samba: fix some security problems
[openwrt/staging/jow.git] / package / network / services / samba36 / patches / 250-remove_domain_logon.patch
1 --- a/source3/rpc_server/rpc_ep_setup.c
2 +++ b/source3/rpc_server/rpc_ep_setup.c
3 @@ -606,6 +606,7 @@ static bool samr_init_cb(void *ptr)
4 return true;
5 }
6
7 +#ifdef NETLOGON_SUPPORT
8 static bool netlogon_init_cb(void *ptr)
9 {
10 struct dcesrv_ep_context *ep_ctx =
11 @@ -654,6 +655,7 @@ static bool netlogon_init_cb(void *ptr)
12
13 return true;
14 }
15 +#endif
16
17 static bool spoolss_init_cb(void *ptr)
18 {
19 @@ -1116,12 +1118,15 @@ bool dcesrv_ep_setup(struct tevent_conte
20 return false;
21 }
22
23 +#ifdef NETLOGON_SUPPORT
24 netlogon_cb.init = netlogon_init_cb;
25 netlogon_cb.shutdown = NULL;
26 netlogon_cb.private_data = ep_ctx;
27 if (!NT_STATUS_IS_OK(rpc_netlogon_init(&netlogon_cb))) {
28 return false;
29 }
30 +#endif
31 +
32
33 rpcsrv_type = lp_parm_const_string(GLOBAL_SECTION_SNUM,
34 "rpc_server",
35 --- a/source3/librpc/rpc/rpc_common.c
36 +++ b/source3/librpc/rpc/rpc_common.c
37 @@ -103,9 +103,11 @@ static bool initialize_interfaces(void)
38 if (!smb_register_ndr_interface(&ndr_table_samr)) {
39 return false;
40 }
41 +#ifdef NETLOGON_SUPPORT
42 if (!smb_register_ndr_interface(&ndr_table_netlogon)) {
43 return false;
44 }
45 +#endif
46 if (!smb_register_ndr_interface(&ndr_table_srvsvc)) {
47 return false;
48 }
49 --- a/source3/smbd/server_exit.c
50 +++ b/source3/smbd/server_exit.c
51 @@ -156,7 +156,9 @@ static void exit_server_common(enum serv
52 rpc_winreg_shutdown();
53 #endif
54
55 +#ifdef NETLOGON_SUPPORT
56 rpc_netlogon_shutdown();
57 +#endif
58 rpc_samr_shutdown();
59 rpc_lsarpc_shutdown();
60 }
61 --- a/source3/rpc_server/svcctl/srv_svcctl_nt.c
62 +++ b/source3/rpc_server/svcctl/srv_svcctl_nt.c
63 @@ -91,9 +91,11 @@ bool init_service_op_table( void )
64 i++;
65 #endif
66
67 +#ifdef NETLOGON_SUPPORT
68 svcctl_ops[i].name = talloc_strdup( svcctl_ops, "NETLOGON" );
69 svcctl_ops[i].ops = &netlogon_svc_ops;
70 i++;
71 +#endif
72
73 #ifdef WINREG_SUPPORT
74 svcctl_ops[i].name = talloc_strdup( svcctl_ops, "RemoteRegistry" );
75 --- a/source3/nmbd/nmbd_processlogon.c
76 +++ b/source3/nmbd/nmbd_processlogon.c
77 @@ -320,6 +320,10 @@ void process_logon_packet(struct packet_
78 NTSTATUS status;
79 const char *pdc_name;
80
81 +#ifndef NETLOGON_SUPPORT
82 + return;
83 +#endif
84 +
85 in_addr_to_sockaddr_storage(&ss, p->ip);
86 pss = iface_ip((struct sockaddr *)&ss);
87 if (!pss) {
88 --- a/source3/rpcclient/rpcclient.c
89 +++ b/source3/rpcclient/rpcclient.c
90 @@ -627,7 +627,9 @@ static struct cmd_set *rpcclient_command
91 #ifdef PRINTER_SUPPORT
92 spoolss_commands,
93 #endif
94 +#ifdef NETLOGON_SUPPORT
95 netlogon_commands,
96 +#endif
97 srvsvc_commands,
98 #ifdef DFS_SUPPORT
99 dfs_commands,
100 --- a/source3/rpc_server/wkssvc/srv_wkssvc_nt.c
101 +++ b/source3/rpc_server/wkssvc/srv_wkssvc_nt.c
102 @@ -824,6 +824,10 @@ WERROR _wkssvc_NetrJoinDomain2(struct pi
103 WERROR werr;
104 struct security_token *token = p->session_info->security_token;
105
106 +#ifndef NETLOGON_SUPPORT
107 + return WERR_NOT_SUPPORTED;
108 +#endif
109 +
