Herb Lewis [Mon, 7 Jul 2008 19:44:13 +0000 (12:44 -0700)]
use variables for files used in multiple places
(cherry picked from commit
cee044bc42d955c535dbb6bb372af01089d37756)
Michael Adam [Tue, 12 Aug 2008 13:19:17 +0000 (15:19 +0200)]
Make sure to always set errno on error path in OpenDir (and hence scan_directory).
Michael
Michael Adam [Tue, 12 Aug 2008 12:59:59 +0000 (14:59 +0200)]
Fix unix_convert() for "*" after changing map_nt_error_from_unix().
map_nt_error_from_unix() now assumes that it is called in
an error path and returns an error even for a given errno == 0.
The original behaviour of unix_convert() used the mapping
of errno == 0 ==> NT_STATUS_OK to return success through
an error path.
I think this must have been an oversight, and unix_convert() worked
only by coincidence (or because explicitly using the knowledge
of the conceptually wrong working of map_nt_error_from_unix().
This patch puts this straight by not interpreting errno == 0
as an error condition and proceeding in that case.
Jeremy - please check!
Michael
Andrew Tridgell [Sun, 10 Aug 2008 00:43:36 +0000 (10:43 +1000)]
I found lots of places where we assume error will be set when calling
one of our virtualised functions, such as db_open(), but error is only
set when a system call fails, and it is not uncommon for us to fail a
function internally without ever making a system call. That led to us
passing back success when a function had in fact failed.
I found two places where we relied on map_nt_error_from_unix()
returning success when errno==0, but lots and lots of places where we
relied on the reverse, so I fixed those two places.
map_nt_error_from_unix() will now always return an error, returning
NT_STATUS_UNSUCCESSFUL if errno is 0
(cherry picked from commit
69d40ca4c1af925d4b0e59ddc69ef8c26e6501d1)
Andrew Tridgell [Mon, 11 Aug 2008 07:21:11 +0000 (17:21 +1000)]
ensure we give an error code to any routines above that are looking
for one
Jeff Layton [Tue, 12 Aug 2008 18:32:54 +0000 (14:32 -0400)]
cifs.upcall: negatively instantiate keys on error
When a request-key upcall exits without instantiating a key, the kernel
will negatively instantiate the key with a 60s timeout. Older kernels,
however seem to also link that key into the session keyring. This
behavior can interefere with subsequent mount attempts until the
key times out. The next request_key() call will get this negative key
even if the upcall would have worked the second time.
Fix this by having cifs.upcall negatively instantiate the key itself
with a 1s timeout and don't attach it to the session keyring.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Volker Lendecke [Tue, 12 Aug 2008 09:59:13 +0000 (11:59 +0200)]
Remove two unused variables
Volker Lendecke [Tue, 29 Jul 2008 07:04:17 +0000 (09:04 +0200)]
Do not create a new mapping if a domain with an explicit config fails
Volker Lendecke [Fri, 18 Jul 2008 10:30:24 +0000 (12:30 +0200)]
Make the docs actually build
Thanks to Karolin for the friendly build service :-)
Volker Lendecke [Thu, 17 Jul 2008 12:05:57 +0000 (14:05 +0200)]
Document idmap rewrite
Volker Lendecke [Thu, 17 Jul 2008 11:32:28 +0000 (13:32 +0200)]
Some doxygen comments for idmap
Volker Lendecke [Wed, 16 Jul 2008 16:14:33 +0000 (18:14 +0200)]
Fix prototypes
Volker Lendecke [Wed, 16 Jul 2008 14:51:46 +0000 (16:51 +0200)]
Remove "idmap alloc config : range" parameter
This was overwritten by "idmap uid/gid" anyway. These are now the range
parameters for the alloc backend.
