Jeremy Allison [Tue, 5 Apr 2011 21:15:56 +0000 (14:15 -0700)]
Fix bug #7080 - Quota only shown when logged as root.
Ensure we also check conn->admin_user when rejecting non-root access.
Larry Reid [Sat, 26 Mar 2011 22:39:27 +0000 (15:39 -0700)]
Fix for servers that don't put a path separator at the end of the service.
Fix bug 8055 - Can't See Parts of DFS CIFS Share.
Volker Lendecke [Fri, 1 Apr 2011 06:40:38 +0000 (08:40 +0200)]
s3: Fix Coverity ID 1137: CONSTANT_EXPRESSION_RESULT
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Fri Apr 1 09:35:19 CEST 2011 on sn-devel-104
This patch and the last one address bug #8054 - winbindd cache stores/retrieves
wrong sizes for 16-bit ints.
Volker Lendecke [Fri, 1 Apr 2011 06:40:38 +0000 (08:40 +0200)]
s3: Fix Coverity ID 1136: CONSTANT_EXPRESSION_RESULT
Marc A. Dahlhaus [Fri, 1 Apr 2011 20:24:56 +0000 (22:24 +0200)]
s3: Fix Bug 8047 -- Fix mdns registration if "interfaces=" is used
David Disseldorp [Fri, 1 Apr 2011 18:21:59 +0000 (11:21 -0700)]
alpha_strcpy() is a utility function which reportedly: Strips out all but 'a-Z0-9' and the character in other_safe_chars and replaces with '_'.
This statement does not currently hold true in all cases (e.g. src =
"ТАНЦЕВАТЬ").
Part of a fix for bug 8040 - smbclient segfaults when a Cyrillic netbios
name or workgroup is configured.
Jeremy Allison [Fri, 25 Mar 2011 22:12:12 +0000 (15:12 -0700)]
Fix bug 8040 - smbclient segfaults when a Cyrillic netbios name or workgroup is configured.
As discovered by David Disseldorp <ddiss@suse.de>, convert_string_talloc()
doesn't always return consistent results for a zero length string. The
API states an incoming string must *always* contain the terminating null,
but unfotunately too much code expects passing in a zero source length
to return a null terminated string, so at least ensure we return a
correct null string in the required character set and return the
correct length.
Also ensure we cannot return a zero length for a converted string
(we ensure that the returned buffer is always allocated and zero
terminated anyway) as calling code depends on the fact that returning
true from this function will *always* return a non-zero length (as
it must include the terminating null).
Note this is a different fix from what went into master (this is
identical to the fix I'm planning for 3.5.x) as convert_string_talloc()
has diverged between the two.
Jeremy.
Jeremy Allison [Thu, 31 Mar 2011 17:49:22 +0000 (10:49 -0700)]
Fix bug #7996 - sgid bit lost on folder rename.
Refuse to set dos attributes into unix mode bits on such a
folder.
Christian Ambach [Mon, 14 Mar 2011 12:08:58 +0000 (08:08 -0400)]
s3: use getgrset() when it is available
When getgrouplist() is not defined, use getgrset() if it is defined
instead of using the initgroups() + getgroups() combo
Major contributions from Yannick Bergeron <yaberger@ca.ibm.com>
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Sat Mar 19 10:09:38 CET 2011 on sn-devel-104
(cherry picked from commit
ed46dfc4f16e230645fae5f3b3b21c462694c30a)
Fix bug #8012 (Use getgrset() instead of initgroups() + getgroups() when
getgrouplist() is not defined).
Björn Jacke [Tue, 23 Feb 2010 14:23:27 +0000 (15:23 +0100)]
s3: add explicit configure option whether or not to enable dmapi support
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(similar to commit
ce7727c1cc2fe4caa9b2d6e33530c3483dd5f980)
Fix bug #8033 - Backport dmapi configure checks.
Stefan Metzmacher [Mon, 21 Mar 2011 13:15:32 +0000 (14:15 +0100)]
s3:util_seaccess: make sure that we don't grant SEC_STD_DELETE to the owner by default
In the file server SEC_STD_DELETE is granted on the file/directory
or by FILE_DELETE_CHILD on the parent directory.
metze
(similar to commit
c7d10179108a3ae8af15c838042294f3fdced03c)
The last 2 patches address bug #8034 (SEC_STD_DELETE is always granted to the
owner of a file).
Stefan Metzmacher [Fri, 18 Mar 2011 15:45:08 +0000 (16:45 +0100)]
s3:smbd: access checks should not depend on share mode flags
metze
(cherry picked from commit
f0ec69b53544b7ff702f94d58b3d64c33eaabc7a)
(cherry picked from commit
dca75c8e3ac23256d93269bdc13d1e67571bc9f2)
Nikolay Martynov [Wed, 16 Mar 2011 20:00:22 +0000 (13:00 -0700)]
Fix inode generation so nautilus can count total dir size correctly
Fix bug #8010 (str_checksum often returns same value for different strings
[Patch]).
