14 years agoMerge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-test
Andrew Tridgell [Thu, 24 Jul 2008 04:26:30 +0000 (14:26 +1000)]
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-test
(This used to be commit 24309dbf4d9622fcfafa29ef98bc0459fdaa814b)

14 years agowe can't query the ACL on a new file till it exists!
Andrew Tridgell [Thu, 24 Jul 2008 04:21:52 +0000 (14:21 +1000)]
we can't query the ACL on a new file till it exists!
(This used to be commit 4f6646f06988b1fb8be9e0c8ae833bb9792184af)

14 years agoinitialise query_maximal_access here too
Andrew Tridgell [Thu, 24 Jul 2008 04:21:31 +0000 (14:21 +1000)]
initialise query_maximal_access here too
(This used to be commit 4b3af09450cf33c6785a3d8fddddc68047f2e388)

14 years agomake sure we initialise query_maximal_access
Andrew Tridgell [Thu, 24 Jul 2008 04:20:02 +0000 (14:20 +1000)]
make sure we initialise query_maximal_access
(This used to be commit 036f73d39a7ef882fd76afcd3c11eef483f6c308)

14 years agofixed spelling error
Andrew Tridgell [Thu, 24 Jul 2008 04:19:49 +0000 (14:19 +1000)]
fixed spelling error
(This used to be commit 341f64834e13cdbc7d4742a4652ae39b70a4231f)

14 years agodsdb_create_prefix_mapping() implementation checks for existing prefix maping in...
Anatoliy Atanasov [Mon, 21 Jul 2008 14:04:49 +0000 (17:04 +0300)]
dsdb_create_prefix_mapping() implementation checks for existing prefix maping in ldb.
if one not found it creates a mapping for it and updates the prefixMap schema attribute in ldb.
(This used to be commit bbe895db7144b192981fad9ab6bbd3ebacb8d299)

14 years agoHandle schema reloading request.
Anatoliy Atanasov [Wed, 23 Jul 2008 06:59:17 +0000 (09:59 +0300)]
Handle schema reloading request.
The ldif for that operation looks like this:

changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1

It uses the rootdse's object functional attribute schemaUpdateNow.
In rootdse_modify() this command is being recognized and it is send as extended operation with DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID.
In the partition module its dispatched to the schema_fsmo module.
The request is processed in the schema_fsmo module by schema_fsmo_extended().
(This used to be commit 39f9184ddf215f2b512319211c0a05702218ef87)

14 years agofixd a bug in the signal handling code - we could get phantom signals
Andrew Tridgell [Thu, 24 Jul 2008 01:48:27 +0000 (11:48 +1000)]
fixd a bug in the signal handling code - we could get phantom signals
(signum 64)
(This used to be commit af7fb2e38ba27cf8058eb1cef1f96bbc7b19849f)

14 years agolibnet_become_dc: send msDS_Behavior_Version == 3 (win2k8) in DsAddEntry
Michael Adam [Wed, 23 Jul 2008 14:23:31 +0000 (16:23 +0200)]
libnet_become_dc: send msDS_Behavior_Version == 3 (win2k8) in DsAddEntry

instead of version 2 (win2k3).
This makes the NET-API-BECOME-DC test work against windows 2003 and 2008.

(This used to be commit a7bfa1fb1bc6fb8e412990b7ff4c3ce9bc55099d)

14 years agolibnet_become_cd: add boolean option "become_dc:force krb5" to control krb5 auth.
Michael Adam [Wed, 23 Jul 2008 15:54:25 +0000 (17:54 +0200)]
libnet_become_cd: add boolean option "become_dc:force krb5" to control krb5 auth.

This allows controlling whether krb5 auth is forced for the rpc bind in
libnet_become_dc. It defaults to "yes". For Windows 2000, DsGetNCChanges
only krb5 auth works due to a bug in Windows (it returns garbage - a
positive object count is returned along with first object == NULL).
For Windows 2008, on the other hand, krb5 auth does not work currently
due to the lack of support for AES keys. (Metze is working on that.)

(This used to be commit af85aad8147b85a0b9ea2ccc66b8f04efdfe5cf3)

14 years agodrsuapi: always set the pid field of the outgoing DsBindInfo to 0.
Michael Adam [Wed, 23 Jul 2008 13:34:45 +0000 (15:34 +0200)]
drsuapi: always set the pid field of the outgoing DsBindInfo to 0.

This is for debugging and informational purposes only.
The assignment is implementation specific.
(WSPP docs, sec. 5.35).

(This used to be commit 1f5704e2dee5900e8d1d87699b76f67c0e12854e)

14 years agolibnet_unbecome_dc: teach unbecomeDC_drsuapi_bind_recv() DsBindInfo48.
Michael Adam [Wed, 23 Jul 2008 13:21:44 +0000 (15:21 +0200)]
libnet_unbecome_dc: teach unbecomeDC_drsuapi_bind_recv() DsBindInfo48.

..to work agains w2k8.