Volker Lendecke [Sun, 13 Jul 2008 10:07:40 +0000 (12:07 +0200)]
idmap rewrite
Volker Lendecke [Sun, 13 Jul 2008 07:59:57 +0000 (09:59 +0200)]
Remove the multi-ID lookup code and the 3.2.0 version of idmap_cache
Volker Lendecke [Mon, 14 Jul 2008 10:32:18 +0000 (12:32 +0200)]
Directly call backends from idmap_[ugs]_to_[ugs]id
Volker Lendecke [Fri, 11 Jul 2008 11:58:31 +0000 (13:58 +0200)]
Move the gid2sid cache to the parent winbind process
Volker Lendecke [Mon, 7 Jul 2008 20:09:39 +0000 (22:09 +0200)]
Move the uid2sid cache to the parent winbind process
Michael Adam [Tue, 12 Aug 2008 08:18:51 +0000 (10:18 +0200)]
WHATSNEW: fix one occurrence of 3.2.0 to say 3.3.0.
Michael
Günther Deschner [Wed, 30 Jul 2008 19:38:21 +0000 (21:38 +0200)]
libnetjoin: support kerberized joining/unjoing (fix #5416).
Guenther
Günther Deschner [Fri, 1 Aug 2008 17:15:52 +0000 (19:15 +0200)]
netapi: add NetLocalGroupSetMembers example code.
Guenther
Günther Deschner [Fri, 1 Aug 2008 15:13:43 +0000 (17:13 +0200)]
netapi: add NetLocalGroupDelMembers example code.
Guenther
Günther Deschner [Fri, 1 Aug 2008 14:03:00 +0000 (16:03 +0200)]
netapi: add NetLocalGroupAddMembers example code.
Guenther
Günther Deschner [Mon, 11 Aug 2008 17:43:24 +0000 (19:43 +0200)]
netapi: implement NetLocalGroupSetMembers_r().
Guenther
Günther Deschner [Mon, 11 Aug 2008 17:42:42 +0000 (19:42 +0200)]
netapi: implement NetLocalGroupDelMembers_r().
Guenther
Günther Deschner [Fri, 1 Aug 2008 14:02:21 +0000 (16:02 +0200)]
netapi: implement NetLocalGroupAddMembers_r().
Guenther
Günther Deschner [Thu, 31 Jul 2008 14:24:58 +0000 (16:24 +0200)]
netapi: add NetLocalGroup*Member calls to public headers.
Guenther
Günther Deschner [Thu, 31 Jul 2008 14:05:11 +0000 (16:05 +0200)]
netapi: add skeleton for NetLocalGroup*Member calls.
Guenther
Günther Deschner [Mon, 11 Aug 2008 17:08:46 +0000 (19:08 +0200)]
re-run make idl.
Guenther
Günther Deschner [Thu, 31 Jul 2008 14:03:57 +0000 (16:03 +0200)]
netapi: add remaining NetLocalGroup*Member calls to IDL.
Guenther
Günther Deschner [Thu, 31 Jul 2008 19:09:00 +0000 (21:09 +0200)]
netapi: add NetUserModalsGet and NetUserModalsSet tests.
Guenther
Günther Deschner [Thu, 31 Jul 2008 19:08:31 +0000 (21:08 +0200)]
netapi: implement NetUserModalsSet_r.
Guenther
Günther Deschner [Thu, 31 Jul 2008 17:26:29 +0000 (19:26 +0200)]
netapi: implement NetUserModalsGet_r.
Guenther
Günther Deschner [Thu, 31 Jul 2008 15:39:07 +0000 (17:39 +0200)]
netapi: add example code for NetUserModalsGet and NetUserModalsSet.
Guenther
Günther Deschner [Thu, 31 Jul 2008 14:47:15 +0000 (16:47 +0200)]
netapi: add NetUserModalsGet and NetUserModalsSet to public headers.
Guenther
Günther Deschner [Thu, 31 Jul 2008 14:43:27 +0000 (16:43 +0200)]
netapi: add skeleton for NetUserModalsGet and NetUserModalsSet.
Guenther
Günther Deschner [Mon, 11 Aug 2008 17:07:51 +0000 (19:07 +0200)]
re-run make idl.
Guenther
Günther Deschner [Thu, 31 Jul 2008 14:42:42 +0000 (16:42 +0200)]
netapi: add NetUserModalsSet and NetUserModalsGet to IDL.
Guenther
Günther Deschner [Fri, 1 Aug 2008 15:22:00 +0000 (17:22 +0200)]
doserr: add WERR_MEMBER_IN_ALIAS.
Guenther
Günther Deschner [Fri, 1 Aug 2008 14:44:05 +0000 (16:44 +0200)]
netapi: add NetApiBufferAllocate.
