summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* s4-wbclient: Cope with winbind returning an errorAndrew Bartlett2014-04-081-0/+4
| | | | | | | | | Change-Id: I8eaf858f9e9e55eec20aa2c585db5459fb73b887 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Apr 8 12:53:13 CEST 2014 on sn-devel-104
* ctdb-daemon: Always update database priority cluster wideAmitay Isaacs2014-04-074-17/+17
| | | | | | | | | | | | | Database priority is a global property and all the nodes should have the priority set for the databases. Just setting priority on one node can lead to problems in the recovery as a database can be frozen at wrong priority and then freezing database would not succeed. Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: David Disseldorp <ddiss@samba.org> Autobuild-User(master): David Disseldorp <ddiss@samba.org> Autobuild-Date(master): Mon Apr 7 14:06:26 CEST 2014 on sn-devel-104
* s3: smbd/nmbd/winbindd - fix append on trailing slash on system paths.Jeremy Allison2014-04-051-1/+1
| | | | | | | | | | | | | | | | | | The xx_path() function incorrectly uses talloc_asprintf_append() instead of talloc_asprintf() on a path that may have been modified by the trim_string() call previously. talloc_asprintf_append() always sticks the new text at the *end* of the allocated buffer, not at the end of the string. Fix bug #10538 - Daemons crashing when lock/state/cache directory parameter has a trailing slash https://bugzilla.samba.org/show_bug.cgi?id=10538 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Sat Apr 5 13:40:30 CEST 2014 on sn-devel-104
* s3: enforce a positive allocation_file_size for non-empty filesBjörn Baumbach2014-04-051-0/+12
| | | | | | | | | | | | | | Some file systems do not allocate a block for very small files. But for non-empty file should report a positive size. Pair-Programmed-With: Michael Adam <obnox@samba.org> Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 5 03:09:00 CEST 2014 on sn-devel-104
* vfs: Store ACL control flags in gpfs vfs module.Alexander Werth2014-04-051-23/+114
| | | | | | | | Use literals to allow a compile and execution on gpfs 3.4. Signed-off-by: Alexander Werth <alexander.werth@de.ibm.com> Reviewed-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* vfs: Support NFS control flags in nfs4_acls.c.Alexander Werth2014-04-052-1/+27
| | | | | | | | | | | The ACL control flags stores in particular the dacl protected bit which is responsible for the "Include inherited permissions from this object's parent" checkbox. This stores the information in the ACL struct passed to and from file system specific vfs modules. Signed-off-by: Alexander Werth <alexander.werth@de.ibm.com> Reviewed-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* talloc: Update flags in pytalloc-util pkgconfig fileLukas Slebodnik2014-04-041-2/+2
| | | | | | | | | | | | | | After exapnding, @LIB_RPATH@ will be -Wl,-rpatch,/usr/local/lib if rpath is used on install. But "-Wl," will be passed to linker and should not be among CFLAGS. Other pkgconfig files have @LIB_RPATH@ in the right place. @see commit 735c1cd2da15167748e92ba6de48fdb5169db587 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Apr 4 23:50:25 CEST 2014 on sn-devel-104
* tevent: Update flags in tevent pkgconfig fileLukas Slebodnik2014-04-041-2/+2
| | | | | | | | | | | After exapnding, @LIB_RPATH@ will be -Wl,-rpatch,/usr/local/lib if rpath is used on install. But "-Wl," will be passed to linker and should not be among CFLAGS. Other pkgconfig files have @LIB_RPATH@ in the right place. @see commit 735c1cd2da15167748e92ba6de48fdb5169db587 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3-kerberos: make ipv6 support for generated krb5 config files more robust.Günther Deschner2014-04-041-2/+27
| | | | | | | | | | | | | Older MIT Kerberos libraries will add any secondary ipv6 address as ipv4 address, defining the (default) krb5 port 88 circumvents that. Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Fri Apr 4 16:33:12 CEST 2014 on sn-devel-104
* s3: rpc_server/srvsvc: count open files in NetConnEnumShekhar Amlekar2014-04-031-11/+47
| | | | | | | | | Signed-off-by: Shekhar Amlekar <samlekar@in.ibm.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Apr 3 21:19:43 CEST 2014 on sn-devel-104
* s3: rpc_server/srvsvc: count share connections in NetConnEnumShekhar Amlekar2014-04-031-9/+45