(This used to be commit 97e8d5813df19cae294b6de2a880606f0f8c2c59)

14 years agolibnet_become_cd: teach becomeDC_drsuapi_bind_recv() DsBindInfo48.
Michael Adam [Wed, 23 Jul 2008 13:18:57 +0000 (15:18 +0200)]
libnet_become_cd: teach becomeDC_drsuapi_bind_recv() DsBindInfo48.

To work with w2k8.

(This used to be commit 7d80fab912576923c7474d77b8ed960b01296914)

14 years agodsdb: teach dreplsrv_out_drsuapi_bind_recv() knowledge of DsBindInfo48.
Michael Adam [Wed, 23 Jul 2008 12:07:06 +0000 (14:07 +0200)]
dsdb: teach dreplsrv_out_drsuapi_bind_recv() knowledge of DsBindInfo48.

To make it work against w2k8.

(This used to be commit a8aea9274170a2b472c45c97a4904bd299d2a92e)

14 years agopassword_hash: add generation of the Primary:Kerberos-Newer-Keys blob
Stefan Metzmacher [Wed, 23 Jul 2008 07:35:19 +0000 (09:35 +0200)]
password_hash: add generation of the Primary:Kerberos-Newer-Keys blob

But it's still of by default until we now what triggers this generation.
It could be that the value is always generated but the KDC only
uses it when in a specific funtional level, but it could also
be that it's only generated in a specific functional level.

(This used to be commit 08618bbd508ede0bb9e1922fae562cffdca41cbd)

14 years agohdb-ldb: try to find Primary:Kerberos-Newer-Keys and fallback to Primary:Kerberos
Stefan Metzmacher [Tue, 22 Jul 2008 16:47:27 +0000 (18:47 +0200)]
hdb-ldb: try to find Primary:Kerberos-Newer-Keys and fallback to Primary:Kerberos

Now provide AES tickets if we find the keys in the supplementalCredentials attribute

(This used to be commit 8300259f103f8cfe014988fad0f7ee0d49bb1ac2)

14 years agodrsblobs.idl: add idl for Primary:Kerberos-Newer-Keys blob in supplementalCredentials
Stefan Metzmacher [Tue, 22 Jul 2008 10:28:07 +0000 (12:28 +0200)]
drsblobs.idl: add idl for Primary:Kerberos-Newer-Keys blob in supplementalCredentials

(This used to be commit 97b7901afbccc9647ad2958d4cf12300de2655d1)

14 years agopassword_hash: order the supplementalCredentials Packages in the same order like...
Stefan Metzmacher [Tue, 22 Jul 2008 16:54:21 +0000 (18:54 +0200)]
password_hash: order the supplementalCredentials Packages in the same order like windows

(This used to be commit ca9cd81a1798fb15195566422b3cad7c282fce89)

14 years agopassword_hash: split the generation of krb5 keys into a different function
Stefan Metzmacher [Tue, 22 Jul 2008 16:27:36 +0000 (18:27 +0200)]
password_hash: split the generation of krb5 keys into a different function

(This used to be commit 4ad73a0bf8952783d3d9a7339c0c4fd8ca28981a)

14 years agopassword_hash: simplify the logic if we have cleartext we always generate the hashes
Stefan Metzmacher [Tue, 22 Jul 2008 16:32:49 +0000 (18:32 +0200)]
password_hash: simplify the logic if we have cleartext we always generate the hashes

(This used to be commit 5edff84429ef0d03b47a438e18861d26c97e17b6)

14 years agopassword_hash: fix callers after idl change for package_PrimaryKerberos
Stefan Metzmacher [Wed, 23 Jul 2008 08:05:43 +0000 (10:05 +0200)]
password_hash: fix callers after idl change for package_PrimaryKerberos

(This used to be commit 1bf552856f3a930c4716ceb73d9ba9adf7502d3d)

14 years agodrsblobs.idl: fix unknowns in package_PrimaryKerberos idl
Stefan Metzmacher [Wed, 23 Jul 2008 06:53:34 +0000 (08:53 +0200)]
drsblobs.idl: fix unknowns in package_PrimaryKerberos idl

(This used to be commit da9ceb2bf17f964334d9317829d40483e2c04b10)

14 years agohdb-ldb: check the SUPPLEMENTAL_CREDENTIALS_SIGNATURE
Stefan Metzmacher [Wed, 23 Jul 2008 11:41:51 +0000 (13:41 +0200)]

(This used to be commit 7219740ef434091617c6bb727374251987ff2a62)

14 years agopassword_hash: check the SUPPLEMENTAL_CREDENTIALS_SIGNATURE
Stefan Metzmacher [Wed, 23 Jul 2008 11:31:14 +0000 (13:31 +0200)]

(This used to be commit 19b8c8e37bafab050ab61266c35006efada2947c)

14 years agodrsblobs.idl: fix idl for supplementalCredentialsSubBlob
Stefan Metzmacher [Wed, 23 Jul 2008 11:06:32 +0000 (13:06 +0200)]
drsblobs.idl: fix idl for supplementalCredentialsSubBlob