Guenther
Günther Deschner [Fri, 1 Aug 2008 13:15:05 +0000 (15:15 +0200)]
netapi: add ConvertStringSidToSid().
Guenther
Günther Deschner [Thu, 31 Jul 2008 19:04:51 +0000 (21:04 +0200)]
netapi: generate the netapi testsuite makefile.
Guenther
Günther Deschner [Mon, 11 Aug 2008 09:20:38 +0000 (11:20 +0200)]
fix build warning.
Guenther
Volker Lendecke [Sat, 9 Aug 2008 19:39:18 +0000 (21:39 +0200)]
Make events robust against their event_context being freed
Volker Lendecke [Sun, 10 Aug 2008 15:53:35 +0000 (17:53 +0200)]
fix smb_len calculation for chained requests
I think chain_reply() is one of the most tricky parts of Samba. This recursion
needs to go away, we need to sequentially walk the chain list.
Volker Lendecke [Sun, 10 Aug 2008 15:37:08 +0000 (17:37 +0200)]
Fix andx offset calculation for more than 2 chained requests
Untested code is broken code.... Test follows later, it's quite an intrusive
change to libsmb/
Volker Lendecke [Sun, 10 Aug 2008 09:33:15 +0000 (11:33 +0200)]
Remove an unused variable, process.c has its static copy
Michael Adam [Fri, 8 Aug 2008 23:04:55 +0000 (01:04 +0200)]
nmbd: add support for delayed initial samlogon packages.
The hosts or networks configured with "init logon delayed hosts"
have their initial samlogon packages (empty username) delayed
by the value configured with "init logon delay" (defaulting
to 100 milliseconds).
This gives the administrator some control over what clients would
consider the preferred logon server: they choose the server that
repsonds most quickly.
Michael
Michael Adam [Fri, 8 Aug 2008 23:03:06 +0000 (01:03 +0200)]
nmbd_packets: make queue_packet() public.
Michael
Michael Adam [Fri, 8 Aug 2008 22:31:48 +0000 (00:31 +0200)]
loadparm: add two parameters "init logon delay hosts" and "init logon delay"
"init logon delays hosts" takes a list of hosts names or addresses
or networks for which the initial SAMLOGON reply should be delayed
(so other DCs get preferred by XP workstations if there are any).
This option takes the same type of list as "hosts allow" does.
"init logon delay" allows one to configure the delay for the hosts
configured for delayed initial samlogon with "init logon delayed hosts".
The value is interpreted as milliseconds. The default value is 100.
This commit only introduces the parameters.
They will be activated in a subsequent commit.
Michael
Michael Adam [Fri, 8 Aug 2008 22:05:38 +0000 (00:05 +0200)]
lib/access: make list_match() public.
Michael
Michael Adam [Fri, 8 Aug 2008 22:03:23 +0000 (00:03 +0200)]
lib/access: make client_match() public.
Michael
Jeremy Allison [Fri, 8 Aug 2008 23:08:11 +0000 (16:08 -0700)]
One more build fix. Ensure we have KRB5_AUTH_CONTEXT_USE_SUBKEY defined before we compile the new code.
Jeremy.
Jeremy Allison [Fri, 8 Aug 2008 22:15:36 +0000 (15:15 -0700)]
Try and fix the build for systems that don't have krb5_auth_con_set_req_cksumtype().
Jeremy.
Jeremy Allison [Fri, 8 Aug 2008 21:33:55 +0000 (14:33 -0700)]
Merge branch 'v3-3-test' of ssh://jra@git.samba.org/data/git/samba into v3-3-test
Jeremy Allison [Fri, 8 Aug 2008 21:32:15 +0000 (14:32 -0700)]
Add Derrick Schommer's <dschommer@F5.com> kerberos delegation patch. Some
work by me and advice by Love.
Jeremy.
Michael Adam [Fri, 8 Aug 2008 21:30:19 +0000 (23:30 +0200)]
build: fix a no previous prototype warning when building without ldap/gssapia
move prototype of dns_create_update_request() to appropriate section in dns.h
Michael
Michael Adam [Fri, 8 Aug 2008 21:03:51 +0000 (23:03 +0200)]
libnet samsync ldif: fix the build without LDAP.
Michael
Yannick Bergeron [Fri, 8 Aug 2008 17:32:15 +0000 (13:32 -0400)]
using NGROUPS_MAX instead of 32 for the max group value in rep_initgroups() subroutine in lib/replace/replace.c
Volker Lendecke [Fri, 8 Aug 2008 16:30:57 +0000 (18:30 +0200)]
Add simple async wrappers around send, recv and connect
To be used later :-)
Jeremy Allison [Fri, 8 Aug 2008 00:55:57 +0000 (17:55 -0700)]
Fix bug #5675 with a varient of Tim Waugh's patch,
as proposed by James Peach.
Jeremy.
Jeremy Allison [Fri, 8 Aug 2008 00:49:19 +0000 (17:49 -0700)]
Fix "might be used uninitialized" warnings.
Jeremy.
Volker Lendecke [Thu, 7 Aug 2008 16:18:10 +0000 (18:18 +0200)]
Fix a build failure on host sunX
Yannick Bergeron [Wed, 6 Aug 2008 17:23:00 +0000 (13:23 -0400)]
Solve an IBM XL C/C++ compiler error encountered in get_exit_code() auth_errors array initialization in client/smbspool.c
Karolin Seeger [Wed, 6 Aug 2008 12:26:41 +0000 (14:26 +0200)]
WHATSNEW: Start WHATSNEW for 3.3.0pre1.
Karolin
Michael Adam [Wed, 6 Aug 2008 11:56:52 +0000 (13:56 +0200)]
libnetapi: fix build of shared library after libnet_join changes.
This needs create_builtin_administrators() and create_builtin_users()
from token_utils now. Did not pop up because the only users of the
shared lib currently are the examples in lib/netapi/examples/
which are not automatically built.
Michael
Andrew Tridgell [Wed, 6 Aug 2008 06:35:43 +0000 (16:35 +1000)]
fixed permissions on ctdb databases
Andrew Tridgell [Wed, 6 Aug 2008 04:02:45 +0000 (14:02 +1000)]
fixed a fd leak when trying to regain contact to a domain controller
in winbind
When a w2k3 DC is rebooted the 139/445 ports come up before the
udp/389 cldap port. During this brief period, winbind manages to
connect to 139/445 but not to udp 389. It then enters a tight loop
where it leaks one fd each time. In a couple of seconds it runs out of
file descriptors, and leaves winbind crippled after the DC does
finally come up
Michael Adam [Tue, 5 Aug 2008 21:38:56 +0000 (23:38 +0200)]
dbwrap: add comment describing behaviour of dbwrap_change_int32_atomic().
Michael
Michael Adam [Tue, 5 Aug 2008 21:14:05 +0000 (23:14 +0200)]
secrets: fix replacemend random seed generator (security issue).
This is a regression introduced by the change to dbwrap.
The replacement dbwrap_change_int32_atomic() does not
correctly mimic the behaviour of tdb_change_int32_atomic():
The intended behaviour is to use *oldval as an initial
value when the entry does not yet exist in the db and to
return the old value in *oldval.
The effect was that:
1. get_rand_seed() always returns sys_getpid() in *new_seed
instead of the incremented seed from the secrets.tdb.
2. the seed stored in the tdb is always starting at 0 instead
of sys_getpid() + 1 and incremented in subsequent calls.
In principle this is a security issue, but i think the danger is
low, since this is only used as a fallback when there is no useable
/dev/urandom, and this is at most called on startup or via
reinit_after_fork.
Michael
Michael Adam [Tue, 5 Aug 2008 21:13:06 +0000 (23:13 +0200)]
dbwrap: add comment describing behaviour of dbwrap_change_uint32_atomic().
Michael
Michael Adam [Tue, 5 Aug 2008 20:38:44 +0000 (22:38 +0200)]
idmap_tdb2: fix a race condition in idmap_tdb2_allocate_id().
The race is a regression introduced by the change to dbwrap.
It might have led to two concurrent processes returning the same id.