| | | | | | Signed-off-by: Shekhar Amlekar <samlekar@in.ibm.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org>
* s3: rpc_server/srvsvc: added routines to compute opens on share connections.Shekhar Amlekar2014-04-031-0/+49
| | | | | | | | | Added routines count_share_opens() and share_file_fn() to count opens on share connections. Signed-off-by: Shekhar Amlekar <samlekar@in.ibm.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org>
* s3: rpc_server/srvsvc: Added routines to count share connections.Shekhar Amlekar2014-04-031-0/+64
| | | | | | | | | Added routines count_share_conns() and share_conn_fn() to count connections to a share. Signed-off-by: Shekhar Amlekar <samlekar@in.ibm.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org>
* autorid: use the db argument in the initialize traverse action.Michael Adam2014-04-031-2/+2
| | | | | | | | | | | | | | By a copy and paste error, the global autorid_db was used. This was not currently a problem in behaviour, because this autorid_db is passed as the argument. This change fixes the callback function for consistency. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Apr 3 08:36:55 CEST 2014 on sn-devel-104
* s3: messages: Implement cleanup of dead records.Jeremy Allison2014-04-034-0/+68
| | | | | | | | | | | | When a smbd process dies, pending messages.tdb records for this process might not get cleaned up. Implement a cleanup for dead records that is triggered after a smbd dies uncleanly; the records for that PID are deleted. Based on a patchset from Christof Schmitt <cs@samba.org>. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org>
* autorid: make the whole initialization atomic with one transaction.Michael Adam2014-04-031-10/+38
| | | | | | | | | | | | | | | | | | | | | | | | Originally, there were several writing operations: - store the range HWM - store the alloc uid HWM - store the alloc gid HWM - store the config - create mappings for a whole list of wellknown sids Each of these consisted of its own transaction, the wellknown preallocation even of one transaction per sid. This change wrapps all of these in one big transaction. Thereby making the whole initialization atomic, and with respect to the creation of the wellknown mappings also more deterministic. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Apr 3 02:41:25 CEST 2014 on sn-devel-104
* autorid: initialize: fix typo in and further improve a debug message.Michael Adam2014-04-031-2/+2
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: initialize: use the split db_open and init_hwms function instead of ↵Michael Adam2014-04-031-1/+6
| | | | | | | | | db_init This way, we can later put all of the storing functions inside one transaction. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: initialize: open the autorid db as late as possible.Michael Adam2014-04-031-8/+9
| | | | | | | But make sure to link the db context to commonconfig afterwards. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: initialize: link config to commonconfig as soon as it is allocated.Michael Adam2014-04-031-1/+1
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: initialize: link commonconfig to dom as soon as it is allocatedMichael Adam2014-04-031-2/+1
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: initialize: store config directly before allocating well knowns.Michael Adam2014-04-031-7/+6
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: split idmap_autorid_db_open and idmap_autorid_init_hwms out of ↵Michael Adam2014-04-032-9/+50
| | | | | | | | | idmap_autorid_db_init These will be used separately in the full initialization function. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: in idmap_autorid_saveconfig, add a debug msg when loading gives errorMichael Adam2014-04-031-0/+2
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: improve the precision of the DEBUG at the end of add_rangeMichael Adam2014-04-031-2/+5
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: add a DEBUG upon talloc fail in the add_range function.Michael Adam2014-04-031-0/+1
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: when storing a new range, always check it does not exist.Michael Adam2014-04-031-15/+22
