Jeremy Allison [Mon, 19 Dec 2016 20:15:59 +0000 (12:15 -0800)]
CVE-2017-2619: s3: smbd: OpenDir_fsp() - Fix memory leak on error.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Jeremy Allison [Mon, 19 Dec 2016 20:13:20 +0000 (12:13 -0800)]
CVE-2017-2619: s3: smbd: OpenDir_fsp() use early returns.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Jeremy Allison [Tue, 20 Dec 2016 00:35:00 +0000 (16:35 -0800)]
CVE-2017-2619: s3: smbd: Create and use open_dir_safely(). Use from OpenDir().
Hardens OpenDir against TOC/TOU races.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Jeremy Allison [Tue, 20 Dec 2016 00:25:26 +0000 (16:25 -0800)]
CVE-2017-2619: s3: smbd: Opendir_internal() early return if SMB_VFS_OPENDIR failed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Jeremy Allison [Mon, 19 Dec 2016 19:55:56 +0000 (11:55 -0800)]
CVE-2017-2619: s3: smbd: Create wrapper function for OpenDir in preparation for making robust.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Ralph Boehme [Sun, 19 Mar 2017 17:52:10 +0000 (18:52 +0100)]
CVE-2017-2619: s4/torture: add SMB2_FIND tests with SMB2_CONTINUE_FLAG_REOPEN flag
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Ralph Boehme [Sun, 19 Mar 2017 14:58:17 +0000 (15:58 +0100)]
CVE-2017-2619: s3/smbd: re-open directory after dptr_CloseDir()
dptr_CloseDir() will close and invalidate the fsp's file descriptor, we
have to reopen it.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Stefan Metzmacher [Mon, 20 Mar 2017 12:56:03 +0000 (13:56 +0100)]
libwbclient: add WBC_SID_NAME_LABEL
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Mar 23 12:55:26 CET 2017 on sn-devel-144
Stefan Metzmacher [Mon, 20 Mar 2017 12:50:59 +0000 (13:50 +0100)]
libcli/security: add SID_NAME_LABEL to sid_type_lookup()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Mon, 20 Mar 2017 12:50:36 +0000 (13:50 +0100)]
lsa.idl: add SID_NAME_LABEL
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Fri, 17 Mar 2017 18:28:16 +0000 (19:28 +0100)]
netlogon.idl: make netr_LogonInfoClass public
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Wed, 22 Mar 2017 14:41:47 +0000 (15:41 +0100)]
net: Don't crash if lsa_LookupPrivDisplayName returns NULL
lsa_LookupPrivDisplayName on Windows 2012R2 can return success and still return
a NULL name:
rpc_api_pipe: got frag len of 36 at offset 0: NT_STATUS_OK
rpc_api_pipe: host 172.18.103.80 returned 12 bytes.
lsa_LookupPrivDisplayName: struct lsa_LookupPrivDisplayName
out: struct lsa_LookupPrivDisplayName
disp_name : *
disp_name : NULL
returned_language_id : *
returned_language_id : 0x0000 (0)
result : NT_STATUS_OK
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 23 07:43:57 CET 2017 on sn-devel-144
Andreas Schneider [Mon, 20 Mar 2017 11:22:44 +0000 (12:22 +0100)]
nsswtich: Add negative tests for authentication with wbinfo
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12708
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Wed Mar 22 10:58:58 CET 2017 on sn-devel-144
Andreas Schneider [Tue, 21 Mar 2017 08:57:30 +0000 (09:57 +0100)]
s3:libads: Remove obsolete smb_krb5_get_ntstatus_from_init_creds()
There is no way we can get a better error code out of this. The original
function called was krb5_get_init_creds_opt_get_error() which has been
deprecated in 2008.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12708
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Volker Lendecke [Tue, 21 Mar 2017 15:00:27 +0000 (16:00 +0100)]
idmap_rfc2307: Clarify the documentation a bit
"bind_path" is a variable name internally used inside Samba. If you
look at "man ldapsearch" from OpenLDAP for example, the more common
term for this parameter is "search base". Adapt the documentation
accordingly.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Volker Lendecke [Tue, 21 Mar 2017 14:52:37 +0000 (15:52 +0100)]
idmap_rfc2307: Slightly simplify idmap_rfc2307_initialize()
Replace an "else" branch with an early "goto err"
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Volker Lendecke [Sun, 8 Jan 2017 13:00:39 +0000 (13:00 +0000)]
idmap_tdb: Avoid a few casts
The times of attempting to be C++ compatible are gone since C compilers
can do very good warnings too.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Andreas Schneider [Mon, 20 Mar 2017 15:08:20 +0000 (16:08 +0100)]
s3:libsmb: Only print error message if kerberos use is forced
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12704
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Mar 21 14:25:54 CET 2017 on sn-devel-144
Martin Schwenke [Mon, 20 Mar 2017 03:49:34 +0000 (14:49 +1100)]
autobuild: Stop waf uninstall from removing test_tmpdir
Most of the autobuild tasks run "make distcheck", which does a
recursive "waf configure make install uninstall". "waf uninstall"
(via BuildContext.install() in Build.py) removes empty directories all
the way up the directory tree. This means that it removes
test_tmpdir, if it is empty, and any empty directories above it.
