metze/samba/wip.git
3 years agosmbd: remove quota support for some ancient OSs
Uri Simchoni [Sun, 13 Mar 2016 06:18:47 +0000 (08:18 +0200)]
smbd: remove quota support for some ancient OSs

Remove quota support for SunOS4 and VxFS on Solaris 2

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
3 years agosamba3.blackbox.smbclient_auth.plain: Add new regression test case.
Robin Hack [Mon, 14 Mar 2016 13:37:10 +0000 (14:37 +0100)]
samba3.blackbox.smbclient_auth.plain: Add new regression test case.

Test case covers commit:
96a49d23a4caebefcea66cfb855fadbae12ccf7c

Test case covers segfault of smbclient binary when
client NTLMv2 auth = yes
client use spnego = no
client max protocol = NT1
options are used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11793
RH BUG: http://bugzilla.redhat.com/show_bug.cgi?id=1271763

How to test:
$ make -j test TESTS="samba3.blackbox.smbclient_auth.plain"
RESULD: Should PASS
$ git revert 96a49d23a4caebefcea66cfb855fadbae12ccf7c
$ make -j test TESTS="samba3.blackbox.smbclient_auth.plain"
RESULT: Should FAIL
(and you can see segfault in dmesg)

Signed-off-by: Robin Hack <rhack@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar 16 18:29:10 CET 2016 on sn-devel-144

3 years agoldb-samba:wscript: python_samba__ldb depends on pyauth
Stefan Metzmacher [Tue, 15 Mar 2016 16:02:03 +0000 (17:02 +0100)]
ldb-samba:wscript: python_samba__ldb depends on pyauth

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11789

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar 16 01:34:29 CET 2016 on sn-devel-144

3 years agos3:wscript: pylibsmb depends on pycredentials
Stefan Metzmacher [Tue, 15 Mar 2016 15:59:51 +0000 (16:59 +0100)]
s3:wscript: pylibsmb depends on pycredentials

The need for pytalloc-util was based on the fact that
pycredentials depends on pytalloc-util.

As pylibsmb only used pycredentials and not pytalloc-util directly,
we should depend on pycredentials.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11789

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agosmbd: enable multi-channel if 'server multi channel support = yes' in the config
Michael Adam [Tue, 26 Jan 2016 07:16:51 +0000 (08:16 +0100)]
smbd: enable multi-channel if 'server multi channel support = yes' in the config

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Mar 15 20:58:19 CET 2016 on sn-devel-144

3 years agoparam: add parameter "server multi channel support", defaults to off.
Günther Deschner [Wed, 20 Jan 2016 16:44:45 +0000 (17:44 +0100)]
param: add parameter "server multi channel support", defaults to off.

Guenther

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agos3: vfs: vfs_xattr_tdb - cleanup. Remove unneeded variable "path".
Jeremy Allison [Sat, 12 Mar 2016 00:07:20 +0000 (16:07 -0800)]
s3: vfs: vfs_xattr_tdb - cleanup. Remove unneeded variable "path".

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Tue Mar 15 11:45:19 CET 2016 on sn-devel-144

3 years agos3:vfs: Change get_acl_blob() to take a const smb_filename * parameter from const...
Jeremy Allison [Fri, 11 Mar 2016 23:50:57 +0000 (15:50 -0800)]
s3:vfs: Change get_acl_blob() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:smbd: Change refuse_symlink() to take a const smb_filename * parameter from const...
Jeremy Allison [Fri, 11 Mar 2016 23:38:28 +0000 (15:38 -0800)]
s3:smbd: Change refuse_symlink() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:smbd: Change get_ea_names_from_file() to take a const smb_filename * parameter...
Jeremy Allison [Fri, 11 Mar 2016 23:34:58 +0000 (15:34 -0800)]
s3:smbd: Change get_ea_names_from_file() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:smbd: Change get_ea_list_from_file_path() to take a const smb_filename * parameter...
Jeremy Allison [Fri, 11 Mar 2016 23:30:00 +0000 (15:30 -0800)]
s3:smbd: Change get_ea_list_from_file_path() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3: smbd: Change canonicalize_ea_name() to take a const smb_filename * parameter...
Jeremy Allison [Fri, 11 Mar 2016 23:25:54 +0000 (15:25 -0800)]
s3: smbd: Change canonicalize_ea_name() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3: smbd: Reformatting - remove unneeded const char *fname variable.
Jeremy Allison [Fri, 11 Mar 2016 23:23:23 +0000 (15:23 -0800)]
s3: smbd: Reformatting - remove unneeded const char *fname variable.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:vfs: vfs_streams_xattr.c: Change walk_xattr_streams() to const struct smb_filename...
Jeremy Allison [Fri, 11 Mar 2016 23:11:20 +0000 (15:11 -0800)]
s3:vfs: vfs_streams_xattr.c: Change walk_xattr_streams() to const struct smb_filename * from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:vfs: vfs_streams_xattr.c - Remove duplicate code. This is exactly vfs_stat_smb_bas...
Jeremy Allison [Fri, 11 Mar 2016 23:08:26 +0000 (15:08 -0800)]
s3:vfs: vfs_streams_xattr.c - Remove duplicate code. This is exactly vfs_stat_smb_basename().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3: vfs: vfs_solarisacl. refuse_symlink() means we can always use STAT here.
Jeremy Allison [Sat, 12 Mar 2016 00:01:31 +0000 (16:01 -0800)]
s3: vfs: vfs_solarisacl. refuse_symlink() means we can always use STAT here.

