summaryrefslogtreecommitdiff
path: root/source3/libads
AgeCommit message (Collapse)AuthorFilesLines
2026-04-07s3:libads: Allow to specify 'dns_lookup_kdc' in krb5.confPavel Filipenský2-11/+45
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15999 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2026-01-23s3:libads: Allocate cli_credentials on a stackframePavel Filipenský1-3/+6
This fixes: ERROR: talloc_free with references at ../../source3/libads/ldap_utils.c:158 What happens: * `struct cli_credentials *creds` is allocated on `ads` talloc context * gensec_set_credentials() creates a talloc_reference to `creds` * TALLOC_FREE(creds) sees two parents and complains All other code is using temporary talloc_stackframe() for `creds`. Do it here as well. Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Jan 23 11:20:28 UTC 2026 on atb-devel-224
2026-01-22s3:libads: Separate use of ads->config.flags for NBT_* and DS_* valuesPavel Filipenský1-22/+24
Use of ads->config.flags is overloaded. It is used to: - pass DS_* flags down to cldap_netlogon() - store the server_type from NETLOGON_SAM_LOGON_RESPONSE Both cases use different values and cannot be combined. E.g. flags mess up with value 0x00000080 NBT_SERVER_CLOSEST 0x00000080 DS_PDC_REQUIRED 0x00000080 Let's create two separate flags nbt_server_type server_flags; /* NBT_* cldap flags identifying the services. */ uint32 required_flags; /* DS_* - Netlogon flags */ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15972 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org> Autobuild-Date(master): Thu Jan 22 09:14:25 UTC 2026 on atb-devel-224
2026-01-22s3:libads: Reset ads->config.flags in ads_disconnect()Pavel Filipenský1-0/+1
This is doing the same thing in ads_disconnect() as commit a26f535 Clear previous CLDAP ping flags when reusing the ADS_STRUCT did in ads_current_time() In this case we: 1) found cached ADS_STRUCT which already has ads->config.flags set: lookup_groupmem() ads_cached_connection() ads_cached_connection_reuse() 2) started search which immediately timeouts (the cached conn. was dead) ads_do_search_retry_internal() ldap_search_with_timeout() - IO_TIMEOUT 3) Retry loop finds a new DC and tries to connect ads_do_search_retry_internal() ads_disconnect() ads_find_dc() ads_try_connect() netlogon_pings() check_cldap_reply_required_flags() 4) check_cldap_reply_required_flags() fails since ads->config.flags (stored possibly long time ago) contain: NBT_SERVER_CLOSEST 0x00000080 which is misinterpreted as: DS_PDC_REQUIRED 0x00000080 the newly found DC is not PDC (we asked for DS_ONLY_LDAP_NEEDED) and since previous DC had NBT_SERVER_CLOSEST we want DS_PDC_REQUIRED and fail. We should anyway avoid mixing independent namespaces NBT_* and DS_* in the same flag. Next commit will do that. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15972 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2026-01-21s3:libads: Do not reduce the page size in case of immediate timeoutsPavel Filipenský1-7/+29
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jan 21 11:38:40 UTC 2026 on atb-devel-224
2026-01-21s3:libads: Fix trailing whitespaces in ldap_utils.cPavel Filipenský1-19/+19
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2026-01-21s3:libads: Set NT_STATUS_UNSUCCESSFUL for IP address entryAndreas Schneider1-1/+4
This is what we do in libads/ldap.c too. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15975 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2026-01-13s3:libsmb: Rework check_negative_conn_cache()Andreas Schneider2-8/+12
The name and results are confusing. Rename the function and use a bool that it is easier to understand. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Jan 13 17:00:06 UTC 2026 on atb-devel-224
2025-12-03s3:libads: Set udp_preference_limit = 0 for MIT KerberosAndreas Schneider1-0/+1
This option enable TCP connection before UDP, when sending a message to the KDC. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-12-03s3:libads: Set a request timeout for Kerberos requestsAndreas Schneider1-0/+15
Without this, libkrb5 can wait indefinitely after creating a TCP connection. This means winbind is stuck forever till it is restarted. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15955 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-11-10s3: talloc_destroy() -> TALLOC_FREE()Volker Lendecke2-11/+11
Sweeping change, I know. Should not change compiled code in most cases, the compiler should be smart enough to elide the assignment right before a return. In the cases where this is not right before the return, TALLOC_FREE() is safer as it makes use-after-free crash. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-09-10nmbd: Fixing CID 1509039 for time_t in DEBUG statementRabinarayan Panigrahi1-2/+2
Fix: typecast changing from (int)t to (intmax_t)t as intmax_t can hold epoch seconds after 2038 year Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com> Reviewed-by: Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-09-05s3:net: Pass down the server from cmdline to sync_pw2keytabs()Andreas Schneider4-14/+37