While this is arguably a waf bug, the simplest solution is to make
test_tmpdir non-empty so it don't get removed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12703
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Mar 21 10:37:08 CET 2017 on sn-devel-144
Volker Lendecke [Sat, 18 Mar 2017 18:06:49 +0000 (19:06 +0100)]
idmap_autorid: Use idmap_config_int
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Mon Mar 20 23:28:38 CET 2017 on sn-devel-144
Volker Lendecke [Sat, 18 Mar 2017 18:05:10 +0000 (19:05 +0100)]
idmap_rid: Use idmap_config_int
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sun, 8 Jan 2017 11:52:56 +0000 (11:52 +0000)]
winbind: Add idmap_config_int
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 18:01:01 +0000 (19:01 +0100)]
idmap_autorid: Use idmap_config_bool
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 17:59:06 +0000 (18:59 +0100)]
idmap_ad: Use idmap_config_bool
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 17:57:03 +0000 (18:57 +0100)]
idmap_rfc2307: Use idmap_config_bool
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 17:53:58 +0000 (18:53 +0100)]
idmap: Use idmap_config_bool in idmap_init_domain
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 7 Jan 2017 15:10:05 +0000 (15:10 +0000)]
winbind: Add idmap_config_bool()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 17:50:38 +0000 (18:50 +0100)]
idmap_ad: Use idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 17:48:46 +0000 (18:48 +0100)]
idmap_rfc2307: Use idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 17:40:28 +0000 (18:40 +0100)]
idmap_ldap: Use idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 17:38:10 +0000 (18:38 +0100)]
idmap_ldap: Use idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 18 Mar 2017 17:34:07 +0000 (18:34 +0100)]
winbind: Use idmap_config_const_string in idmap_init_domain
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 7 Jan 2017 14:55:41 +0000 (14:55 +0000)]
winbind: Use idmap_config_const_string in idmap_script_db_init
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 7 Jan 2017 14:55:41 +0000 (14:55 +0000)]
winbind: Use idmap_config_const_string in idmap_tdb2_db_init
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 7 Jan 2017 14:55:41 +0000 (14:55 +0000)]
winbind: Use idmap_config_const_string in wb_xids2sids_add_dom
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 7 Jan 2017 14:55:41 +0000 (14:55 +0000)]
winbind: Use idmap_config_const_string in idmap_init_named_domain
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 7 Jan 2017 14:55:41 +0000 (14:55 +0000)]
winbind: Use idmap_config_const_string in domain_has_idmap_config
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sat, 7 Jan 2017 14:53:09 +0000 (14:53 +0000)]
winbind: Add idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Sun, 8 Jan 2017 17:54:06 +0000 (17:54 +0000)]
lib: Simplify smb_nanosleep
We have the recalculation logic also in sys_poll_intr, don't duplicate it.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Mar 20 16:11:16 CET 2017 on sn-devel-144
Volker Lendecke [Sun, 19 Mar 2017 19:10:29 +0000 (20:10 +0100)]
lib: Make sys_poll_intr available to ctdb
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Volker Lendecke [Sun, 8 Jan 2017 19:52:47 +0000 (19:52 +0000)]
lib: Avoid an includes.h
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Martin Schwenke [Sat, 18 Mar 2017 09:38:32 +0000 (20:38 +1100)]
ctdb-tests: Catch cases where mktemp fails due to missing TMPDIR
TMPDIR sometimes goes missing during autobuild. When that happens the
error messages produced by CTDB tests are not very helpful. This
should make it clear.
