ads->auth.flags & ADS_AUTH_DISABLE_KERBEROS) &&
> 	    got_kerberos_mechanism) 
> 	{
>+		mech = "KRB5";
>+
> 		if (ads->auth.password == NULL ||
> 		    ads->auth.password[0] == '\0')
> 		{
>@@ -775,7 +778,11 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
> 							blob);
> 			if (!ADS_ERR_OK(status)) {
> 				DEBUG(0,("kinit succeeded but "
>-					"ads_sasl_spnego_gensec_bind(KRB5) failed: %s\n",
>+					"ads_sasl_spnego_gensec_bind(KRB5) failed "
>+					"for %s/%s with user[%s] realm[%s]: %s\n",
>+					p.service, p.hostname,
>+					ads->auth.user_name,
>+					ads->auth.realm,
> 					ads_errstr(status)));
> 			}
> 		}
>@@ -785,17 +792,34 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
> 		    !(ads->auth.flags & ADS_AUTH_ALLOW_NTLMSSP)) {
> 			goto done;
> 		}
>+
>+		DEBUG(1,("ads_sasl_spnego_gensec_bind(KRB5) failed "
>+			 "for %s/%s with user[%s] realm[%s]: %s, "
>+			 "fallback to NTLMSSP\n",
>+			 p.service, p.hostname,
>+			 ads->auth.user_name,
>+			 ads->auth.realm,
>+			 ads_errstr(status)));
> 	}
> #endif
> 
> 	/* lets do NTLMSSP ... this has the big advantage that we don't need
> 	   to sync clocks, and we don't rely on special versions of the krb5 
> 	   library for HMAC_MD4 encryption */
>+	mech = "NTLMSSP";
> 	status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO",
> 					     CRED_DONT_USE_KERBEROS,
> 					     p.service, p.hostname,
> 					     data_blob_null);
> done:
>+	if (!ADS_ERR_OK(status)) {
>+		DEBUG(1,("ads_sasl_spnego_gensec_bind(%s) failed "
>+			 "for %s/%s with user[%s] realm=[%s]: %s\n", mech,
>+			  p.service, p.hostname,
>+			  ads->auth.user_name,
>+			  ads->auth.realm,
>+			  ads_errstr(status)));
>+	}
> 	ads_free_service_principal(&p);
> 	TALLOC_FREE(frame);
> 	if (blob.data != NULL) {
>-- 
>1.9.1
>
>
>From 6754d3194071febfd6fde3827642e372b110dc02 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 22 Feb 2017 21:18:32 +0100
>Subject: [PATCH 5/6] s3:winbindd: allow a fallback to NTLMSSP for LDAP
> connections
>
>This matches the behaviour of pdb_get_trust_credentials() for
>our machine account and allows us to fallback to NTLMSSP
>when contacting trusted domains.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>(cherry picked from commit 4e9a0894cd977585ccc94e7c1811de1b0293382d)
>---
> source3/winbindd/winbindd_ads.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/source3/winbindd/winbindd_ads.c b/source3/winbindd/winbindd_ads.c
>index 077c6ec..05ef2ec 100644
>--- a/source3/winbindd/winbindd_ads.c
>+++ b/source3/winbindd/winbindd_ads.c
>@@ -120,6 +120,8 @@ static ADS_STATUS ads_cached_connection_connect(ADS_STRUCT **adsp,
> 	ads->auth.renewable = renewable;
> 	ads->auth.password = password;
> 
>+	ads->auth.flags |= ADS_AUTH_ALLOW_NTLMSSP;
>+
> 	ads->auth.realm = SMB_STRDUP(auth_realm);
> 	if (!strupper_m(ads->auth.realm)) {
> 		ads_destroy(&ads);
>-- 
>1.9.1
>
>