Volker Lendecke [Fri, 18 Mar 2011 16:47:27 +0000 (17:47 +0100)]
s3: Attempt to fix bug 8016 -- gpfs_get_xattr broken
Jeremy Allison [Mon, 14 Mar 2011 23:12:31 +0000 (16:12 -0700)]
Fix bug #8005 - smbtorture4 BASE-TCONDEV fails when tested on Samba
When pulling non-aligned ucs2 strings, we neglected to add in the
pad byte to the buffer length we've eaten. This caused the device
string in TCONX (which seems to be one of the few places that uses
non-aligned ucs2 strings) to be incorrectly read.
Volker please check.
Jeremy.
(cherry picked from commit
e59a950c049679f0394ea41b463dbb9837eb5e63)
Christian Ambach [Thu, 10 Feb 2011 14:55:50 +0000 (15:55 +0100)]
nsswitch: fix a segfault in the krb5 locator plugin
after the number of retries was exceeded, the loop did not
bail out correctly with an error and went on using a null pointer
Fix bug #8008 (winbind krb5 locator crash).
Volker Lendecke [Mon, 14 Mar 2011 17:35:23 +0000 (10:35 -0700)]
s3: Fix bug 8009 - net rap session cannot get username
Looking in [MS-RAP].pdf - these strings are always 4 bytes as an
offset in the rparam area, the string length is the size in the rdata area.
Se we must always return we have consumed 4 param bytes.
Volker Lendecke [Mon, 14 Mar 2011 17:35:36 +0000 (18:35 +0100)]
s3: Fix the talloc hierarchy in shadow_copy2_connectpath
We have to return on talloc_tos() because we don't have a mem_ctx given to us.
So we have to create a separate temporary talloc context.
Fix bug #8011 (memory corruption in shadow_copy2).
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Mon Mar 14 19:21:11 CET 2011 on sn-devel-104
(cherry picked from commit
746b299ec1b11ea1e70c130b69a9a379ec478750)
Karolin Seeger [Sat, 5 Mar 2011 21:14:43 +0000 (22:14 +0100)]
WHATSNEW: Update release notes for 3.5.8.
Karolin
Karolin Seeger [Sat, 5 Mar 2011 14:24:10 +0000 (15:24 +0100)]
WHATSNEW: Start to list changes since 3.5.7.
Karolin
Stefan Metzmacher [Wed, 2 Mar 2011 09:14:54 +0000 (10:14 +0100)]
rerun 'make samba3-idl'
metze
The last 10 patches address bug #7567 (printing from Windows 7 fails with
0x000003e6 (in AD w2k8r2 controlled domain)).
Stefan Metzmacher [Tue, 1 Mar 2011 13:20:32 +0000 (14:20 +0100)]
librpc/ndr: handle NOALIGN flag for relative pointers and alignment DATA_BLOBs
metze
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Mar 1 17:11:03 CET 2011 on sn-devel-104
(cherry picked from commit
ef224aa004d5f1726d8dca020e0ef96d8c58565e)
(cherry picked from commit
1ea17bacdb09d28a12a8b6ddeba3ac285cd9f905)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 22 Feb 2011 14:56:30 +0000 (15:56 +0100)]
spoolss.idl: align spoolss_DriverFileInfo relative pointer to 4 byte
metze
(cherry picked from commit
b6ece01c7922adeb3c9e718bc8cc610cae7c543c)
(cherry picked from commit
ba1a72cb153892e491af91a6bb61e1820135fa12)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 22 Feb 2011 18:23:33 +0000 (19:23 +0100)]
spoolss.idl: align spoolss_PrinterEnumValues 'data' based on the type
metze
(cherry picked from commit
341330600aebcec92fba64ea343888c15a0c3d44)
(cherry picked from commit
757471a5fcd4f95da28402bae6c9ceccff7d6548)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 22 Feb 2011 14:58:45 +0000 (15:58 +0100)]
librpc/ndr: remove align2 hack for relative pointers
metze
(cherry picked from commit
23f6f449792d889538e0d0028bb8fbd5c807b0da)
(cherry picked from commit
9313b5d1da24406dd7d26afb2488fee0cbea44a9)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 22 Feb 2011 14:57:21 +0000 (15:57 +0100)]
librpc: align nstring and nstring_array to 2 byte
metze
(cherry picked from commit
712ef2590d0ee59a4a659926cdf8aac6e968dfa8)
(cherry picked from commit
0fb64a26b3b35b75f2f548d882bed41aa0386c6b)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 22 Feb 2011 14:45:44 +0000 (15:45 +0100)]
librpc/ndr: ndr align relative pointers based on the given flags
We used to do this only for the reverse relative pointers
and now we always do it.
