samba.git
5 months agoWHATSNEW: Document change of default for nfs4:acedup parameter
Christof Schmitt [Thu, 18 Jul 2019 17:59:14 +0000 (10:59 -0700)]
WHATSNEW: Document change of default for nfs4:acedup parameter

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agodocs: Update vfs_gpfs manpage for the new default of nfs4:acedup
Christof Schmitt [Thu, 18 Jul 2019 17:22:28 +0000 (10:22 -0700)]
docs: Update vfs_gpfs manpage for the new default of nfs4:acedup

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Change default of nfs4:acedup to "merge"
Christof Schmitt [Thu, 18 Jul 2019 17:13:48 +0000 (10:13 -0700)]
nfs4_acls: Change default of nfs4:acedup to "merge"

All tutorials i could find that configure Samba with NFSv4 ACLs set this
parameter to "merge". As this seems to be the main usecase, make this
setting the default.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agodocs: Update manpages for deprecated nfs4:acedup settings
Christof Schmitt [Wed, 17 Jul 2019 17:46:45 +0000 (10:46 -0700)]
docs: Update manpages for deprecated nfs4:acedup settings

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Mark nfs4:acedup ignore and reject as deprecated
Christof Schmitt [Wed, 17 Jul 2019 17:51:18 +0000 (10:51 -0700)]
nfs4_acls: Mark nfs4:acedup ignore and reject as deprecated

The default setting for nfs4:acedup is "dontcare". The only
recommendation i could find is setting this to "merge". The setting of
"ignore" is dangerous as it would silently drop ACEs. "reject" also
seems less useful as it would disallow setting of ACLs that can easily
be stored.

Report "ignore" and "reject" as deprecated. Maybe these can be removed
in the future to simplify the code.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agodocs: Update nfs4:mode example for vfs_zfs
Christof Schmitt [Wed, 19 Jun 2019 20:56:57 +0000 (13:56 -0700)]
docs: Update nfs4:mode example for vfs_zfs

nfs4:mode special has been deprecated. Switch the example to "simple" to
avoid the deprecated setting in the example.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Update copyright header
Christof Schmitt [Thu, 18 Jul 2019 19:06:06 +0000 (12:06 -0700)]
nfs4_acls: Update copyright header

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Add warning for deprecated setting nfs4:mode special
Christof Schmitt [Wed, 19 Jun 2019 20:53:54 +0000 (13:53 -0700)]
nfs4_acls: Add warning for deprecated setting nfs4:mode special

The documentation states this has been deprecated for years. Add logging
a warning when this is set. Maybe this can be removed in the future.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Use C99 initializer instead of ZERO_STRUCTP for params struct
Christof Schmitt [Tue, 9 Jul 2019 21:41:01 +0000 (14:41 -0700)]
nfs4_acls: Use C99 initializer instead of ZERO_STRUCTP for params struct

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Change type of smbacl4_substitute_simple to void
Christof Schmitt [Wed, 19 Jun 2019 20:42:19 +0000 (13:42 -0700)]
nfs4_acls: Change type of smbacl4_substitute_simple to void

The function always returned true and the return code was never checked,
so simply change to void.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Remove unused SMB_ACLTYPE_ defines
Christof Schmitt [Wed, 19 Jun 2019 18:14:20 +0000 (11:14 -0700)]
nfs4_acls: Remove unused SMB_ACLTYPE_ defines

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agovfs_gpfs: Implement special case for denying owner access to ACL
Christof Schmitt [Tue, 9 Jul 2019 20:39:55 +0000 (13:39 -0700)]
vfs_gpfs: Implement special case for denying owner access to ACL

In GPFS, it is not possible to deny ACL or attribute access through a
SPECIAL_OWNER entry. The best that can be done is mapping this to a
named user entry, as this one can at least be stored in an ACL. The same
cannot be done for inheriting SPECIAL_OWNER entries, as these represent
CREATOR OWNER entries, and the limitation of not being able to deny
owner access to ACL or attributes remains.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agovfs_gpfs: Move mapping from generic NFSv ACL to GPFS ACL to separate function
Christof Schmitt [Tue, 9 Jul 2019 20:08:35 +0000 (13:08 -0700)]
vfs_gpfs: Move mapping from generic NFSv ACL to GPFS ACL to separate function

This is not functional change. It cleans up the code a bit and makes
expanding this codepath in a later patch easier.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agodocs: Remove gpfs:merge_writeappend from vfs_gpfs manpage
Christof Schmitt [Wed, 10 Jul 2019 18:06:19 +0000 (11:06 -0700)]
docs: Remove gpfs:merge_writeappend from vfs_gpfs manpage