(This used to be commit 24c5b10136f6e640832193aaf9e6d7e865c288bc)

14 years agopassword_hash: ignore reserved value, but still set it like windows does
Stefan Metzmacher [Wed, 23 Jul 2008 10:00:42 +0000 (12:00 +0200)]
password_hash: ignore reserved value, but still set it like windows does

(This used to be commit 5b860572686167d0291161f6597f143e538e2f3a)

14 years agodrsblobs.idl: rename unknown1 -> reserved
Stefan Metzmacher [Wed, 23 Jul 2008 11:53:03 +0000 (13:53 +0200)]
drsblobs.idl: rename unknown1 -> reserved

(This used to be commit 9a70b2237d4fdd523edfbca0329ad35e71faf998)

14 years agopassword_hash: don't add zero padding as w2k8 also don't add it
Stefan Metzmacher [Tue, 22 Jul 2008 16:31:45 +0000 (18:31 +0200)]
password_hash: don't add zero padding as w2k8 also don't add it

(This used to be commit 26e9169d454349795ad0bc64d7f65059541ab89e)

14 years agohdb-ldb: fix comment about padding
Stefan Metzmacher [Tue, 22 Jul 2008 16:46:24 +0000 (18:46 +0200)]
hdb-ldb: fix comment about padding

(This used to be commit ca28d05b11e602e0f98cda0e02f973562c199dc6)

14 years agohdb-ldb: fix crash bug in the error path
Stefan Metzmacher [Tue, 22 Jul 2008 16:34:14 +0000 (18:34 +0200)]
hdb-ldb: fix crash bug in the error path

(This used to be commit ac02d6a0f765e3b66fb6796f129edb1a348ecd84)

14 years agoRPC-DSSYNC: print 'supplementalCredentials' more verbosely
Stefan Metzmacher [Tue, 22 Jul 2008 12:06:36 +0000 (14:06 +0200)]
RPC-DSSYNC: print 'supplementalCredentials' more verbosely

(This used to be commit 6a7637b12e4a34915a53e81a0f47571da21fdc5a)

14 years agorpc_server: be more strict with the incoming assoc_group_id
Stefan Metzmacher [Wed, 23 Jul 2008 12:41:16 +0000 (14:41 +0200)]
rpc_server: be more strict with the incoming assoc_group_id

Allow 0 and 0x12345678 only.
This fixes the RPC-HANDLES test.

(This used to be commit c123e597cc84685abf2b0d3564e1a26d80bbef2f)

14 years agosmbtorture: add a warning for unknown BindInfo length to the RPC-DSSYNC test
Michael Adam [Wed, 23 Jul 2008 09:06:50 +0000 (11:06 +0200)]
smbtorture: add a warning for unknown BindInfo length to the RPC-DSSYNC test

(This used to be commit 7ee99105ea3a50d8ee2c83ecd39e834ed9efb98c)

14 years agosmbtorture: add support for the DSBindInfo48 to the RPC-DSSYNC test.
Michael Adam [Wed, 23 Jul 2008 09:05:24 +0000 (11:05 +0200)]
smbtorture: add support for the DSBindInfo48 to the RPC-DSSYNC test.

(This used to be commit 67a99e445871861945fd0a45784cffb358bdccf3)

14 years agolibnet/become_dc: add a comment and explain why it's important to specify krb5
Stefan Metzmacher [Thu, 17 Jul 2008 11:36:59 +0000 (13:36 +0200)]
libnet/become_dc: add a comment and explain why it's important to specify krb5

(This used to be commit 26d1f9366d8611af1a69095b4cede2d2c95c982d)

14 years agoMerge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
Andrew Bartlett [Wed, 23 Jul 2008 06:20:07 +0000 (16:20 +1000)]
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
(This used to be commit ae311d89d2d477b235a6a9294a8bb463ed0a8c05)

14 years agoThe SMB session key must not be more than 16 bytes in SAMR (and
Andrew Bartlett [Wed, 23 Jul 2008 06:19:54 +0000 (16:19 +1000)]
The SMB session key must not be more than 16 bytes in SAMR (and
presumably LSA).

Tests show that Vista requires the sesion key to be truncated for a
domain join.

Andrew Bartlett
(This used to be commit af629a3738298d27eb2dbecf466ceb503cec9638)

14 years agoMerge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
Andrew Bartlett [Wed, 23 Jul 2008 06:15:46 +0000 (16:15 +1000)]
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
(This used to be commit 532ccbbe7aa360440f455dfa136f425b9996e998)

14 years agoMerge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
Andrew Bartlett [Wed, 23 Jul 2008 06:15:43 +0000 (16:15 +1000)]
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
(This used to be commit a93b20b85b7b35965c428f1543cb7bbe96e16d42)

14 years agoRemove the 'accoc_group_id' check in the RPC server.
Andrew Bartlett [Wed, 23 Jul 2008 06:14:20 +0000 (16:14 +1000)]
Remove the 'accoc_group_id' check in the RPC server.

