Try to catch up on the code I've put into HEAD that should be in 3.0:

 - vorlan's hosts allow with DNS names patch
 - use x_fileno() in debug.c, not the struct directly.
 - check for server timeout on password change (was reporting success)
 - better error/status loggin in both the pam_winbind client and winbindd_pam
server code.
 - (pdb_ldap) don't set the ldap version twice - we do it on every bind anyway.

diff --git a/source/lib/access.c b/source/lib/access.c
index 4e524735e49cb48394aefcd30fc17617fc5a1db2..a39bc6df763c035921c06397cdbf20ce7caa0a26 100644 (file)
--- a/source/lib/access.c
+++ b/source/lib/access.c
@@ -316,20 +316,20 @@ BOOL check_access(int sock, char **allow_list, char **deny_list)
                else
                {
                        DEBUG (3, ("check_access: hostnames in host allow/deny list.\n"));
-                       ret = allow_access(deny_list,allow_list, get_socket_name(sock),
+                       ret = allow_access(deny_list,allow_list, get_socket_name(sock,True),
                                           get_socket_addr(sock));
                }
                
                if (ret) 
                {
                        DEBUG(2,("Allowed connection from %s (%s)\n",
-                                only_ip ? "" : get_socket_name(sock),
+                                only_ip ? "" : get_socket_name(sock,True),
                                 get_socket_addr(sock)));
                } 
                else 
                {
                        DEBUG(0,("Denied connection from %s (%s)\n",
-                                only_ip ? "" : get_socket_name(sock),
+                                only_ip ? "" : get_socket_name(sock,True),
                                 get_socket_addr(sock)));
                }
        }

diff --git a/source/lib/debug.c b/source/lib/debug.c
index f4f3ee2f9f94c9ac7f28d6b7385286d0a42f58ce..483db71b852424dbfff9d058aa93c22cd3788260 100644 (file)
--- a/source/lib/debug.c
+++ b/source/lib/debug.c
@@ -603,7 +603,7 @@ BOOL reopen_logs( void )
        (void)umask(oldumask);
 
        /* Take over stderr to catch ouput into logs */
-       if (dbf && sys_dup2(dbf->fd, 2) == -1) {
+       if (dbf && sys_dup2(x_fileno(dbf), 2) == -1) {
                close_low_fds(True); /* Close stderr too, if dup2 can't point it
                                        at the logfile */
        }

diff --git a/source/lib/util_sock.c b/source/lib/util_sock.c
index fc2abf976f45512b299c5a7152e000e3127ff9de..04c20f65967c58b56d375ce1561116fa187adda8 100644 (file)
--- a/source/lib/util_sock.c
+++ b/source/lib/util_sock.c
@@ -832,7 +832,7 @@ void client_setfd(int fd)
 
 char *client_name(void)
 {
-       return get_socket_name(client_fd);
+       return get_socket_name(client_fd,False);
 }
 
 char *client_addr(void)
@@ -890,7 +890,7 @@ static BOOL matchname(char *remotehost,struct in_addr  addr)
 /*******************************************************************
  return the DNS name of the remote end of a socket
  ******************************************************************/
-char *get_socket_name(int fd)
+char *get_socket_name(int fd, BOOL force_lookup)
 {
        static pstring name_buf;
        static fstring addr_buf;
@@ -902,7 +902,7 @@ char *get_socket_name(int fd)
           situations won't work because many networks don't link dhcp
           with dns. To avoid the delay we avoid the lookup if
           possible */
-       if (!lp_hostname_lookups()) {
+       if (!lp_hostname_lookups() && (force_lookup == False)) {
                return get_socket_addr(fd);
        }
        

diff --git a/source/libsmb/clirap.c b/source/libsmb/clirap.c
index 2064e1495439b1f5f73bea7fbd105125181c8fe3..b4924fd77356d4352e88c8b20cfe885a96d9b1a9 100644 (file)
--- a/source/libsmb/clirap.c
+++ b/source/libsmb/clirap.c
@@ -343,13 +343,17 @@ BOOL cli_oem_change_password(struct cli_state *cli, const char *user, const char
     return False;
   }
 
-  if (cli_receive_trans(cli,SMBtrans,
+  if (!cli_receive_trans(cli,SMBtrans,
                        &rparam, &rprcnt,
                        &rdata, &rdrcnt)) {
-    if (rparam)
-      cli->rap_error = SVAL(rparam,0);
+         DEBUG(0,("cli_oem_change_password: Failed to recieve reply to password change for user %s\n",
+                  user ));
+         return False;
   }
-
+  
+  if (rparam)
+         cli->rap_error = SVAL(rparam,0);
+  
   SAFE_FREE(rparam);
   SAFE_FREE(rdata);
 

diff --git a/source/nsswitch/pam_winbind.c b/source/nsswitch/pam_winbind.c
index f95caefb4cd409fd63ba20666ff5f7ca06939f64..7d0353664f26172c89ad49c6a0eb170b1ce5b1bc 100644 (file)
--- a/source/nsswitch/pam_winbind.c
+++ b/source/nsswitch/pam_winbind.c
@@ -134,22 +134,15 @@ static int pam_winbind_request(enum winbindd_cmd req_type,
        return PAM_SUCCESS;
 }
 
-/* talk to winbindd */
-static int winbind_auth_request(const char *user, const char *pass, int ctrl)
+static int pam_winbind_request_log(enum winbindd_cmd req_type,
+                              struct winbindd_request *request,
+                              struct winbindd_response *response,
+                                  int ctrl,
+                                  const char *user)
 {
-       struct winbindd_request request;
-       struct winbindd_response response;
        int retval;
 