metze
(cherry picked from commit
84b884eb4bec38b721d6c38704f12d1d2c601bcb)
(cherry picked from commit
6648ce8990a97da739d4be69657e9ace6198068c)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 22 Feb 2011 17:19:13 +0000 (18:19 +0100)]
librpc/ndr: let ndr_push/pull_DATA_BLOB() look at LIBNDR_FLAG_REMAINING before LIBNDR_ALIGN_FLAGS
metze
(cherry picked from commit
6c3a49ced333988b21d86e47b2b1dd1a5957e15c)
(cherry picked from commit
5f8b7f95e9ce5946f048b242dbbaa14897aea919)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Günther Deschner [Thu, 22 Apr 2010 09:42:45 +0000 (11:42 +0200)]
spoolss: pretty-print a struct spoolss_Time.
Guenther
(cherry picked from commit
440075247d11a7852d8567753f426fa67f41d875)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Günther Deschner [Mon, 2 Aug 2010 13:52:09 +0000 (15:52 +0200)]
spoolss: fix potential crash bug in spoolss_PrinterEnumValues push path.
Guenther
(cherry picked from commit
45952b56797982d27731b20d97f5648c9414814a)
(cherry picked from commit
ad68e45b505331683a2510de20f113a7c20e68e1)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Jonathan Nieder [Sun, 2 Jan 2011 08:40:09 +0000 (02:40 -0600)]
s3-param: Make "rlimit_max below minimum Windows limit" notification less scary
The fix to bug #6837 results in messages from testparm that look
like a misconfiguration even though they aren't:
rlimit_max: rlimit_max (8192) below minimum Windows limit (16384)
Apply a slight change in wording ("increasing rlimit_max to minimum
Windows limit") to make it clearer that the user has done nothing
wrong. (Similarly for sysctl_max.)
Reported-by: Miguel Medalha <miguelmedalha@sapo.pt>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Rusty Russell [Fri, 20 Nov 2009 09:39:57 +0000 (10:39 +0100)]
s3:vfs:gpfs: fix logic when gpfs:winattr is false (the default!)
On my autocluster setup, it's not set. Maybe it should be? Otherwise
smbclient and some Windows client programs will get errors like:
# smbclient //localhost/data -Uadministrator%XXX
Domain=[VSOFS1] OS=[Unix] Server=[Samba 3.4.2-ctdb-10]
smb: \> put /etc/resolv.conf resolv.conf
NT_STATUS_ACCESS_DENIED closing remote file \resolv.conf
smb: \>
Caused by attempting to update the time on close.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit
385d925f7e0fedca7d480e4f25d89e3194433b88)
Fix bug #7498 (robocopy fails to a GPFS share when setting the date).
Jeremy Allison [Thu, 24 Feb 2011 02:24:41 +0000 (18:24 -0800)]
Fix bug 7950 - Samba 3.5.x fails BASE-CREATEX_SHAREMODES_DIR smbtorture4 test
We need to revalidate the pathname once re-constructed from a root fsp.
Jeremy.
(cherry picked from commit
916e82823b56a70d7761644b38a250ea8c38e204)
Karolin Seeger [Mon, 28 Feb 2011 13:46:28 +0000 (14:46 +0100)]
WHATSNEW: Start release notes for 3.5.8.
Karolin
(cherry picked from commit
6964fc50a01d53dd4ad05895213fbb66f66898f4)
Karolin Seeger [Mon, 28 Feb 2011 13:44:31 +0000 (14:44 +0100)]
VERSION: Bump version number up to 3.5.8.
Karolin
(cherry picked from commit
1faa7a838e91d894026e009f463cb9e629a86a60)
Karolin Seeger [Sun, 27 Feb 2011 17:42:19 +0000 (18:42 +0100)]
WHATSNEW: Prepare 3.5.7 release notes.
Karolin
(cherry picked from commit
ba3837e1ce6024e8cc5153e803d32a6ed750408b)
Jeremy Allison [Sun, 27 Feb 2011 16:58:06 +0000 (17:58 +0100)]
Fix denial of service - memory corruption.
CVE-2011-0719
Fix bug #7949 (DoS in Winbind and smbd with many file descriptors open).
All current released versions of Samba are vulnerable to
a denial of service caused by memory corruption. Range
checks on file descriptors being used in the FD_SET macro
were not present allowing stack corruption. This can cause
the Samba code to crash or to loop attempting to select
on a bad file descriptor set.
A connection to a file share, or a local account is needed
to exploit this problem, either authenticated or unauthenticated
(guest connection).
Currently we do not believe this flaw is exploitable
beyond a crash or causing the code to loop, but on the
advice of our security reviewers we are releasing fixes
in case an exploit is discovered at a later date.
(cherry picked from commit
c3ad6eb506623435d3d9ce62d6f34ed1c960d4be)
Günther Deschner [Fri, 7 Jan 2011 16:28:29 +0000 (17:28 +0100)]
s3-winbindd: let winbind try to use samlogon validation level 6. (bug #7945)
The benefit of this that it makes us more robust to secure channel resets
triggered from tools outside the winbind process. Long term we need to have a
shared tdb secure channel store though as well.
Guenther
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(similar to commit
f60398d7b20869d7b09d81854f3727fdcd897430)
(similar to commit
7add712498fe93603b1bffff2c633e097ce8fbdf)
Volker Lendecke [Tue, 7 Sep 2010 03:58:45 +0000 (20:58 -0700)]
s3: Prune the printername cache when a printer is deleted.
Signed-off-by: Andreas Schneider <asn@samba.org>
Fix bug #7656 (Scalability problem with hundreds of printers).
Stefan Metzmacher [Tue, 1 Feb 2011 17:46:57 +0000 (18:46 +0100)]
s3:winbindd: catch lookup_names/sids schannel errors over ncacn_ip_tcp (bug #7944)
If winbindd connects to a domain controller it doesn't establish the lsa
connection over ncacn_ip_tcp direct. This happens only on demand.
If someone does a 'net rpc testjoin' and then a
wbinfo -n DOMAIN\\administrator, we'll get DCERPC faults with
ACCESS_DENIED/SEC_PKG_ERROR, because winbindd's in memory copy
of the schannel session key is invalidated.
This problem can also happen on other calls, but the
lookup_names/sids calls on thet lsa ncacn_ip_tcp connection
are the most important ones.
The long term fix is to store the schannel client state in a
tdb, but for now it's enough to catch the error and invalidate
the all connections to the dc and reestablish the schannel
session key.
The fix for bug 7568 (commit
be396411a4e1f3a174f8a44b6c062d834135e70a)
made this worse, as it assumes winbindd's in memory session key is
always the current one.
metze
(cherry picked from commit
255f2e06991aa543cd2c6f4d0123664b2a76c99d)
(cherry picked from commit
a699ac50f7c9a5eeb57215879e17631c9a1f534f)
Stefan Metzmacher [Wed, 2 Feb 2011 13:18:33 +0000 (14:18 +0100)]
librpc/rpc: display DCERPC_FAULT_SEC_PKG_ERROR nicely in dcerpc_errstr()
metze
Stefan Metzmacher [Wed, 2 Feb 2011 13:20:58 +0000 (14:20 +0100)]
rerun 'make samba3-idl'
metze
Stefan Metzmacher [Sun, 30 Jan 2011 16:34:11 +0000 (17:34 +0100)]
dcerpc.idl: add DCERPC_FAULT_SEC_PKG_ERROR
metze
(cherry picked from commit
8d07deaeaacbd376f9824ac350c01510e05a76ca)
(cherry picked from commit
85358c0534472fde71e304ddada678b61637ba40)
Stefan Metzmacher [Mon, 24 Jan 2011 07:47:12 +0000 (08:47 +0100)]
s3:lib/events: use DLIST_DEMOTE() for fd events
This makes sure that fd events doesn't dry out,
because a fd with a lower number is busy.
metze
The last 3 patches address bug #7942 (inotify can somehow cause endless loops in
with select()).
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Mon Jan 31 16:59:44 CET 2011 on sn-devel-104
(cherry picked from commit
ad10289ebcc78ab62ec86abb29f81eb769d17f4e)
(cherry picked from commit
3d2f72844a221dbdfe94fbf6e2b45c98ee158a9b)
Stefan Metzmacher [Mon, 24 Jan 2011 08:00:53 +0000 (09:00 +0100)]
s3:smbd: let smbd_server_connection_loop_once() check for select errors
metze
(cherry picked from commit
0bbe7334d69bcaa476f0741e0bd9685b023a4208)
(cherry picked from commit
d677921237c66e6cdf83de04e16c576a101d6493)
Stefan Metzmacher [Mon, 24 Jan 2011 07:57:47 +0000 (08:57 +0100)]
s3:lib/events: don't loop over fd events is select gave -1
metze
(cherry picked from commit
1f2be10ebf4cc06e3b7aac41ea35bfc4a41ce828)
(cherry picked from commit
d506b574bb94fdc23c5a62c5326cd478b5b63a11)
Volker Lendecke [Sat, 29 Jan 2011 09:59:14 +0000 (10:59 +0100)]
s3: Fix bug 7940 -- fall back for utimes calls
There are systems where ./configure has detected advanced utimes calls which
are then not available on other kernels. We should do a proper fallback.
Volker Lendecke [Sat, 22 Jan 2011 15:22:42 +0000 (16:22 +0100)]
s3: Fix connecting to port-139 only servers
When the TCP RST came before the 5 msecs timeout kicked in, we
viewed this as final, as state->req_139 was not set yet.
Fix bug introduced by a fix for bug #7881 (winbind flaky against w2k8).
Karolin Seeger [Sat, 15 Jan 2011 18:19:43 +0000 (19:19 +0100)]
Revert "s3-printing: update parent smbd pcap cache"
This reverts commit
5a2b2d4aeb6fe4af13aa0c92d22ba5bc9b7f7e13.
Karolin Seeger [Sat, 15 Jan 2011 18:19:13 +0000 (19:19 +0100)]
Revert "s3-printing: reload shares after pcap cache fill"
This reverts commit
a8a01e4a3dcafd97372021d0d6f859fd3a69235f.
This commit seems to break 'make test'.
Volker Lendecke [Fri, 14 Jan 2011 15:43:00 +0000 (16:43 +0100)]
s3: Fix bug 7917: Yet another bug in chain_reply
Found by Michael Hanscho <samba@micha.priv.at> with a WinCE client.
Björn Baumbach [Wed, 22 Dec 2010 14:20:29 +0000 (15:20 +0100)]
s3-rpcclient: Fix bug #7880: cmd_spoolss_deletedriver() returned without checking all architectures.
Continues now with next architecture if no driver is available.
Because of the broken behavior of the rpccli_*() functions,
we need special error code handling.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
f5af66e67d7c6d62315671c0cf57f47973316226)
David Disseldorp [Mon, 10 Jan 2011 13:08:07 +0000 (14:08 +0100)]
s3-printing: update parent smbd pcap cache
If a client connects to a samba share and while connected a printer is
added, the client will see the new printer share after a maximum of
'printcap cache time' seconds.
smbd's forked for new client connections inherit printcap information
from the parent (listener) smbd, which does not perform updates on
printcap cache time expiry. Therefore newly connected clients may
initially be presented with stale printer shares.
Add a housekeeping function to the parent smbd to ensure newly connected
clients see up to date printer shares.
The last 2 patches address bug #7836 (A newly added printer isn't visbile to
clients).
David Disseldorp [Sun, 19 Dec 2010 18:52:08 +0000 (19:52 +0100)]
s3-printing: reload shares after pcap cache fill
Since commit
eada8f8a, updates to the cups pcap cache are performed
asynchronously - cups_cache_reload() forks a child process to request
cups printer information and notify the parent smbd on completion.
Currently printer shares are reloaded immediately following the call to
cups_cache_reload(), this occurs prior to smbd receiving new cups pcap
information from the child process. Such behaviour can result in stale
print shares as outlined in bug 7836.
This fix ensures print shares are only reloaded after new pcap data has
been received.
Pair-Programmed-With: Lars Müller <lars@samba.org>
Günther Deschner [Mon, 29 Nov 2010 16:56:40 +0000 (17:56 +0100)]
s3-spoolss: Fix Bug #7641: handle win9x adddriver calls w/o config file.
This turned cupsaddsmb to run into an infinite loop.
Guenther
(cherry picked from commit
c62509c8f2589e7b952517626d61ee34b83e96b3)
(cherry picked from commit
0a0f3b4947689ca4ab7015e9a1ace8d204bab9f3)
Andrew Bartlett [Fri, 10 Dec 2010 04:32:08 +0000 (15:32 +1100)]
s3-dns Don't use DELEG_FLAG in DNS update, Windows 2008R2 does not like it (cherry picked from commit
280caa6b3bb1199939f9349ea5a436a491c81791)
The last 2 patches address bug #7356 (net ads dns register fails in 2008 R2
domain).
Andrew Bartlett [Fri, 10 Dec 2010 04:30:22 +0000 (15:30 +1100)]
s3-dns Don't use SEQUENCE_FLAG in DNS update, Windows 2008R2 does not like it
Andrew Bartlett
(cherry picked from commit
0f1cc889a26477e9a98629f120fe5890b2e106fa)
Stefan Metzmacher [Mon, 3 Jan 2011 15:58:56 +0000 (16:58 +0100)]
s3:net_rpc_vampire_keytab: don't return -1 on success (bug #7899)
metze
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Mon Jan 3 19:05:11 CET 2011 on sn-devel-104
(cherry picked from commit
ddbbc7b12ae8e51bc9658e3356bbeefe314f55bb)
(cherry picked from commit
32d111bef6d38bc3f946e68f133d37e1f1cc25bc)
Björn Baumbach [Fri, 7 Jan 2011 14:53:13 +0000 (15:53 +0100)]
s3-nmbd: Fix bug #7875
nmbd --port didn't work
Stefan Metzmacher [Wed, 29 Dec 2010 11:08:19 +0000 (12:08 +0100)]
s3:lib/netapi: don't set SAMR_FIELD_FULL_NAME if we just want to set the account name (bug #7896)
metze
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Dec 30 18:09:13 CET 2010 on sn-devel-104
(cherry picked from commit
f1d15ea54c313e71fc032b2ed191bdecad868858)
Stefan Metzmacher [Thu, 23 Dec 2010 07:17:48 +0000 (08:17 +0100)]
s3:libsmb: use 16 zero bytes as channel binding checksum in the gssapi checksum (bug #7883)
This fixes SMB session setups with kerberos against some closed
source SMB servers.
The new behavior matches heimdal and mit.
metze
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Dec 23 09:38:43 CET 2010 on sn-devel-104
(cherry picked from commit
e9dddc55e324c62973e6a561477b532cf9ed79af)
(cherry picked from commit
3356192af5d36fbe986c4728162d10fe883ba2fd)
Andrew Bartlett [Sat, 11 Sep 2010 06:13:33 +0000 (16:13 +1000)]
s3-krb5 Fix Kerberos on FreeBSD with Samba4 DCs
The idea of this patch is: Don't support a mix of different kerberos
features.
Either we should prepare a GSSAPI (8003) checksum and mark the request as
such, or we should use the old behaviour (a normal kerberos checksum of 0 data).
Sending the GSSAPI checksum data, but without marking it as GSSAPI broke
Samba4, and seems well outside the expected behaviour, even if Windows accepts it.
Andrew Bartlett
(cherry picked from commit
3b4db34011f06fb785153fa9070fb1da9d8f5c78)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sun, 2 Jan 2011 06:42:57 +0000 (07:42 +0100)]
s3: Fix a memleak in receive_getdc_response
The last 2 patches addresbug #7879 (Memory problems in winbind).
Volker Lendecke [Sun, 2 Jan 2011 01:48:03 +0000 (02:48 +0100)]
Fix a valgrind error
Thanks to Tridge for the hint.
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Sun Jan 2 10:58:51 CET 2011 on sn-devel-104
Volker Lendecke [Sat, 18 Dec 2010 15:02:09 +0000 (16:02 +0100)]
s3: Fix bug 7066 -- wbcAuthenticateEx gives unix times
We might eventually want to change this, but right now we get unix times
out of the winbind pipe struct
Volker Lendecke [Tue, 6 Jul 2010 14:55:14 +0000 (16:55 +0200)]
s3: Fix another aspect of bug 7262
(Unable to maintain users' groups via UsrMgr)
Björn Jacke [Fri, 26 Nov 2010 00:32:53 +0000 (01:32 +0100)]
ѕ3/configue: set Tru64 cc's PIC switch right (none)
-fPIC made shared library builds fail there
Fixes #7821
(cherry picked from commit
dbcf73c45782c310cb7ff1f2177d410399e2f06d)
Michael Adam [Thu, 30 Dec 2010 10:12:42 +0000 (11:12 +0100)]
s3:winbind: fix bug #7894 - sporadic winbind panic in rpc query_user_list
correctly evaluate return code of rpccli_samr_QueryDisplayInfo()
before accessing results.
Jeremy Allison [Wed, 29 Dec 2010 01:24:27 +0000 (17:24 -0800)]
Fix bug #7892 - open_file_fchmod() leaves a stale lock.
Volker Lendecke [Tue, 21 Dec 2010 20:55:01 +0000 (21:55 +0100)]
s3: Use smbsock_any_connect in winbind
The last 7 patches address bug #7881 (winbind flaky against w2k8).
Volker Lendecke [Tue, 21 Dec 2010 17:52:53 +0000 (18:52 +0100)]
s3: Retry *SMBSERVER in nb_connect
Volker Lendecke [Mon, 13 Dec 2010 16:17:51 +0000 (17:17 +0100)]
s3: Add smbsock_any_connect
Volker Lendecke [Sun, 12 Dec 2010 17:55:06 +0000 (18:55 +0100)]
s3: Add an async smbsock_connect
This connects to 445 and after 5 milliseconds also to 139. It treats a netbios
session setup failure as equivalent as a TCP connect failure. So if 139 is
faster but fails the nb session setup, the 445 still has the chance to succeed.
Volker Lendecke [Wed, 22 Dec 2010 14:21:27 +0000 (15:21 +0100)]
v3-5-test: Pull in tevent_req_poll_ntstatus from master
Volker Lendecke [Sun, 12 Dec 2010 17:54:31 +0000 (18:54 +0100)]
s3: Add async cli_session_request
This does not do the redirects, but I think that might be obsolete anyway
Volker Lendecke [Sun, 12 Dec 2010 17:53:49 +0000 (18:53 +0100)]
s3: Add some const to name_mangle()
Stefan Metzmacher [Thu, 16 Dec 2010 11:07:24 +0000 (12:07 +0100)]
s3:net ads dns register: use "cluster addresses" option if configured (bug #7871)
metze
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Fri Dec 17 16:49:14 CET 2010 on sn-devel-104
(cherry picked from commit
1dc2fa7616207a2d3a9f1cbe69b2ec1fc61634fd)
(cherry picked from commit
9a40e5f6a500571cc752383ca7fa27347e4efa45)
Michael Adam [Thu, 16 Dec 2010 00:49:14 +0000 (01:49 +0100)]
s3:net ads dns register: add support for specifying addresse on the commandline (bug #7871)
In the clustering case, this is also made the only possiblity to do dns updates,
since the list addresses on the local interfaces is not suitable in that case.
This fixes the "net ads dns register" part of bug #7871.
It might be extended by a parsing of the "cluster addresses" setting.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
5e83a05009787d8a2086db1adc1ed58d61b3725d)
(cherry picked from commit
9ed3d33fb3d7365a127ea2752032840272697902)
Michael Adam [Wed, 15 Dec 2010 23:52:41 +0000 (00:52 +0100)]
s3:net: add net_update_dns_ext() that accepts a list of addresses as parameter (bug# 7871)
This generalized form of net_update_dns() will be used to
add support for specifying a list of addresses on the commandline
of "net ads dns register".
This prepares the "net ads dns register" part of the fix for bug #7871.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
4d91f98b433e07922373bf4e3ba9668b7af71a00)
(cherry picked from commit
4b7775500b1055acf62decbc0fc8283b088da452)
Michael Adam [Wed, 1 Dec 2010 23:42:21 +0000 (00:42 +0100)]
s3:net: disable dynamic dns updates at the end of "net ads join" in a cluster (bug #7871)
In a clustered environment, registering the set of ip addresses that are
assigned to the interfaces of the node that performs the join does usually
not have the desired effect, since the local interfaces do not carry
complete set of the cluster's public IP addresses. And it can also contain
internal addresses that should not be visible to the outside at all.
In order to do dns updates in a clustererd setup, use net ads dns register.
This fixes the net ads join part of bug #7871.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
b8f19df53e66bf0260b4ae6c49acea87ac379deb)
(cherry picked from commit
1c73d52ddddfcec25cf079da4a0d6bf81fb030da)
Andrew Bartlett [Fri, 10 Dec 2010 04:08:53 +0000 (15:08 +1100)]
s3-net Allow 'net ads dns register' to take an optional hostname argument
This allows the administrator to more carefully chose what name to register.
Andrew Bartlett
(cherry picked from commit
c2a1ad9047508cf2745a9019e6783c8b8f7ef475)
(cherry picked from commit
10c5a59315ef69eeb4d8bc19237de9787284a63d)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 1 Dec 2010 23:39:23 +0000 (00:39 +0100)]
s3:ntlm_auth: support clients which offer a spnego mechs we don't support (bug #7855)
Before we rejected the authentication if we don't support the
first spnego mech the client offered.
We now negotiate the first mech we support.
This fix works arround problems, when a client
sends the NEGOEX (1.3.6.1.4.1.311.2.2.30) oid,
which we don't support.
metze
(cherry picked from commit
f802075f08fe0d86f3d176f2302236aeb5834f3d)
Modified to work in the v3-5-test branch, e.g. use ntlmssp_end()
The last 9 patches address bug #7855 (ntlm_auth only handles the first spnego
mech).
Stefan Metzmacher [Wed, 1 Dec 2010 04:59:16 +0000 (05:59 +0100)]
s3:ntlm_auth: free session key, as we don't use it (at least for now)
metze
(cherry picked from commit
ee4f5ac6182969bcab91955e6d6581e408d222f1)
Stefan Metzmacher [Wed, 1 Dec 2010 04:50:59 +0000 (05:50 +0100)]
s3:ntlm_auth: fix memory leak in the raw ntlmssp code path
metze
(cherry picked from commit
9a56ade6b1d627126418c75de4602610b4482503)
Stefan Metzmacher [Tue, 30 Nov 2010 09:52:52 +0000 (10:52 +0100)]
s3: Correctly unwrap the krb ticket in gss-spnego (cherry picked from commit
547b268cfaa2e791bf92e8804bfa504c4e37050b)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
renamed to _spnego_parse_krb5_wrap()
metze
Volker Lendecke [Thu, 16 Sep 2010 08:22:00 +0000 (10:22 +0200)]
s3: Fall back to raw NTLMSSP for the gss-spnego protocol
This is to handle the mod_auth_ntlm_winbind protocol
sending "Negotiate" to IE, which sends raw NTLMSSP
instead of a SPNEGO wrapped NTLMSSP blob.
