Print this page 
NEX-18708 Domain logons may get STATUS_ACCESS_DENIED
Reviewed by: Matt Barden <matt.barden@nexenta.com>
Reviewed by: Evan Layton <evan.layton@nexenta.com>
NEX-14666 Need to provide SMB 2.1 Client
NEX-17187 panic in smbfs_acl_store
NEX-17231 smbfs create xattr files finds wrong file
NEX-17224 smbfs lookup EINVAL should be ENOENT
NEX-17260 SMB1 client fails to list directory after NEX-14666
Reviewed by: Evan Layton <evan.layton@nexenta.com>
Reviewed by: Matt Barden <matt.barden@nexenta.com>
Reviewed by: Rick McNeal <rick.mcneal@nexenta.com>
Reviewed by: Saso Kiselkov <saso.kiselkov@nexenta.com>
Reviewed by: Joyce McIntosh <joyce.mcintosh@nexenta.com>
and: (cleanup)
1575 untangle libmlrpc from SMB server
Reviewed by: Matt Barden <matt.barden@nexenta.com>
Reviewed by: Evan Layton <evan.layton@nexenta.com>
Reviewed by: Toomas Soome <tsoome@me.com>
Approved by: Richard Lowe <richlowe@richlowe.net>
NEX-4083 Upstream changes from illumos 5917 and 5995
Reviewed by: Matt Barden <matt.barden@nexenta.com>
Reviewed by: Kevin Crowe <kevin.crowe@nexenta.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>
NEX-2667 Wrong error when join domain with wrong password
Reviewed by: Kevin Crowe <kevin.crowe@nexenta.com>
Reviewed by: Bayard Bell <bayard.bell@nexenta.com>
SUP-621 ... join AD domain, ... ACCESS_DENIED when trying to open \lsarpc
NEX-2225 Unable to join NexentaStor to 2008 AD
NEX-2286 smbadm join error messages are uninformative
NEX-1852 re-enable Kerberos-style AD join (try 2)
NEX-1638 Updated DC Locator
 Includes work by: matt.barden@nexenta.com, kevin.crowe@nexenta.com
SFR-56 Identity Management for UNIX (IDMU) authentication support
re #13190 rb4312 idmapd error -9961 (No AD servers)
re #12435 rb3958 r10 is added 2 times to panic info
re #12393 rb3935 Kerberos and smbd disagree about who is our AD server
Split Close
Expand all
Collapse all
          --- old/usr/src/lib/smbsrv/libmlsvc/common/mlsvc_util.c
          +++ new/usr/src/lib/smbsrv/libmlsvc/common/mlsvc_util.c
↓ open down ↓ 12 lines elided ↑ open up ↑ 
  13   13   * When distributing Covered Code, include this CDDL HEADER in each
  14   14   * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  /*
  22   22   * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  23      - * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
       23 + * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
  24   24   */
  25   25  
  26   26  /*
  27   27   * Utility functions to support the RPC interface library.
  28   28   */
  29   29  
  30   30  #include <stdio.h>
  31   31  #include <stdarg.h>
  32   32  #include <strings.h>
  33   33  #include <unistd.h>
  34   34  #include <netdb.h>
  35   35  #include <stdlib.h>
  36   36  #include <sys/time.h>
  37   37  #include <sys/systm.h>
  38   38  #include <note.h>
  39   39  #include <syslog.h>
  40   40  
  41   41  #include <smbsrv/libsmb.h>
  42   42  #include <smbsrv/libsmbns.h>
  43   43  #include <smbsrv/libmlsvc.h>
  44      -#include <smbsrv/ntaccess.h>
       44 +#include <smb/ntaccess.h>
  45   45  #include <smbsrv/smbinfo.h>
  46   46  #include <smbsrv/netrauth.h>
  47   47  #include <libsmbrdr.h>
  48   48  #include <lsalib.h>
  49   49  #include <samlib.h>
  50   50  #include <mlsvc.h>
  51   51  
  52   52  static DWORD
  53   53  mlsvc_join_rpc(smb_domainex_t *dxi,
  54   54          char *admin_user, char *admin_pw,
  55   55          char *machine_name, char *machine_pw);
  56   56  static DWORD
  57   57  mlsvc_join_noauth(smb_domainex_t *dxi,
  58   58          char *machine_name, char *machine_pw);
  59   59  
  60      -
       60 +/*
       61 + * This is called by smbd_dc_update just after we've learned about a
       62 + * new domain controller.  Make sure we can authenticate with this DC.