This makes sure that during 'net ads join' the keytab create code - sync_pw2keytabs() talks to the same DC at what the machine account was created. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15905 Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Pair-Programmed-With: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org> Autobuild-Date(master): Fri Sep 5 13:38:33 UTC 2025 on atb-devel-224
2025-09-02lib: Use talloc_realloc_zero() in a few obvious placesVolker Lendecke1-2/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-08-13libads: change netlogon_pings() behaviour wrt to min_servers parameterRalph Boehme5-14/+19
Currently if a caller passes min_servers=X with X>1, netlogon_pings() will fail if it can't contact X DCs. This is not really what we want. What we want is: we want at least one DC, and up to X. Change implemenentation in that sense and rename the min_servers argument to wanted_servers to express this behaviour change. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15844 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Wed Aug 13 19:31:10 UTC 2025 on atb-devel-224
2025-08-13libads: reverse termination condition in netlogon_pings_done()Ralph Boehme1-5/+6
No change in behaviour, prepares for upcoming change and minimizes its diff. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15844 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-08-13libads: fix get_kdc_ip_string()Ralph Boehme1-4/+12
Correctly handle the interaction between optionally passed in DC via pss and DC lookup. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15876 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30libads: check for if DCs are in paused state when processing CLDAP repliesRalph Boehme1-3/+10
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30s3/libads: get rid of additional loop calling add_failed_connection_entry()Ralph Boehme1-12/+10
Just call add_failed_connection_entry() in the initial loop at all places where we have a "bad" result. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30s3:libads: let get_kdc_ip_string() check for a blacklisted server nameStefan Metzmacher1-0/+22
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30s3:libads: let cldap_ping_list() check for a blacklisted server nameStefan Metzmacher1-0/+24
If we black listed a server we should not use it even if it responses to CLDAP requests. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Pair-Programmed-With: Ralph Boehme <slow@samba.org> Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-07libads: fix get_kdc_ip_string() ...Ralph Boehme1-0/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224
2025-06-16libsmb: Remove "source3/libsmb/libsmb.h"Volker Lendecke1-1/+0
libsmb.h added ads_status.h and cli_smb2_fnum.h. Only few users need either. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-11s3:net: 'net ads keytab list' should only list default keytabAndreas Schneider1-55/+18
If you don't specify a keytab, assume we just want the default keytab. This will make upcoming changes to the code easier. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2025-04-11s3:net: Remove `net ads keytab flush`Andreas Schneider2-57/+0
This removes all entries from a keytab *and* removes all SPNs from the AD machine account. We should not do that and if you want to get rid of the keytab you can use `rm`. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2025-03-09s3:libads: Make sure that REALM is always added to keytab principalsPavel Filipenský1-1/+18
The code responsible for adding SPNs to keytab should always set the REALM part. Current code is not adding it for e.g. SPNs synced from AD. If REALM is missing, krb5_parse_name() will succeed (and add the REALM) only if the krb5.conf contains libdefaults section with default_realm set and will fail otherwise. E.g.: [libdefaults] default_realm = SOMETESTDOMAIN1.MY.COM When calling 'net ads join' we get the following error if SPN is missing REALM and krb5.conf does not provide the default_realm: pw2kt_process_add_info: Failed to parse principal: RestrictedKrbHost/$MACHINE_NAME Failed to join domain: failed to create kerberos keytab BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727 Pair-Programmed-With: Noel Power <noel.power@suse.com> Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org> Autobuild-Date(master): Sun Mar 9 00:25:08 UTC 2025 on atb-devel-224
2025-02-15s3:libads: Remove specifier for 'host' principal from 'sync machine password ↵Pavel Filipenský1-15/+6
to keytab' Use specifier 'spn_prefixes=host' instead of 'host' BUG: https://bugzilla.samba.org/show_bug.cgi?id=15759 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-02-13s3: Add new keytab specifiersPavel Filipenský1-232/+399