(cherry picked from commit
70ab7eb5303a5ff058939541dd5bc1f81113a48e)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 30 Nov 2010 09:46:28 +0000 (10:46 +0100)]
s3: Split off output generation from manage_squid_ntlmssp_request (cherry picked from commit
de2c143f4d540f695db5c7fe8685614c03977365)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Thu, 16 Sep 2010 08:36:21 +0000 (10:36 +0200)]
s3: Wrap the ntlm_auth loop with a talloc_stackframe (cherry picked from commit
ae483bbe9af526623189cefe7735f3f2813da6d7)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Wed, 15 Sep 2010 08:29:44 +0000 (10:29 +0200)]
s3: Fix some debug msgs in ntlm_auth (cherry picked from commit
6400f3ee62108e3dd1e6c1013ccea9fb4b08d562)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Mon, 13 Sep 2010 16:09:20 +0000 (18:09 +0200)]
ntlm_auth: Fix a valgrind error (cherry picked from commit
69db4b4ccf051b05517e6eb9039ab48f90608075)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Holger Hetterich [Sat, 4 Dec 2010 17:18:50 +0000 (18:18 +0100)]
Fix bso#3185, return false when EOF is encountered in param name.
Jeremy Allison [Sun, 5 Dec 2010 19:40:21 +0000 (20:40 +0100)]
s3: Fix bug 7843: Expand the local SAMs aliases
Volker Lendecke [Sat, 4 Dec 2010 19:34:05 +0000 (20:34 +0100)]
s3: Fix bug 7842: WINBINDD_LOOKUPRIDS does not return the domain name
Volker Lendecke [Sat, 4 Dec 2010 19:31:36 +0000 (20:31 +0100)]
s3: Fix bug 7841: WINBINDD_LOOKUPRIDS asks the wrong domain
Jeremy Allison [Thu, 2 Dec 2010 23:27:17 +0000 (15:27 -0800)]
Fix bug #7835 - vfs_fill_sparse() doesn't use posix_fallocate when strict allocate is on
Tries posix_fallocate() and then falls back to old code.
Jeremy.
Volker Lendecke [Sat, 13 Nov 2010 17:03:25 +0000 (18:03 +0100)]
s3: Fix "force group" with ntlmssp guest session setup
This one is subtle: Set "force group = <somegroup>" together with "guest ok =
yes". Then try "smbclient //server/share -U%". Works. Then try to connect to
the same share from Windows 2003 using an anonymous connection. Breaks with
make_connection: connection to share denied due to security descriptor
although the share_info.tdb is empty. I've seen reports of this on the lists,
but I could never ever nail it until a customer gave me access to such a box.
What happens? With an empty share_info.tdb we create a security descriptor
allow everything to the world. The problem with the above parameter combination
is that S-1-1-0 (World) is lost in the token. When you look at the callers of
create_local_token, they are only called if the preceding check_ntlm_password
did not create server_info->ptok. Not so with the one in auth_ntlmssp.c. So, if
we get a NTLMSSP session setup with user="", domain="", pass="" we call
create_local_token even though check_guest_security() via
make_server_info_guest() has already correctly done so. In this case
create_local_token puts S-1-1-0 into user_sids[1], which is supposed to be the
primary group sid of the user logging in. "force group" then overwrites this ->
the world is gone -> "denied due to security descriptor".
Why don't you see it with smbclient -U% (anonymous connection)? smbclient does
not use ntlmssp for anon session setup.
This seems not to happen to 3.6.
Volker
Fix bug #7817 ("force group" broken).
Volker Lendecke [Thu, 18 Nov 2010 12:28:47 +0000 (13:28 +0100)]
s3: Make winbind recover from a signing error
When winbind sees a signing error on the smb connection to a DC (for whatever
reason, our bug, network glitch, etc) it should recover properly. The "old"
code in clientgen.c just closed the socket in this case. This is the right
thing to do, this connection is spoiled anyway. The new, async code did not do
this so far, which led to the code in winbindd_cm.c not detect that we need to
reconnect.
Fix bug #7800 (winbind does not recover from smb signing errors).
olivier [Wed, 10 Nov 2010 16:48:06 +0000 (17:48 +0100)]
switch from mtime to ctime which is more reliable if files can be accessed outside samba as well
Fix bug #7789 (change vfs_scannedonly from mtime to ctime).
Jeremy Allison [Tue, 23 Nov 2010 22:21:25 +0000 (14:21 -0800)]
Fix bug #7812 - vfs_acl_xattr/vfs_acl_tdb: ACL inheritance cannot be disabled
We were losing the incoming security descriptor revision number and
most importantly the "type" field as sent by the client. Ensure we
correctly store these in the xattr object.
Jeremy.
Jeremy Allison [Wed, 17 Nov 2010 23:58:15 +0000 (15:58 -0800)]
Fix our privileges code to display privileges with the "high" 32-bit value set.
SeSecurityPrivilege is the first LUID we have added that has a non-zero
"high" value, ensure our LUID code correctly supports it.
Jeremy.
The last 14 patches address bug #7716 (acl_xattr and acl_tdb modules don't store
unmodified copies of security descriptors).