       63 + */
  61   64  DWORD
  62   65  mlsvc_netlogon(char *server, char *domain)
  63   66  {
  64      -        mlsvc_handle_t netr_handle;
  65   67          DWORD status;
  66   68  
  67      -        status = netr_open(server, domain, &netr_handle);
  68      -        if (status != 0) {
  69      -                syslog(LOG_NOTICE, "Failed to connect to %s "
  70      -                    "for domain %s (%s)", server, domain,
  71      -                    xlate_nt_status(status));
  72      -                return (status);
  73      -        }
  74      -
  75      -        status = netlogon_auth(server, &netr_handle, NETR_FLG_INIT);
       69 +        status = smb_netlogon_check(server, domain);
  76   70          if (status != NT_STATUS_SUCCESS) {
  77   71                  syslog(LOG_NOTICE, "Failed to establish NETLOGON "
  78   72                      "credential chain with DC: %s (%s)", server,
  79   73                      xlate_nt_status(status));
  80   74                  syslog(LOG_NOTICE, "The machine account information on the "
  81   75                      "domain controller does not match the local storage.");
  82   76                  syslog(LOG_NOTICE, "To correct this, use 'smbadm join'");
  83   77          }
  84      -        (void) netr_close(&netr_handle);
  85   78  
  86   79          return (status);
  87   80  }
  88   81  
  89   82  /*
  90   83   * Join the specified domain.  The method varies depending on whether
  91   84   * we're using "secure join" (using an administrative account to join)
  92   85   * or "unsecure join" (using a pre-created machine account).  In the
  93   86   * latter case, the machine account is created "by hand" before this
  94   87   * machine attempts to join, and we just change the password from the
↓ open down ↓ 322 lines elided ↑ open up ↑ 
 417  410                      "Change machine account password: %s",
 418  411                      xlate_nt_status(status));
 419  412          }
 420  413          return (status);
 421  414  }
 422  415  
 423  416  void
 424  417  mlsvc_disconnect(const char *server)
 425  418  {
 426  419          smbrdr_disconnect(server);
      420 +}
      421 +
      422 +/*
      423 + * A few more helper functions for RPC services.
      424 + */
      425 +
      426 +/*
      427 + * Check whether or not the specified user has administrator privileges,
      428 + * i.e. is a member of Domain Admins or Administrators.
      429 + * Returns true if the user is an administrator, otherwise returns false.
      430 + */
      431 +boolean_t
      432 +ndr_is_admin(ndr_xa_t *xa)
      433 +{
      434 +        smb_netuserinfo_t *ctx = xa->pipe->np_user;
      435 +
      436 +        return (ctx->ui_flags & SMB_ATF_ADMIN);
      437 +}
      438 +
      439 +/*
      440 + * Check whether or not the specified user has power-user privileges,
      441 + * i.e. is a member of Domain Admins, Administrators or Power Users.
      442 + * This is typically required for operations such as managing shares.
      443 + * Returns true if the user is a power user, otherwise returns false.
      444 + */
      445 +boolean_t
      446 +ndr_is_poweruser(ndr_xa_t *xa)
      447 +{
      448 +        smb_netuserinfo_t *ctx = xa->pipe->np_user;
      449 +
      450 +        return ((ctx->ui_flags & SMB_ATF_ADMIN) ||
      451 +            (ctx->ui_flags & SMB_ATF_POWERUSER));
      452 +}
      453 +
      454 +int32_t
      455 +ndr_native_os(ndr_xa_t *xa)
      456 +{
      457 +        smb_netuserinfo_t *ctx = xa->pipe->np_user;
      458 +
      459 +        return (ctx->ui_native_os);
 427  460  }
    
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX