Andrew Bartlett [Sun, 10 Nov 2013 21:38:03 +0000 (10:38 +1300)]
TODO:SIGN-OFF: s4-auth: Support password history correctly, including allowing NTLM logins using the old password
This is only done during a 1 hour allowed period, by default.
We only update bad password count when not one of the last 3 passwords
Andrew Bartlett
Change-Id: I76fd8010ce273a21efb55f9601d17b9978a0acf0
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
TODO: Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 9 Dec 2013 01:23:49 +0000 (14:23 +1300)]
lib/param: Add new parameter "old password allowed period"
Change-Id: I46228b492ba71ba4f3fee380a1ccadb328e3ade1
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Thu, 5 Dec 2013 03:57:49 +0000 (16:57 +1300)]
torture-samr: Lock accounts for 50 seconds in rpc.samr.passwords.lockout test to ensure consistent results
Change-Id: I886eb83d4c620e4d719a38ec47b45bacd1406b9d
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Sun, 24 Nov 2013 21:03:05 +0000 (10:03 +1300)]
REVIEW/RUN selftest: Add test for password lockout
Change-Id: Ia690b83f82b5ad7b02b203ffdecd2e05066b6711
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Mon, 4 Nov 2013 08:37:45 +0000 (21:37 +1300)]
REVIEW:UF_LOCKOUT dsdb: reset badPwdCount and and remove lockoutTime on password change
Change-Id: I93dec072012773364d2e60fdf32f50f7775ef577
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
REVIEW: "lockoutTime" NULL vs. 0
REVIEW: ACB_AUTOLOCK|ACB_PW_EXPIRED vs. UF_LOCKOUT|UF_PASSWORD_EXPIRED
REVIEW: should this be implicitly done when verifying the old password?
REVIEW: don't we need everything from authsam_zero_bad_pwd_count()?
Andrew Bartlett [Sun, 16 Mar 2014 09:17:51 +0000 (22:17 +1300)]
dsdb-tests: Remove pointless creation of ldaptestou
This is not used in this test, and is not removed by the test either.
Andrew Bartlett
Change-Id: I34366d469a1ebed04c3cea5a7f206cb0bf433e03
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Mon, 2 Dec 2013 02:44:37 +0000 (15:44 +1300)]
dsdb: check type with talloc_get_type_abort in samdb_set_password
Change-Id: Ie5b534c70dd87ecf58d6a830e38750ecf16eb855
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Wed, 6 Nov 2013 04:11:18 +0000 (17:11 +1300)]
dsdb: Implement password lockout on LDAP password changes
To do this, and have the badPwdCount update stick, we must abort,
open, close and reopen transactions such that the badPwdCount update
is in it's own transaction.
To ensure the tests can confirm the correct behaviour here, we must
output the Windows error code in the error message.
Andrew Bartlett
Change-Id: I5b1515b26b308301cf90ce8a3c848a3cedee85a2
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Thu, 28 Nov 2013 03:18:31 +0000 (16:18 +1300)]
dsdb: Move dsdb_update_bad_pwd_count to dsdb/common/util.c
This allows the password_hash code to call the same update routine.
Andrew Bartlett
Change-Id: I3d954469defa3f5d26ffc5ae0583ec7e1957ea11
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Thu, 28 Nov 2013 02:42:07 +0000 (15:42 +1300)]
auth: Split out badPwdCount update into a helper function
This will allow password_hash to call this using dsdb_module_*() functions.
Andrew Bartlett
Change-Id: Ib6705300f3f12f4e5e9c73bfd041e6f72bb3ac4a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Tue, 26 Nov 2013 04:04:46 +0000 (17:04 +1300)]
dsdb: collapse wrong password and no-password-hash errors into one handler
This avoids giving away too much information to an attacker.