This check breaks more than it fixes, and while technically not
correct, is the best solution we have at this time.  Otherwise,
SCHANNEL binds from WinXP fail.

Andrew Bartlett
(This used to be commit f8628fa330abcd50923d995d5bda1f4811582ea9)

14 years agoExplain where some other OIDs are allocated.
Andrew Bartlett [Wed, 23 Jul 2008 03:49:00 +0000 (13:49 +1000)]
Explain where some other OIDs are allocated.

This is an odd place for an OID registry - we perhaps need a central
wiki page.

Andrew Bartlett
(This used to be commit 1c909973977ae117703c1ccf7589acc4625e76e5)

14 years agoChange occurrences of the u1 member of DsBindInfo* to pid after idl change.
Michael Adam [Tue, 22 Jul 2008 13:35:23 +0000 (15:35 +0200)]
Change occurrences of the u1 member of DsBindInfo* to pid after idl change.

(This used to be commit b91bbc5fe4a47e5823be6be5f2f203f1f14105de)

14 years agodrsuapi.idl: change the u1 field in DsBindInfo* to "pid".
Michael Adam [Tue, 22 Jul 2008 13:33:26 +0000 (15:33 +0200)]
drsuapi.idl: change the u1 field in DsBindInfo* to "pid".

According to the WSPP docs, section 5.35,
this is the "process identifyer" of the client.
It is meant for informational and debugging purposes
only and its assignment is implementation specific.

(This used to be commit 579306eb5b58b6c1142b3c489e4bcf6da50810d6)

14 years agodrsuapi.idl: add drsuapi_SupportedExtensionsExt bitfield.
Michael Adam [Tue, 22 Jul 2008 11:07:55 +0000 (13:07 +0200)]
drsuapi.idl: add drsuapi_SupportedExtensionsExt bitfield.

This knowledge is obtained from the wspp-docs (section 5.35).

(This used to be commit f5afb695045b1a2f3b8c00a4d82d40e8e50726c9)

14 years agodrsuapi.idl: the last 16 bytes in DsBindInfo48 ar the GUID of the config dn.
Michael Adam [Tue, 22 Jul 2008 10:46:04 +0000 (12:46 +0200)]
drsuapi.idl: the last 16 bytes in DsBindInfo48 ar the GUID of the config dn.

This bit seems not to be documented in the WSPP docs.

(This used to be commit 705f79bd0a5e93daa0cb11b5dcca36e75c75df93)

14 years agodrsuapi.idl: add drsuapi_DsBindInfo48.
Michael Adam [Tue, 22 Jul 2008 09:37:32 +0000 (11:37 +0200)]
drsuapi.idl: add drsuapi_DsBindInfo48.

This is necessary to make DsGetNcChanges work with win2008.

(This used to be commit dd278b069b8683a0e3721ebb7d0de06d2bc1c86f)

14 years agos3 cli_do_rpc_ndr does not use PI_* anymore
Volker Lendecke [Mon, 21 Jul 2008 11:05:23 +0000 (13:05 +0200)]
s3 cli_do_rpc_ndr does not use PI_* anymore
(This used to be commit e625c6b2516111002c99239c1a2188c6d5d87ab6)

14 years agoInstall'named.txt' to private/ as documentation.
Andrew Bartlett [Tue, 22 Jul 2008 01:09:18 +0000 (11:09 +1000)]
Install'named.txt' to private/ as documentation.

This document is much more use when subbed with all the right things.

Andrew Bartlett
(This used to be commit 136a85599815670c807f212d7d4003ec53a13729)

14 years agoImprove DNS and Group poicy configurations.
Matthias Dieter Wallnöfer [Tue, 22 Jul 2008 01:06:47 +0000 (11:06 +1000)]
Improve DNS and Group poicy configurations.

 - fixes bug #4813 (simplify DNS setup)
  - This reworks the named.conf to be a fully fledged include
  - This also moves the documentation into named.txt
 - improves bug #4900 (Group policy support in Samba)
   - by creating an empty GPT.INI
 - fixes bug #5582 (DNS: Enhanced zone file)
   - This is now closer to the zone file AD creates

committed by Andrew Bartlett
(This used to be commit 74d684f6b329d7dd573cdc55e16bb8e629474b02)

14 years agoProperly cast array length in print functions.
Jelmer Vernooij [Mon, 21 Jul 2008 10:47:08 +0000 (12:47 +0200)]
Properly cast array length in print functions.
(This used to be commit f321240fa91fa19c1131f119c42f64897d220682)

14 years agoFix winbindd not to sit in a busy loop...
Andrew Bartlett [Mon, 21 Jul 2008 05:00:18 +0000 (15:00 +1000)]
Fix winbindd not to sit in a busy loop...

Clearly winbindd in Samba4 has not ever been run against windows, as
when we fixed the Samba4 server not to cause XP to loop like this,
Samba4's own client starts looping...