This fix is achieved by changing dbwrap_change_uint32_atomic() to
match the original behaviour of tdb_change_uint32_atomic(), which
is the following: *oldval is used as initial value when
the value does not yet exist and that the old value should be
returned in *oldval.
dbwrap_change_uint32_atomic() is used (only) in idmap_tdb2.c,
to get new ids.
Michael
Michael Adam [Mon, 4 Aug 2008 21:30:16 +0000 (23:30 +0200)]
registry: use _bystring wrappers to dbwrap_trans_(store|delete).
Michael
Steve French [Tue, 5 Aug 2008 20:36:11 +0000 (15:36 -0500)]
Building cifs.upcall is giving this build warning:
client/cifs.upcall.c:205: warning: function declaration isn’t a prototype
This patch fixes this by properly declaring usage() args as void.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@samba.org>
Steve French [Tue, 5 Aug 2008 18:27:07 +0000 (13:27 -0500)]
cifs.upcall: fix manpage and comments
The "cifs.resolver" key type has been changed to "dns_resolver". Fix
the comments at the top of cifs.upcall and the manpage accordingly.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@samba.org>
---
docs-xml/manpages-3/cifs.upcall.8.xml | 4 ++--
source/client/cifs.upcall.c | 8 ++++----
2 files changed, 6 insertions(+), 6 deletions(-)
Steve French [Tue, 5 Aug 2008 18:15:46 +0000 (13:15 -0500)]
Backing out most of changeset
5222b8db3fb692e5071bfd1b41849a8eb0a17995
(so parsing for domain parameter in mount.cifs matches online help)
and rephrasing original code to make it more clear.
The check for "domain" was meant to allow for "dom" or "DOM" and the
option ("dom") described in the help (e.g. "/sbin/mount.cifs -?") is the
shorter ("dom") form. The reason that the string we compare against
is larger was to improve readability (we could compare against "dom"
but note /* "domain" or "DOMAIN" or "dom" or "DOM" */ but it seemed
terser to just show the larger string in the strcmp target. The
change to "workgoup" from workg* (anything which begins with "workg"
doesn't matter - it is a minor behavior change - but probably few
scripts depend on the "alias" for this option).
Rework code so that it is clearer what we are comparing against.
Karolin Seeger [Tue, 5 Aug 2008 12:20:32 +0000 (14:20 +0200)]
man pages: Improve description of boolean values in smb.conf.5.
This fixes bug #5378.
Thanks Morton K. Poulsen <morten+bugzilla.samba.org [at] afdelingp.dk>
for reporting!
Karolin
Karolin Seeger [Tue, 5 Aug 2008 12:10:11 +0000 (14:10 +0200)]
man pages: Add documentation about smbclient command "rename".
This fixes bug #5268.
Thanks to Alexander Franz <a.franz [at] gmx.net> for reporting!
Karolin
Karolin Seeger [Tue, 5 Aug 2008 10:55:20 +0000 (12:55 +0200)]
README.Coding: A few minor fixes.
Karolin
Stefan Metzmacher [Mon, 4 Aug 2008 12:28:02 +0000 (14:28 +0200)]
libnet_keytab: fix the build with heimdal
metze
Stefan Metzmacher [Mon, 4 Aug 2008 11:52:18 +0000 (13:52 +0200)]
clikrb5: don't use krb5_keyblock_init() when no salt is specified
If the caller wants to create a key with no salt we should
not use krb5_keyblock_init() (only used when using heimdal)
because it does sanity checks on the key length.
metze
Volker Lendecke [Fri, 1 Aug 2008 14:05:49 +0000 (16:05 +0200)]
cli_request_new() already gave use the req, remove a pointless function call
Volker Lendecke [Fri, 1 Aug 2008 13:29:06 +0000 (15:29 +0200)]
Fix a typo
Michael Adam [Fri, 1 Aug 2008 15:13:42 +0000 (17:13 +0200)]
libnet dssync: start memory allocation cleanup: use tmp ctx in libnet_dssync().
Don't leak temporary data to callers but use a temporary context
that is freed at the end.
Michael
Michael Adam [Fri, 1 Aug 2008 15:10:59 +0000 (17:10 +0200)]
libnet dssync: fix memory allocation for error/result messages.
Use the libnet_dssync_context as a talloc context for the
result_message and error_message string members.