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Mon Mar 20 08:53:02 CET 2017 on sn-devel-144
Volker Lendecke [Fri, 17 Mar 2017 12:52:57 +0000 (13:52 +0100)]
s3:winbind: Use the correct talloc context for user information
This fixes the substitution for 'template homedir'.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12699
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Sat Mar 18 19:47:40 CET 2017 on sn-devel-144
Andreas Schneider [Fri, 17 Mar 2017 12:35:39 +0000 (13:35 +0100)]
s3:winbind: Remove unused struct getpwent_user
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Mar 18 08:59:01 CET 2017 on sn-devel-144
Andreas Schneider [Fri, 17 Mar 2017 12:24:13 +0000 (13:24 +0100)]
s3:winbind: Use correct struct member for size calculation
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Volker Lendecke [Fri, 27 Jan 2017 15:03:03 +0000 (16:03 +0100)]
tldap: Allow dropping messages in tldap_search()
For probing whether a connection is a live a rootdse search might be
interesting where we don't really care for the result, only success or
failure of the operation.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Amitay Isaacs [Tue, 14 Mar 2017 05:12:55 +0000 (16:12 +1100)]
ctdb-readonly: Avoid a tight loop waiting for revoke to complete
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12697
During revoking readonly delegations, if one of the nodes disappears, then
there is no point re-trying revoking readonly delegation. The database
needs to be recovered before the revoke operation can succeed. So retry
only after a grace period.
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Fri Mar 17 14:05:57 CET 2017 on sn-devel-144
Ralph Boehme [Thu, 16 Mar 2017 16:52:50 +0000 (17:52 +0100)]
winbindd: remove trailing spaces in get_cache()
Trailing spaces are annoyingly highlighted red in my emacs setup so I'd
like to get rid of them. :)
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 17 00:20:17 CET 2017 on sn-devel-144
Ralph Boehme [Thu, 16 Mar 2017 16:51:29 +0000 (17:51 +0100)]
winbindd: README.Coding fixes for get_cache()
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Ralph Boehme [Thu, 16 Mar 2017 16:45:36 +0000 (17:45 +0100)]
winbindd: fix long lines in get_cache()
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Ralph Boehme [Thu, 16 Mar 2017 09:36:14 +0000 (10:36 +0100)]
winbindd: untangle reconnect_methods vs reconnect_ads_methods
No change in behaviour. The previous logic just seemed a bit clumsy
because of the ifdefs.
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Ralph Boehme [Thu, 16 Mar 2017 08:32:55 +0000 (09:32 +0100)]
winbindd: use NULL for pointer check in get_cache()
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Amitay Isaacs [Thu, 16 Mar 2017 02:29:18 +0000 (13:29 +1100)]
lib/util: Fix initializer
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Amitay Isaacs [Thu, 16 Mar 2017 02:28:57 +0000 (13:28 +1100)]
replace: Fix compiler warning flag
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Thu, 16 Mar 2017 10:58:02 +0000 (11:58 +0100)]
docs: Deprecate "auth methods"
Keeping this parameter prevents fixing bug 2976
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Thu, 16 Mar 2017 08:31:10 +0000 (09:31 +0100)]
docs: Deprecate "map untrusted to domain"
The implementation of this parameter depends on Samba to enumerate
trusted domains. In an active directory environment, we don't know of
a good way to enumerate all domains that we have to accept as trusted,
in particular with multiple forests, one-way and external trusts. We
hope to replace this parameter in the future with something that matches
Windows behaviour better, after the deprecation phase of this parameter
is over and we can remove it.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Thu, 16 Mar 2017 16:17:51 +0000 (09:17 -0700)]
Changes to make the Solaris C compiler happy.
Fix Bug 12693 dbwrap_watch.c syntax error before or at: }
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12693
Signed-off-by: Tom schulz <schulz@adi.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Wed, 15 Mar 2017 20:52:05 +0000 (13:52 -0700)]
s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes.
We expect the following attributes to be present in an LDAP GPO object:
displayName
flags
gPCFileSysPath
name
ntSecurityDescriptor
versionNumber
and fail if a result is returned without them. Change this
to skip results that don't contain these attributes instead.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12695
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Jeremy Allison [Thu, 16 Mar 2017 16:10:52 +0000 (09:10 -0700)]
Fix for Solaris C compiler.
Inspired by comment 4 in bug 12559.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12559
Signed-off-by: Tom Schulz <schulz@adi.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Aurelien Aptel [Wed, 15 Mar 2017 10:34:20 +0000 (11:34 +0100)]
s3:smbd: exit early if srv_send_smb fails
coverity fix.
Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
Jeremy Allison [Tue, 14 Mar 2017 20:34:07 +0000 (13:34 -0700)]
s3: locking: Update oplock optimization for the leases era !
