From 7fe79ba73210c96d2d67fdf5a03529eb03fc5318 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 27 Apr 2026 18:14:18 +0200 Subject: [PATCH 1/3] s3:winbindd: let init_dc_connection_rpc() fail if domain->dcname is still NULL This can happen on a DC itself trying to talk to itself, which is currently not expected. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15973 Signed-off-by: Stefan Metzmacher Reviewed-by: Volker Lendecke (cherry picked from commit 38a9910ac99a015a3dac76b93f02d16e140c05e6) --- source3/winbindd/winbindd_cm.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c index 6e11461e07ef..72d59755bcfa 100644 --- a/source3/winbindd/winbindd_cm.c +++ b/source3/winbindd/winbindd_cm.c @@ -1974,6 +1974,15 @@ static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain, bool need return NT_STATUS_TRUSTED_DOMAIN_FAILURE; } + if (domain->dcname == NULL) { + /* + * This can happen on a DC itself trying to talk to itself, + * which is currently not expected. + */ + DBG_WARNING("no dcname for domain %s\n", domain->name); + return NT_STATUS_NO_LOGON_SERVERS; + } + return NT_STATUS_OK; } -- 2.43.0 From a7a615add58b4032b4acf6ba1679378fbe7c909c Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 27 Apr 2026 18:31:55 +0200 Subject: [PATCH 2/3] s3:winbindd: replace smbXcli_conn_remote_{name,sockaddr}() with domain->{dcname,dcaddr} domain->conn.cli might be NULL, so we should not deference it. init_dc_connection_rpc() already checks that domain->dcname is not NULL... BUG: https://bugzilla.samba.org/show_bug.cgi?id=15973 Signed-off-by: Stefan Metzmacher Reviewed-by: Volker Lendecke (cherry picked from commit 34c4ab4c610960ba587659e077608778970363a0) --- source3/winbindd/winbindd_cm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c index 72d59755bcfa..31d56e0ac06a 100644 --- a/source3/winbindd/winbindd_cm.c +++ b/source3/winbindd/winbindd_cm.c @@ -2571,8 +2571,8 @@ retry: goto anonymous; } - remote_name = smbXcli_conn_remote_name(conn->cli->conn); - remote_sockaddr = smbXcli_conn_remote_sockaddr(conn->cli->conn); + remote_name = domain->dcname; + remote_sockaddr = &domain->dcaddr; /* * We have an authenticated connection. Use a SPNEGO @@ -2846,8 +2846,8 @@ static NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain, goto done; } - remote_name = smbXcli_conn_remote_name(conn->cli->conn); - remote_sockaddr = smbXcli_conn_remote_sockaddr(conn->cli->conn); + remote_name = domain->dcname; + remote_sockaddr = &domain->dcaddr; status = winbindd_get_trust_credentials(domain, talloc_tos(), @@ -2937,8 +2937,8 @@ retry: goto anonymous; } - remote_name = smbXcli_conn_remote_name(conn->cli->conn); - remote_sockaddr = smbXcli_conn_remote_sockaddr(conn->cli->conn); + remote_name = domain->dcname; + remote_sockaddr = &domain->dcaddr; /* * We have an authenticated connection. Use a SPNEGO @@ -3222,8 +3222,8 @@ static NTSTATUS cm_connect_netlogon_transport(struct winbindd_domain *domain, TALLOC_FREE(conn->netlogon_pipe); TALLOC_FREE(conn->netlogon_creds_ctx); - remote_name = smbXcli_conn_remote_name(conn->cli->conn); - remote_sockaddr = smbXcli_conn_remote_sockaddr(conn->cli->conn); + remote_name = domain->dcname; + remote_sockaddr = &domain->dcaddr; result = winbindd_get_trust_credentials(domain, talloc_tos(), -- 2.43.0 From 131e583768655b15f5a518aa357d50c492c16db6 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 27 Apr 2026 18:13:36 +0200 Subject: [PATCH 3/3] s3:winbindd: let wb_irpc_SamLogon reject the local domain as RWDC If the clients use a subdomain of our domain the 'sam' auth backend passed the request along to the 'winbind' auth backend. If winbindd tries to use the local domain we hit the case that an unknown domain was used. So we need to bounce the request back to 'sam_ignoredomain'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15973 Signed-off-by: Stefan Metzmacher Reviewed-by: Volker Lendecke Autobuild-User(master): Volker Lendecke Autobuild-Date(master): Tue Apr 28 11:49:16 UTC 2026 on atb-devel-224 (cherry picked from commit b4e612725f9fe11f1791bd170cef8b0dade45ba6) --- source3/winbindd/winbindd_irpc.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/source3/winbindd/winbindd_irpc.c b/source3/winbindd/winbindd_irpc.c index 5981eb2d2445..7f36d7795fa0 100644 --- a/source3/winbindd/winbindd_irpc.c +++ b/source3/winbindd/winbindd_irpc.c @@ -252,6 +252,30 @@ static NTSTATUS wb_irpc_SamLogon(struct irpc_message *msg, return NT_STATUS_OK; } + if (IS_DC && domain->primary && !domain->rodc) { + /* + * target_domain_name might + * be a subdomain of domain->alt_name, + * that's why the 'sam' backend passed it along + * to 'winbind' auth backend, but we need to bounce + * it back to the 'sam_ignoredomain' backend. + */ + DBG_NOTICE("target_domain[%s] routed to primary domain[%s][%s]\n", + target_domain_name, domain->name, domain->alt_name); + req->out.result = NT_STATUS_NO_SUCH_DOMAIN; + req->out.authoritative = 0; + return NT_STATUS_OK; + } + + if (IS_DC && domain->internal && !domain->rodc) { + /* + * Something strange happened + */ + DBG_ERR("target_domain[%s] routed to internal domain[%s\n", + target_domain_name, domain->name); + return NT_STATUS_REQUEST_NOT_ACCEPTED; + } + DEBUG(5, ("wb_irpc_SamLogon called\n")); return wb_irpc_forward_rpc_call(msg, msg, -- 2.43.0