For a posix acl call on a symlink, we've already refused it.
For a Windows acl mapped call on a symlink, we want to follow
it.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3: vfs: vfs_hpuxacl. refuse_symlink() means we can always use STAT here.
Jeremy Allison [Fri, 11 Mar 2016 22:29:20 +0000 (14:29 -0800)]
s3: vfs: vfs_hpuxacl. refuse_symlink() means we can always use STAT here.

For a posix acl call on a symlink, we've already refused it.
For a Windows acl mapped call on a symlink, we want to follow
it.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agobuild: mark explicit dependencies on pytalloc-util
Garming Sam [Tue, 15 Mar 2016 00:29:54 +0000 (13:29 +1300)]
build: mark explicit dependencies on pytalloc-util

All subsystems that include pytalloc.h need to link against
pytalloc-util.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11789

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Tue Mar 15 07:08:16 CET 2016 on sn-devel-144

3 years agobuild: improve comments in tests/oldquotas.c
Uri Simchoni [Sun, 13 Mar 2016 05:17:23 +0000 (07:17 +0200)]
build: improve comments in tests/oldquotas.c

Add comments to #else and #endif

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Mar 15 02:18:15 CET 2016 on sn-devel-144

3 years agos3:vfs: Change smbacl4_GetFileOwner() to take const struct smb_filename * from const...
Jeremy Allison [Fri, 11 Mar 2016 00:17:32 +0000 (16:17 -0800)]
s3:vfs: Change smbacl4_GetFileOwner() to take const struct smb_filename * from const char *.

Preparing to remove vfs_stat_smb_basename() call.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
3 years agos3:smbd:vfs: Change posix_get_nt_acl() from const char * to const struct smb_filename *.
Jeremy Allison [Fri, 11 Mar 2016 00:05:48 +0000 (16:05 -0800)]
s3:smbd:vfs: Change posix_get_nt_acl() from const char * to const struct smb_filename *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
3 years agos3:smbd:vfs: Change smb_get_nt_acl_nfs4() to take a const struct smb_filename *.
Jeremy Allison [Thu, 10 Mar 2016 23:56:51 +0000 (15:56 -0800)]
s3:smbd:vfs: Change smb_get_nt_acl_nfs4() to take a const struct smb_filename *.

Push the struct further down closer to places that use
lp_posix_pathname() functions.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
3 years agos3:smbd: Fix build for vfs_aixacl2.c.
Jeremy Allison [Thu, 10 Mar 2016 23:34:58 +0000 (15:34 -0800)]
s3:smbd: Fix build for vfs_aixacl2.c.

Missed conversion of get_nt_acl_fn from const char *
to const struct smb_filename *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
3 years agos3: smbd: Remove the last lp_posix_pathnames() in the rename path.
Jeremy Allison [Thu, 10 Mar 2016 23:15:34 +0000 (15:15 -0800)]
s3: smbd: Remove the last lp_posix_pathnames() in the rename path.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
3 years agosmbd:smb2: remove an unnecessary !! cast.
Michael Adam [Thu, 3 Mar 2016 15:57:45 +0000 (16:57 +0100)]
smbd:smb2: remove an unnecessary !! cast.

Casting to bool is done implcitly upon assignment.
Thanks to Ralph for pointing this out!

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Mon Mar 14 23:01:31 CET 2016 on sn-devel-144

3 years agos3:libnet:libnet_join: update msDS-SupportedEncryptionTypes (if required) with machin...
Günther Deschner [Fri, 11 Mar 2016 22:15:06 +0000 (23:15 +0100)]
s3:libnet:libnet_join: update msDS-SupportedEncryptionTypes (if required) with machine creds.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Mar 14 19:38:48 CET 2016 on sn-devel-144

3 years agos3:libnet:libnet_join: fill in output enctypes and only modify when necessary.
Günther Deschner [Fri, 11 Mar 2016 15:05:53 +0000 (16:05 +0100)]
s3:libnet:libnet_join: fill in output enctypes and only modify when necessary.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agos3:libnet:libnet_join: define list of desired encryption types only once.
Günther Deschner [Fri, 11 Mar 2016 15:04:52 +0000 (16:04 +0100)]
s3:libnet:libnet_join: define list of desired encryption types only once.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agos3:librpc:idl:libnet_join: add encryption types to libnet_JoinCtx.
Günther Deschner [Fri, 11 Mar 2016 15:02:27 +0000 (16:02 +0100)]
s3:librpc:idl:libnet_join: add encryption types to libnet_JoinCtx.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agos3:libnet:libnet_join: always try to create machineaccount via LDAP first.
Günther Deschner [Thu, 10 Mar 2016 17:03:47 +0000 (18:03 +0100)]
s3:libnet:libnet_join: always try to create machineaccount via LDAP first.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agos3:libads:ldap: fix ads_check_ou_dn to deal with account_ou not being initialized
Günther Deschner [Fri, 11 Mar 2016 11:15:14 +0000 (12:15 +0100)]
s3:libads:ldap: fix ads_check_ou_dn to deal with account_ou not being initialized

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agos3:libads:ndr: add ADS_AUTH_USER_CREDS to ndr_print_ads_auth_flags()
Günther Deschner [Fri, 11 Mar 2016 11:13:24 +0000 (12:13 +0100)]
s3:libads:ndr: add ADS_AUTH_USER_CREDS to ndr_print_ads_auth_flags()

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agos3:libads:ldap: print LDAP error message with log level 10.
Günther Deschner [Fri, 4 Mar 2016 16:42:05 +0000 (17:42 +0100)]
s3:libads:ldap: print LDAP error message with log level 10.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agos3:libnet:libnet_join: prepare to allow connecting with machine creds.
Günther Deschner [Wed, 2 Mar 2016 17:07:53 +0000 (18:07 +0100)]
s3:libnet:libnet_join: prepare to allow connecting with machine creds.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agoPartly revert "s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add"
Günther Deschner [Fri, 11 Mar 2016 22:14:13 +0000 (23:14 +0100)]
Partly revert "s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add"

This partly reverts commit 0c74d62524db376b6a3fac00c688be0cdffcaa80.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agotests: Allow alternative error code for backupkey test
Garming Sam [Sun, 13 Mar 2016 23:02:06 +0000 (12:02 +1300)]
tests: Allow alternative error code for backupkey test

It appears that incorrect decryption triggers a different error code,
causing a test which fails every now and again, as sometimes the invalid
data will parse as a SID, and so pass one of the checks.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Mar 14 03:55:16 CET 2016 on sn-devel-144

3 years agodsdb/repl: Ensure we use the LOCAL attid value, not the remote one
Andrew Bartlett [Thu, 10 Mar 2016 00:43:15 +0000 (13:43 +1300)]
dsdb/repl: Ensure we use the LOCAL attid value, not the remote one

The key here is that while this never was an issue for builtin schema,
nor for objects with an msDS-IntID used outside the schema partition,
additional attributes added and used in the schema partition were
incorrectly using the wrong attributeID value in the replPropertyMetaData.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11783

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sun Mar 13 23:29:14 CET 2016 on sn-devel-144

3 years agos4:torture/lsa: improve debug message
Stefan Metzmacher [Thu, 10 Mar 2016 11:16:25 +0000 (12:16 +0100)]
s4:torture/lsa: improve debug message

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agos3:winbindd: don't unclude two '\0' at the end of the domain list
Stefan Metzmacher [Thu, 10 Mar 2016 11:17:43 +0000 (12:17 +0100)]
s3:winbindd: don't unclude two '\0' at the end of the domain list

This avoids a scary "trustdom_list_done: Got invalid trustdom response" message.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11782

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agobuild: fix disk-free quota support on Solaris 10
Uri Simchoni [Wed, 3 Feb 2016 04:41:42 +0000 (06:41 +0200)]
build: fix disk-free quota support on Solaris 10

Samba has no code to support quota on Solaris 10 (and possibly other
os's such as AIX) using the new quota interface. The new interface
serves both disk size/free space reporting (clamping the underlying
file system numbers with quota), and direct manipulation of the user's
quota.

However, there's legacy code that supports only disk size/free space on
Solaris 10. In the waf build, this code is not compiled because there is
no test for it.

This patch adds a test to see whether the legacy code can be used.

Issue reported and fix tested by Andrew Morgan <morgan@orst.edu>.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11788

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sun Mar 13 01:37:58 CET 2016 on sn-devel-144

3 years agosmbd: Only check dev/inode in open_directory, not the full stat()
Andrew Bartlett [Fri, 11 Mar 2016 01:27:53 +0000 (14:27 +1300)]
smbd: Only check dev/inode in open_directory, not the full stat()

This is needed because the smb2.create.mkdir-dup test creates a race,
and against an AD DC this can cause a flapping test if the lstat() and
stat() calls are made either side of the chown() due to creation of a
file by administrator.

Fix based on original patches by myself, by Douglas Bagnall
<douglas.bagnall@catalyst.net.nz>.  and Jeremy Allison <jra@samba.org>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11780

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Mar 12 09:43:21 CET 2016 on sn-devel-144

3 years agolib/socket/interfaces: Fix some uninitialied bytes.
Günther Deschner [Wed, 2 Mar 2016 17:32:53 +0000 (18:32 +0100)]
lib/socket/interfaces: Fix some uninitialied bytes.