Andrew Bartlett
(This used to be commit 9741772190a85c7c42c17ff24a4aa3f53fbc9f3a)

14 years agoRename structures to better match the names in the WSPP IDL.
Andrew Bartlett [Mon, 21 Jul 2008 03:42:07 +0000 (13:42 +1000)]
Rename structures to better match the names in the WSPP IDL.

The 'comment' element in a number of domain structures is called
oem_information.  This was picked up actually because with OpenLDAP
doing the schema checking, it noticed that 'comment' was not a valid

The rename tries to keep this consistant in both the LDB mappings and
IDL, so we don't make the same mistake in future.

This has no real schema impact, as this value isn't actually used for
anything, as 'comment' was not used in the provision.

Andrew Bartlett
(This used to be commit 65dc0d536590d055a5ee775606ac90ee5fcaee9a)

14 years agoRemove bogus test in 'enum trusted domains' LSA server.
Andrew Bartlett [Mon, 21 Jul 2008 02:05:53 +0000 (12:05 +1000)]
Remove bogus test in 'enum trusted domains' LSA server.

The change to the RPC-LSA test proves that when the remote server has
0 trusted domains, it will return NT_STATUS_NO_MORE_ENTRIES, not

Andrew Bartlett
(This used to be commit 40a55b34c2ce75267cf004dc4cfb8153c061e66b)

14 years agoMerge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
Andrew Bartlett [Mon, 21 Jul 2008 01:27:23 +0000 (11:27 +1000)]
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
(This used to be commit 55bde3c9daeafdac04574365c23d181345639f34)

14 years agoSleep longer in the hope that the OpenLDAP backend might catch up
Andrew Bartlett [Mon, 21 Jul 2008 01:18:54 +0000 (11:18 +1000)]
Sleep longer in the hope that the OpenLDAP backend might catch up
(This used to be commit 63c80c885dc3fb2228f082be8db752bb29e3962e)

14 years agoFix ldb_map to add/remove the same 'extra' objectclass
Andrew Bartlett [Mon, 21 Jul 2008 01:18:21 +0000 (11:18 +1000)]
Fix ldb_map to add/remove the same 'extra' objectclass

The code previously added data->add_objectClass, but only removed the
fixed objectclass of extensibleObject.

Found by the ldap.py test.

Andrew Bartlett
(This used to be commit 4fa15c3173a997fa0b9041161d81e742e1fdb41c)

14 years agoMake invalid 'member' detection work again.
Andrew Bartlett [Sun, 20 Jul 2008 23:36:24 +0000 (09:36 +1000)]
Make invalid 'member' detection work again.

This defines a rootdn globally, and due to OpenLDAP bugs, gives it
manage access to the whole database.  This makes the memberOf module
able to validate the links again, now we have database ACLs.

Andrew Bartlett
(This used to be commit 9fe3e9f09f89fd92f8a16768e53391ff5f8489ec)

14 years agoFix RAW-OPEN against Samba3
Volker Lendecke [Sat, 19 Jul 2008 10:47:31 +0000 (12:47 +0200)]
Fix RAW-OPEN against Samba3

This test assumed that fnums are recycled immediately after a close. This is
not true on Samba 3.

Andrew B., I assume this is just a bug in the test. Assuming recycled fnums
might be true on Windows and Samba 4, but I don't think we should assume this

(This used to be commit a4c3a59d47b2b1c794eda556d252c61907be1b3c)

14 years agoMake a seperate template for the refint configuration too
Andrew Bartlett [Fri, 18 Jul 2008 08:58:56 +0000 (18:58 +1000)]
Make a seperate template for the refint configuration too
(This used to be commit d2a527acc5ee6fe9b943657dc9c3ace920b2d619)

14 years agoPut the memberof template into a seperate setup/ file.
Andrew Bartlett [Fri, 18 Jul 2008 08:44:07 +0000 (18:44 +1000)]
Put the memberof template into a seperate setup/ file.

Set a memberof-dn in a fruitless attempt to fix the ACL problem I'm
having with OpenLDAP

Andrew Bartlett
(This used to be commit 6d6e03834a1a77a8ceba41fbe8c9d49680065ba3)

14 years agoMore 'must be ignored' options from the MS-SMB doc.
Andrew Bartlett [Fri, 18 Jul 2008 08:40:19 +0000 (18:40 +1000)]
More 'must be ignored' options from the MS-SMB doc.

Also in particular the 'sync' flags (which Samba has traditionally

Thanks to Olivier Salamin <olivier.salamin@gmail.com> for pointing out
more flags that needed to be handled.