>From 4d5f2c2907b09916399315b72f9ad216aa1c1fb4 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 22 Feb 2017 21:29:50 +0100
>Subject: [PATCH 6/6] s3:idmap_ad: make use of pdb_get_trust_credentials() to
> get the machine account creds
>
>This is mostly a cosmetic change currently.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Ralph Boehme <slow@samba.org>
>
>Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
>Autobuild-Date(master): Fri Feb 24 22:34:48 CET 2017 on sn-devel-144
>
>(cherry picked from commit 3d7fed0f2883d529bb635fc6df86f39d5a434d25)
>---
> source3/winbindd/idmap_ad.c | 36 +++++++++++++-----------------------
> 1 file changed, 13 insertions(+), 23 deletions(-)
>
>diff --git a/source3/winbindd/idmap_ad.c b/source3/winbindd/idmap_ad.c
>index f406392..5039e9b 100644
>--- a/source3/winbindd/idmap_ad.c
>+++ b/source3/winbindd/idmap_ad.c
>@@ -22,7 +22,7 @@
> #include "idmap.h"
> #include "tldap_gensec_bind.h"
> #include "tldap_util.h"
>-#include "secrets.h"
>+#include "passdb.h"
> #include "lib/param/param.h"
> #include "utils/net.h"
> #include "auth/gensec/gensec.h"
>@@ -249,7 +249,6 @@ static NTSTATUS idmap_ad_get_tldap_ctx(TALLOC_CTX *mem_ctx,
> 				       const char *domname,
> 				       struct tldap_context **pld)
> {
>-	struct db_context *db_ctx;
> 	struct netr_DsRGetDCNameInfo *dcinfo;
> 	struct sockaddr_storage dcaddr;
> 	struct cli_credentials *creds;
>@@ -300,11 +299,19 @@ static NTSTATUS idmap_ad_get_tldap_ctx(TALLOC_CTX *mem_ctx,
> 		return NT_STATUS_NO_MEMORY;
> 	}
> 
>-	creds = cli_credentials_init(dcinfo);
>-	if (creds == NULL) {
>-		DBG_DEBUG("cli_credentials_init failed\n");
>+	/*
>+	 * Here we use or own machine account as
>+	 * we run as domain member.
>+	 */
>+	status = pdb_get_trust_credentials(lp_workgroup(),
>+					   lp_realm(),
>+					   dcinfo,
>+					   &creds);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		DBG_DEBUG("pdb_get_trust_credentials() failed - %s\n",
>+			  nt_errstr(status));
> 		TALLOC_FREE(dcinfo);
>-		return NT_STATUS_NO_MEMORY;
>+		return status;
> 	}
> 
> 	lp_ctx = loadparm_init_s3(dcinfo, loadparm_s3_helpers());
>@@ -314,23 +321,6 @@ static NTSTATUS idmap_ad_get_tldap_ctx(TALLOC_CTX *mem_ctx,
> 		return NT_STATUS_NO_MEMORY;
> 	}
> 
>-	cli_credentials_set_conf(creds, lp_ctx);
>-
>-	db_ctx = secrets_db_ctx();
>-	if (db_ctx == NULL) {
>-		DBG_DEBUG("Failed to open secrets.tdb.\n");
>-		return NT_STATUS_INTERNAL_ERROR;
>-	}
>-
>-	status = cli_credentials_set_machine_account_db_ctx(creds, lp_ctx,
>-							    db_ctx);
>-	if (!NT_STATUS_IS_OK(status)) {
>-		DBG_DEBUG("cli_credentials_set_machine_account "
>-			  "failed: %s\n", nt_errstr(status));
>-		TALLOC_FREE(dcinfo);
>-		return status;
>-	}
>-
> 	rc = tldap_gensec_bind(ld, creds, "ldap", dcinfo->dc_unc, NULL, lp_ctx,
> 			       GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
> 	if (!TLDAP_RC_IS_SUCCESS(rc)) {
>-- 
>1.9.1
>

Flags:

slow: review+

Actions: View

Attachments on bug 12598: 12984 | 12985 | 12986