| | | | | | | | | | | Also check for existence when the range is >= the HWM, typically the "acquire" case where we bump the HWM. In case of external modification, we would previously simply overwrite an an existing range mapping. Now we check and throw INTERNAL_DB_CORRUPTION in this case. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: fix a potential for data corruption.Michael Adam2014-04-031-1/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The initialization of the HWM values in autorid.tdb was racy: It did: 1. fetch the HWM value 2. if it did not exist, store 0 in a transaction. This can be racy if two processes at the same time try to run the initialization code, especially in a cluster, when winbindd and smbd are started simultaneously on all nodes. The race is that the HWM is not re-fetched inside the transaction. Assume both processes see that the HWM does not exist. Both try to start a transaction. Process 1 gets the lock and process 2 blocks. After Process 1 has stored the HWM, it proceeds and manages to start subsequent transactions which also bump the HWM value (e.g. a range allocation, which is also triggered from allocation code). When process 2 finally manages to start the transaction, the HWM value is aready > 0. But process 2 does not look again and simply overwrites the HWM with 0. So the next allocation will overwrite an existing mapping, at least partially. This patch changes the mechanism to: 1. fetch the hwm value 2. if it does not exist start a transaction 3. fetch the hwm value 4. if it does not exist, store 0 5. commit the transaction. Note: this is not theoretical. Corruptions have been seen in cluster environments. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: print debug message when a HWM key has been createdMichael Adam2014-04-031-0/+2
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: reverse logic flow in idmap_autorid_init_hwm(), decreasing indentation.Michael Adam2014-04-031-9/+13
| | | | | | | I.e. move writing case to the end. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* autorid: store hwm as uint32_t in idmap_autorid_init_hwm()Michael Adam2014-04-031-1/+1
| | | | | | | | The HWM is treated as uint32_t all the times. This was just a leftover from old code. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dfs_server: get_dcs: fix pointer list terminationArvid Requate2014-04-031-3/+8
| | | | | | | | | Should fix a potential SEGV e.g. in case searched_site == NULL and no objects with objectClass=site are found. Signed-off-by: Arvid Requate <requate@univention.de> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* script to generate content for libcli/util/nterr.c & libcli/util/ntstatus.hNoel Power2014-04-021-0/+243
| | | | | | | | | | | | | | A ropey script to generate some missing NT_STATUS error codes and and descriptions. The script generates ntstatus.c & ntstatus.h whose contents are used to extend the existing contents of libcli/util/nterr.c & libcli/util/ntstatus.h Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Apr 2 22:40:06 CEST 2014 on sn-devel-104
* Add error codes and message descriptions for NTSTATUSNoel Power2014-04-022-0/+4238
| | | | | | | | | | | Error codes and descriptions were autogenerated from [MS-ERREF] see http://msdn.microsoft.com/en-us/library/cc704588.aspx Additionally some missing error descriptions for existing errors were identified and generated. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* Use correct error code value for NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGENoel Power2014-04-021-1/+1
| | | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* script to generate libcli/util/hresult.c & libcli/util/hresult.hNoel Power2014-04-021-0/+207
| | | | | | | | | | | This hacky script was used to generate the contents of libcli/util/hresult.c & libcli/util/hresult.h. It expects the table contents of http://msdn.microsoft.com/en-us/library/cc704587.aspx cut'n'pasted into the text file specified as it's single required input param Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* Allow FSRVP access generic HRESULT error message descriptionsNoel Power2014-04-023-8/+11
| | | | | | | | | | | | FSRVP can possibly return any HRESULT error in addition to it's own specific errors. This change searches the HRESULT errors for a description if the error doesn't match any of the known FSRVP ones. Also removed some errors defined in fsrvp.idl (now that they are defined in hresult.h) Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* Add autogenerated HRESULT error codes and descriptions from MS_ERREFNoel Power2014-04-023-2/+14741