Andrew Bartlett
Change-Id: Id0c0ec508304990e64e5d728396d0d0c1cd7f966
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Tue, 26 Nov 2013 02:32:18 +0000 (15:32 +1300)]
kdc: call authsam_zero_bad_pwd_count on successful AS-REQ
Change-Id: I91bb663dcf1b1033cf756a860404c677e4ac4ade
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Tue, 18 Feb 2014 00:53:38 +0000 (13:53 +1300)]
heimdal: Only indicate successful authentication after successful authz
This is needed to match Windows behaviour for NTLM logins.
Andrew Bartlett
Change-Id: I142de19b480cd6499d6f7f025f655e220558d54c
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Sun, 16 Mar 2014 09:34:49 +0000 (22:34 +1300)]
dsdb: Remove reset of lockoutTime, this is only handled in the SAMR server
Tests indicate that direct manipulation of this generated flag on userAccountControl has no impact.
Andrew Bartlett
Change-Id: I87f1c2b56d268fc87fab625ce5aa797bd7c8a93a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Tue, 26 Nov 2013 03:30:42 +0000 (16:30 +1300)]
REVIEW:UF_LOCKOUT s4-samr: Reset badPwdCount and lockoutTime when ACB_AUTOLOCK is removed from the acct_ctrl
Change-Id: I891e6f38edc1f74a717a0e71b434486e029d1e14
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
REVIEW: "lockoutTime" NULL vs. 0
REVIEW: ACB_AUTOLOCK|ACB_PW_EXPIRED vs. UF_LOCKOUT|UF_PASSWORD_EXPIRED
Andrew Bartlett [Thu, 28 Nov 2013 00:28:29 +0000 (13:28 +1300)]
heimdal: Do not attempt password authentication for locked out accounts
Change-Id: I49695cc4ae0dd0b02034e5411b277882ec5f5f44
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 25 Nov 2013 01:13:02 +0000 (14:13 +1300)]
kdc: Match windows and return KRB5KDC_ERR_CLIENT_REVOKED when the account is locked out
Change-Id: I3c306d1516aa569549f5f024fe1fff2d4f2abefc
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Sun, 10 Nov 2013 22:35:12 +0000 (11:35 +1300)]
s4-auth: Add authsam_zero_bad_pwd_count to zero out badPwdCount and lockoutTime on successful login
Change-Id: I2530f08a91f9b6484203dbdaba988f2df1a04ea1
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Sun, 10 Nov 2013 21:37:38 +0000 (10:37 +1300)]
dsdb: Add samdb_result_passwords_from_history helper function
Change-Id: I949c6c64551f68c4381b41b30120874ead82949e
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Sun, 10 Nov 2013 21:32:58 +0000 (10:32 +1300)]
s4-auth: Rework memory handling to use a tmp_ctx
Change-Id: Iceb4a04dbd04f581d2bbade86213c8ecfa35d306
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Fri, 8 Nov 2013 00:38:22 +0000 (13:38 +1300)]
samba-tool add password lockout handling to samba-tool domain passwordsettings
Change-Id: I291924785b505b26b91152c0c13b4afd4de068a6
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Thu, 7 Nov 2013 04:04:14 +0000 (17:04 +1300)]
torture-samr: Try breaking the NT hash first, as the LM hash may not be being checked
Change-Id: Iea9040bc7130f8b779c35bd367a9915633cd494d
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Wed, 6 Nov 2013 02:54:17 +0000 (15:54 +1300)]
dsdb: give a better error message and return code on failed password change
Change-Id: I064a7e192caccbb5acc17ba385f1625425c176d1
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Tue, 5 Nov 2013 21:39:42 +0000 (10:39 +1300)]
s4:auth: Add password lockout support to the AD DC
Change-Id: I25d10da50dd6119801cd37349cce970599531c6b
Pair-Programmed-With: Arvid Requate <requate@univention.de>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Arvid Requate <requate@univention.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 4 Nov 2013 08:37:17 +0000 (21:37 +1300)]
dsdb: Put password lockout support in samdb_result_passwords()
This seems to be the best choke point to check for locked out
accounts, as aside from the KDC, all the password authentication and
change callers use it.