Valgrind reports the following:

==26599== Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s)
==26599==    at 0x7014707: ioctl (in /usr/lib64/libc-2.22.so)
==26599==    by 0x79D1585: query_iface_speed_from_name (interfaces.c:152)
==26599==    by 0x79D1BBA: _get_interfaces (interfaces.c:277)
==26599==    by 0x79D1E80: get_interfaces (interfaces.c:368)
==26599==    by 0x508A7E3: load_interfaces (interface.c:612)
==26599==    by 0x150B30: main (net.c:963)
==26599==  Address 0xffefff0d8 is on thread 1's stack
==26599==  in frame #1, created by query_iface_speed_from_name
(interfaces.c:130)
==26599==
==26599== Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s)
==26599==    at 0x7014707: ioctl (in /usr/lib64/libc-2.22.so)
==26599==    by 0x79D15CC: query_iface_speed_from_name (interfaces.c:164)
==26599==    by 0x79D1BBA: _get_interfaces (interfaces.c:277)
==26599==    by 0x79D1E80: get_interfaces (interfaces.c:368)
==26599==    by 0x508A7E3: load_interfaces (interface.c:612)
==26599==    by 0x150B30: main (net.c:963)
==26599==  Address 0xffefff0d8 is on thread 1's stack
==26599==  in frame #1, created by query_iface_speed_from_name
(interfaces.c:130)

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
3 years agoselftest: mark samba4.winbind.struct.domain_info.ad_member as flapping
Stefan Metzmacher [Fri, 11 Mar 2016 09:49:21 +0000 (10:49 +0100)]
selftest: mark samba4.winbind.struct.domain_info.ad_member as flapping

See https://lists.samba.org/archive/samba-technical/2016-March/112861.html

  found 517 lines matching '^UNEXPECTED' in 641 files matching 'samba.stdout$'
   175 UNEXPECTED(failure): samba4.winbind.struct.domain_info(ad_member:local)
    19 UNEXPECTED(failure): samba4.winbind.struct.domain_info(s3member:local)
    12 UNEXPECTED(failure): samba4.rpc.backupkey with seal.backupkey.server_wrap_encrypt_decrypt_wrong_key(ad_dc_ntvfs)
    12 UNEXPECTED(failure): samba4.drs.delete_object.python(promoted_dc).delete_object.DrsDeleteObjectTestCase.test_ReplicateDeletedObject1(promoted_dc)
    12 UNEXPECTED(failure): samba4.rpc.backupkey with seal.backupkey.server_wrap_decrypt_wrong_r2(ad_dc_ntvfs)
    11 UNEXPECTED(failure): samba4.ldap.notification.python(ad_dc_ntvfs).__main__.LDAPNotificationTest.test_max_search(ad_dc_ntvfs)

We'll see if we also need to add
samba4.winbind.struct.domain_info.s3member
before we're able to identify and fix the problem.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Mar 12 02:14:39 CET 2016 on sn-devel-144

3 years agos4:dsdb/test/sort: avoid 'from collections import Counter'
Stefan Metzmacher [Fri, 11 Mar 2016 09:39:13 +0000 (10:39 +0100)]
s4:dsdb/test/sort: avoid 'from collections import Counter'

This is only available in python 2.7 and >= 3.1

This should fix make test with python 2.6.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:dsdb/test/notification: make test_invalid_filter more resilient against ordering...
Stefan Metzmacher [Fri, 11 Mar 2016 09:16:27 +0000 (10:16 +0100)]
s4:dsdb/test/notification: make test_invalid_filter more resilient against ordering races

We saw a lot of flapping tests with:

    [1793(11038)/1892 at 1h55m26s]
    samba4.ldap.notification.python(ad_dc_ntvfs)(ad_dc_ntvfs)
    UNEXPECTED(failure):
    samba4.ldap.notification.python(ad_dc_ntvfs).__main__.LDAPNotificationTest.test_max_search(ad_dc_ntvfs)
    REASON: Exception: Exception: Traceback (most recent call last):
      File
    "/memdisk/autobuild/fl/b1782183/samba/source4/dsdb/tests/python/notification.py",
    line 181, in test_max_search
        self.assertEquals(num, ERR_TIME_LIMIT_EXCEEDED)
    AssertionError: 11 != 3

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoAdded MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth
Herwin Weststrate [Wed, 9 Dec 2015 17:47:47 +0000 (18:47 +0100)]
Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth

An implementation of https://lists.samba.org/archive/samba/2012-March/166497.html (which has been discussed in 2012, but was never implemented).

It has been tested on a Debian Jessie system with this patch added to the Debian package (which is currently 4.1.17). Even though this is Samba 4, the ntlm_auth installed is the one from Samba 3 (yes, it surprised me too). The backend was a machine with Windows 2012R2.

It was first tested with the local security policy 'Network Security: LAN Manager authentication level' setting changed to 'Send NTLMv2 Response Only' (allow ntlm v1). This way we are able to authenticate with and without the MSV1_0_ALLOW_MSVCHAPV2 flag (as expected).