| | | | | | | | | | | | error codes & string descriptions are generated from http://msdn.microsoft.com/en-us/library/cc704587.aspx, additionally there is a function to return the error description from the error code, this function will also try to determine the error description associated with a W_ERROR code translated as a HRESULT. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* torture-samr: Add testing of account lockout and password change behaviourAndrew Bartlett2014-04-022-39/+347
| | | | | | | | | | | | | | | | | | | | This is the regression test to avoid a repeat of CVE-2013-4496 This includes confirming that badPwdCount is updated on login, not just on first failure However the badPwdCount is not updated if the account is disabled Note: that samr_QueryUserInfo return the effective bad_password_count in level 5, 16 and 21, while it returns the raw value in level 3. (Sadly the s3 code does not do this correctly, so a knownfail is added) Change-Id: I4fd8ac5c3b1357e7a98386756dac2a43eb778ecf Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Apr 2 19:30:59 CEST 2014 on sn-devel-104
* selftest: Run rpc.samr.passwords.badpwdcount against s3dcAndrew Bartlett2014-04-022-1/+2
| | | | | | Change-Id: I9529def954521bf8ab05212759a2ef6bbe9913f8 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* torture-samr: Add test for lockout with and without a password historyAndrew Bartlett2014-04-021-2/+18
| | | | | | Change-Id: I6f4b3e92feabe4ff09839329b0db3d33cc6c73b4 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* torture-samr: Improve rpc.samr.passwords.badpwdcount testAndrew Bartlett2014-04-021-10/+12
| | | | | | Change-Id: I89ac30d715e89f14aca049e0e5c5043a39ab93c7 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* selftest: Add test for password lockoutAndrew Bartlett2014-04-022-0/+1485
| | | | | | Change-Id: Ia690b83f82b5ad7b02b203ffdecd2e05066b6711 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
* dsdb: Allow SAMR server to return the computed, not actual badPwdCountAndrew Bartlett2014-04-022-13/+58
| | | | | | | | | | | | This matters after the lockout observation period has expired. Note: that QueryUserInfo level 3 returns the raw badPwdCount value. Andrew Bartlett Change-Id: I7b304a50984072bc6cb1daf3315b4427443632a9 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:rpc_server/samr: passdown unmodified acct_flags to the ldb layer.Stefan Metzmacher2014-04-021-15/+1
| | | | | | | | The samldb module will handle the verification and magic. Change-Id: If38e0ed229b98eac4db9b39988de4a25f9a352f2 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/samldb: rework samldb_user_account_control_change()Stefan Metzmacher2014-04-021-99/+134
| | | | | | | | | | | | - Removing ACB_AUTOLOCK/UF_LOCKOUT from the effective userAccountControl flags (combined with msDS-User-Account-Control-Computed) results in lockoutTime=0 (implying badPadCount=0). - We also do more validation of the account type flags now. Change-Id: If7f224cf60920037a0ae19a10d116ac265771a4c Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libds: add UF_PARTIAL_SECRETS_ACCOUNT to UF_ACCOUNT_TYPE_MASKStefan Metzmacher2014-04-021-1/+2
| | | | | | Change-Id: Ie26520c37c393ab4d2e3c5782e3dca46d4d1f83c Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/samldb: remove fantasy code from samldb_user_account_control_change()Stefan Metzmacher2014-04-021-10/+0
| | | | | | | | Setting UF_PASSWORD_EXPIRED doesn't reset "pwdLastSet" to "0"! Change-Id: I9e004195ad864b8b3fe036986b1087398d1f6fc5 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-samr: Escape the username in the LDAP filterAndrew Bartlett2014-04-021-2/+2
| | | | | | Change-Id: I99945f0b86ea2862c88c00ad39c809ef1101ca9b Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4-auth: Support password history correctly, including allowing NTLM logins ↵Andrew Bartlett2014-04-023-27/+297
| | | | | | | | | | | | | | | using the old password This is only done during a 1 hour allowed period, by default. We only update bad password count when not one of the last 3 passwords Andrew Bartlett Change-Id: I76fd8010ce273a21efb55f9601d17b9978a0acf0 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
generated by cgit (git 2.34.1) at 2024-07-06 23:42:26 +0000