The Samba-Bugzilla – Attachment 15521 Details for
Bug 13884
Joining Active Directory should not use SAMR to set the password
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
patch for 4.11
v4.11.patch (text/plain), 40.26 KB, created by
Andreas Schneider
on 2019-10-09 08:33:32 UTC
(
hide
)
Description:
patch for 4.11
Filename:
MIME Type:
Creator:
Andreas Schneider
Created:
2019-10-09 08:33:32 UTC
Size:
40.26 KB
patch
obsolete
>From 086297b8d119fa68313416f257fc71727d1f4b7f Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Thu, 8 Aug 2019 14:35:38 +0200 >Subject: [PATCH 01/11] testprogs: Fix failure count in test_net_ads.sh > >There are missing ` at the end of the line. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=13884 > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit 320b5be4dce95d8dac4b3c0847faf5b730754a37) >--- > testprogs/blackbox/test_net_ads.sh | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh >index d3c4de5b741..512aa9d2952 100755 >--- a/testprogs/blackbox/test_net_ads.sh >+++ b/testprogs/blackbox/test_net_ads.sh >@@ -141,10 +141,10 @@ testit "test spn service doensn't exist in AD but is present in keytab file afte > # SPN parser is very basic but does detect some illegal combination > > windows_spn="$spn_service/$spn_host:" >-testit_expect_failure "test (dedicated keytab) fail to parse windows spn with missing port" $VALGRIND $net_tool ads keytab add $windows_spn -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1 >+testit_expect_failure "test (dedicated keytab) fail to parse windows spn with missing port" $VALGRIND $net_tool ads keytab add $windows_spn -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1` > > windows_spn="$spn_service/$spn_host/" >-testit_expect_failure "test (dedicated keytab) fail to parse windows spn with missing servicename" $VALGRIND $net_tool ads keytab add $windows_spn -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1 >+testit_expect_failure "test (dedicated keytab) fail to parse windows spn with missing servicename" $VALGRIND $net_tool ads keytab add $windows_spn -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1` > > testit "changetrustpw (dedicated keytab)" $VALGRIND $net_tool ads changetrustpw || failed=`expr $failed + 1` > >-- >2.23.0 > > >From a733592f28e6767eeaf71e999943e654bbd00ba0 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 13 Aug 2019 17:06:58 +0200 >Subject: [PATCH 02/11] s3:libads: Use ldap_add_ext_s() in ads_gen_add() > >ldap_add_s() is marked as deprecated. > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit 456322a61319a10aaedda5244488ea4e5aa5cb64) >--- > source3/libads/ldap.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c >index 2110390b65f..66aea348e23 100644 >--- a/source3/libads/ldap.c >+++ b/source3/libads/ldap.c >@@ -1596,7 +1596,7 @@ ADS_STATUS ads_gen_add(ADS_STRUCT *ads, const char *new_dn, ADS_MODLIST mods) > /* make sure the end of the list is NULL */ > mods[i] = NULL; > >- ret = ldap_add_s(ads->ldap.ld, utf8_dn, (LDAPMod**)mods); >+ ret = ldap_add_ext_s(ads->ldap.ld, utf8_dn, (LDAPMod**)mods, NULL, NULL); > ads_print_error(ret, ads->ldap.ld); > TALLOC_FREE(utf8_dn); > return ADS_ERROR(ret); >-- >2.23.0 > > >From 40e18112ba77d4e6f81abde8e0f4a82e1acdd7a2 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 13 Aug 2019 17:41:40 +0200 >Subject: [PATCH 03/11] s3:libnet: Require sealed LDAP SASL connections for > joining > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit b84abb3a46211dc84e52ef95750627e4dd081f2f) >--- > libgpo/pygpo.c | 2 +- > source3/lib/netapi/joindomain.c | 5 ++++- > source3/libads/ads_proto.h | 9 ++++++++- > source3/libads/ads_struct.c | 14 +++++++++++++- > source3/libads/ldap.c | 4 ++-- > source3/libnet/libnet_join.c | 3 ++- > source3/libsmb/namequery_dc.c | 2 +- > source3/printing/nt_printing_ads.c | 6 +++--- > source3/utils/net_ads.c | 13 +++++++++---- > source3/winbindd/winbindd_ads.c | 5 ++++- > source3/winbindd/winbindd_cm.c | 5 ++++- > 11 files changed, 51 insertions(+), 17 deletions(-) > >diff --git a/libgpo/pygpo.c b/libgpo/pygpo.c >index b1f788d3a00..581d20e0649 100644 >--- a/libgpo/pygpo.c >+++ b/libgpo/pygpo.c >@@ -210,7 +210,7 @@ static int py_ads_init(ADS *self, PyObject *args, PyObject *kwds) > self->ads_ptr = NULL; > } > /* always succeeds or crashes */ >- self->ads_ptr = ads_init(realm, workgroup, ldap_server); >+ self->ads_ptr = ads_init(realm, workgroup, ldap_server, ADS_SASL_PLAIN); > > return 0; > } >diff --git a/source3/lib/netapi/joindomain.c b/source3/lib/netapi/joindomain.c >index ff2154ba803..8d0752f4531 100644 >--- a/source3/lib/netapi/joindomain.c >+++ b/source3/lib/netapi/joindomain.c >@@ -411,7 +411,10 @@ WERROR NetGetJoinableOUs_l(struct libnetapi_ctx *ctx, > > dc = strip_hostname(info->dc_unc); > >- ads = ads_init(info->domain_name, info->domain_name, dc); >+ ads = ads_init(info->domain_name, >+ info->domain_name, >+ dc, >+ ADS_SASL_PLAIN); > if (!ads) { > return WERR_GEN_FAILURE; > } >diff --git a/source3/libads/ads_proto.h