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agovfs_gpfs: Remove merge_writeappend parameter
Christof Schmitt [Tue, 9 Jul 2019 19:04:35 +0000 (12:04 -0700)]
vfs_gpfs: Remove merge_writeappend parameter

All supported GPFS versions now support setting WRITE and APPEND in the
ACLs independently. Remove this now unused parameter to simplify the
code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Use correct owner information for ACL after owner change
Christof Schmitt [Wed, 17 Jul 2019 22:29:06 +0000 (15:29 -0700)]
nfs4_acls: Use correct owner information for ACL after owner change

After a chown, the cached stat data is obviously no longer valid. The
code in smb_set_nt_acl_nfs4 checked the file correctly, but did only use
a local buffer for the stat data. So later checks of the stat buffer
under the fsp->fsp_name->st would still see the old information.

Fix this by removing the local stat buffer and always update the one
under fsp->fsp_name->st.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Add test for merging duplicates when mapping from NFS4 ACL to DACL
Christof Schmitt [Wed, 10 Jul 2019 20:14:32 +0000 (13:14 -0700)]
nfs4_acls: Add test for merging duplicates when mapping from NFS4 ACL to DACL

The previous patch introduced merging of duplicates on the mapping path
from NFS4 ACL entries to DACL entries. Add a testcase to verify the
expected behavior of this codepath.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Remove duplicate entries when mapping from NFS4 ACL to DACL
Christof Schmitt [Tue, 2 Jul 2019 22:08:11 +0000 (15:08 -0700)]
nfs4_acls: Remove duplicate entries when mapping from NFS4 ACL to DACL

The previous patch added an additional entry for IDMAP_TYPE_BOTH. When
mapping back to a DACL, there should be no additional entry. Add a loop
that will check and remove entries that are exact duplicates.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Rename smbacl4_fill_ace4 function
Christof Schmitt [Thu, 18 Jul 2019 18:49:29 +0000 (11:49 -0700)]
nfs4_acls: Rename smbacl4_fill_ace4 function

As this function now maps the ACE and also adds it to the NFSv4 ACE,
change the name to better describe its behavior.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Add additional owner entry when mapping to NFS4 ACL with IDMAP_TYPE_BOTH
Christof Schmitt [Wed, 17 Jul 2019 17:49:47 +0000 (10:49 -0700)]
nfs4_acls: Add additional owner entry when mapping to NFS4 ACL with IDMAP_TYPE_BOTH

With IDMAP_TYPE_BOTH, all entries have to be mapped to group entries.
In order to have the file system reflect the owner permissions in the
POSIX modebits, create a second entry for the user. This will be mapped
to the "special owner" entry.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Remove redundant pointer variable
Christof Schmitt [Tue, 16 Jul 2019 22:56:12 +0000 (15:56 -0700)]
nfs4_acls: Remove redundant pointer variable

The previous patch introduced a pointer to a local variable to reduce
the amount of lines changed. Remove that pointer and adjust all usage
accordingly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Remove redundant logging from smbacl4_fill_ace4
Christof Schmitt [Tue, 16 Jul 2019 22:50:36 +0000 (15:50 -0700)]
nfs4_acls: Remove redundant logging from smbacl4_fill_ace4

Logging flags in case they do not match seems unnecessary. Other log
messages should show the flags as well.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Move adding of NFS4 ACE to ACL to smbacl4_fill_ace4
Christof Schmitt [Tue, 16 Jul 2019 22:30:36 +0000 (15:30 -0700)]
nfs4_acls: Move adding of NFS4 ACE to ACL to smbacl4_fill_ace4

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Move smbacl4_MergeIgnoreReject function
Christof Schmitt [Tue, 16 Jul 2019 22:20:25 +0000 (15:20 -0700)]
nfs4_acls: Move smbacl4_MergeIgnoreReject function

This static function will be called earlier in later patches.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Remove i argument from smbacl4_MergeIgnoreReject
Christof Schmitt [Mon, 15 Jul 2019 21:43:01 +0000 (14:43 -0700)]
nfs4_acls: Remove i argument from smbacl4_MergeIgnoreReject

This is only used for logging of a rejected ACL, but does not provide
additional useful information. Remove it to simplify the function a bit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Add missing braces in smbacl4_win2nfs4
Christof Schmitt [Tue, 2 Jul 2019 20:20:44 +0000 (13:20 -0700)]
nfs4_acls: Add missing braces in smbacl4_win2nfs4

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Add helper function for checking INHERIT flags.
Christof Schmitt [Wed, 26 Jun 2019 20:20:17 +0000 (13:20 -0700)]
nfs4_acls: Add helper function for checking INHERIT flags.