110 if (!r->in.domain_name) {
111 return WERR_INVALID_PARAM;
112 }
113 @@ -901,6 +905,10 @@ WERROR _wkssvc_NetrUnjoinDomain2(struct
114 WERROR werr;
115 struct security_token *token = p->session_info->security_token;
116
117 +#ifndef NETLOGON_SUPPORT
118 + return WERR_NOT_SUPPORTED;
119 +#endif
120 +
121 if (!r->in.account || !r->in.encrypted_password) {
122 return WERR_INVALID_PARAM;
123 }
124 --- a/source3/libsmb/trusts_util.c
125 +++ b/source3/libsmb/trusts_util.c
126 @@ -46,9 +46,11 @@ NTSTATUS trust_pw_change_and_store_it(st
127 NTSTATUS nt_status;
128
129 switch (sec_channel_type) {
130 +#ifdef NETLOGON_SUPPORT
131 case SEC_CHAN_WKSTA:
132 case SEC_CHAN_DOMAIN:
133 break;
134 +#endif
135 default:
136 return NT_STATUS_NOT_SUPPORTED;
137 }
138 @@ -159,6 +161,11 @@ bool enumerate_domain_trusts( TALLOC_CTX
139 *num_domains = 0;
140 *sids = NULL;
141
142 +#ifndef NETLOGON_SUPPORT
143 + return False;
144 +#endif
145 +
146 +
147 /* lookup a DC first */
148
149 if ( !get_dc_name(domain, NULL, dc_name, &dc_ss) ) {
150 @@ -243,6 +250,10 @@ NTSTATUS change_trust_account_password(
151 struct cli_state *cli = NULL;
152 struct rpc_pipe_client *netlogon_pipe = NULL;
153
154 +#ifndef NETLOGON_SUPPORT
155 + return NT_STATUS_UNSUCCESSFUL;
156 +#endif
157 +
158 DEBUG(5,("change_trust_account_password: Attempting to change trust account password in domain %s....\n",
159 domain));
160
161 --- a/source3/auth/auth_domain.c
162 +++ b/source3/auth/auth_domain.c
163 @@ -538,7 +538,9 @@ static NTSTATUS auth_init_trustdomain(st
164
165 NTSTATUS auth_domain_init(void)
166 {
167 +#ifdef NETLOGON_SUPPORT
168 smb_register_auth(AUTH_INTERFACE_VERSION, "trustdomain", auth_init_trustdomain);
169 smb_register_auth(AUTH_INTERFACE_VERSION, "ntdomain", auth_init_ntdomain);
170 +#endif
171 return NT_STATUS_OK;
172 }
173 --- a/source3/smbd/process.c
174 +++ b/source3/smbd/process.c
175 @@ -2431,8 +2431,10 @@ static bool housekeeping_fn(const struct
176 /* check if we need to reload services */
177 check_reload(sconn, time_mono(NULL));
178
179 +#ifdef NETLOGON_SUPPORT
180 /* Change machine password if neccessary. */
181 attempt_machine_password_change();
182 +#endif
183
184 /*
185 * Force a log file check.
186 --- a/source3/rpc_server/srv_pipe.c
187 +++ b/source3/rpc_server/srv_pipe.c
188 @@ -421,10 +421,12 @@ static bool check_bind_req(struct pipes_
189 if (ok) {
190 context_fns->allow_connect = false;
191 }
192 +#ifdef NETLOGON_SUPPORT
193 ok = ndr_syntax_id_equal(abstract, &ndr_table_netlogon.syntax_id);
194 if (ok) {
195 context_fns->allow_connect = false;
196 }
197 +#endif
198 /*
199 * for the epmapper and echo interfaces we allow "connect"
200 * auth_level by default.
201 --- a/source3/rpc_client/cli_pipe.c
202 +++ b/source3/rpc_client/cli_pipe.c
203 @@ -2221,6 +2221,10 @@ static void rpc_pipe_bind_step_two_trigg
204 struct schannel_state);
205 struct tevent_req *subreq;
206
207 +#ifndef NETLOGON_SUPPORT
208 + tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
209 + return;
210 +#endif
211 if (schannel_auth == NULL ||
212 !ndr_syntax_id_equal(&state->cli->abstract_syntax,
213 &ndr_table_netlogon.syntax_id)) {