b/source3/libads/ads_proto.h >index 154bf67f964..92bb3a22cdb 100644 >--- a/source3/libads/ads_proto.h >+++ b/source3/libads/ads_proto.h >@@ -32,6 +32,12 @@ > #ifndef _LIBADS_ADS_PROTO_H_ > #define _LIBADS_ADS_PROTO_H_ > >+enum ads_sasl_state_e { >+ ADS_SASL_PLAIN = 0, >+ ADS_SASL_SIGN, >+ ADS_SASL_SEAL, >+}; >+ > /* The following definitions come from libads/ads_struct.c */ > > char *ads_build_path(const char *realm, const char *sep, const char *field, int reverse); >@@ -39,7 +45,8 @@ char *ads_build_dn(const char *realm); > char *ads_build_domain(const char *dn); > ADS_STRUCT *ads_init(const char *realm, > const char *workgroup, >- const char *ldap_server); >+ const char *ldap_server, >+ enum ads_sasl_state_e sasl_state); > bool ads_set_sasl_wrap_flags(ADS_STRUCT *ads, int flags); > void ads_destroy(ADS_STRUCT **ads); > >diff --git a/source3/libads/ads_struct.c b/source3/libads/ads_struct.c >index 3ab682c0e38..043a1b21247 100644 >--- a/source3/libads/ads_struct.c >+++ b/source3/libads/ads_struct.c >@@ -132,7 +132,8 @@ char *ads_build_domain(const char *dn) > */ > ADS_STRUCT *ads_init(const char *realm, > const char *workgroup, >- const char *ldap_server) >+ const char *ldap_server, >+ enum ads_sasl_state_e sasl_state) > { > ADS_STRUCT *ads; > int wrap_flags; >@@ -152,6 +153,17 @@ ADS_STRUCT *ads_init(const char *realm, > wrap_flags = 0; > } > >+ switch (sasl_state) { >+ case ADS_SASL_PLAIN: >+ break; >+ case ADS_SASL_SIGN: >+ wrap_flags |= ADS_AUTH_SASL_SIGN; >+ break; >+ case ADS_SASL_SEAL: >+ wrap_flags |= ADS_AUTH_SASL_SEAL; >+ break; >+ } >+ > ads->auth.flags = wrap_flags; > > /* Start with the configured page size when the connection is new, >diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c >index 66aea348e23..2dc204f1ae8 100644 >--- a/source3/libads/ldap.c >+++ b/source3/libads/ldap.c >@@ -2966,7 +2966,7 @@ ADS_STATUS ads_current_time(ADS_STRUCT *ads) > > if ( !ads->ldap.ld ) { > if ( (ads_s = ads_init( ads->server.realm, ads->server.workgroup, >- ads->server.ldap_server )) == NULL ) >+ ads->server.ldap_server, ADS_SASL_PLAIN )) == NULL ) > { > status = ADS_ERROR(LDAP_NO_MEMORY); > goto done; >@@ -3028,7 +3028,7 @@ ADS_STATUS ads_domain_func_level(ADS_STRUCT *ads, uint32_t *val) > > if ( !ads->ldap.ld ) { > if ( (ads_s = ads_init( ads->server.realm, ads->server.workgroup, >- ads->server.ldap_server )) == NULL ) >+ ads->server.ldap_server, ADS_SASL_PLAIN )) == NULL ) > { > status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); > goto done; >diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c >index b876d7ea89f..a512afc238a 100644 >--- a/source3/libnet/libnet_join.c >+++ b/source3/libnet/libnet_join.c >@@ -140,7 +140,8 @@ static ADS_STATUS libnet_connect_ads(const char *dns_domain_name, > > my_ads = ads_init(dns_domain_name, > netbios_domain_name, >- dc_name); >+ dc_name, >+ ADS_SASL_SEAL); > if (!my_ads) { > return ADS_ERROR_LDAP(LDAP_NO_MEMORY); > } >diff --git a/source3/libsmb/namequery_dc.c b/source3/libsmb/namequery_dc.c >index 4ee5b5278e4..f63dde61603 100644 >--- a/source3/libsmb/namequery_dc.c >+++ b/source3/libsmb/namequery_dc.c >@@ -69,7 +69,7 @@ static bool ads_dc_name(const char *domain, > > /* Try this 3 times then give up. */ > for( i =0 ; i < 3; i++) { >- ads = ads_init(realm, domain, NULL); >+ ads = ads_init(realm, domain, NULL, ADS_SASL_PLAIN); > if (!ads) { > TALLOC_FREE(sitename); > return False; >diff --git a/source3/printing/nt_printing_ads.c b/source3/printing/nt_printing_ads.c >index 2588e1de7e7..a82f1361fc8 100644 >--- a/source3/printing/nt_printing_ads.c >+++ b/source3/printing/nt_printing_ads.c >@@ -227,7 +227,7 @@ WERROR nt_printer_guid_retrieve(TALLOC_CTX *mem_ctx, const char *printer, > return WERR_NOT_ENOUGH_MEMORY; > } > >- ads = ads_init(lp_realm(), lp_workgroup(), NULL); >+ ads = ads_init(lp_realm(), lp_workgroup(), NULL, ADS_SASL_PLAIN); > if (ads == NULL) { > result = WERR_RPC_S_SERVER_UNAVAILABLE; > goto out; >@@ -577,7 +577,7 @@ WERROR nt_printer_publish(TALLOC_CTX *mem_ctx, > > TALLOC_FREE(sinfo2); > >- ads = ads_init(lp_realm(), lp_workgroup(), NULL); >+ ads = ads_init(lp_realm(), lp_workgroup(), NULL, ADS_SASL_PLAIN); > if (!ads) { > DEBUG(3, ("ads_init() failed\n")); > win_rc = WERR_RPC_S_SERVER_UNAVAILABLE; >@@ -633,7 +633,7 @@ WERROR check_published_printers(struct messaging_context *msg_ctx) > tmp_ctx = talloc_new(NULL); > if (!tmp_ctx) return WERR_NOT_ENOUGH_MEMORY; > >- ads = ads_init(lp_realm(), lp_workgroup(), NULL); >+ ads = ads_init(lp_realm(), lp_workgroup(), NULL, ADS_SASL_PLAIN); > if (!ads) { > DEBUG(3, ("ads_init() failed\n")); > return WERR_RPC_S_SERVER_UNAVAILABLE; >diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c >index 4a0f59a1e80..19ac9e4533f 100644 >--- a/source3/utils/net_ads.c >+++ b/source3/utils/net_ads.c >@@ -620,7 +620,10 @@ retry_connect: > realm = assume_own_realm(c); > } > >- ads = ads_init(realm, c->opt_target_workgroup, c->opt_host); >+ ads = ads_init(realm, >+ c->opt_target_workgroup, >+ c->opt_host, >+ ADS_SASL_PLAIN); > > if (!c->opt_user_name) { > c->opt_user_name = "administrator"; >@@ -729,7 +732,8 @@ static int net_ads_check_int(const char *realm, const char *workgroup, const cha > ADS_STRUCT *ads; > ADS_STATUS status; > >- if ( (ads = ads_init( realm, workgroup, host )) == NULL ) { >+ ads = ads_init(realm, workgroup, host, ADS_SASL_PLAIN); >+ if (ads == NULL ) { > return -1; > } > >@@ -1764,7 +1768,7 @@ static void _net_ads_join_dns_updates(struct net_context *c, TALLOC_CTX *ctx, st > * kinit with the machine password to do dns update. > */ > >- ads_dns = ads_init(lp_realm(), NULL, r->in.dc_name); >+ ads_dns = ads_init(lp_realm(), NULL, r->in.dc_name, ADS_SASL_PLAIN); > > if (ads_dns == NULL) { > d_fprintf(stderr, _("DNS update failed: out of memory!\n")); >@@ -2655,7 +2659,8 @@ static int net_ads_password(struct net_context *c, int argc, const char **argv) > > /* use the realm so we can eventually change passwords for users > in realms other than default */ >- if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) { >+ ads = ads_init(realm, c->opt_workgroup, c->opt_host, ADS_SASL_PLAIN); >+ if (ads == NULL) { > return -1; > } > >diff --git a/source3/winbindd/winbindd_ads.c b/source3/winbindd/winbindd_ads.c >index 485ca831be9..20f47eb5954 100644 >--- a/source3/winbindd/winbindd_ads.c >+++ b/source3/winbindd/winbindd_ads.c >@@ -110,7 +110,10 @@ static ADS_STATUS ads_cached_connection_connect(ADS_STRUCT **adsp, > /* we don't want this to affect the users ccache */ > setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1); > >- ads = ads_init(target_realm, target_dom_name, ldap_server); >+ ads = ads_init(target_realm, >+ target_dom_name, >+ ldap_server, >+ ADS_SASL_SEAL); > if (!ads) { > DEBUG(1,("ads_init for domain %s failed\n", target_dom_name)); > return ADS_ERROR(LDAP_NO_MEMORY); >diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c >index b9a1c1eda7b..0e671ca22be 100644 >--- a/source3/winbindd/winbindd_cm.c >+++ b/source3/winbindd/winbindd_cm.c >@@ -1414,7 +1414,10 @@ static bool dcip_check_name(TALLOC_CTX *mem_ctx, > > print_sockaddr(addr, sizeof(addr), pss); > >- ads = ads_init(domain->alt_name, domain->name, addr); >+ ads = ads_init(domain->alt_name, >+ domain->name, >+ addr, >+ ADS_SASL_PLAIN); > ads->auth.flags |= ADS_AUTH_NO_BIND; > ads->config.flags |= request_flags; > ads->server.no_fallback = true; >-- >2.23.0 > > >From 0715b6fa8f6c17f27fe482854146244a2c383311 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 13 Aug 2019 16:30:07 +0200 >Subject: [PATCH 04/11] s3:libads: Cleanup error code paths in > ads_create_machine_acct() > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit 8ed993789f93624b7b60dd5314fe5472e69e903a) >--- > source3/libads/ldap.c | 34 +++++++++++++++++++++++----------- > 1 file changed, 23 insertions(+), 11 deletions(-) > >diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c >index 2dc204f1ae8..a0bc5fe6741 100644 >--- a/source3/libads/ldap.c >+++ b/source3/libads/ldap.c >@@ -2092,11 +2092,12 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > uint32_t etype_list) > { > ADS_STATUS ret; >- char *samAccountName, *controlstr; >- TALLOC_CTX *ctx; >+ char *samAccountName = NULL; >+ char *controlstr = NULL; >+ TALLOC_CTX *ctx = NULL; > ADS_MODLIST mods; > char *machine_escaped = NULL; >- char *new_dn; >+ char *new_dn = NULL; > const char *objectClass[] = {"top", "person", "organizationalPerson", > "user", "computer", NULL}; > LDAPMessage *res = NULL; >@@ -2110,13 +2111,14 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > return ret; > } > >- if (!(ctx = talloc_init("ads_add_machine_acct"))) >+ ctx = talloc_init("ads_add_machine_acct"); >+ if (ctx == NULL) { > return ADS_ERROR(LDAP_NO_MEMORY); >- >- ret = ADS_ERROR(LDAP_NO_MEMORY); >+ } > > machine_escaped = escape_rdn_val_string_alloc(machine_name); >- if (!machine_escaped) { >+ if (machine_escaped == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); > goto done; > } > >@@ -2131,17 +2133,26 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > ads_msgfree(ads, res); > > new_dn = talloc_asprintf(ctx, "cn=%s,%s", machine_escaped, org_unit); >- samAccountName = talloc_asprintf(ctx, "%s$", machine_name); >+ if (new_dn == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } > >- if ( !new_dn || !samAccountName ) { >+ samAccountName = talloc_asprintf(ctx, "%s$", machine_name); >+ if (samAccountName == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); > goto done; > } > >- if (!(controlstr = talloc_asprintf(ctx, "%u", acct_control))) { >+ controlstr = talloc_asprintf(ctx, "%u", acct_control); >+ if (controlstr == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); > goto done; > } > >- if (!