This avoids some code duplication. Do not make this static, as it will
be used in a later patch.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmit <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Use correct type when checking ownerGID
Christof Schmitt [Tue, 25 Jun 2019 22:21:06 +0000 (15:21 -0700)]
nfs4_acls: Use correct type when checking ownerGID

uid and gid are members of the same union so this makes no difference,
but for type correctness and readability use the gid to check for
ownerGID.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Use switch/case for checking idmap type
Christof Schmitt [Mon, 15 Jul 2019 20:15:32 +0000 (13:15 -0700)]
nfs4_acls: Use switch/case for checking idmap type

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Use sids_to_unixids to lookup uid or gid
Christof Schmitt [Wed, 26 Jun 2019 20:24:16 +0000 (13:24 -0700)]
nfs4_acls: Use sids_to_unixids to lookup uid or gid

This is the newer API to lookup id mappings and will make it easier to
add to the IDMAP_TYPE_BOTH case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping from DACL to NFS4 ACL with IDMAP_TYPE_BOTH
Christof Schmitt [Tue, 2 Jul 2019 20:04:44 +0000 (13:04 -0700)]
test_nfs4_acls: Add test for mapping from DACL to NFS4 ACL with IDMAP_TYPE_BOTH

When id mappings use IDMAP_TYPE_BOTH, the NFSv4 ACL mapping code is not
aware whether a particular entry is for a user or a group. The
underlying assumption then is that is should not matter, as both the ACL
mapping maps everything to NFSv4 ACL group entries and the user's token
will contain gid entries for the groups.

Add a testcase to verify that when mapping from DACLS to NFSv4 ACL
entries with IDMAP_TYPE_BOTH, all entries are mapped as expected.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping from NFS4 ACL to DACL with IDMAP_TYPE_BOTH
Christof Schmitt [Tue, 2 Jul 2019 19:50:42 +0000 (12:50 -0700)]
test_nfs4_acls: Add test for mapping from NFS4 ACL to DACL with IDMAP_TYPE_BOTH

When id mappings use IDMAP_TYPE_BOTH, the NFSv4 ACL mapping code is not
aware whether a particular entry is for a user or a group. The
underlying assumption then is that is should not matter, as both the ACL
mapping maps everything to NFSv4 ACL group entries and the user's token
will contain gid entries for the groups.

Add a testcase to verify that when mapping from NFSv4 ACL entries to
DACLs with IDMAP_TYPE_BOTH, all entries are mapped as expected.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping from NFS4 to DACL in config mode special
Christof Schmitt [Tue, 2 Jul 2019 19:23:02 +0000 (12:23 -0700)]
test_nfs4_acls: Add test for mapping from NFS4 to DACL in config mode special

The mapping code between NFSv4 ACLs and security descriptors still has
the deprecated config setting "nfs4:mode = special". This should not be
used as it has security problems: All entries matching owner or group
are mapped to "special owner" or "special group", which can change its
meaning when being inherited to a new file or directory with different
owner and owning group.

This mode should eventually be removed, but as long as it still exists
add testcases to verify the expected behavior. This patch adds the
testcase for "nfs4:mode = special" when mapping from the NFS4 ACL to the
DACL in the security descriptor.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping from DACL to NFS4 ACL with config special
Christof Schmitt [Tue, 2 Jul 2019 19:16:08 +0000 (12:16 -0700)]
test_nfs4_acls: Add test for mapping from DACL to NFS4 ACL with config special

The mapping code between NFSv4 ACLs and security descriptors still has
the deprecated config setting "nfs4:mode = special". This should not be
used as it has security problems: All entries matching owner or group
are mapped to "special owner" or "special group", which can change its
meaning when being inherited to a new file or directory with different
owner and owning group.

This mode should eventually be removed, but as long as it still exists
add testcases to verify the expected behavior. This patch adds the
testcase for "nfs4:mode = special" when mapping from the DACL in the
security descriptor to the NFSv4 ACL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for matching DACL entries for acedup
Christof Schmitt [Tue, 2 Jul 2019 19:09:04 +0000 (12:09 -0700)]
test_nfs4_acls: Add test for matching DACL entries for acedup

The NFSv4 mapping code has a config option nfs4:acedup for the mapping
path from DACLs to NFSv4 ACLs. Part of this codepath is detecting
duplicate ACL entries. Add a testcase with different ACL entries and
verify that only exactly matching entries are detected as duplicates and
treated accordingly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for acedup settings
Christof Schmitt [Tue, 2 Jul 2019 19:07:36 +0000 (12:07 -0700)]
test_nfs4_acls: Add test for acedup settings