After the basic step has been verified, the local security policy 'Network Security: LAN Manager authentication level' setting was changed to 'Send NTLMv2 Response Only. Refuse LM & NTLM' (only allow ntlm v2). The behaviour now changed according to the MSV1_0_ALLOW_MSVCHAPV2 flag (again: as expected).

  $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain=
  Logon failure (0xc000006d)
  $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain= --allow-mschapv2
  NT_KEY: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

The changes in `wbclient.h` are intended for programs that use libwinbind directly instead of authenticating via `ntlm_auth`. I intend to use that within FreeRADIUS (see https://bugzilla.samba.org/show_bug.cgi?id=11149).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11694
Signed-off-by: Herwin Weststrate <herwin@quarantainenet.nl>
Reviewed-by: Kai Blin <kai@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoctdb-client: Increase the timeout for TRANS3_COMMIT control
Amitay Isaacs [Thu, 10 Mar 2016 07:01:31 +0000 (18:01 +1100)]
ctdb-client: Increase the timeout for TRANS3_COMMIT control

On a busy system, TRANS3_COMMIT control can take upto or longer than
3 seconds.  On timeout, there are few possible outcomes.

1. The transaction has completed on all nodes and TRANS3_COMMIT control
   has returned.  In such a case, there is no problem.

2. The transaction has completed on the local node, but TRANS3_COMMIT
   control is still active.  In such a case, ctdb_transaction_commit()
   can return successfully.  If this is being called from ctdb, then
   ctdb will exit.  This will cause ctdb daemon to trigger recovery
   since the client exited while transaction is active.  This will cause
   unnecessary recovery.

3. Database recovery was started and ctdb_transaction_commit() will
   retry till the recovery completes the transaction.

Increasing the timeout to 30 seconds will avoid the spurious database
recoveries when TRANS3_COMMIT control takes longer to finish.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Mar 11 19:59:53 CET 2016 on sn-devel-144

3 years agosmbd: Prevent a crash
Volker Lendecke [Thu, 10 Mar 2016 07:54:54 +0000 (08:54 +0100)]
smbd: Prevent a crash

smb2srv_session_close_previous_check crashes if
ndr_pull_smbXsrv_session_globalB fails for some reason. It depends on "is_free"
to be correctly set. All we can do for an invalid database is to discard the
record and set it free.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 11 00:12:18 CET 2016 on sn-devel-144

3 years agos3: smbd: Simplify logic inside rename_internals_fsp() part 2
Jeremy Allison [Thu, 10 Mar 2016 00:12:00 +0000 (16:12 -0800)]
s3: smbd: Simplify logic inside rename_internals_fsp() part 2

Removes the use of an extraneous 'struct smb_filename *'
which wasn't being created correctly, only as a place
holder for two char * pointers.

Use split_stream_filename() to create the char * pointers
directly and make it clearer what we're up to here.

The logic here is still complex, but I'm satified
it does the correct thing.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3: smbd: Simplify logic inside rename_internals_fsp() part 1.
Jeremy Allison [Thu, 10 Mar 2016 00:01:52 +0000 (16:01 -0800)]
s3: smbd: Simplify logic inside rename_internals_fsp() part 1.

Use standard parent_dirname() function instead of hand-hacking
using strrchr_m(xxx, '/'). Next commit should enable removal
of synthetic_smb_fname_split().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:lib: Move internal lp_posix_pathnames() call out of utility function synthetic_smb...
Jeremy Allison [Thu, 10 Mar 2016 00:00:47 +0000 (16:00 -0800)]
s3:lib: Move internal lp_posix_pathnames() call out of utility function synthetic_smb_fname_split().

Make it a passed in parameter instead.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:lib: Remove the const SMB_STRUCT_STAT * parameter from synthetic_smb_fname_split().
Jeremy Allison [Wed, 9 Mar 2016 23:50:02 +0000 (15:50 -0800)]
s3:lib: Remove the const SMB_STRUCT_STAT * parameter from synthetic_smb_fname_split().

Only one caller uses this, and this can be handled externally.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:lib: Rewrite synthetic_smb_fname_split() to use split_stream_filename().
Jeremy Allison [Wed, 9 Mar 2016 23:45:55 +0000 (15:45 -0800)]
s3:lib: Rewrite synthetic_smb_fname_split() to use split_stream_filename().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agos3:lib. Add split_stream_filename() Not yet used.
Jeremy Allison [Wed, 9 Mar 2016 22:56:49 +0000 (14:56 -0800)]
s3:lib. Add split_stream_filename() Not yet used.

Will replace internals of synthetic_smb_fname_split().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
3 years agoselftest: add some test cases to net ads join
Uri Simchoni [Wed, 4 Nov 2015 05:32:57 +0000 (07:32 +0200)]
selftest: add some test cases to net ads join

Perform a testjoin between steps to verify join status
Perform most testjoins with machine account because that's
the more common case.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Thu Mar 10 14:41:13 CET 2016 on sn-devel-144

3 years agoselftest: run net ads join test in a private client env
Uri Simchoni [Wed, 4 Nov 2015 05:31:47 +0000 (07:31 +0200)]
selftest: run net ads join test in a private client env

net ads join command changes machine password, thus affecting
the test environment beyond the thing we want to test.