Andrew Bartlett
(This used to be commit 370bb39cd79fe49efd36a1ceb3e896d386e6d3ce)

14 years agoAdd the interface ID to the rpc_pipe_register_commands call in s3 srv code
Volker Lendecke [Wed, 16 Jul 2008 19:50:25 +0000 (21:50 +0200)]
Add the interface ID to the rpc_pipe_register_commands call in s3 srv code
(This used to be commit efe249928312f730ee580e72b9c640ef88b0ed5b)

14 years agodrsuapi: print out the number of linked attribute values we got
Stefan Metzmacher [Wed, 16 Jul 2008 11:02:54 +0000 (13:02 +0200)]
drsuapi: print out the number of linked attribute values we got

(This used to be commit 34f8b2abdd546f6b60ddae2ad839119f211c995c)

14 years agodrsuapi: make use of the 'more_data' field in DsGetNCChangesCtr[1|6]
Stefan Metzmacher [Wed, 16 Jul 2008 11:01:56 +0000 (13:01 +0200)]
drsuapi: make use of the 'more_data' field in DsGetNCChangesCtr[1|6]

(This used to be commit 35c7fa470a7433d081403b2b57a331c7dc287aef)

14 years agodrsuapi: check ctr6->drs_error
Stefan Metzmacher [Wed, 16 Jul 2008 11:00:07 +0000 (13:00 +0200)]
drsuapi: check ctr6->drs_error

(This used to be commit 511847f5f5015bcdef69e80b91cb08ffb1690e59)

14 years agodrsuapi: get ctr6 out of xpress compressed level
Stefan Metzmacher [Wed, 16 Jul 2008 10:58:29 +0000 (12:58 +0200)]
drsuapi: get ctr6 out of xpress compressed level

(This used to be commit 4e0708148a121bd41a12abf6122d5d6f3f09667a)

14 years agodrsuapi: total_object_count was the wrong guess
Stefan Metzmacher [Tue, 15 Jul 2008 14:59:09 +0000 (16:59 +0200)]
drsuapi: total_object_count was the wrong guess

The total_object_count member of DsGetNCChangesCtr[1|6] was wrong
it's the error code of an extended operation.

DsGetNCChangesCtr6 has a nc_object_count value which contains
the estimated amount of objects in the naming_context.

W2k seems to have a bug and sends this number of objects
in the extended_ret field. Maybe it's just a bug and
not a feature:-)

(This used to be commit 67931092128ce89aadf689a54e20d6e4a9d7fe2c)

14 years agodrsuapi.idl: fix unknowns in drsuapi_DsGetNCChangesCtr*
Stefan Metzmacher [Tue, 15 Jul 2008 13:36:54 +0000 (15:36 +0200)]
drsuapi.idl: fix unknowns in drsuapi_DsGetNCChangesCtr*

(This used to be commit 9e99e59ca7e56bf74417ec85339e09e86f50d17e)

14 years agolibnet/become_dc: an unknown field in drsuapi.idl changed to object_flags
Stefan Metzmacher [Tue, 15 Jul 2008 14:58:16 +0000 (16:58 +0200)]
libnet/become_dc: an unknown field in drsuapi.idl changed to object_flags

(This used to be commit a6198ab6cb829969b12068324d870966a6cfc029)

14 years agodrsuapi.idl: fix unknowns in drsuapi_DsReplicaObject*
Stefan Metzmacher [Tue, 15 Jul 2008 13:35:47 +0000 (15:35 +0200)]
drsuapi.idl: fix unknowns in drsuapi_DsReplicaObject*

(This used to be commit de2aed042d09ae7a31ddc4cd920c8fcf193ba06a)

14 years agodrsuapi.idl: fix unknowns in drsuapi_DsReplicaCursor[2]
Stefan Metzmacher [Tue, 15 Jul 2008 13:34:23 +0000 (15:34 +0200)]
drsuapi.idl: fix unknowns in drsuapi_DsReplicaCursor[2]

(This used to be commit a681e55067a83f06e465b81afb2b0b870b674dca)

14 years agodrsuapi.idl: correctly handle xpress compressed payload
Stefan Metzmacher [Fri, 11 Jul 2008 08:19:53 +0000 (08:19 +0000)]
drsuapi.idl: correctly handle xpress compressed payload


Signed-off-by: Stefan Metzmacher <metze@samba.org>
(This used to be commit d9d19eef4f67da89e7d818d23a2372bee6f86dba)

14 years agobecome_dc: we need to replicate using krb5 auth to work against w2k
Stefan Metzmacher [Wed, 16 Jul 2008 09:30:47 +0000 (11:30 +0200)]
become_dc: we need to replicate using krb5 auth to work against w2k

With NTLMSSP we just get strange responses with a random object count
and a NULL object list. On the domain partition where we try to replicate
the password fields.

(This used to be commit ce12a9105113ad7cff96b7d553a8d69901c56de7)

14 years agoNET-API-BECOME-DC: fix crash bugs because of unintialized variables
Stefan Metzmacher [Tue, 15 Jul 2008 16:28:25 +0000 (18:28 +0200)]
NET-API-BECOME-DC: fix crash bugs because of unintialized variables

(This used to be commit 6acf42c2e41bb1d44c1fcaaaa58fc3f148491836)

14 years agoAnother kludge to let the OpenLDAP backend catch up.
Andrew Bartlett [Wed, 16 Jul 2008 07:06:33 +0000 (17:06 +1000)]
Another kludge to let the OpenLDAP backend catch up.

This will go away when this is handled in an internal transation.