(mods = ads_init_mods(ctx))) { >+ mods = ads_init_mods(ctx); >+ if (mods == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); > goto done; > } > >@@ -2155,6 +2166,7 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > > etype_list_str = talloc_asprintf(ctx, "%d", (int)etype_list); > if (etype_list_str == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); > goto done; > } > ads_mod_str(ctx, &mods, "msDS-SupportedEncryptionTypes", >-- >2.23.0 > > >From 70872507813bc26a003fb7637ba67f93070f000e Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Wed, 21 Aug 2019 12:22:32 +0200 >Subject: [PATCH 05/11] s3:libads: Use a talloc_asprintf in > ads_find_machine_acct() > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit 35f3e4aed1f1c2ba1c8dc50921f238937f343357) >--- > source3/libads/ldap.c | 12 ++++++++---- > 1 file changed, 8 insertions(+), 4 deletions(-) > >diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c >index a0bc5fe6741..f799c8f45d8 100644 >--- a/source3/libads/ldap.c >+++ b/source3/libads/ldap.c >@@ -1367,18 +1367,22 @@ char *ads_parent_dn(const char *dn) > ADS_STATUS status; > char *expr; > const char *attrs[] = {"*", "msDS-SupportedEncryptionTypes", "nTSecurityDescriptor", NULL}; >+ TALLOC_CTX *frame = talloc_stackframe(); > > *res = NULL; > > /* the easiest way to find a machine account anywhere in the tree > is to look for hostname$ */ >- if (asprintf(&expr, "(samAccountName=%s$)", machine) == -1) { >- DEBUG(1, ("asprintf failed!\n")); >- return ADS_ERROR_NT(NT_STATUS_NO_MEMORY); >+ expr = talloc_asprintf(frame, "(samAccountName=%s$)", machine); >+ if (expr == NULL) { >+ status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); >+ goto done; > } > > status = ads_search(ads, res, expr, attrs); >- SAFE_FREE(expr); >+ >+done: >+ TALLOC_FREE(frame); > return status; > } > >-- >2.23.0 > > >From f3df67af96c465b5146d0f8a4f028069ccdbf564 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Wed, 14 Aug 2019 13:01:19 +0200 >Subject: [PATCH 06/11] s3:libads: Fix detection if acount already exists in > ads_find_machine_count() > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit 4f389c1f78cdc2424795e3b2a1ce43818c400c2d) >--- > source3/libads/ldap.c | 36 ++++++++++++++++++++++++++++-------- > 1 file changed, 28 insertions(+), 8 deletions(-) > >diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c >index f799c8f45d8..ea0d79a3600 100644 >--- a/source3/libads/ldap.c >+++ b/source3/libads/ldap.c >@@ -1366,7 +1366,21 @@ char *ads_parent_dn(const char *dn) > { > ADS_STATUS status; > char *expr; >- const char *attrs[] = {"*", "msDS-SupportedEncryptionTypes", "nTSecurityDescriptor", NULL}; >+ const char *attrs[] = { >+ /* This is how Windows checks for machine accounts */ >+ "objectClass", >+ "SamAccountName", >+ "userAccountControl", >+ "DnsHostName", >+ "ServicePrincipalName", >+ "unicodePwd", >+ >+ /* Additional attributes Samba checks */ >+ "msDS-SupportedEncryptionTypes", >+ "nTSecurityDescriptor", >+ >+ NULL >+ }; > TALLOC_CTX *frame = talloc_stackframe(); > > *res = NULL; >@@ -1380,6 +1394,11 @@ char *ads_parent_dn(const char *dn) > } > > status = ads_search(ads, res, expr, attrs); >+ if (ADS_ERR_OK(status)) { >+ if (ads_count_replies(ads, *res) != 1) { >+ status = ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT); >+ } >+ } > > done: > TALLOC_FREE(frame); >@@ -1867,11 +1886,11 @@ ADS_STATUS ads_clear_service_principal_names(ADS_STRUCT *ads, const char *machin > char *dn_string = NULL; > > ret = ads_find_machine_acct(ads, &res, machine_name); >- if (!ADS_ERR_OK(ret) || ads_count_replies(ads, res) != 1) { >+ if (!ADS_ERR_OK(ret)) { > DEBUG(5,("ads_clear_service_principal_names: WARNING: Host Account for %s not found... skipping operation.\n", machine_name)); > DEBUG(5,("ads_clear_service_principal_names: WARNING: Service Principals for %s have NOT been cleared.\n", machine_name)); > ads_msgfree(ads, res); >- return ADS_ERROR(LDAP_NO_SUCH_OBJECT); >+ return ret; > } > > DEBUG(5,("ads_clear_service_principal_names: Host account for %s found\n", machine_name)); >@@ -2027,12 +2046,12 @@ ADS_STATUS ads_add_service_principal_names(ADS_STRUCT *ads, > const char **servicePrincipalName = spns; > > ret = ads_find_machine_acct(ads, &res, machine_name); >- if (!ADS_ERR_OK(ret) || ads_count_replies(ads, res) != 1) { >+ if (!ADS_ERR_OK(ret)) { > DEBUG(1,("ads_add_service_principal_name: WARNING: Host Account for %s not found... skipping operation.\n", > machine_name)); > DEBUG(1,("ads_add_service_principal_name: WARNING: Service Principals have NOT been added.\n")); > ads_msgfree(ads, res); >- return ADS_ERROR(LDAP_NO_SUCH_OBJECT); >+ return ret; > } > > DEBUG(1,("ads_add_service_principal_name: Host account for %s found\n", machine_name)); >@@ -2127,7 +2146,7 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > } > > ret = ads_find_machine_acct(ads, &res, machine_escaped); >- if (ADS_ERR_OK(ret) && ads_count_replies(ads, res) == 1) { >+ if (ADS_ERR_OK(ret)) { > DBG_DEBUG("Host account for %s already exists.\n", > machine_escaped); > ret = ADS_ERROR_LDAP(LDAP_ALREADY_EXISTS); >@@ -3688,14 +3707,15 @@ ADS_STATUS ads_leave_realm(ADS_STRUCT *ads, const char *hostname) > TALLOC_FREE(hostnameDN); > > status = ads_find_machine_acct(ads, &res, host); >- if (ADS_ERR_OK(status) && ads_count_replies(ads, res) == 1) { >+ if ((status.error_type == ENUM_ADS_ERROR_LDAP) && >+ (status.err.rc != LDAP_NO_SUCH_OBJECT)) { > DEBUG(3, ("Failed to remove host account.