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12628
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Mar 15 20:04:32 CET 2017 on sn-devel-144
Jeremy Allison [Tue, 14 Mar 2017 20:23:13 +0000 (13:23 -0700)]
s3: locking: Move two leases functions into a new file.
map_oplock_to_lease_type(), fsp_lease_type().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12628
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Volker Lendecke [Sat, 11 Mar 2017 09:16:03 +0000 (10:16 +0100)]
lib: Fix an uninitialized variable warning
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Mar 15 14:21:43 CET 2017 on sn-devel-144
Volker Lendecke [Wed, 25 Jan 2017 16:44:38 +0000 (17:44 +0100)]
passdb: Remove pdb_ipa
The version used these days can be found under
https://pagure.io/freeipa/blob/master/f/daemons/ipa-sam
Having a stale copy in Samba only confuses things.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Mar 15 09:18:21 CET 2017 on sn-devel-144
Andreas Schneider [Mon, 13 Mar 2017 16:30:37 +0000 (17:30 +0100)]
testprogs: Correctly expand shell parameters
The old behaviour is:
for var in $*
do
echo "$var"
done
And you get this:
$ sh test.sh 1 2 '3 4'
1
2
3
4
Changing it to:
for var in "$@"
do
echo "$var"
done
will correctly expand to:
$ sh test.sh 1 2 '3 4'
1
2
3 4
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Mar 15 05:26:17 CET 2017 on sn-devel-144
Andreas Schneider [Tue, 14 Mar 2017 15:12:20 +0000 (16:12 +0100)]
s3:vfs_expand_msdfs: Do not open the remote address as a file
The arguments get passed in the wrong order to read_target_host().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12687
Signed-off-by: Andreas Schneider <asn@samba.org>
Alexander Bokovoy [Fri, 10 Mar 2017 14:20:06 +0000 (16:20 +0200)]
lib/crypto: implement samba.crypto Python module for RC4
Implement a small Python module that exposes arcfour_crypt_blob()
function widely used in Samba C code.
When Samba Python bindings are used to call LSA CreateTrustedDomainEx2,
there is a need to encrypt trusted credentials with RC4 cipher.
Current Samba Python code relies on Python runtime to provide RC4
cipher. However, in FIPS 140-2 mode system crypto libraries do not
provide access RC4 cipher at all. According to Microsoft dochelp team,
Windows is treating AuthenticationInformation blob encryption as 'plain
text' in terms of FIPS 140-2, thus doing application-level encryption.
Replace samba.arcfour_encrypt() implementation with a call to
samba.crypto.arcfour_crypt_blob().
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Mar 15 01:30:24 CET 2017 on sn-devel-144
Volker Lendecke [Mon, 13 Mar 2017 18:09:27 +0000 (19:09 +0100)]
examples:clifuse: Add a stub for getattr
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Mar 14 19:15:03 CET 2017 on sn-devel-144
Volker Lendecke [Mon, 13 Mar 2017 16:48:56 +0000 (17:48 +0100)]
examples: Add '-p', '--port' to smb2mount
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Volker Lendecke [Tue, 24 Jan 2017 20:42:51 +0000 (21:42 +0100)]
libsmb: Slightly simplify trustdom_cache_fetch
Also adapt to modern coding standards
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Volker Lendecke [Tue, 24 Jan 2017 20:40:42 +0000 (21:40 +0100)]
libsmb: Use talloc in trustdom_cache_key
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Volker Lendecke [Tue, 24 Jan 2017 20:35:16 +0000 (21:35 +0100)]
libsmb: Simplify trustdom_cache_store
The additional arguments were never used
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Volker Lendecke [Tue, 24 Jan 2017 20:30:40 +0000 (21:30 +0100)]
libsmb: Make a few functions static
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Volker Lendecke [Fri, 20 Jan 2017 12:40:23 +0000 (13:40 +0100)]
libsmb: Remove some stale code
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Andreas Schneider [Mon, 13 Mar 2017 14:34:20 +0000 (15:34 +0100)]
krb5_wrap: Fix smb_gss_krb5_import_cred() picky-developer build
This does not build on Fedora 25 with picky-developer turned on.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Andreas Schneider [Mon, 13 Mar 2017 15:34:05 +0000 (16:34 +0100)]
testprogs: Test 'net ads join' with a dedicated keytab
This checks that a 'net ads join' can create the keytab and make sure we
will not regress in future.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Andreas Schneider [Mon, 13 Mar 2017 16:28:58 +0000 (17:28 +0100)]
param: Allow to specify kerberos method on the commandline
We support --option for our tools but you cannot set an option where the
value of the option includes a space.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Andreas Schneider [Mon, 13 Mar 2017 15:24:52 +0000 (16:24 +0100)]
s3:libads: Correctly handle the keytab kerberos methods
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Andreas Schneider [Mon, 13 Mar 2017 15:11:39 +0000 (16:11 +0100)]
krb5_wrap: Print a warning for an invalid keytab name
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Stefan Metzmacher [Mon, 13 Mar 2017 14:59:54 +0000 (15:59 +0100)]
remove historic source3/change-log
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Mar 13 19:45:31 CET 2017 on sn-devel-144
Garming Sam [Sun, 12 Mar 2017 23:18:00 +0000 (12:18 +1300)]
getncchanges: Remove O(n) loop in link parsing
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Mar 13 08:57:24 CET 2017 on sn-devel-144
Garming Sam [Sun, 12 Mar 2017 23:16:13 +0000 (12:16 +1300)]
dsdb: Allow parsed_dn_find to have a prefixed blob match
This allows us to search against binary DN using only the attributeID in
the case of msDS-RevealedUsers (as it appears right at the beginning).