Andrew Bartlett
Change-Id: I0f21a79697cb8b08ef639445bd05a896a2c9ee1b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Tue, 29 Oct 2013 21:50:19 +0000 (10:50 +1300)]
kdc: Include values from msDS-User-Account-Control-Computed when checking user flags
Change-Id: I27280d7dd139c6c65dddac611dbdcd7e518ee536
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Tue, 29 Oct 2013 04:30:18 +0000 (17:30 +1300)]
dsdb: Rework samdb_result_acct_flags to use either userAccountControl or msDS-User-Account-Control-Computed
This allows us to avoid the domain lookup in the constructed attribute
when not required.
By using msDS-User-Account-Control-Computed the lockout and password
expiry checks are now handled in the operational ldb module.
Andrew Bartlett
Change-Id: I6eb94933e4602e2e50c2126062e9dfa83a46191b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Tue, 29 Oct 2013 02:44:15 +0000 (15:44 +1300)]
dsdb-operational: Implement msDS-UserPasswordExpiryTimeComputed
This assists in testing this aspect of
msDS-User-Account-Control-Computed, and is exposed in AD for clients
to query.
Andrew Bartlett
Change-Id: I10fd214b0585a16f8addb00c252f656419a03f4a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Tue, 29 Oct 2013 02:38:08 +0000 (15:38 +1300)]
TODO:SIGN-OFF: dsdb-operational: Implement msDS-User-Account-Control-Computed
This is needed to get consistent account lockout support across the whole server.
Andrew Bartlett
Change-Id: I2fa1e707d33f5567b6cb4e2b27e340fa9f40cee9
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
TODO: Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 28 Oct 2013 23:31:46 +0000 (12:31 +1300)]
kdc: Set flags.locked_out on a locked-out user.
This only changes the log output, the same error is still returned
Change-Id: Id3c13e9373140c276783e5bd288f29de2bf4a45d
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 28 Oct 2013 23:30:58 +0000 (12:30 +1300)]
dsdb-operational: Use a list for the extra attributes that may be required
Change-Id: Ifa2e006c9401e92e71d6588d6ea879c6f437cdd5
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Sun, 3 Nov 2013 23:30:55 +0000 (12:30 +1300)]
selftest: Run rpc.samr.passwords.lockout against the s3dc environment
Change-Id: I7ee562cbf1e067ed90b22e212002e88752450e34
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Fri, 8 Nov 2013 03:21:39 +0000 (16:21 +1300)]
torture-samr: set min password age to 0 for lockout and badpwdcount tests
Change-Id: I0d44fcc712e6f239d9adc739fdafc1b20dd2beba
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Thu, 31 Oct 2013 03:57:47 +0000 (16:57 +1300)]
torture-samr: Make failures easier to trace with torture_assert
Change-Id: I729ba2f0a0501575357977754401a0cb40d95b34
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Wed, 30 Oct 2013 01:16:27 +0000 (14:16 +1300)]
torture-samr: Indent samba3-skip block
Change-Id: I2bb9f175e61401606742737a883604b922044ea5
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Wed, 30 Oct 2013 01:16:03 +0000 (14:16 +1300)]
torture-samr: Actually fail on failures in rpc.samr, rather than just printing pretty warnings
Change-Id: I00d66ecd84cd1a7d733f491d19328cec93ba8d2b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 25 Nov 2013 01:09:48 +0000 (14:09 +1300)]
kerberos: Map KRB5KDC_ERR_CLIENT_REVOKED to NT_STATUS_ACCOUNT_LOCKED_OUT
Change-Id: I333083e11a56d0f99ec36df25a96804d0ff2d110
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 25 Nov 2013 01:09:26 +0000 (14:09 +1300)]
ldb_ildap: Map some wrong username/password errors on to LDB_ERR_INVALID_CREDENTIALS
This is better than just LDB_ERR_OPERATIONS_ERROR for all errors.