The NFSv4 ACL mapping code has a setting nfs4:acedup. Depending on the
setting, when mapping from DACLs to NFSv4 ACLs, duplicate ACL entries
are either merged, ignored or rejected. Add a testcase that has
duplicate ACL entries and verify the expected behavior for all possible
settings of the nfs4:acedup option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for 'map full control' option
Christof Schmitt [Tue, 2 Jul 2019 19:02:58 +0000 (12:02 -0700)]
test_nfs4_acls: Add test for 'map full control' option

"map full control" when enabled adds the DELETE_CHILD permission, when
all other permissions are present. This allows Windows clients to
display the "FULL CONTROL" permissions.

Add a testcase that verifies this mapping when mapping from NFSv4 ACL to
the DACL in the security descriptor. Also verify that switching the
option off disables this behavior.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping from NFS4 to DACL CREATOR entries
Christof Schmitt [Tue, 2 Jul 2019 18:57:45 +0000 (11:57 -0700)]
test_nfs4_acls: Add test for mapping from NFS4 to DACL CREATOR entries

Add testcase for mapping from NFSv4 ACL entries for "special owner" and
"special group" to DACL entries in the security descriptor. Each NFSv4
entry here with INHERIT_ONLY maps directly to a CREATOR OWNER or CREATOR
GROUP entry in the DACL. Entries without INHERIT_ONLY map to the CREATOR
entry and an additional explicit entry granting permission on the
current object.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping CREATOR entries to NFS4 ACL entries
Christof Schmitt [Tue, 2 Jul 2019 18:55:59 +0000 (11:55 -0700)]
test_nfs4_acls: Add test for mapping CREATOR entries to NFS4 ACL entries

Add testcase for mapping DACL entries CREATOR OWNER and CREATOR GROUP
with inheritance flag in the security descriptor to NFSv4 "special
owner" and "special group" entries. This is the correct mapping for
these entries as inheriting "special owner" and "special group" grants
permissions to the actual owner and owning group of the new file or
directory, similar to what CREATOR entries do.

The other side is that CREATOR entries without any inheritance flags do
not make sense, so these are not mapped to NFSv4 ACL entries.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping from DACL to special NFS4 ACL entries
Christof Schmitt [Tue, 2 Jul 2019 18:53:15 +0000 (11:53 -0700)]
test_nfs4_acls: Add test for mapping from DACL to special NFS4 ACL entries

Add testcase for mapping from entries in the DACL security descriptor to
"special" entries in the NFSv4 ACL. Verify that the WORLD well-known SID
maps to "everyone" in the NFSv4 ACL. Verify that the "Unix NFS" SID is
ignored, as there is no meaningful mapping for this entry. Verify that
SID entries matching the owner or group are mapped to "special owner"
or "special group", but only if no inheritance flags are used. "special
owner" and "special group" with inheritance flags have the meaning of
CREATOR OWNER and CREATOR GROUP and will be tested in another testcase.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping of special NFS4 ACL entries to DACL entries
Christof Schmitt [Tue, 2 Jul 2019 18:46:23 +0000 (11:46 -0700)]
test_nfs4_acls: Add test for mapping of special NFS4 ACL entries to DACL entries

In addition to entries for users and groups, NFSv4 ACLs have the concept
of entries for "special" entries. Only the "owner", "group" and
"everyone" entries are currently used in the ACL mapping.

Add a testcase that verifies the mapping from NFSv4 "special" entries to
the DACL in the security descriptor. Verify that only "owner", "group"
and "everyone" are mapped and all other "special" entries are ignored.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping permissions from DACL to NFS4 ACL
Christof Schmitt [Tue, 2 Jul 2019 18:35:34 +0000 (11:35 -0700)]
test_nfs4_acls: Add test for mapping permissions from DACL to NFS4 ACL

Add testcase for mapping the permission flags from the DACL in the
Security Descriptor to a NFSv4 ACL. The mapping is straight-forward as
the same permission bits exist for Security Descriptors and NFSv4 ACLs.
In addition, the code also maps from the generic DACL permissions to a
set of NFSv4 permissions, also verify this mapping.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for mapping permissions from NFS4 ACL to DACL
Christof Schmitt [Tue, 2 Jul 2019 18:33:29 +0000 (11:33 -0700)]
test_nfs4_acls: Add test for mapping permissions from NFS4 ACL to DACL

Add testcase for mapping permissions from the NFSv4 ACL to DACL in the
security descriptor. The mapping is simple as each permission bit exists
on both sides.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for flags mapping from DACL to NFS4 ACL
Christof Schmitt [Tue, 2 Jul 2019 18:30:12 +0000 (11:30 -0700)]
test_nfs4_acls: Add test for flags mapping from DACL to NFS4 ACL