This cange runs the test in a private client env, with its
own hostname, newly-generated machine SID, and a separate
secrets.tdb, thus not affecting the running AD member server,

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
3 years agos4:rpc_server: dcesrv_generic_session_key should only work on local transports
Stefan Metzmacher [Tue, 10 Nov 2015 09:25:10 +0000 (10:25 +0100)]
s4:rpc_server: dcesrv_generic_session_key should only work on local transports

This matches modern Windows servers.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Mar 10 10:15:21 CET 2016 on sn-devel-144

3 years agos4:rpc_server/samr: hide a possible NO_USER_SESSION_KEY error
Stefan Metzmacher [Fri, 26 Feb 2016 15:41:10 +0000 (16:41 +0100)]
s4:rpc_server/samr: hide a possible NO_USER_SESSION_KEY error

Windows servers doesn't return the raw NT_STATUS_NO_USER_SESSION_KEY
error, but return WRONG_PASSWORD or even hide the error by using a random
session key, that results in an invalid, unknown, random NTHASH.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:librpc/rpc: dcerpc_generic_session_key() should only be available on local transports
Stefan Metzmacher [Tue, 10 Nov 2015 09:25:10 +0000 (10:25 +0100)]
s4:librpc/rpc: dcerpc_generic_session_key() should only be available on local transports

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:torture:samba3rpc: use an authenticated SMB connection and an anonymous DCERPC...
Stefan Metzmacher [Tue, 15 Dec 2015 21:44:24 +0000 (22:44 +0100)]
s4:torture:samba3rpc: use an authenticated SMB connection and an anonymous DCERPC connection on top

This is the only way to get a reliable transport session key.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:selftest: run rpc.samr over ncacn_np instead of ncacn_ip_tcp
Stefan Metzmacher [Fri, 18 Dec 2015 19:18:42 +0000 (20:18 +0100)]
s4:selftest: run rpc.samr over ncacn_np instead of ncacn_ip_tcp

It requires a transport session key, which is only reliable available
over SMB.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:torture: the backupkey tests need to use ncacn_np: for LSA calls
Stefan Metzmacher [Mon, 29 Feb 2016 06:47:39 +0000 (07:47 +0100)]
s4:torture: the backupkey tests need to use ncacn_np: for LSA calls

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:torture/rpc: do testjoin only via ncalrpc or ncacn_np
Stefan Metzmacher [Thu, 17 Dec 2015 07:55:03 +0000 (08:55 +0100)]
s4:torture/rpc: do testjoin only via ncalrpc or ncacn_np

ncacn_ip_tcp doesn't have the required session key.
It used to be the wellknown "SystemLibraryDTC" constant,
but that's not available in modern systems anymore.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libsmb: remove unused functions in clispnego.c
Stefan Metzmacher [Wed, 2 Mar 2016 06:27:41 +0000 (07:27 +0100)]
s3:libsmb: remove unused functions in clispnego.c

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libsmb: remove unused cli_session_setup_kerberos*() functions
Stefan Metzmacher [Wed, 2 Mar 2016 06:27:16 +0000 (07:27 +0100)]
s3:libsmb: remove unused cli_session_setup_kerberos*() functions

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libsmb: make use of cli_session_setup_gensec*() for Kerberos
Stefan Metzmacher [Wed, 2 Mar 2016 13:58:30 +0000 (14:58 +0100)]
s3:libsmb: make use of cli_session_setup_gensec*() for Kerberos

This pares a fix for https://bugzilla.samba.org/show_bug.cgi?id=10288

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libsmb: call cli_state_remote_realm() within cli_session_setup_spnego_send()
Stefan Metzmacher [Wed, 2 Mar 2016 13:35:21 +0000 (14:35 +0100)]
s3:libsmb: call cli_state_remote_realm() within cli_session_setup_spnego_send()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libsmb: provide generic cli_session_setup_gensec_send/recv() pair
Stefan Metzmacher [Tue, 1 Mar 2016 14:47:11 +0000 (15:47 +0100)]
s3:libsmb: provide generic cli_session_setup_gensec_send/recv() pair

It will be possible to use this for more than just NTLMSSP in future.