Andrew Bartlett
Change-Id: Id832cf02fcd1dc0347d5ab9eb9a2db78fda39dc6
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 25 Nov 2013 01:08:38 +0000 (14:08 +1300)]
auth: Pass though error from GENSEC sub-mechanism
This allows wrong-password or account-locked-out errors to be passed
though from Kerberos (gssapi).
Andrew Bartlett
Change-Id: I4bc11a1ad98dfbcc5a4ad9101cd843a7a59f0b59
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Fri, 14 Feb 2014 10:13:37 +0000 (23:13 +1300)]
selftest: make blackbox_setpassword.sh test run independently
Change-Id: I8f3cdfc2c66800f9a1e11aec4f25a42752b6b205
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Thu, 5 Dec 2013 03:06:46 +0000 (16:06 +1300)]
s3-auth: Do not reset bad password count to 0 if account is disabled
Change-Id: I895435fb278eae5d92b4a8e15d062769c0e8a71a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Thu, 31 Oct 2013 03:59:16 +0000 (16:59 +1300)]
s3-auth: Only call pdb_get_acct_ctrl() once in check_sam_security
Change-Id: I43792711543e25c50c29ab5a24d16f614c670cca
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 25 Nov 2013 04:23:53 +0000 (17:23 +1300)]
torture/samr: Re-open the user when checking for ACB_AUTOLOCK
This flag appears to be cached from the open, so the test incorrectly
indicated that the flag was not set over SAMR.
Andrew Bartlett
Change-Id: I2f1f017191dddb6c2ac496712064fa1b6b48be53
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Sun, 3 Nov 2013 23:26:18 +0000 (12:26 +1300)]
torture-samr: Set lockout_seconds to 60 for samba3
The source3 account policy code deals with lockouts in terms of
minutes, not nanoseconds, so we have to lock out for at least 60
seconds otherwise we do not wait long enough.
Andrew Bartlett.
Change-Id: I2b30d1c0d9b020b3aba6ed3343361e9a576b7d9a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Wed, 30 Oct 2013 01:09:15 +0000 (14:09 +1300)]
s3-samr: Refuse to set lockout_duration < lockout_window per rpc.samr.passwords.lockout
This was not noticed previously because the test was not run.
Andrew Bartlett
Change-Id: I88701b6c3057ec26f44b3ccab4134ac9aabe552a
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Sat, 25 Jan 2014 10:14:36 +0000 (11:14 +0100)]
s4:librpc/rpc: use dcerpc_binding_get_object() in order to pass the object to the epmapper
This way we'll be able to do epmapper lookups for the DFS-R (MS-FRS2) endpoint, by using
"
5bc1ed07-f5f5-485f-9dfd-
6fd0acf9a23c@ncacn_ip_tcp:hostname.exmple.com[krb5,seal]"
as binding.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Fri, 7 Feb 2014 21:17:43 +0000 (22:17 +0100)]
s4:librpc/tests: assert the the abstract syntax has the expected value (null)
This makes sure that it's not mixed with the object guid anymore.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 11 Mar 2014 07:49:07 +0000 (08:49 +0100)]
librpc/rpc: finally maintain only the object guid
This has nothing to do with ndr_syntax_id...
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 4 Feb 2014 12:52:26 +0000 (13:52 +0100)]
librpc/rpc: maintain "abstract_syntax" as string option of dcerpc_binding
This should not be mixed with the object guid! They are different things!
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Mon, 10 Mar 2014 14:52:49 +0000 (15:52 +0100)]
s4:librpc/tests: reset the object on the binding created from the tower
The tower doesn't contain information about the object only about
the abstract syntax.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Thu, 16 Jan 2014 07:23:47 +0000 (08:23 +0100)]
s4:torture/raw: fix debug message in torture_raw_qfileinfo_pipe()
We no longer use dcerpc_pipe_open_smb() there.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 22 Jan 2014 10:19:15 +0000 (11:19 +0100)]
s4:torture/rpc: make use of dcerpc_binding_handle_auth_info() in backupkey.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 22 Jan 2014 10:19:15 +0000 (11:19 +0100)]
s4:torture/rpc: make use of dcerpc_binding_handle_auth_info() in lsa.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 22 Jan 2014 10:18:35 +0000 (11:18 +0100)]
s4:torture/rpc: fix altercontext test against windows
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 22 Jan 2014 11:22:30 +0000 (12:22 +0100)]
s4:torture/rpc: remove bogus rpc.multibind test
We can later add a more useful test that tests
security context multiplexing correctly.
And another one that demonstrates that only DCERPC_BIND
must be the first (and only the first) PDU on a connection.
Otherwise DCERPC_ALTER_CONTEXT is used.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 22 Jan 2014 11:21:50 +0000 (12:21 +0100)]
s4:selftest: don't run rpc.multibind anymore
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 22 Jan 2014 13:14:12 +0000 (14:14 +0100)]
s4:dsdb/repl: make use of dcerpc_binding_handle_is_connected()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Thu, 13 Feb 2014 17:55:48 +0000 (18:55 +0100)]
s4:librpc/test: test ipv6 addresses in dcerpc_binding strings
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Thu, 13 Feb 2014 17:55:10 +0000 (18:55 +0100)]
librpc/rpc: handle ipv6 addresses without transport in dcerpc_parse_binding()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 11 Mar 2014 15:28:16 +0000 (16:28 +0100)]
librpc/rpc: add "schannel" => DCERPC_SCHANNEL as ncacn_option
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Thu, 13 Feb 2014 17:00:36 +0000 (18:00 +0100)]
s4:librpc/tests: add more no transport tests
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Thu, 13 Feb 2014 18:51:30 +0000 (19:51 +0100)]
lib/util: let is_ipaddress_v6() cope with "fe80::1234%3"
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Thu, 16 Jan 2014 08:22:53 +0000 (09:22 +0100)]
s4:librpc/rpc: correctly map the fault code of alter context to NTSTATUS
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Thu, 23 Jan 2014 08:48:20 +0000 (09:48 +0100)]
s4:librpc/rpc: remove unused dcecli_connection->binding_string
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Thu, 23 Jan 2014 08:46:55 +0000 (09:46 +0100)]
s4:torture/rpc: avoid using dcecli_connection->binding_string
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 18 Mar 2014 06:07:13 +0000 (07:07 +0100)]
librpc/rpc: use dcerpc_binding_set_string_option(b, "endpoint", NULL) to reset the endpoint
We should always go through just one code path to [re]set a value.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 18 Mar 2014 06:07:13 +0000 (07:07 +0100)]
librpc/rpc: let dcerpc_binding_set_transport() also reset the assoc_group_id
This is transport/endpoint specific.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Sun, 16 Mar 2014 10:50:39 +0000 (11:50 +0100)]
libcli/smb: reuse tstream_smbXcli_np_disconnect_send/recv as helper
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Sun, 16 Mar 2014 10:50:39 +0000 (11:50 +0100)]
libcli/smb: add tstream_smbXcli_np_disconnect_cleanup() to handle talloc_free(req)
If the tevent_req of tstream_smbXcli_np_disconnect_* is explicitly or
implicitly free'ed, we need to make sure we still deliver the
close request to the server! Otherwise the SMB signing sequence gets out of
sync.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 22 Jan 2014 10:29:15 +0000 (11:29 +0100)]
libcli/smb: make TSTREAM_SMBXCLI_NP_MAX_BUF_SIZE public
This should be used to negotiate the may fragment size
of DCERPC connections.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 11 Mar 2014 13:29:46 +0000 (14:29 +0100)]
libcli/smb: keep references to smbXcli_{conn,session,tcon} in tstream_smbXcli_np
This fixes some valgrind errors when the smbXcli_tcon disappears before the
smbXcli_conn.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 11 Mar 2014 14:05:37 +0000 (15:05 +0100)]
s4:torture/rpc: fix error path in torture_leave_domain()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Mon, 3 Mar 2014 01:26:36 +0000 (14:26 +1300)]
build: Exclude source4/selftest/provisions/release-4-1-0rc3 from the tarball
Change-Id: Id4ddaabb91363174d2fbef09e823f53b13912a51
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Mar 21 10:06:04 CET 2014 on sn-devel-104
Andrew Bartlett [Thu, 27 Feb 2014 02:17:35 +0000 (15:17 +1300)]
dbcheck: Ensure dbcheck can operate with --attrs set
This also includes a test to ensure we do not regress on this point.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andreas Schneider [Thu, 20 Mar 2014 13:45:01 +0000 (14:45 +0100)]
s3-rpc_server: Fix handling of fragmented rpc requests.
