← Back to branch summary

~lefteris-nikoltsios/+junk/samba-lp1016895

« back to all changes in this revision

Viewing changes to examples/bind9-patches/0004-If-tkey-gssapi-initialisation-fails-then-heck-for-th.patch

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
examples/bind9-patches/0004-If-tkey-gssapi-initialisation-fails-then-heck-for-th.patch
 
1
From c73ceb48ffc518e171d1d40b82ae2b5f603fe038 Mon Sep 17 00:00:00 2001
 
2
From: Andrew Tridgell <tridge@samba.org>
 
3
Date: Wed, 17 Feb 2010 15:27:44 +1100
 
4
Subject: [PATCH 4/5] If tkey-gssapi initialisation fails, then heck for the most common
 
5
 configuration errors so that the admin doesn't spend all day trying to
 
6
 work out why the config is broken.
 
7
 
 
8
---
 
9
 lib/dns/gssapictx.c |   48 ++++++++++++++++++++++++++++++++++++++++++++++++
 
10
 1 files changed, 48 insertions(+), 0 deletions(-)
 
11
 
 
12
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
 
13
index 11eadb9..879393c 100644
 
14
--- a/lib/dns/gssapictx.c
 
15
+++ b/lib/dns/gssapictx.c
 
16
@@ -66,6 +66,7 @@
 
17
  * we include SPNEGO's OID.
 
18
  */
 
19
 #if defined(GSSAPI)
 
20
+#include <krb5/krb5.h>
 
21
 
 
22
 static unsigned char krb5_mech_oid_bytes[] = {
 
23
        0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x01, 0x02, 0x02
 
24
@@ -191,6 +192,50 @@ log_cred(const gss_cred_id_t cred) {
 
25
 }
 
26
 #endif
 
27
 
 
28
+#ifdef GSSAPI
 
29
+/*
 
30
+ * check for the most common configuration errors.
 
31
+ *
 
32
+ * The errors checked for are:
 
33
+ *   - tkey-gssapi-credential doesn't start with DNS/
 
34
+ *   - the default realm in /etc/krb5.conf and the
 
35
+ *     tkey-gssapi-credential bind config option don't match
 
36
+ */
 
37
+static void dst_gssapi_check_config(const char *gss_name)
 
38
+{
 
39
+       const char *p;
 
40
+       krb5_context krb5_ctx;
 
41
+       char *krb5_realm = NULL;
 
42
+
 
43
+       if (strncasecmp(gss_name, "DNS/", 4) != 0) {
 
44
+               gss_log(ISC_LOG_ERROR, "tkey-gssapi-credential (%s) should start with 'DNS/'");
 
45
+               return;
 
46
+       }
 
47
+
 
48
+       if (krb5_init_context(&krb5_ctx) != 0) {
 
49
+               gss_log(ISC_LOG_ERROR, "Unable to initialise krb5 context");
 
50
+               return;
 
51
+       }
 
52
+       if (krb5_get_default_realm(krb5_ctx, &krb5_realm) != 0) {
 
53
+               gss_log(ISC_LOG_ERROR, "Unable to get krb5 default realm");
 
54
+               krb5_free_context(krb5_ctx);
 
55
+               return;
 
56
+       }
 
57
+       if (!(p = strchr(gss_name, '/'))) {
 
58
+               gss_log(ISC_LOG_ERROR, "badly formatted tkey-gssapi-credentials (%s)", gss_name);
 
59
+               krb5_free_context(krb5_ctx);
 
60
+               return;
 
61
+       }
 
62
+       if (strcasecmp(p+1, krb5_realm) != 0) {
 
63
+               gss_log(ISC_LOG_ERROR,"default realm from krb5.conf (%s) does not match tkey-gssapi-credential (%s)",
 
64
+                       krb5_realm, gss_name);
 
65
+               krb5_free_context(krb5_ctx);
 
66
+               return;
 
67
+       }
 
68
+       krb5_free_context(krb5_ctx);
 
69
+}
 
70
+#endif
 
71
+
 
72
 isc_result_t
 
73
 dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate,
 
74
                       gss_cred_id_t *cred)
 
75
@@ -223,6 +268,8 @@ dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate,
 
76
                gret = gss_import_name(&minor, &gnamebuf,
 
77
                                       GSS_C_NO_OID, &gname);
 
78
                if (gret != GSS_S_COMPLETE) {
 
79
+                       dst_gssapi_check_config((char *)array);
 
80
+
 
81
                        gss_log(3, "failed gss_import_name: %s",
 
82
                                gss_error_tostring(gret, minor, buf,
 
83
                                                   sizeof(buf)));
 
84
@@ -254,6 +301,7 @@ dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate,
 
85
                        initiate ? "initiate" : "accept",
 
86
                        (char *)gnamebuf.value,
 
87
                        gss_error_tostring(gret, minor, buf, sizeof(buf)));
 
88
+               dst_gssapi_check_config((char *)array);
 
89
                return (ISC_R_FAILURE);
 
90
        }
 
91
 
 
92
--
 
93
1.6.3.3
 
94