Add testcase for the mapping of inheritance flags from the DACL in the
security descriptor to the NFSv4 ACL. The mapping is different for files
and directories as some inheritance flags should not be present for
files. Also other flags are not mapped at all, verify this behavior.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add test for flags mapping from NFS4 ACL to DACL
Christof Schmitt [Tue, 2 Jul 2019 18:28:31 +0000 (11:28 -0700)]
test_nfs4_acls: Add test for flags mapping from NFS4 ACL to DACL

Add testcase for the mapping of inheritance flags when mapping from a
NFSv4 ACL to a DACL in the security descriptor. The mapping is different
between files and directories, as some inheritance flags should never be
present for files. Some defined flags like SUCCESSFUL_ACCESS are also
not mapped at this point, also verify this behavior.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add tests for mapping of ACL types
Christof Schmitt [Tue, 2 Jul 2019 18:25:33 +0000 (11:25 -0700)]
test_nfs4_acls: Add tests for mapping of ACL types

Add testcases for mapping the type field (ALLOW or DENY) between NFSv4
ACLs and security descriptors.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agotest_nfs4_acls: Add tests for mapping of empty ACLs
Christof Schmitt [Tue, 2 Jul 2019 18:23:40 +0000 (11:23 -0700)]
test_nfs4_acls: Add tests for mapping of empty ACLs

This is a fairly simple test that ensures the mapping of empty ACLs
(without any ACL entries) is always done the same way.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agoselftest: Start implementing unit test for nfs4_acls
Christof Schmitt [Tue, 2 Jul 2019 18:22:13 +0000 (11:22 -0700)]
selftest: Start implementing unit test for nfs4_acls

Existing smbtorture tests set and query ACLs through SMB, only working
with the DACLs in the Security Descriptors, but never check the NFSv4
ACL representation. This patch introduces a unit test to verify the
mapping between between Security Descriptors and NFSv4 ACLs. As the
mapping code queries id mappings, the id mapping cache is first primed
with the mappings used by the tests and those mappings are removed again
during teardown.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agonfs4_acls: Remove fsp from smbacl4_win2nfs4
Christof Schmitt [Tue, 11 Jun 2019 23:15:10 +0000 (16:15 -0700)]
nfs4_acls: Remove fsp from smbacl4_win2nfs4

Only the information whether the ACL is for a file or a directory is
required. Replacing the fsp with a flag is clearer and allows for unit
testing of the mapping functions.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agoRevert "nfs4acl: Fix owner mapping with ID_TYPE_BOTH"
Christof Schmitt [Fri, 7 Jun 2019 19:55:32 +0000 (12:55 -0700)]
Revert "nfs4acl: Fix owner mapping with ID_TYPE_BOTH"

This reverts commit 5d4f7bfda579cecb123cfb1d7130688f1d1c98b7.

That patch broke the case with ID_TYPE_BOTH where a file is owned by a
group (e.g. using autorid and having a file owned by
BUILTIN\Administrators). In this case, the ACE entry for the group gets
mapped a to a user ACL entry and the group no longer has access (as in
the user's token the group is not mapped to a uid).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
5 months agodcerpc: use anon creds for unknown transport
Douglas Bagnall [Wed, 10 Jul 2019 04:24:46 +0000 (16:24 +1200)]
dcerpc: use anon creds for unknown transport

Otherwise we get a segfault when the NULL creds are dereferenced in cli_credentials_is_anonymous()

 $  python3 -c"from samba.dcerpc.dnsserver import dnsserver; d = dnsserver('addc')"

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jul 22 23:37:57 UTC 2019 on sn-devel-184

5 months agos4/auth/py: avoid null deref with bad python arguments
Douglas Bagnall [Tue, 9 Jul 2019 10:52:33 +0000 (22:52 +1200)]
s4/auth/py: avoid null deref with bad python arguments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agos4/gensec/py: avoid null deref with bad python arguments
Douglas Bagnall [Tue, 9 Jul 2019 10:52:19 +0000 (22:52 +1200)]
s4/gensec/py: avoid null deref with bad python arguments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agos3/smbd/py: avoid null deref with bad python arguments
Douglas Bagnall [Tue, 9 Jul 2019 10:51:38 +0000 (22:51 +1200)]
s3/smbd/py: avoid null deref with bad python arguments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agos3/libsmb/py: avoid null deref with bad python arguments
Douglas Bagnall [Tue, 9 Jul 2019 10:51:18 +0000 (22:51 +1200)]
s3/libsmb/py: avoid null deref with bad python arguments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agos4/auth/pygensec: don't segfault when reporting bad types
Douglas Bagnall [Sun, 7 Jul 2019 05:23:23 +0000 (17:23 +1200)]
s4/auth/pygensec: don't segfault when reporting bad types