This prepares a fix for https://bugzilla.samba.org/show_bug.cgi?id=10288

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libsmb: let cli_session_setup_ntlmssp*() use gensec_update_send/recv()
Stefan Metzmacher [Tue, 1 Mar 2016 17:31:50 +0000 (18:31 +0100)]
s3:libsmb: let cli_session_setup_ntlmssp*() use gensec_update_send/recv()

This pares a fix for https://bugzilla.samba.org/show_bug.cgi?id=10288

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libsmb: unused ntlmssp.c
Stefan Metzmacher [Wed, 9 Dec 2015 10:49:37 +0000 (11:49 +0100)]
s3:libsmb: unused ntlmssp.c

Everything uses the top level ntlmssp code via gensec now.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libsmb: make use gensec based SPNEGO/NTLMSSP
Stefan Metzmacher [Thu, 26 Nov 2015 13:34:46 +0000 (14:34 +0100)]
s3:libsmb: make use gensec based SPNEGO/NTLMSSP

This pares a fix for https://bugzilla.samba.org/show_bug.cgi?id=10288

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libads: make use of ads_sasl_spnego_gensec_bind() for GSS-SPNEGO with Kerberos
Stefan Metzmacher [Wed, 2 Mar 2016 10:42:51 +0000 (11:42 +0100)]
s3:libads: make use of ads_sasl_spnego_gensec_bind() for GSS-SPNEGO with Kerberos

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libads: keep service and hostname separately in ads_service_principal
Stefan Metzmacher [Wed, 2 Mar 2016 10:33:04 +0000 (11:33 +0100)]
s3:libads: keep service and hostname separately in ads_service_principal

Caller will use them instead of the full principal in future.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libads: don't pass given_principal to ads_generate_service_principal() anymore.
Stefan Metzmacher [Wed, 2 Mar 2016 10:31:01 +0000 (11:31 +0100)]
s3:libads: don't pass given_principal to ads_generate_service_principal() anymore.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libads: provide a generic ads_sasl_spnego_gensec_bind() function
Stefan Metzmacher [Wed, 9 Dec 2015 12:14:05 +0000 (13:14 +0100)]
s3:libads: provide a generic ads_sasl_spnego_gensec_bind() function

It will be possible to use this for more than just NTLMSSP in future.

Similar to https://bugzilla.samba.org/show_bug.cgi?id=10288

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libads: make use of GENSEC_OID_SPNEGO in ads_sasl_spnego_ntlmssp_bind()
Stefan Metzmacher [Wed, 9 Dec 2015 14:02:29 +0000 (15:02 +0100)]
s3:libads: make use of GENSEC_OID_SPNEGO in ads_sasl_spnego_ntlmssp_bind()

This avoids using the hand made spnego code, that
doesn't support the GENSEC_FEATURE_NEW_SPNEGO protection.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agos3:libads: make use of GENSEC_FEATURE_LDAP_STYLE
Stefan Metzmacher [Wed, 9 Dec 2015 14:04:02 +0000 (15:04 +0100)]
s3:libads: make use of GENSEC_FEATURE_LDAP_STYLE

This is more generic and will handle the
ntlmssp_[un]wrap() behaviour at the right level.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:libads: add missing TALLOC_FREE(frame) in error path
Stefan Metzmacher [Sat, 5 Mar 2016 01:53:45 +0000 (02:53 +0100)]
s3:libads: add missing TALLOC_FREE(frame) in error path

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:ldap_server: make use of GENSEC_FEATURE_LDAP_STYLE
Stefan Metzmacher [Wed, 9 Dec 2015 13:51:57 +0000 (14:51 +0100)]
s4:ldap_server: make use of GENSEC_FEATURE_LDAP_STYLE

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agos4:selftest: simplify the loops over samba4.ldb.ldap
Stefan Metzmacher [Fri, 18 Dec 2015 10:46:22 +0000 (11:46 +0100)]
s4:selftest: simplify the loops over samba4.ldb.ldap

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agos4:selftest: we don't need to run ldap test with --option=socket:testnonblock=true
Stefan Metzmacher [Fri, 18 Dec 2015 08:54:08 +0000 (09:54 +0100)]
s4:selftest: we don't need to run ldap test with --option=socket:testnonblock=true

The LDAP client library uses tstream and that handles non blocking
sockets natively.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agos4:libcli/ldap: fix retry authentication after a bad password
Stefan Metzmacher [Fri, 18 Dec 2015 12:10:58 +0000 (13:10 +0100)]
s4:libcli/ldap: fix retry authentication after a bad password

We need to start with an empty input buffer.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agos4:libcli/ldap: make use of GENSEC_FEATURE_LDAP_STYLE
Stefan Metzmacher [Wed, 9 Dec 2015 13:51:57 +0000 (14:51 +0100)]
s4:libcli/ldap: make use of GENSEC_FEATURE_LDAP_STYLE

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: remove ntlmssp_unwrap() fallback for LDAP
Stefan Metzmacher [Tue, 8 Mar 2016 11:58:51 +0000 (12:58 +0100)]
auth/ntlmssp: remove ntlmssp_unwrap() fallback for LDAP

This is now handled by GENSEC_FEATURE_LDAP_STYLE.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoauth/ntlmssp: add more compat for GENSEC_FEATURE_LDAP_STYLE
Stefan Metzmacher [Wed, 9 Dec 2015 13:48:14 +0000 (14:48 +0100)]
auth/ntlmssp: add more compat for GENSEC_FEATURE_LDAP_STYLE

We want also work against old Samba servers which didn't had
GENSEC_FEATURE_LDAP_STYLE we negotiate SEAL too. We may remove this in a few
years. As all servers should support GENSEC_FEATURE_LDAP_STYLE by then.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: implement GENSEC_FEATURE_LDAP_STYLE
Stefan Metzmacher [Wed, 9 Dec 2015 13:48:14 +0000 (14:48 +0100)]
auth/ntlmssp: implement GENSEC_FEATURE_LDAP_STYLE

We need to handle NTLMSSP_NEGOTIATE_SIGN as
NTLMSSP_NEGOTIATE_SEAL if GENSEC_FEATURE_LDAP_STYLE
is requested.