\n")); > SAFE_FREE(host); > return status; > } > > SAFE_FREE(host); >- return status; >+ return ADS_SUCCESS; > } > > /** >-- >2.23.0 > > >From d3b65ed277e459199c220892bbf4d71e469f8b89 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Wed, 14 Aug 2019 12:17:20 +0200 >Subject: [PATCH 07/11] s3:libads: Don't set supported encryption types during > account creation > >This is already handled by libnet_join_post_processing_ads_modify() >which calls libnet_join_set_etypes() if encrytion types should be set. > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit b755a6438022579dab1a403c81d60b1ed7efca38) >--- > source3/libads/ldap.c | 18 ------------------ > 1 file changed, 18 deletions(-) > >diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c >index ea0d79a3600..cdefe290c28 100644 >--- a/source3/libads/ldap.c >+++ b/source3/libads/ldap.c >@@ -2127,12 +2127,6 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > uint32_t acct_control = ( UF_WORKSTATION_TRUST_ACCOUNT |\ > UF_DONT_EXPIRE_PASSWD |\ > UF_ACCOUNTDISABLE ); >- uint32_t func_level = 0; >- >- ret = ads_domain_func_level(ads, &func_level); >- if (!ADS_ERR_OK(ret)) { >- return ret; >- } > > ctx = talloc_init("ads_add_machine_acct"); > if (ctx == NULL) { >@@ -2184,18 +2178,6 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > ads_mod_strlist(ctx, &mods, "objectClass", objectClass); > ads_mod_str(ctx, &mods, "userAccountControl", controlstr); > >- if (func_level >= DS_DOMAIN_FUNCTION_2008) { >- const char *etype_list_str; >- >- etype_list_str = talloc_asprintf(ctx, "%d", (int)etype_list); >- if (etype_list_str == NULL) { >- ret = ADS_ERROR(LDAP_NO_MEMORY); >- goto done; >- } >- ads_mod_str(ctx, &mods, "msDS-SupportedEncryptionTypes", >- etype_list_str); >- } >- > ret = ads_gen_add(ads, new_dn, mods); > > done: >-- >2.23.0 > > >From 0baafa0a9bb9567a5de52e3a1b544215edbce606 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 13 Aug 2019 16:34:34 +0200 >Subject: [PATCH 08/11] s3:libads: Fix creating machine account using LDAP > >This implements the same behaviour as Windows. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=13884 > >Pair-Programmed-With: Guenther Deschner <gd@samba.org> >Signed-off-by: Guenther Deschner <gd@samba.org> >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit ce7762935051c862ecdd3e82d93096aac61dd292) >--- > source3/libads/ads_proto.h | 4 +- > source3/libads/ldap.c | 118 +++++++++++++++++++++++++++++++---- > source3/libnet/libnet_join.c | 23 ++++--- > 3 files changed, 124 insertions(+), 21 deletions(-) > >diff --git a/source3/libads/ads_proto.h b/source3/libads/ads_proto.h >index 92bb3a22cdb..495ef5d3325 100644 >--- a/source3/libads/ads_proto.h >+++ b/source3/libads/ads_proto.h >@@ -114,8 +114,10 @@ ADS_STATUS ads_add_service_principal_names(ADS_STRUCT *ads, const char *machine_ > const char **spns); > ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > const char *machine_name, >+ const char *machine_password, > const char *org_unit, >- uint32_t etype_list); >+ uint32_t etype_list, >+ const char *dns_domain_name); > ADS_STATUS ads_move_machine_acct(ADS_STRUCT *ads, const char *machine_name, > const char *org_unit, bool *moved); > int ads_count_replies(ADS_STRUCT *ads, void *res); >diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c >index cdefe290c28..928c0da5af9 100644 >--- a/source3/libads/ldap.c >+++ b/source3/libads/ldap.c >@@ -1516,7 +1516,6 @@ ADS_STATUS ads_mod_strlist(TALLOC_CTX *ctx, ADS_MODLIST *mods, > name, (const void **) vals); > } > >-#if 0 > /** > * Add a single ber-encoded value to a mod list > * @param ctx An initialized TALLOC_CTX >@@ -1537,7 +1536,6 @@ static ADS_STATUS ads_mod_ber(TALLOC_CTX *ctx, ADS_MODLIST *mods, > return ads_modlist_add(ctx, mods, LDAP_MOD_REPLACE|LDAP_MOD_BVALUES, > name, (const void **) values); > } >-#endif > > static void ads_print_error(int ret, LDAP *ld) > { >@@ -2111,8 +2109,10 @@ ADS_STATUS ads_add_service_principal_names(ADS_STRUCT *ads, > > ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > const char *machine_name, >+ const char *machine_password, > const char *org_unit, >- uint32_t etype_list) >+ uint32_t etype_list, >+ const char *dns_domain_name) > { > ADS_STATUS ret; > char *samAccountName = NULL; >@@ -2120,13 +2120,23 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > TALLOC_CTX *ctx = NULL; > ADS_MODLIST mods; > char *machine_escaped = NULL; >+ char *dns_hostname = NULL; > char *new_dn = NULL; >- const char *objectClass[] = {"top", "person", "organizationalPerson", >- "user", "computer", NULL}; >+ char *utf8_pw = NULL; >+ size_t utf8_pw_len = 0; >+ char *utf16_pw = NULL; >+ size_t utf16_pw_len = 0; >+ struct berval machine_pw_val; >+ bool ok; >+ const char **spn_array = NULL; >+ size_t num_spns = 0; >+ const char *spn_prefix[] = { >+ "HOST", >+ "RestrictedKrbHost", >+ }; >+ size_t i; > LDAPMessage *res = NULL; >- uint32_t acct_control = ( UF_WORKSTATION_TRUST_ACCOUNT |\ >- UF_DONT_EXPIRE_PASSWD |\ >- UF_ACCOUNTDISABLE ); >+ uint32_t acct_control = UF_WORKSTATION_TRUST_ACCOUNT; > > ctx = talloc_init("ads_add_machine_acct"); > if (ctx == NULL) { >@@ -2139,10 +2149,9 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > goto done; > } > >+ /* Check if the machine account already exists. */ > ret = ads_find_machine_acct(ads, &res, machine_escaped); > if (ADS_ERR_OK(ret)) { >- DBG_DEBUG("Host account for %s already exists.