-       ZERO_STRUCT(request);
-
-       strncpy(request.data.auth.user, user, 
-                sizeof(request.data.auth.user)-1);
-
-       strncpy(request.data.auth.pass, pass, 
-                sizeof(request.data.auth.pass)-1);
-       
-        retval = pam_winbind_request(WINBINDD_PAM_AUTH, &request, &response);
+        retval = pam_winbind_request(req_type, request, response);
 
        switch (retval) {
        case PAM_AUTH_ERR:
@@ -178,8 +171,16 @@ static int winbind_auth_request(const char *user, const char *pass, int ctrl)
                }        
                return retval;
        case PAM_SUCCESS:
-               /* Otherwise, the authentication looked good */
-               _pam_log(LOG_NOTICE, "user '%s' granted acces", user);
+               if (req_type == WINBINDD_PAM_AUTH) {
+                       /* Otherwise, the authentication looked good */
+                       _pam_log(LOG_NOTICE, "user '%s' granted acces", user);
+               } else if (req_type == WINBINDD_PAM_CHAUTHTOK) {
+                       /* Otherwise, the authentication looked good */
+                       _pam_log(LOG_NOTICE, "user '%s' password changed", user);
+               } else { 
+                       /* Otherwise, the authentication looked good */
+                       _pam_log(LOG_NOTICE, "user '%s' OK", user);
+               }
                return retval;
        default:
                /* we don't know anything about this return value */
@@ -187,12 +188,29 @@ static int winbind_auth_request(const char *user, const char *pass, int ctrl)
                         retval, user);
                return retval;
        }
-     /* should not be reached */
+}
+
+/* talk to winbindd */
+static int winbind_auth_request(const char *user, const char *pass, int ctrl)
+{
+       struct winbindd_request request;
+       struct winbindd_response response;
+
+       ZERO_STRUCT(request);
+
+       strncpy(request.data.auth.user, user, 
+                sizeof(request.data.auth.user)-1);
+
+       strncpy(request.data.auth.pass, pass, 
+                sizeof(request.data.auth.pass)-1);
+       
+       
+        return pam_winbind_request_log(WINBINDD_PAM_AUTH, &request, &response, ctrl, user);
 }
 
 /* talk to winbindd */
 static int winbind_chauthtok_request(const char *user, const char *oldpass,
-                                     const char *newpass)
+                                     const char *newpass, int ctrl)
 {
        struct winbindd_request request;
        struct winbindd_response response;
@@ -218,7 +236,7 @@ static int winbind_chauthtok_request(const char *user, const char *oldpass,
             request.data.chauthtok.newpass[0] = '\0';
         }
        
-        return pam_winbind_request(WINBINDD_PAM_CHAUTHTOK, &request, &response);
+        return pam_winbind_request_log(WINBINDD_PAM_CHAUTHTOK, &request, &response, ctrl, user);
 }
 
 /*
@@ -665,7 +683,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
                 * rebuild the password database file.
                 */
 
-               retval = winbind_chauthtok_request(user, pass_old, pass_new);
+               retval = winbind_chauthtok_request(user, pass_old, pass_new, ctrl);
                _pam_overwrite(pass_new);
                _pam_overwrite(pass_old);
                pass_old = pass_new = NULL;

diff --git a/source/nsswitch/winbindd_pam.c b/source/nsswitch/winbindd_pam.c
index 3e7a8ad97139fada6e6423df24b476a09e67846f..969cf272a37f6d1acc93bf69421257029bb2294c 100644 (file)
--- a/source/nsswitch/winbindd_pam.c
+++ b/source/nsswitch/winbindd_pam.c
@@ -354,5 +354,12 @@ done:
        fstrcpy(state->response.data.auth.error_string, nt_errstr(result));
        state->response.data.auth.pam_error = nt_status_to_pam(result);
 
+       DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, 
+             ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n", 
+              domain,
+              user,
+              state->response.data.auth.nt_status_string,
+              state->response.data.auth.pam_error));         
+
        return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }

diff --git a/source/passdb/pdb_ldap.c b/source/passdb/pdb_ldap.c
index a10e6f2989b43c7baaeb6895f626084b02771d33..2121c335a0a75856667abfac1279cdb3be131671 100644 (file)
--- a/source/passdb/pdb_ldap.c
+++ b/source/passdb/pdb_ldap.c
@@ -1420,13 +1420,6 @@ static NTSTATUS ldapsam_modify_entry(LDAP *ldap_struct,SAM_ACCOUNT *newpwd,char
                char *retoid;
                struct berval *retdata;
 
-               if (ldap_get_option(ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) {
-                       if (version != LDAP_VERSION3) {
-                               version = LDAP_VERSION3;
-                               ldap_set_option (ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
-                       }
-               }
-
                if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
                        DEBUG(0,("ber_alloc_t returns NULL\n"));
                        return ret;

diff --git a/source/web/cgi.c b/source/web/cgi.c
index 684086f61e2d6c30ef446ed9020f0d6fb64b6611..c9cb78f6f1a28cef8bfcb2b4ba6f41b02b9c8583 100644 (file)
--- a/source/web/cgi.c
+++ b/source/web/cgi.c
@@ -636,7 +636,7 @@ return the hostname of the client
 char *cgi_remote_host(void)
 {
        if (inetd_server) {
-               return get_socket_name(1);
+               return get_socket_name(1,False);
        }
        return getenv("REMOTE_HOST");
 }