Andrew Bartlett
(This used to be commit f567e17758cfe937249beafae0a9087b67b27755)

14 years agoFix the build - this element was renamed.
Andrew Bartlett [Wed, 16 Jul 2008 05:28:54 +0000 (15:28 +1000)]
Fix the build - this element was renamed.
(This used to be commit 60161954ad5c99ce9934a968c5d41f41fafd780f)

14 years agoReorder whitespace in generated slapd.conf
Andrew Bartlett [Wed, 16 Jul 2008 04:04:24 +0000 (14:04 +1000)]
Reorder whitespace in generated slapd.conf

This helps us see the real groupings in the generated memberOf

Andrew Bartlett
(This used to be commit ec70ebb8310e563324233662f8e779c55fb87514)

14 years agoIgnore and handle more NT Create & X options.
Andrew Bartlett [Wed, 16 Jul 2008 04:00:18 +0000 (14:00 +1000)]
Ignore and handle more NT Create & X options.

The MS-SMB document explains that some of these options should be
ignored.  The test proves it.

/* Must be ignored by the server, per MS-SMB 2.2.8 */
/* Must be ignored by the server, per MS-SMB 2.2.8 */

If we implement HSM in samba4 (likely) we should honour this bit.
/* Don't pull this file off tape in a HSM system */

Andrew Bartlett
(This used to be commit 502739ff90d56d2c9aabe8e224317f6ceb175c17)

14 years agoDon't keep an extra ldb around forever.
Andrew Bartlett [Wed, 16 Jul 2008 01:11:25 +0000 (11:11 +1000)]
Don't keep an extra ldb around forever.

We just open it to figure out if we need to be a Global Catalog server.

Andrew Bartlett
(This used to be commit f13572d9e9f1962b637cbd573588184d1459d252)

14 years agoMerge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
Andrew Bartlett [Tue, 15 Jul 2008 12:22:34 +0000 (22:22 +1000)]
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet


(This used to be commit 5d539b7da46e38e7570fa5af4549b142f25e4585)

14 years agoSimplify the contextCSN determination.
Andrew Bartlett [Tue, 15 Jul 2008 12:10:42 +0000 (22:10 +1000)]
Simplify the contextCSN determination.

We only ever have one backend partition per Samba partition.

Andrew Bartlett
(This used to be commit 316a9b312a2d4a4ea5a5c70946fb06b61fab1a7d)

14 years agoLock down the LDAP backend - only samba may read or write
Andrew Bartlett [Tue, 15 Jul 2008 12:07:45 +0000 (22:07 +1000)]
Lock down the LDAP backend - only samba may read or write
(This used to be commit a3912801fb25f715725c06402d4bdff9a926f15d)

14 years agoMerge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
Andrew Bartlett [Tue, 15 Jul 2008 10:27:43 +0000 (20:27 +1000)]
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
(This used to be commit 7fb8179f214bbba95eb35d221cb9892b55afe121)

14 years agoRevert Fedrora DS backend to use extensibleObject.
Andrew Bartlett [Tue, 15 Jul 2008 10:26:04 +0000 (20:26 +1000)]
Revert Fedrora DS backend to use extensibleObject.

Until I create a samba4openldaptop and samba4fedoratop...

Andrew Bartlett
(This used to be commit 6e232c4ae6dc4151599ab4e57add2ec232d4ac13)

14 years agoKill of some bogus debugs for the world who does not use the LDAP backend
Andrew Bartlett [Tue, 15 Jul 2008 09:31:37 +0000 (19:31 +1000)]
Kill of some bogus debugs for the world who does not use the LDAP backend
(This used to be commit 5bde586bdb4a1523a62a764b9ff292a4a8cee4fe)

14 years agoFix asking for credentials for non-LDAP provisions.
Andrew Bartlett [Tue, 15 Jul 2008 08:44:58 +0000 (18:44 +1000)]
Fix asking for credentials for non-LDAP provisions.
(This used to be commit 78416f4840df4f8d1f9cc5e46a48b19c86888050)

14 years agoRework provision to handle both simple and SASL binds.
Andrew Bartlett [Tue, 15 Jul 2008 05:46:32 +0000 (15:46 +1000)]
Rework provision to handle both simple and SASL binds.

Fedora DS is still setup for simple binds only, at this point.
(it also fails on other issues).

Andrew Bartlett
(This used to be commit b24c572d5a38c1f6906751c2ad2f809e1995b510)

14 years agoConnect to the LDAP backend with SASL credentials.
Andrew Bartlett [Tue, 15 Jul 2008 05:15:12 +0000 (15:15 +1000)]
Connect to the LDAP backend with SASL credentials.

This reworks our LDAP backend code to move from anonymous access to a
shared-secret SASL-protected connection.  (SASL selects NTLM or
DIGEST-MD5 on my system).

To get this working, we must pre-populate the LDAP backend with a DN
to store ths SASL secret on, and we use back-ldif for this.

This gives us a reasonable basis to deploy a replicated OpenLDAP
backend solution.