This works arround a bug in Windows, which allow signed only
messages using NTLMSSP and LDAP.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/gensec: add GENSEC_FEATURE_LDAP_STYLE define
Stefan Metzmacher [Wed, 9 Dec 2015 13:48:14 +0000 (14:48 +0100)]
auth/gensec: add GENSEC_FEATURE_LDAP_STYLE define

This will be used for LDAP connections and may trigger
backend specific behaviour.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: use ndr_push_AV_PAIR_LIST in gensec_ntlmssp_server_negotiate().
Günther Deschner [Tue, 18 Aug 2009 22:40:12 +0000 (00:40 +0200)]
auth/ntlmssp: use ndr_push_AV_PAIR_LIST in gensec_ntlmssp_server_negotiate().

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Günther Deschner <gd@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolibrpc/ndr: add ndr_ntlmssp_find_av() helper function
Stefan Metzmacher [Tue, 24 Nov 2015 14:40:29 +0000 (15:40 +0100)]
librpc/ndr: add ndr_ntlmssp_find_av() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agontlmssp.idl: make AV_PAIR_LIST public
Stefan Metzmacher [Thu, 19 Nov 2015 14:38:02 +0000 (15:38 +0100)]
ntlmssp.idl: make AV_PAIR_LIST public

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agontlmssp.idl: MsAvRestrictions is MsvAvSingleHost now
Stefan Metzmacher [Mon, 21 Dec 2015 08:07:57 +0000 (09:07 +0100)]
ntlmssp.idl: MsAvRestrictions is MsvAvSingleHost now

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agosecurity.idl: add LSAP_TOKEN_INFO_INTEGRITY
Stefan Metzmacher [Mon, 21 Dec 2015 08:06:56 +0000 (09:06 +0100)]
security.idl: add LSAP_TOKEN_INFO_INTEGRITY

This is used in [MS-KILE] and implicit in [MS-NLMP].

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: use ntlmssp_version_blob() in the server
Stefan Metzmacher [Tue, 24 Nov 2015 13:07:23 +0000 (14:07 +0100)]
auth/ntlmssp: use ntlmssp_version_blob() in the server

We already set NTLMSSP_NEGOTIATE_VERSION in
gensec_ntlmssp_server_start(), so it's always
set in chal_flags.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: let the client always include NTLMSSP_NEGOTIATE_VERSION
Stefan Metzmacher [Fri, 20 Nov 2015 09:52:29 +0000 (10:52 +0100)]
auth/ntlmssp: let the client always include NTLMSSP_NEGOTIATE_VERSION

This matches a modern Windows client.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: add ntlmssp_version_blob()
Stefan Metzmacher [Tue, 24 Nov 2015 13:05:17 +0000 (14:05 +0100)]
auth/ntlmssp: add ntlmssp_version_blob()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: don't send domain and workstation in the NEGOTIATE_MESSAGE
Stefan Metzmacher [Fri, 20 Nov 2015 09:52:29 +0000 (10:52 +0100)]
auth/ntlmssp: don't send domain and workstation in the NEGOTIATE_MESSAGE

We don't set NTLMSSP_NEGOTIATE_OEM_{DOMAIN,WORKSTATION}_SUPPLIED anyway.

This matches modern Windows clients.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: set NTLMSSP_ANONYMOUS for anonymous authentication
Stefan Metzmacher [Tue, 8 Dec 2015 12:59:42 +0000 (13:59 +0100)]
auth/ntlmssp: set NTLMSSP_ANONYMOUS for anonymous authentication

This matches a modern Windows client.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: define all client neg_flags in gensec_ntlmssp_client_start()
Stefan Metzmacher [Tue, 1 Dec 2015 10:01:24 +0000 (11:01 +0100)]
auth/ntlmssp: define all client neg_flags in gensec_ntlmssp_client_start()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: NTLMSSP_NEGOTIATE_VERSION is not a negotiated option
Stefan Metzmacher [Fri, 20 Nov 2015 09:52:29 +0000 (10:52 +0100)]
auth/ntlmssp: NTLMSSP_NEGOTIATE_VERSION is not a negotiated option

NTLMSSP_NEGOTIATE_VERSION only indicates the existence of the version
information in the packet.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
3 years agoauth/ntlmssp: split out a debug_ntlmssp_flags_raw() that's more complete
Stefan Metzmacher [Tue, 1 Dec 2015 10:16:02 +0000 (11:16 +0100)]
auth/ntlmssp: split out a debug_ntlmssp_flags_raw() that's more complete

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>