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agoauth/pycreds/encrypt_netr_crypt_password: don't pretend arg is optional
Douglas Bagnall [Tue, 9 Jul 2019 11:07:18 +0000 (23:07 +1200)]
auth/pycreds/encrypt_netr_crypt_password: don't pretend arg is optional

The "|O" signature is saying the password argument is optional, which
makes no sense in terms of the funxtion and immediately leads to a
TypeError (or until last commit, segfault). Removing the "|" leaves it
with a TypeError, but it is better worded and faster.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agoauth/pycreds/encrypt_netr_crypt_password: don't segfault
Douglas Bagnall [Sun, 7 Jul 2019 01:47:51 +0000 (13:47 +1200)]
auth/pycreds/encrypt_netr_crypt_password: don't segfault

Non-talloc objects were treated as talloc objects, to no good effect

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agopysecurity: use unsigned int, not int to approximate uint32_t
Douglas Bagnall [Sun, 7 Jul 2019 00:14:50 +0000 (12:14 +1200)]
pysecurity: use unsigned int, not int to approximate uint32_t

the "I" flag for unsigned int has been available since Python 2.3

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agopycredentials.h: use import to ensure python type correctness
Douglas Bagnall [Sat, 6 Jul 2019 07:09:57 +0000 (19:09 +1200)]
pycredentials.h: use import to ensure python type correctness

Because we include pyrpc_util.h, pycredentials doesn't need its own
PyStringFromStringOrNull().

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agoauth/pycredentials: always check self is a Credentials object
Douglas Bagnall [Sat, 6 Jul 2019 07:07:11 +0000 (19:07 +1200)]
auth/pycredentials: always check self is a Credentials object

This prevents a segfault with

    credentials.Credentials.guess(x)

where x is not a Credentials object.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agos4/rpc/py_security: don't deref NULL for invalid values
Douglas Bagnall [Fri, 5 Jul 2019 11:01:39 +0000 (23:01 +1200)]
s4/rpc/py_security: don't deref NULL for invalid values

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agos4/py_dsdb: avoid NULL deref in set_domain_sid()
Douglas Bagnall [Thu, 4 Jul 2019 10:21:36 +0000 (22:21 +1200)]
s4/py_dsdb: avoid NULL deref in set_domain_sid()

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agolibcli/pysecurity: use pytalloc_get_name to avoid NULL deref
Douglas Bagnall [Tue, 9 Jul 2019 09:45:03 +0000 (09:45 +0000)]
libcli/pysecurity: use pytalloc_get_name to avoid NULL deref

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agotalloc: Release talloc 2.3.0 talloc-2.3.0
Andrew Bartlett [Mon, 22 Jul 2019 01:42:37 +0000 (13:42 +1200)]
talloc: Release talloc 2.3.0

* add pytalloc_get_name() to safely access te talloc name in Python bindings
* Use a new minor version to allow talloc updates in the 4.11 release stream

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz
5 months agotalloc/py_util: remove tautologically dead code
Douglas Bagnall [Sun, 7 Jul 2019 00:34:37 +0000 (12:34 +1200)]
talloc/py_util: remove tautologically dead code

Being careful is good and all, but if we don't trust the

       static PyTypeObject *type = NULL;

two lines up, we need to reconsider our entire software universe.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agotalloc: pytalloc_get_checked_type: survive non-talloc objects
Douglas Bagnall [Tue, 9 Jul 2019 09:44:12 +0000 (09:44 +0000)]
talloc: pytalloc_get_checked_type: survive non-talloc objects

If the python object is not a talloc object, we will end up
with a NULL pointer. We weren't checking for that properly

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agotalloc: add pytalloc_get_name() helper
Douglas Bagnall [Tue, 9 Jul 2019 08:59:19 +0000 (08:59 +0000)]
talloc: add pytalloc_get_name() helper

In several places we go

   talloc_get_name(pytalloc_get_ptr(py_obj))

which is a certain NULL derefernce if py_obj is not a talloc object.