Andrew Bartlett
(This used to be commit cd0745253c4a9ec59a035e830e54d74a05b71aaa)

14 years agoMake up a full hostname for ldapi connections.
Andrew Bartlett [Tue, 15 Jul 2008 05:10:29 +0000 (15:10 +1000)]
Make up a full hostname for ldapi connections.

The DIGEST-MD5 SASL method requires a hostname, so provide one.

Andrew Bartlett
(This used to be commit edfb2ed1f22bc735af5a0c3d3ae6ab6771d28f2c)

14 years agoAdd a standard filter for finding the LDAP secrets.
Andrew Bartlett [Tue, 15 Jul 2008 05:09:32 +0000 (15:09 +1000)]
Add a standard filter for finding the LDAP secrets.
(This used to be commit 28c784966809d634e8497e0716b30bad018467b4)

14 years agoCleanup ldap_bind_sasl.
Andrew Bartlett [Tue, 15 Jul 2008 05:08:57 +0000 (15:08 +1000)]
Cleanup ldap_bind_sasl.

With these changes, we don't leak the LDAP socket, and don't reset all
credentials feature flags, just the ones we are actually incompatible

Andrew Bartlett
(This used to be commit 72e52a301102941c41ab423e0212fe9a1aed0405)

14 years agoUse secrets.ldb to store credentials to contact LDAP backend.
Andrew Bartlett [Tue, 15 Jul 2008 05:07:13 +0000 (15:07 +1000)]
Use secrets.ldb to store credentials to contact LDAP backend.

This makes Samba4 behave much like Samba3 did, and use a single set of
administrative credentials for it's connection to LDAP.

Andrew Bartlett
(This used to be commit e396a59788d77aa2fbf3b523c3773fe0e5c976c0)

14 years agoAllow ldap credentials to be (optionally) stored in secrets.ldb
Andrew Bartlett [Tue, 15 Jul 2008 05:05:41 +0000 (15:05 +1000)]
Allow ldap credentials to be (optionally) stored in secrets.ldb

This includes a simple bind DN, or SASL credentials.

The error messages are reworked as on systems without an LDAP backend,
we will fail to find this record very often.

Andrew Bartlett
(This used to be commit 95825ae6d5e9d9846f3a7505a81ebe603826227e)

14 years agoTry to make NTLMSSP less fussy for unimportant messages.
Andrew Bartlett [Tue, 15 Jul 2008 05:04:06 +0000 (15:04 +1000)]
Try to make NTLMSSP less fussy for unimportant messages.

We don't really care (because nobody uses them) what we send as the
domain and workstation in the negotiate packet.

Andrew Bartlett
(This used to be commit 9ac07e14873df2c18d0e9501691c2d4c4047e218)

14 years agoFix 'make gdbtest-enb' and the GDB_PROVISION option.
Andrew Bartlett [Tue, 15 Jul 2008 05:01:43 +0000 (15:01 +1000)]
Fix 'make gdbtest-enb' and the GDB_PROVISION option.
(This used to be commit 79c4d8e2fabc9c33d978c064b9c01ca45e463ced)

14 years agoRemove C++ keywords from events.h header.
Andrew Bartlett [Mon, 14 Jul 2008 08:47:10 +0000 (18:47 +1000)]
Remove C++ keywords from events.h header.

Andrew Bartlett
(This used to be commit 7ca421eb32bed3c400f863b654712d922c82bfb9)

14 years agorename sambaPassword -> userPassword.
Andrew Bartlett [Sat, 12 Jul 2008 05:26:42 +0000 (15:26 +1000)]
rename sambaPassword -> userPassword.

This attribute is used in a very similar way (virtual attribute
updating the password) in AD on Win2003, so eliminate the difference.

This should not cause a problem for on-disk passwords, as by default
we do not store the plaintext at all.

Andrew Bartlett
(This used to be commit 1cf0d751493b709ef6b2234ec8847a7499f48ab3)

14 years agoUse common code to fill in allowedAttributes in kludge_acl.
Andrew Bartlett [Fri, 11 Jul 2008 05:11:32 +0000 (15:11 +1000)]
Use common code to fill in allowedAttributes in kludge_acl.

This code is now in common with ad2oLschema.

Andrew Bartlett
(This used to be commit 0a797388ca442c3ad4809888897b1c63b65a7fdf)

14 years agoMerge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
Andrew Bartlett [Thu, 10 Jul 2008 08:07:51 +0000 (18:07 +1000)]
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local
(This used to be commit f956908cde7dd40643ff49cf433d0cf7765027de)

14 years agoAvoid the use of extensibleObject in ldap mapping backend.
Andrew Bartlett [Thu, 10 Jul 2008 07:54:43 +0000 (17:54 +1000)]
Avoid the use of extensibleObject in ldap mapping backend.

Instead of extensibleObject, we use the new (more correct) ad2oLschema
tool, and a new objectClass called 'samba4Top', which we add and
remove in the same way we did extensibleObject.

Andrew Bartlett
(This used to be commit 5ab20aa8b43415751f77602fff3a3008bf2186db)