Using the passed in mem_ctx makes the implicit assumption
that mem_ctx is at least as long-lived as the libnet_dssync_context,
which is wrong.
Michael
Michael Adam [Fri, 1 Aug 2008 15:09:08 +0000 (17:09 +0200)]
dssync keytab: add comment header explaining add_to_keytab_entries().
Michael
Michael Adam [Fri, 1 Aug 2008 12:26:46 +0000 (14:26 +0200)]
libnet dssync: add my C after dssync keytab changes.
Michael
Michael Adam [Thu, 31 Jul 2008 22:12:18 +0000 (00:12 +0200)]
vampire keytab: add command line switch --clean-old-entries .
This allows to control cleaning the keytab.
It will only clean old occurences of keys that are replicated in
this run. So if you want to ensure things are cleaned up, combine
this switch with --force-full-repl or --single-obj-repl (+dn list).
Michael
Michael Adam [Thu, 31 Jul 2008 22:09:28 +0000 (00:09 +0200)]
dssync: add clean_old_entries flag to dssync_ctx.
Initialize it to false.
And pass it down to the libnet_keytab context in
libnet_dssync_keytab.c:keytab_startup().
Unused yet.
Michael
Note: This might not be not 100% clean design to put this into the
toplevel dssync context while it is keytab specific. But then, on the
other hand, other imaginable backends might want to use this flag, too...
Michael Adam [Thu, 31 Jul 2008 22:07:40 +0000 (00:07 +0200)]
libnet keytab: implement cleaning of old entries in libnet_keytab_add().
Triggered by the flag clean_old_entries from the libnet_keytab_contex
(unused yet...).
Michael
Michael Adam [Thu, 31 Jul 2008 22:05:42 +0000 (00:05 +0200)]
libnet keytab: add parameter ingnore_kvno to libnet_keytab_remove_entries()
to allow for removing all entries with given principal and enctype without
repecting the kvno (i.e. cleaning "old" entries...)
This is called with ignore_kvno == false from libnet_keytab_add_entry() to
keep the original behaviour.
Michael
Michael Adam [Thu, 31 Jul 2008 22:03:10 +0000 (00:03 +0200)]
libnet keytab: add flag clean_old_entries to libnet_keytab_context.
Michael
Michael Adam [Thu, 31 Jul 2008 21:15:35 +0000 (23:15 +0200)]
libnet keytab: use proper counter type (uint32_t) in libnet_keytab_add().
Michael
Michael Adam [Thu, 31 Jul 2008 21:05:45 +0000 (23:05 +0200)]
vampire keytab: introduce switch --single-obj-repl.
This controls whether single object replication is to be used.
This only has an effect when at least one object dn is given
on the commandline.
NOTE: Now the default is to use normal replication with uptodateness
vectors and use object dns given on the command line as a positive
write filter. Single object replication is only performed when this
new switch is specified.
Michael
Michael Adam [Thu, 31 Jul 2008 20:53:41 +0000 (22:53 +0200)]
dssync keytab: when not in single object replication mode, use object dn list as write filter.
I.e. only the passwords and keys of those objects whose dns are provided
are written to the keytab file. Others are skippded.
Michael
Michael Adam [Thu, 31 Jul 2008 10:25:06 +0000 (12:25 +0200)]
dssync keytab: support storing kerberos keys from supplemental credentials.
Michael
Michael Adam [Wed, 30 Jul 2008 15:53:28 +0000 (17:53 +0200)]
libnet dssync: rename flag single to single_object_replication
So that it is more obvious what this controls.
Michael
Michael Adam [Wed, 30 Jul 2008 15:46:13 +0000 (17:46 +0200)]
net rpc vampire: rename --repl-nodiff to --force-full-repl.
This more clear.
Michael
Michael Adam [Wed, 30 Jul 2008 15:44:22 +0000 (17:44 +0200)]
libnet dssync: rename repl_nodiff flag to force_full_replication.
Michael
Michael Adam [Wed, 30 Jul 2008 11:02:36 +0000 (13:02 +0200)]
libnet dssync: support lists of dns (instead of one dn) for single object replication.
Just specify several DNs separated by spaces on the command line of
"net rpc vampire keytab" to get the passwords for each of these
accouns via single object replication.
Michael