← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/samba/oneiric-security

« back to all changes in this revision

Viewing changes to source3/winbindd/winbindd_rpc.c

  • Committer: Bazaar Package Importer
  • Author(s): Chuck Short
  • Date: 2011-03-10 10:03:01 UTC
  • mfrom: (0.39.11 sid)
  • Revision ID: james.westby@ubuntu.com-20110310100301-jfjg41wv0iq05zj4
Tags: 2:3.5.8~dfsg-1ubuntu1
https://launchpad.net/bugs/639768
* Merge from debian unstable.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access. 
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/mksmbpasswd.awk:
    - Do not add user with UID less than 1000 to smbpasswd
  + debian/control:
    - Make libwbclient0 replace/conflict with hardy's likewise-open.
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
    - Add cuups breaks to push the package to aslo upgrade cups (LP: #639768)
  + debian/rules:
    - enable "native" PIE hardening.
    - Add BIND_NOW to maximize benefit of RELRO hardening.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
    - Don't ship the /etc/network/if-up.d file.
  + debian/samba.postinst: 
    - Fixed bashism.
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/samba.logrotate: Make it upstart compatible
  + debian/samba-common.dhcp: Fix typo to get a proper parsing in
    /etc/samba/dhcp.
  + Dropped:
    - debian/patches/fix-windows7-print-connection.patch: Merged upstream.
    - debian/patches/security-CVE-2011-0719.patch: Merged upstream. 

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/winbindd/winbindd_rpc.c
84
84
                                                      &total_size,
85
85
                                                      &returned_size,
86
86
                                                      &disp_info);
 
87
 
 
88
                if (!NT_STATUS_IS_OK(result)) {
 
89
                        if (!NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
 
90
                                return result;
 
91
                        }
 
92
                }
 
93
 
87
94
                num_dom_users = disp_info.info1.count;
88
95
                start_idx += disp_info.info1.count;
89
96
                loop_count++;
1230
1237
        /* And restore our original timeout. */
1231
1238
        rpccli_set_timeout(cli, orig_timeout);
1232
1239
 
 
1240
        if (NT_STATUS_V(status) == DCERPC_FAULT_ACCESS_DENIED ||
 
1241
            NT_STATUS_V(status) == DCERPC_FAULT_SEC_PKG_ERROR) {
 
1242
                /*
 
1243
                 * This can happen if the schannel key is not
 
1244
                 * valid anymore, we need to invalidate the
 
1245
                 * all connections to the dc and reestablish
 
1246
                 * a netlogon connection first.
 
1247
                 */
 
1248
                invalidate_cm_connection(&domain->conn);
 
1249
                status = NT_STATUS_ACCESS_DENIED;
 
1250
        }
 
1251
 
1233
1252
        if (!NT_STATUS_IS_OK(status)) {
1234
1253
                return status;
1235
1254
        }
1297
1316
        /* And restore our original timeout. */
1298
1317
        rpccli_set_timeout(cli, orig_timeout);
1299
1318
 
 
1319
        if (NT_STATUS_V(status) == DCERPC_FAULT_ACCESS_DENIED ||
 
1320
            NT_STATUS_V(status) == DCERPC_FAULT_SEC_PKG_ERROR) {
 
1321
                /*
 
1322
                 * This can happen if the schannel key is not
 
1323
                 * valid anymore, we need to invalidate the
 
1324
                 * all connections to the dc and reestablish
 
1325
                 * a netlogon connection first.
 
1326
                 */
 
1327
                invalidate_cm_connection(&domain->conn);
 
1328
                status = NT_STATUS_ACCESS_DENIED;
 
1329
        }
 
1330
 
1300
1331
        if (!NT_STATUS_IS_OK(status)) {
1301
1332
                return status;
1302
1333
        }