This is a helper function that chooses to say "non-talloc object"
rather than crash.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agotests/py-segfault: add messaging.deregister()
Douglas Bagnall [Thu, 4 Jul 2019 21:37:13 +0000 (09:37 +1200)]
tests/py-segfault: add messaging.deregister()

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agopy segfault test: registry.open_hive
Douglas Bagnall [Thu, 4 Jul 2019 10:19:55 +0000 (22:19 +1200)]
py segfault test: registry.open_hive

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 months agos3:rpc_server: Call server exit routines in sigterm handler
Samuel Cabrero [Tue, 26 Feb 2019 12:38:40 +0000 (13:38 +0100)]
s3:rpc_server: Call server exit routines in sigterm handler

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Jul 22 18:04:53 UTC 2019 on sn-devel-184

5 months agos3:rpc_server: Call epmapper RPC shutdown function from server exit routines
Samuel Cabrero [Tue, 26 Feb 2019 12:35:09 +0000 (13:35 +0100)]
s3:rpc_server: Call epmapper RPC shutdown function from server exit routines

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Call fsrvp RPC shutdown function from server exit routines
Samuel Cabrero [Tue, 26 Feb 2019 12:33:12 +0000 (13:33 +0100)]
s3:rpc_server: Call fsrvp RPC shutdown function from server exit routines

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Call server exit routines in sigterm handler
Samuel Cabrero [Tue, 26 Feb 2019 12:24:33 +0000 (13:24 +0100)]
s3:rpc_server: Call server exit routines in sigterm handler

The exit server routines already call rpc shutdown functions

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Improve debug messages
Samuel Cabrero [Tue, 26 Feb 2019 12:59:54 +0000 (13:59 +0100)]
s3:rpc_server: Improve debug messages

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server:spoolssd: Move socket creation to its own function
Samuel Cabrero [Wed, 27 Feb 2019 15:52:20 +0000 (16:52 +0100)]
s3:rpc_server:spoolssd: Move socket creation to its own function

The function also handles the registration in the endpoint mapper.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Return NTSTATUS in is_known_pipename function
Samuel Cabrero [Mon, 18 Feb 2019 20:06:02 +0000 (21:06 +0100)]
s3:rpc_server: Return NTSTATUS in is_known_pipename function

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Make make_external_rpc_pipe_p and np_proxy_state private
Samuel Cabrero [Mon, 18 Feb 2019 20:04:00 +0000 (21:04 +0100)]
s3:rpc_server: Make make_external_rpc_pipe_p and np_proxy_state private

This function and struct is not used outside rpc_ncacn_np.c

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Check pointer before dereference
Samuel Cabrero [Thu, 14 Feb 2019 13:22:49 +0000 (14:22 +0100)]
s3:rpc_server: Check pointer before dereference

The debug message dereference the pointer, but as close_policy_by_pipe
is called from pipes_struct destructor it may be not initialized yet if
an error occur in the initialization code.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Rename dcesrv_handle struct
Samuel Cabrero [Mon, 11 Feb 2019 10:47:56 +0000 (11:47 +0100)]
s3:rpc_server: Rename dcesrv_handle struct

The name conflicts with the S4 name.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Unify RPC client disconnect and termination functions
Samuel Cabrero [Mon, 18 Feb 2019 19:28:05 +0000 (20:28 +0100)]
s3:rpc_server: Unify RPC client disconnect and termination functions

These functions are used by endpoint mapper to delete the endpoints
when a NCALRPC connection from an external daemon is lost and by
preforked childs to accept the next client as soon as the current
connection terminates. We can use the same function for both purposes.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:spoolss: Set remote and local address for accepted connections
Samuel Cabrero [Mon, 18 Feb 2019 19:27:31 +0000 (20:27 +0100)]
s3:spoolss: Set remote and local address for accepted connections

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Return NTSTATUS in make_internal_rpc_pipe_p
Samuel Cabrero [Wed, 13 Feb 2019 09:48:54 +0000 (10:48 +0100)]
s3:rpc_server: Return NTSTATUS in make_internal_rpc_pipe_p

Also make it static as it is not used outside rpc_ncacn_np.c

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Set debug class in all rpc server related files
Samuel Cabrero [Tue, 5 Feb 2019 18:27:58 +0000 (19:27 +0100)]
s3:rpc_server: Set debug class in all rpc server related files

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Initialize auxiliary variable checked in error path
Samuel Cabrero [Wed, 27 Feb 2019 15:54:49 +0000 (16:54 +0100)]
s3:rpc_server: Initialize auxiliary variable checked in error path

The auxiliary variable is checked in the function's exit code so reset
it after each usage.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:prefork: Allow to associate private data with listening socket
Samuel Cabrero [Mon, 28 Jan 2019 09:57:53 +0000 (10:57 +0100)]
s3:prefork: Allow to associate private data with listening socket