\n", >- machine_escaped); > ret = ADS_ERROR_LDAP(LDAP_ALREADY_EXISTS); > ads_msgfree(ads, res); > goto done; >@@ -2155,28 +2164,111 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > goto done; > } > >+ /* Create machine account */ >+ > samAccountName = talloc_asprintf(ctx, "%s$", machine_name); > if (samAccountName == NULL) { > ret = ADS_ERROR(LDAP_NO_MEMORY); > goto done; > } > >+ dns_hostname = talloc_asprintf(ctx, >+ "%s.%s", >+ machine_name, >+ dns_domain_name); >+ if (dns_hostname == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ /* Add dns_hostname SPNs */ >+ for (i = 0; i < ARRAY_SIZE(spn_prefix); i++) { >+ char *spn = talloc_asprintf(ctx, >+ "%s/%s", >+ spn_prefix[i], >+ dns_hostname); >+ if (spn == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ ok = add_string_to_array(spn_array, >+ spn, >+ &spn_array, >+ &num_spns); >+ if (!ok) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ } >+ >+ /* Add machine_name SPNs */ >+ for (i = 0; i < ARRAY_SIZE(spn_prefix); i++) { >+ char *spn = talloc_asprintf(ctx, >+ "%s/%s", >+ spn_prefix[i], >+ machine_name); >+ if (spn == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ ok = add_string_to_array(spn_array, >+ spn, >+ &spn_array, >+ &num_spns); >+ if (!ok) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ } >+ >+ /* Make sure to NULL terminate the array */ >+ spn_array = talloc_realloc(ctx, spn_array, const char *, num_spns + 1); >+ if (spn_array == NULL) { >+ return ADS_ERROR_LDAP(LDAP_NO_MEMORY); >+ } >+ spn_array[num_spns] = NULL; >+ > controlstr = talloc_asprintf(ctx, "%u", acct_control); > if (controlstr == NULL) { > ret = ADS_ERROR(LDAP_NO_MEMORY); > goto done; > } > >+ utf8_pw = talloc_asprintf(ctx, "\"%s\"", machine_password); >+ if (utf8_pw == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ utf8_pw_len = strlen(utf8_pw); >+ >+ ok = convert_string_talloc(ctx, >+ CH_UTF8, CH_UTF16MUNGED, >+ utf8_pw, utf8_pw_len, >+ (void *)&utf16_pw, &utf16_pw_len); >+ if (!ok) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ machine_pw_val = (struct berval) { >+ .bv_val = utf16_pw, >+ .bv_len = utf16_pw_len, >+ }; >+ > mods = ads_init_mods(ctx); > if (mods == NULL) { > ret = ADS_ERROR(LDAP_NO_MEMORY); > goto done; > } > >- ads_mod_str(ctx, &mods, "cn", machine_name); >- ads_mod_str(ctx, &mods, "sAMAccountName", samAccountName); >- ads_mod_strlist(ctx, &mods, "objectClass", objectClass); >+ ads_mod_str(ctx, &mods, "objectClass", "Computer"); >+ ads_mod_str(ctx, &mods, "SamAccountName", samAccountName); > ads_mod_str(ctx, &mods, "userAccountControl", controlstr); >+ ads_mod_str(ctx, &mods, "DnsHostName", dns_hostname); >+ ads_mod_strlist(ctx, &mods, "ServicePrincipalName", spn_array); >+ ads_mod_ber(ctx, &mods, "unicodePwd", &machine_pw_val); > > ret = ads_gen_add(ads, new_dn, mods); > >diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c >index a512afc238a..d5c8599beee 100644 >--- a/source3/libnet/libnet_join.c >+++ b/source3/libnet/libnet_join.c >@@ -338,10 +338,22 @@ static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx, > /* Attempt to create the machine account and bail if this fails. > Assume that the admin wants exactly what they requested */ > >+ if (r->in.machine_password == NULL) { >+ r->in.machine_password = >+ trust_pw_new_value(mem_ctx, >+ r->in.secure_channel_type, >+ SEC_ADS); >+ if (r->in.machine_password == NULL) { >+ return ADS_ERROR_LDAP(LDAP_NO_MEMORY); >+ } >+ } >+ > status = ads_create_machine_acct(r->in.ads, > r->in.machine_name, >+ r->in.machine_password, > r->in.account_ou, >- r->in.desired_encryption_types); >+ r->in.desired_encryption_types, >+ r->out.dns_domain_name); > > if (ADS_ERR_OK(status)) { > DEBUG(1,("machine account creation created\n")); >@@ -2668,12 +2680,11 @@ static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx, > if (ADS_ERR_OK(ads_status)) { > > /* >- * LDAP object create succeeded, now go to the rpc >- * password set routines >+ * LDAP object creation succeeded. > */ >- > r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE; >- goto rpc_join; >+ >+ return WERR_OK; > } > > if (initial_account_ou != NULL) { >@@ -2687,8 +2698,6 @@ static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx, > DBG_INFO("Failed to pre-create account in OU %s: %s\n", > r->in.account_ou, ads_errstr(ads_status)); > } >- rpc_join: >- > #endif /* HAVE_ADS */ > > if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) && >-- >2.23.0 > > >From 965198de0fba63666ef307e9b704981c97cca319 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Wed, 14 Aug 2019 10:15:19 +0200 >Subject: [PATCH 09/11] s3:libnet: Improve debug messages > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit 39b8c8b30a5d5bd70f8da3a02cf77f7592788b94) >--- > source3/libnet/libnet_join.