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Sun, 12 Mar 2017 23:14:23 +0000 (12:14 +1300)]
dsdb: Move parsed_dn_find into a common location
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Tue, 7 Mar 2017 02:42:59 +0000 (15:42 +1300)]
tests/dbcheck-links: remove spurious sleeping
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Fri, 10 Mar 2017 01:25:21 +0000 (14:25 +1300)]
getncchanges: generalize samdb_result_sid_array_ndr a little
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Fri, 10 Mar 2017 01:31:10 +0000 (14:31 +1300)]
getncchanges: Add a comment regarding sIDHistory for allow/deny in repl_secret
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Mon, 6 Mar 2017 23:30:09 +0000 (12:30 +1300)]
objectclass_attrs: Restrict systemOnly attributes
This allows restriction of auditing attributes from being wiped.
Modifications of the RID Set must be done as SYSTEM.
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Wed, 8 Mar 2017 02:16:49 +0000 (15:16 +1300)]
tests/match_rules: Use system privilege for msDS-RevealedUsers
Must be done before the systemOnly attribute is enforced.
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Fri, 3 Mar 2017 04:31:46 +0000 (17:31 +1300)]
dbcheck: Improve dbcheck to find (and may fix) dangling msDS-RevealedUsers
We cannot add missing backlinks because of the duplicate checking. There
seems to be no trivial way to add the bypass.
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Fri, 3 Mar 2017 03:02:40 +0000 (16:02 +1300)]
getncchanges: include object SID in tokenGroups calculation for repl secret
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Fri, 3 Mar 2017 03:05:25 +0000 (16:05 +1300)]
tests/repl_rodc: Test the direct allow/deny attribute works
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Thu, 2 Mar 2017 22:18:33 +0000 (11:18 +1300)]
getncchanges: Reorder and comment code for clarity
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Thu, 2 Mar 2017 22:14:24 +0000 (11:14 +1300)]
getncchanges: Prevent a small, but possible race condition in build_object
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Thu, 2 Mar 2017 22:01:36 +0000 (11:01 +1300)]
getncchanges: Refactor filter_attrs from build_object
This makes it easier to have a transaction around it.
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Tue, 28 Feb 2017 03:21:25 +0000 (16:21 +1300)]
getncchanges: Tie destination DSA GUID to authenticating RODC for REPL_SECRET
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Fri, 3 Mar 2017 01:00:39 +0000 (14:00 +1300)]
tests/repl_rodc: Ensure that the machine account is tied to the destination DSA
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Garming Sam [Fri, 3 Mar 2017 03:21:12 +0000 (16:21 +1300)]
getncchanges: Implement functionality for msDS-RevealedUsers
This multi-valued DN+Binary linked attribute is present on the server object
for an RODC. A link to an object is added to it whenever secret
attributes from that object are replicated to an RODC to serve as an
audit trail.
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Bob Campbell <bobcampbell@catalyst.net.nz>
Bob Campbell [Fri, 17 Feb 2017 02:51:36 +0000 (15:51 +1300)]
getncchanges: Do not filter secrets by PAS in EXOP_REPL_SECRET
This conforms with Windows' behaviour.
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Garming Sam [Wed, 8 Mar 2017 04:12:32 +0000 (17:12 +1300)]
replmd: Include extra data on DN in search if it exists
This is important for multi-valued DN+Binary (or DN+String) attributes,
as otherwise they will be considered duplicates.
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Bob Campbell <bobcampbell@catalyst.net.nz>
Garming Sam [Fri, 10 Mar 2017 04:29:53 +0000 (17:29 +1300)]
replmd: Ensure that binary blobs in links are ordered in the database
This is required if we are to search them with a binsearch.
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>