Prepare for merger RPC server codebase, where it will be necessary to
stablish an association between the listening socket and the
dcesrv_endpoint that the socket is serving.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Remove named_pipe_client struct and use dcerpc_ncacn_conn
Samuel Cabrero [Mon, 18 Feb 2019 18:38:08 +0000 (19:38 +0100)]
s3:rpc_server: Remove named_pipe_client struct and use dcerpc_ncacn_conn

Now NCACN_NP connections run the same loop as NCACN_IP_TCP and NCALRPC
connections.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Check remote address supplied to dcerpc_ncacn_accept
Samuel Cabrero [Mon, 18 Feb 2019 18:34:38 +0000 (19:34 +0100)]
s3:rpc_server: Check remote address supplied to dcerpc_ncacn_accept

Check if the supplied tsocket_address is valid before changing the
talloc chunk parent to the ncacn_conn struct.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Make dcerpc_ncacn_packet_process public
Samuel Cabrero [Mon, 18 Feb 2019 18:33:29 +0000 (19:33 +0100)]
s3:rpc_server: Make dcerpc_ncacn_packet_process public

In preparation to remove the named_pipe_client struct, this function
will be set as tevent callback from rpc_ncacn_np.c

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Add a function to initialize the dcerpc_ncacn_conn struct
Samuel Cabrero [Mon, 18 Feb 2019 18:31:04 +0000 (19:31 +0100)]
s3:rpc_server: Add a function to initialize the dcerpc_ncacn_conn struct

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Split dcerpc_ncacn_accept to deal with tstream_npa
Samuel Cabrero [Mon, 18 Feb 2019 18:24:54 +0000 (19:24 +0100)]
s3:rpc_server: Split dcerpc_ncacn_accept to deal with tstream_npa

In preparation to remove the named_pipe_client struct split the function
if two parts and build the tstream context as soon as possible, as it
will take care of closing the socket when the tstream_context is freed.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Add termination function and data to dcerpc_ncacn_conn
Samuel Cabrero [Mon, 18 Feb 2019 17:48:57 +0000 (18:48 +0100)]
s3:rpc_server: Add termination function and data to dcerpc_ncacn_conn

In preparation to remove the named_pipe_client structure, this function
will be called from ncacn_conn destructor passing the private data pointer
as argument. It is mainly used by preforked childs in "process model" to
attend the next client as soon as the previous client ends the connection.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
5 months agos3:rpc_server: Move dcerpc_ncanc_conn to header file
Samuel Cabrero [Mon, 18 Feb 2019 17:25:48 +0000 (18:25 +0100)]
s3:rpc_server: Move dcerpc_ncanc_conn to header file

Next commits will remove named_pipe_client and dcerpc_ncacn_connection
will be used in its place. It has to be moved to a header file as it
will be used by functions in rpc_server.c and rpc_ncacn_np.c.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
5 months agos3:rpc_server: Set dcerpc_ncacn_connection destructor
Samuel Cabrero [Tue, 5 Feb 2019 12:34:39 +0000 (13:34 +0100)]
s3:rpc_server: Set dcerpc_ncacn_connection destructor

And call disconnection callback from there if it is set.
Additionally change named_pipe_termination_fn to have * in typedef.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:epmapper: Rename conflicting struct
Samuel Cabrero [Thu, 31 Jan 2019 20:57:04 +0000 (21:57 +0100)]
s3:epmapper: Rename conflicting struct

Rename an epmapper internal struct which will conflict when merging s3
and s4 rpc servers.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3-prefork: Add header inclusion guards
Samuel Cabrero [Sun, 3 Feb 2019 21:33:53 +0000 (22:33 +0100)]
s3-prefork: Add header inclusion guards

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
5 months agos3:rpc_server: Return NTSTATUS in rpc_ep_setup and setup functions
Samuel Cabrero [Thu, 31 Jan 2019 15:42:35 +0000 (16:42 +0100)]
s3:rpc_server: Return NTSTATUS in rpc_ep_setup and setup functions

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:rpc_server: Fix hidden strict aliasing issues
Samuel Cabrero [Mon, 18 Feb 2019 16:28:34 +0000 (17:28 +0100)]
s3:rpc_server: Fix hidden strict aliasing issues

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
5 months agolib:tsocket: New function to build a tsocket_context from samba_address
Samuel Cabrero [Mon, 18 Feb 2019 16:27:46 +0000 (17:27 +0100)]
lib:tsocket: New function to build a tsocket_context from samba_address

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 months agos3:utils: New struct to fix strict aliasing issues with sockets API
Samuel Cabrero [Mon, 18 Feb 2019 16:09:14 +0000 (17:09 +0100)]
s3:utils: New struct to fix strict aliasing issues with sockets API

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>