We need to call pipe_init_outgoing_data() as the first thing in
process_complete_pdu(). Otherwise the caller may use uninitialized
memory and tries to write a response into the socket.
The problem happens only if a real socket is used, which means
in all cases for master and only with external rpc daemons in v4-0
and v4-1.
The problem looks like this in the logs.
[2014/03/20 14:49:35.531663, 10, pid=7309, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1627(process_complete_pdu)
Processing packet type 0
[2014/03/20 14:49:35.531695, 10, pid=7309, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request)
Checking request auth.
[2014/03/20 14:49:35.531738, 10, pid=7309, effective(0, 0), real(0, 0)] ../source3/rpc_server/rpc_server.c:521(named_pipe_packet_process)
Sending 1 fragments in a total of 0 bytes
[2014/03/20 14:49:35.531769, 10, pid=7309, effective(0, 0), real(0, 0)] ../source3/rpc_server/rpc_server.c:526(named_pipe_packet_process)
Sending PDU number: 0, PDU Length:
4294967228
[2014/03/20 14:49:35.531801, 2, pid=7309, effective(0, 0), real(0, 0)] ../source3/rpc_server/rpc_server.c:565(named_pipe_packet_done)
Writev failed!
[2014/03/20 14:49:35.531845, 2, pid=7309, effective(0, 0), real(0, 0)] ../source3/rpc_server/rpc_server.c:595(named_pipe_packet_done)
Fatal error(Message too long). Terminating client(127.0.0.1) connection!
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10481
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Guenther Deschner <gd@samba.org
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Thu Mar 20 18:30:17 CET 2014 on sn-devel-104
Günther Deschner [Thu, 20 Mar 2014 14:57:10 +0000 (15:57 +0100)]
s4-torture: add some tests for pre-allocated buffers in enumprinterdrivers call.
Guenther
Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Günther Deschner [Thu, 20 Mar 2014 14:56:13 +0000 (15:56 +0100)]
s4-torture: add test_EnumPrinterDrivers_buffers function.
This will allow to test the enumdriver call with pre-allocated buffer.
Guenther
Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Jeremy Allison [Mon, 17 Mar 2014 21:35:00 +0000 (14:35 -0700)]
s3: smbd: Fileserving share access checks.
Git commit
86d1e1db8e2747e30c89627cda123fde1e84f579
fixed share_access not being reset between users,
by changing make_connection_snum() to call a common
function check_user_share_access() in the same way
that change_to_user() (which can be called on any
incoming packet) does.
Unfortunately that bugfix was incorrect and
broke "force user" and "force group" as it
called check_user_share_access() inside
make_connection_snum() using the conn->session_info
pointer instead of the vuser->session_info pointer.
conn->session_info represents the token to use
when actually accessing the file system, and so
is modified by force user and force group.
conn->session_info represents the "pristine"
token of the user logging in, and is never modified
by force user and force group.
Samba 3.6.x checked the share access based on
the "pristine" token of the user logging in,
not the token modified by force user and force group.