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15759 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-02-04s3,s4: Make case spelling of sAMAccountName consistentPavel Filipenský2-8/+8
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-01-30s3-libads: dump ADS_MODSLIST before attempting the LDAP modifyGünther Deschner1-0/+66
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15777 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-01-13s3:libads: prepare trust_pw_change() for ServerAuthenticateKerberos()Stefan Metzmacher1-16/+260
We use kerberos_kinit_passwords_ext() to check the password before and after ServerPasswordSet2() as ServerAuthenticateKerberos() does not check it. We use the ip address of the dcerpc connection in order to use a fixed KDC, so that we talk to the same server that also received the ServerPasswordSet2(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-01-13s3:libads: rename variables in trust_pw_change()Stefan Metzmacher1-11/+11
We'll have more than nt_hashes soon. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2024-12-05s3:libads: add kerberos_kinit_passwords_ext() helperStefan Metzmacher2-0/+592
This can check more than one password and is designed to support getting a TGT for our machine account also falling back to older passwords... If we don't have a plaintext password it falls back to an nt_hash. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-12-05s3:libads: split out kerberos_kinit_generic_once()Stefan Metzmacher1-19/+86
This can be used to kinit with a keyblock later and also a loop over multiple password generations will be possible. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-12-05s3:libads: remove unused time_offset from kerberos_kinit_password()Stefan Metzmacher3-5/+2
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-12-05s3:libads: let kerberos_kinit_password_ext() always initialize *ntstatusStefan Metzmacher1-0/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-12-05s3:libads: fix compiler warning in trust_pw_change()Stefan Metzmacher1-1/+1
../../source3/libads/trusts_util.c: In function ‘trust_pw_change’: ../../source3/libads/trusts_util.c:302:45: warning: dereferencing type-punned pointer might break strict-aliasing rules [-Wstrict-aliasing] 302 | (void **)&new_trust_pw_blob.data, Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-11-11libads: Move check_cldap_reply_required_flags() to netlogon_ping.cVolker Lendecke4-56/+55
netlogon_ping.c depends on it but itself has fewer dependencies than cldap.c, so we can use it in more places Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11libads: Simplify ads_fill_cldap_reply()Volker Lendecke1-15/+5
Both callers now guarantee via the filter in netlogon_pings() that the reply contains DCs that have the required flags set. Remove those checks from ads_fill_cldap_reply() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11libads: Pass "required_flags" through ads_cldap_netlogon_5()Volker Lendecke3-2/+6
... down to netlogon_pings(). Passing 0 right now, this will change for some callers Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11libads: Pass "required_flags" through ads_cldap_netlogon()Volker Lendecke1-1/+3
... down to netlogon_pings() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11libads: Make ads_cldap_netlogon() staticVolker Lendecke2-10/+5
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11libads: remove cldap_multi_netlogonVolker Lendecke2-299/+0
Replaced by netlogon_pings() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11kerberos: Use netlogon_pings()Volker Lendecke1-12/+18
This also makes sure we've got a KDC via DS_KDC_REQUIRED Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11ldap: Use netlogon_pingsVolker Lendecke1-9/+16
This already requests the flags that ads_fill_cldap_reply() will later check for, so netlogon_pings will only feed sufficient DCs into ads_fill_cldap_reply. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11cldap: Use netlogon_pings()Volker Lendecke1-11/+15
Allow LDAPS for ads_cldap_netlogon() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11libads: Add netlogon_pings()Volker Lendecke2-0/+890
This encapsulates our logic that we send CLDAP requests on UDP/389, sending them with 100msec timeouts until someone replies. It also contains the code to do this over LDAP/389 or LDAPS/636. It also contains code to filter for domain controller flags like DS_ONLY_LDAP_NEEDED, this logic exists in several places right now. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-11-11cldap: Make cldap_netlogon.out.netlogon a pointerVolker Lendecke1-1/+1
struct netlogon_samlogon_response has subpointers, this patch enables a proper talloc hierarchy. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-10-25libads: Modernize DEBUGsVolker Lendecke1-3/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2024-10-25libads: Simplify get_kdc_ip_string with talloc_asprintf_addbufVolker Lendecke1-17/+9
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 19:00:44 +0000