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c >index d5c8599beee..31d1d221ed3 100644 >--- a/source3/libnet/libnet_join.c >+++ b/source3/libnet/libnet_join.c >@@ -356,7 +356,7 @@ static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx, > r->out.dns_domain_name); > > if (ADS_ERR_OK(status)) { >- DEBUG(1,("machine account creation created\n")); >+ DBG_WARNING("Machine account successfully created\n"); > return status; > } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) && > (status.err.rc == LDAP_ALREADY_EXISTS)) { >@@ -364,7 +364,7 @@ static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx, > } > > if (!ADS_ERR_OK(status)) { >- DEBUG(1,("machine account creation failed\n")); >+ DBG_WARNING("Failed to create machine account\n"); > return status; > } > >-- >2.23.0 > > >From b0e8a1d9d8f420035d4b5542a8fc3feafb84d281 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Thu, 8 Aug 2019 14:40:04 +0200 >Subject: [PATCH 10/11] s3:libads: Just change the machine password if account > already exists > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=13884 > >Pair-Programmed-With: Guenther Deschner <gd@samba.org> >Signed-off-by: Guenther Deschner <gd@samba.org> >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit 14f320fa1e40ecc3a43dabb0cecd57430270a521) >--- > source3/libads/ldap.c | 167 ++++++++++++++++++++++++++++++----- > source3/libnet/libnet_join.c | 1 + > 2 files changed, 146 insertions(+), 22 deletions(-) > >diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c >index 928c0da5af9..979192eb3ed 100644 >--- a/source3/libads/ldap.c >+++ b/source3/libads/ldap.c >@@ -2098,6 +2098,127 @@ ADS_STATUS ads_add_service_principal_names(ADS_STRUCT *ads, > return ret; > } > >+static uint32_t ads_get_acct_ctrl(ADS_STRUCT *ads, >+ LDAPMessage *msg) >+{ >+ uint32_t acct_ctrl = 0; >+ bool ok; >+ >+ ok = ads_pull_uint32(ads, msg, "userAccountControl", &acct_ctrl); >+ if (!ok) { >+ return 0; >+ } >+ >+ return acct_ctrl; >+} >+ >+static ADS_STATUS ads_change_machine_acct(ADS_STRUCT *ads, >+ LDAPMessage *msg, >+ const struct berval *machine_pw_val) >+{ >+ ADS_MODLIST mods; >+ ADS_STATUS ret; >+ TALLOC_CTX *frame = talloc_stackframe(); >+ uint32_t acct_control; >+ char *control_str = NULL; >+ const char *attrs[] = { >+ "objectSid", >+ NULL >+ }; >+ LDAPMessage *res = NULL; >+ char *dn = NULL; >+ >+ dn = ads_get_dn(ads, frame, msg); >+ if (dn == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ acct_control = ads_get_acct_ctrl(ads, msg); >+ if (acct_control == 0) { >+ ret = ADS_ERROR(LDAP_NO_RESULTS_RETURNED); >+ goto done; >+ } >+ >+ /* >+ * Changing the password, disables the account. So we need to change the >+ * userAccountControl flags to enable it again. >+ */ >+ mods = ads_init_mods(frame); >+ if (mods == NULL) { >+ ret = ADS_ERROR_LDAP(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ ads_mod_ber(frame, &mods, "unicodePwd", machine_pw_val); >+ >+ ret = ads_gen_mod(ads, dn, mods); >+ if (!ADS_ERR_OK(ret)) { >+ goto done; >+ } >+ TALLOC_FREE(mods); >+ >+ /* >+ * To activate the account, we need to disable and enable it. >+ */ >+ acct_control |= UF_ACCOUNTDISABLE; >+ >+ control_str = talloc_asprintf(frame, "%u", acct_control); >+ if (control_str == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ mods = ads_init_mods(frame); >+ if (mods == NULL) { >+ ret = ADS_ERROR_LDAP(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ ads_mod_str(frame, &mods, "userAccountControl", control_str); >+ >+ ret = ads_gen_mod(ads, dn, mods); >+ if (!ADS_ERR_OK(ret)) { >+ goto done; >+ } >+ TALLOC_FREE(mods); >+ TALLOC_FREE(control_str); >+ >+ /* >+ * Enable the account again. >+ */ >+ acct_control &= ~UF_ACCOUNTDISABLE; >+ >+ control_str = talloc_asprintf(frame, "%u", acct_control); >+ if (control_str == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ mods = ads_init_mods(frame); >+ if (mods == NULL) { >+ ret = ADS_ERROR_LDAP(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ ads_mod_str(frame, &mods, "userAccountControl", control_str); >+ >+ ret = ads_gen_mod(ads, dn, mods); >+ if (!ADS_ERR_OK(ret)) { >+ goto done; >+ } >+ TALLOC_FREE(mods); >+ TALLOC_FREE(control_str); >+ >+ ret = ads_search_dn(ads, &res, dn, attrs); >+ ads_msgfree(ads, res); >+ >+done: >+ talloc_free(frame); >+ >+ return ret; >+} >+ > /** > * adds a machine account to the ADS server > * @param ads An intialized ADS_STRUCT >@@ -2149,11 +2270,34 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > goto done; > } > >+ utf8_pw = talloc_asprintf(ctx, "\"%s\"", machine_password); >+ if (utf8_pw == NULL) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ utf8_pw_len = strlen(utf8_pw); >+ >+ ok = convert_string_talloc(ctx, >+ CH_UTF8, CH_UTF16MUNGED, >+ utf8_pw, utf8_pw_len, >+ (void *)&utf16_pw, &utf16_pw_len); >+ if (!ok) { >+ ret = ADS_ERROR(LDAP_NO_MEMORY); >+ goto done; >+ } >+ >+ machine_pw_val = (struct berval) { >+ .bv_val = utf16_pw, >+ .bv_len = utf16_pw_len, >+ }; >+ > /* Check if the machine account already exists. */ > ret = ads_find_machine_acct(ads, &res, machine_escaped); > if (ADS_ERR_OK(ret)) { >- ret = ADS_ERROR_LDAP(LDAP_ALREADY_EXISTS); >+ /* Change the machine account password */ >+ ret = ads_change_machine_acct(ads, res, &machine_pw_val); > ads_msgfree(ads, res); >+ > goto done; > } > ads_msgfree(ads, res); >@@ -2236,27 +2380,6 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads, > goto done; > } > >- utf8_pw = talloc_asprintf(ctx, "\"%s\"", machine_password); >- if (utf8_pw == NULL) { >- ret = ADS_ERROR(LDAP_NO_MEMORY); >- goto done; >- } >- utf8_pw_len = strlen(utf8_pw); >- >- ok = convert_string_talloc(ctx, >- CH_UTF8, CH_UTF16MUNGED, >- utf8_pw, utf8_pw_len, >- (void *)&utf16_pw, &utf16_pw_len); >- if (!ok) { >- ret = ADS_ERROR(LDAP_NO_MEMORY); >- goto done; >- } >- >- machine_pw_val = (struct berval) { >- .bv_val = utf16_pw, >- .bv_len = utf16_pw_len, >- }; >- > mods = ads_init_mods(ctx); > if (mods == NULL) { > ret = ADS_ERROR(LDAP_NO_MEMORY); >diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c >index 31d1d221ed3..1052afde641 100644 >--- a/source3/libnet/libnet_join.c >+++ b/source3/libnet/libnet_join.c >@@ -968,6 +968,7 @@ static ADS_STATUS libnet_join_post_processing_ads_modify(TALLOC_CTX *mem_ctx, > > if (r->in.ads->auth.ccache_name != NULL) { > ads_kdestroy(r->in.ads->auth.ccache_name); >+ r->in.ads->auth.ccache_name = NULL; > } > > ads_destroy(&r->in.ads); >-- >2.23.0 > > >From 3c77c549f3eb562b809026ef32e032e3f6607f91 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Thu, 22 Aug 2019 16:31:30 +0200 >Subject: [PATCH 11/11] testprogs: Add test for 'net ads join createcomputer=' > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> > >Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> >Autobuild-Date(master): Wed Oct 9 08:26:17 UTC 2019 on sn-devel-184 > >(cherry picked from commit 459b43e5776180dc1540cd845b72ff78747ecd6f) >--- > testprogs/blackbox/test_net_ads.sh | 32 ++++++++++++++++++++++++++++-- > 1 file changed, 30 insertions(+), 2 deletions(-) > >diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh >index 512aa9d2952..cc8345c4624 100755 >--- a/testprogs/blackbox/test_net_ads.sh >+++ b/testprogs/blackbox/test_net_ads.sh >@@ -31,6 +31,16 @@ if [ -x "$BINDIR/ldbsearch" ]; then > ldbsearch="$BINDIR/ldbsearch" > fi > >+ldbadd="ldbadd" >+if [ -x "$BINDIR/ldbadd" ]; then >+ ldbadd="$BINDIR/ldbadd" >+fi >+ >+ldbdel="ldbdel" >+if [ -x "$BINDIR/ldbdel" ]; then >+ ldbdel="$BINDIR/ldbdel" >+fi >+ > # Load test functions > . `dirname $0`/subunit.sh > >@@ -188,8 +198,9 @@ testit "testjoin user+password" $VALGRIND $net_tool ads testjoin -U$DC_USERNAME% > > testit "leave+keep_account" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD --keep-account || failed=`expr $failed + 1` > >-computers_ldb_ou="CN=Computers,DC=addom,DC=samba,DC=example,DC=com" >-testit "ldb check for existence of machine account" $ldbsearch -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER.$REALM -s base -b "cn=$HOSTNAME,$computers_ldb_ou" || failed=`expr $failed + 1` >+base_dn="DC=addom,DC=samba,DC=example,DC=com" >+computers_dn="CN=Computers,$base_dn" >+testit "ldb check for existence of machine account" $ldbsearch -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER.$REALM -s base -b "cn=$HOSTNAME,$computers_dn" || failed=`expr $failed + 1` > > testit "join" $VALGRIND $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` > >@@ -198,6 +209,23 @@ testit "testjoin" $VALGRIND $net_tool ads testjoin || failed=`expr $failed + 1` > ##Goodbye... > testit "leave" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` > >+# >+# Test createcomputer option of 'net ads join' >+# >+testit "Create OU=Servers,$base_dn" $VALGRIND $ldbadd -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER <<EOF >+dn: OU=Servers,$base_dn >+objectClass: organizationalUnit >+EOF >+ >+testit "join+createcomputer" $VALGRIND $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD createcomputer=Servers || failed=`expr $failed + 1` >+ >+testit "ldb check for existence of machine account in OU=Servers" $ldbsearch -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER.$REALM -s base -b "cn=$HOSTNAME,OU=Servers,$base_dn" || failed=`expr $failed + 1` >+ >+## Goodbye... >+testit "leave+createcomputer" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` >+ >+testit "Remove OU=Servers" $VALGRIND $ldbdel -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER "OU=Servers,$base_dn" >+ > rm -rf $BASEDIR/$WORKDIR > > exit $failed >-- >2.23.0 >
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=15521">View the attachment on a separate page</a>.</b>
View Attachment As Raw
Flags:
ab
:
review+
Actions:
View
Attachments on
bug 13884
:
15055
|
15056
|
15385
|
15391
| 15521 |
15522