This change restores the expected behavior.
Fixes bug #9878 - force user does not work as expected
https://bugzilla.samba.org/show_bug.cgi?id=9878
Signed-off-by: Jeremy Allison <jra@samba.org>
Tested-by: Gerhard Wiesinger <lists@wiesinger.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Mar 18 19:19:31 CET 2014 on sn-devel-104
Michael Adam [Tue, 18 Mar 2014 12:05:42 +0000 (13:05 +0100)]
tdb: change version to 1.2.13.
* internal code cleanups
* always open internal TDBs with incompatible hash
* avoid reallocations in locking code
* systematize output format in tdbtool dump
* reduce freelist contention when allocating new records
- try to find dead records also in other chains
- don't do blocking locks on the freelist
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Mar 18 15:42:48 CET 2014 on sn-devel-104
Volker Lendecke [Tue, 18 Mar 2014 07:04:42 +0000 (08:04 +0100)]
tdb: Reduce freelist contention
In a metadata-intensive benchmark we have seen the locking.tdb freelist to be
one of the central contention points. This patch removes most of the contention
on the freelist. Ages ago we already reduced freelist contention by using the
even much older DEAD records: If TDB_VOLATILE is set, don't directly put
deleted records on the freelist, but just mark a few of them just as DEAD. The
next new record can them re-use that space without consulting the freelist.
This patch builds upon the DEAD records: If we need space and the freelist is
busy, instead of doing a blocking wait on the freelist, start looking into
other chains for DEAD records and steal them from there. This way every hash
chain becomes a small freelist. Just wander around the hash chains as long as
the freelist is still busy.
With this patch and the tdb mutex patch (following hopefully some time soon)
you can see a heavily busy clustered smbd run without locking.tdb futex
syscalls.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Tue, 18 Mar 2014 07:03:16 +0000 (08:03 +0100)]
tdb: Make "tdb_purge_dead" internally public
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Tue, 18 Mar 2014 07:01:40 +0000 (08:01 +0100)]
tdb: Make "tdb_find_dead" internally public
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Tue, 18 Mar 2014 07:00:45 +0000 (08:00 +0100)]
tdb: Add "last_ptr" to tdb_find_dead
Will be used soon to unlink a dead record from a chain
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Tue, 18 Mar 2014 06:52:59 +0000 (07:52 +0100)]
tdb: Move adding tailer space to tdb_find_dead
This aligns the tdb_find_dead API with the tdb_allocate API and thus makes it a
bit easier to understand, at least for me.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Tue, 18 Mar 2014 06:46:38 +0000 (07:46 +0100)]
tdb: Do a best fit search for dead records
Hash chains are (or can be made) short enough that a full search for the
best-fitting dead record is feasible. The freelist can become much longer,
there we don't do the full search but accept records which are too large.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Mon, 17 Mar 2014 05:47:11 +0000 (06:47 +0100)]
tdb: Don't purge records to a blocked freelist
If the freelist is heavily contended, we should avoid accessing it
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sun, 16 Mar 2014 20:08:32 +0000 (20:08 +0000)]
tdb: Fix a tdb corruption
tdb_purge_dead can change the next pointer of "rec" if we purge the record
right behind the current record to be deleted. Just overwrite the magic,
not the whole record with stale data.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Andrew Bartlett [Fri, 28 Feb 2014 04:49:12 +0000 (17:49 +1300)]
dsdb: Further assert that we always have an objectClass and an rDN
We must have these two elements in a replPropertyMetaData for it to be
valid.
We may have to relax this for new partition creation, but for now we
want to find and isolate the database corruption.
The printing of the LDIF is moved above the checks to make it easier
to diagnoise the failures when further reproduced.
Based initially on a patch originally by Arvid Requate <requate@univention.de>
Andrew Bartlett
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Change-Id: I5f583d89e6d4c5e8e2d9667f336a0e8fd8347b25
Reviewed-on: https://gerrit.samba.org/164
Reviewed-by: Kamen Mazdrashki <kamenim@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Mar 17 06:44:17 CET 2014 on sn-devel-104
Andrew Bartlett [Tue, 29 Oct 2013 21:21:00 +0000 (10:21 +1300)]
wintest: Try harder to make wintest force the telnet server to start
We try and force the server to start, and we try to force the
TelnetClients group to exist
Change-Id: I192f0aaaf283b77065ecc671ca2b59a69781d744
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-on: https://gerrit.samba.org/36
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Mar 14 14:51:20 CET 2014 on sn-devel-104
Andrew Bartlett [Mon, 2 Dec 2013 02:47:42 +0000 (15:47 +1300)]
ldapsrv: Pass struct ldb_result * rather than void *
Change-Id: Ic521cbfcf922cfe9e14c89116c097b777a86af40
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-on: https://gerrit.samba.org/35
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Christof Schmitt [Thu, 13 Mar 2014 16:26:44 +0000 (09:26 -0700)]
docs: Add gpfs:recalls parameter to vfs_gpfs manpage
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Mar 14 12:49:56 CET 2014 on sn-devel-104
Christian Ambach [Wed, 20 Mar 2013 14:16:37 +0000 (15:16 +0100)]
s3:modules/vfs_gpfs add gpfs:recalls option
When this option is set to no, an attempt to open an offline file will
be rejected with access denied. This helps preventing recall storms
triggered by careless applications like Finder and Explorer.
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Andrew Bartlett [Fri, 28 Feb 2014 09:59:06 +0000 (22:59 +1300)]
dsdb: Ensure to sort replPropertyMetaData as UNSIGNED, not SIGNED quantities
enum is an int, and therefore signed. Some attributes have the high bit set.
Andrew Bartlett
Change-Id: I39a5499b7c6bbb763e15977d802cda8c69b94618
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-on: https://gerrit.samba.org/163
Reviewed-by: Kamen Mazdrashki <kamenim@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar 14 10:16:41 CET 2014 on sn-devel-104
Andrew Bartlett [Thu, 20 Feb 2014 21:20:52 +0000 (10:20 +1300)]
kdc: Use correct KDC include path when building against the system heimdal
This ensures we notice any API changes at compile time.
Andrew Bartlett
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
Stefan Metzmacher [Wed, 12 Mar 2014 14:12:42 +0000 (15:12 +0100)]
selftest/subunithelper.py: correctly pass testsuite-uxsuccess to end_testsuite()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 13 23:49:36 CET 2014 on sn-devel-104
Stefan Metzmacher [Wed, 12 Mar 2014 14:12:42 +0000 (15:12 +0100)]
selftest/subunithelper.py: correctly handle fail_immediately in end_testsuite of FilterOps
This way --fail-immediately also works if a command segfaults.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Wed, 12 Mar 2014 14:12:42 +0000 (15:12 +0100)]
selftest/subunithelper.py: correctly handle unexpected success in FilterOps
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Mon, 17 Feb 2014 08:15:30 +0000 (09:15 +0100)]
script/autobuild: use --force-rebase option
This makes sure the current user will be the committer.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Jose A. Rivera [Mon, 3 Mar 2014 06:22:46 +0000 (11:52 +0530)]
lib/popt: Patch memory leak in popthelp.c
Memory created as "t" was not being free'd.
Change-Id: I5f6e20acc6c440a1cd9908aed7a90de2000f22f8
Coverity-Id: 240599
Coverity-Id: 240600
Signed-off-by: Jose A. Rivera <jarrpa@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
Jose A. Rivera [Mon, 3 Mar 2014 06:19:55 +0000 (11:49 +0530)]
lib/popt: Small whitespace fix for readability.
Change-Id: Ib920f7e84c0247a8f09aa4c79c65b26afb78f234
Signed-off-by: Jose A. Rivera <jarrpa@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
git.samba.org / metze / samba / wip.git / log