summaryrefslogtreecommitdiffstats
path: root/source/lib
Commit message (Collapse)AuthorAgeFilesLines
...
* | Fix client autonegotiate signing.Volker Lendecke2003-08-121-1/+2
| | | | | | | | Jeremy.
* | Apply some constVolker Lendecke2003-08-111-2/+2
| |
* | Update my copyrights according to my agreement with IBMJim McDonough2003-08-012-2/+2
| |
* | Fix copyright statements for various pieces of Anthony Liguori's work.Jim McDonough2003-08-011-1/+1
| |
* | Return proper error when it is impossible to change quota flagsAlexander Bokovoy2003-07-311-2/+23
| |
* | Add a command line option (-S on|off|required) to enable signing on clientJeremy Allison2003-07-301-3/+22
| | | | | | | | | | connections. Overrides smb.conf parameter if set. Jeremy.
* | split replace into replace and replace1 to allow setenv to be used byHerb Lewis2003-07-292-18/+42
| | | | | | | | | | nsswitch modules. Add required libraries to get rid of undefined functions for libns_winbind.so and libns_wins.so
* | Add NT quotas support. Users allowed now to manage quotas on systems with ↵Alexander Bokovoy2003-07-291-44/+169
| | | | | | | | sysquotas interface detected (Linux at least) using native Windows tools. Also move default quota support for NT quotas to VFS module default_quota. Code by Metze
* | If we strupper_m after the alpha_strcpy() we know that it is less likalyAndrew Bartlett2003-07-271-2/+2
| | | | | | | | | | | | to contain multibyte charcters, as these should have been stripped. Andrew Bartlett
* | When removing an 'unused' function, it helps to remove the 'unused' callers...Andrew Bartlett2003-07-271-76/+0
| | | | | | | | Andrew Bartlett
* | Use push_ucs2_allocate(), rather than convert_string_allocate() directly.Andrew Bartlett2003-07-272-45/+9
| | | | | | | | | | | | | | | | | | Remove strdup_upper/strdup_lower from their old file, now that they have been moved to charcnv.c Note that string_replace assumes that s is a pstring. (doco change only) Andrew Bartlett
* | Some small fixes to our charset conversion code:Andrew Bartlett2003-07-271-50/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Treat the NMB names in the 'session request' packet as 'ASCII'. This means that we do not get invalid multibyte from the wire, even if we truncate in the conversion. (Otherwise we panic when we try to strupper_m it). - Remove acnv_uxu2(), as it was duplicated by push_ucs2_allocate() - Remove acnv_dosu2(), as it is not used. - In push_ucs2(), with the STR_UPPER flag, do the case conversion *after* the UCS2 conversion, when it we know that the length can't change. Also faster, as we don't need to do another 2 UCS2 conversions. Andrew Bartlett
* | Fix bug #184; set max_pw_age in account_pol to -1 so the default is never to ↵Gerald Carter2003-07-251-1/+1
| | | | | | | | expire
* | fix user_in_list to work with winbind groups again; my bugGerald Carter2003-07-251-1/+1
| |
* | More printf portability fixes. Got caught out by some gcc'isms lastTim Potter2003-07-253-5/+5
| | | | | | | | time. )-:
* | More printf fixes - size_t is long on some architectures.Tim Potter2003-07-243-3/+3
| |
* | Ensure a prototype is generated for smb_snprintf()Tim Potter2003-07-231-1/+1
| | | | | | | | Final bit for bug 187.
* | convert snprintf() calls using pstrings & fstringsGerald Carter2003-07-233-4/+4
| | | | | | | | | | | | to pstr_sprintf() and fstr_sprintf() to try to standardize. lots of snprintf() calls were using len-1; some were using len. At least this helps to be consistent.
* | A fix for bug 174. I'm pushing this to the tree to test it on one ofTim Potter2003-07-231-4/+2
| | | | | | | | the build farm machines that I don't have direct access to (hpntc9I).
* | Fixup a bunch of printf-style functions and debugs to use unsigned long whenTim Potter2003-07-221-1/+1
| | | | | | | | | | | | displaying pid_t, uid_t and gid_t values. This removes a whole lot of warnings on some of the 64-bit build farm machines as well as help us out when 64-bit uid/gid/pid values come along.
* | Replace the eight (!) copies of dummy become/unbecome root with a single one.Tim Potter2003-07-221-0/+33
| |
* | Fix StrCaseCmp() to avoid calling smb_panic() on invalid multibyte strings.Andrew Bartlett2003-07-191-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fix results in - we no longer use fixed-size buffers in StrCaseCmp (previously limited to a pstring) - we return strcmp(s, t) if either of the strings is invalid - for non-ascii cases, we call iconv twice, not 4 times. The basic idea with this fix is that if a string is not valid in the currnet charset, then (unless it is byte-equivilant) it cannot be case-equivilant to any other string. This should address the majority of our smb_panic() cases on this matter. It will not fix them all - we still call unix_strupper(), aka strupper_m() elsewhere, but this was being called on every file in the directory when we performed unix_convert(). Tested with the stf unit tests for this routine. Andrew Bartlett
* | Disconnect an idle LDAP connection after 150 seconds.Volker Lendecke2003-07-171-1/+43
| | | | | | | | | | | | | | | | | | | | | | | | Not strictly a bugfix, but it should considerably reduce the load we put on LDAP servers given that at least nss_ldap on Linux keeps a connection open. And it should also stress our reconnect-code a bit more ;-) Thanks to metze for this! Volker
* | Add API framework for server SMB signing.Jeremy Allison2003-07-161-82/+100
| | | | | | | | Jeremy.
* | Volker's patch for open_socket_out() to speed up connectionsGerald Carter2003-07-161-3/+8
| |
* | Fix memleakVolker Lendecke2003-07-151-1/+3
| |
* | Jeremy requested that I get my NTLMSSP patch into CVS. He didn't requestAndrew Bartlett2003-07-141-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the schannel code, but I've included that anyway. :-) This patch revives the client-side NTLMSSP support for RPC named pipes in Samba, and cleans up the client and server schannel code. The use of the new code is enabled by the 'sign', 'seal' and 'schannel' commands in rpcclient. The aim was to prove that our separate NTLMSSP client library actually implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation, in the hope that knowing this will assist us in correctly implementing NTLMSSP signing for SMB packets. (Still not yet functional) This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with calls to libsmb/ntlmssp.c. In the process, we have gained the ability to use the more secure NT password, and the ability to sign-only, instead of having to seal the pipe connection. (Previously we were limited to sealing, and could only use the LM-password derived key). Our new client-side NTLMSSP code also needed alteration to cope with our comparatively simple server-side implementation. A future step is to replace it with calls to the same NTLMSSP library. Also included in this patch is the schannel 'sign only' patch I submitted to the team earlier. While not enabled (and not functional, at this stage) the work in this patch makes the code paths *much* easier to follow. I have also included similar hooks in rpccleint to allow the use of schannel on *any* pipe. rpcclient now defaults to not using schannel (or any other extra per-pipe authenticiation) for any connection. The 'schannel' command enables schannel for all pipes until disabled. This code is also much more secure than the previous code, as changes to our cli_pipe routines ensure that the authentication footer cannot be removed by an attacker, and more error states are correctly handled. (The same needs to be done to our server) Andrew Bartlett
* | Undo 'Fix compiler warning'. It didn't work because the value of inbuf ↵Tim Potter2003-07-141-21/+11
| | | | | | | | | | | | | | | | | | changes so we end up freeing a pointer we didn't mallocate. Also, calling strdup() in a frequently called function just to clear up a const compiler warning seems inelegant and inefficient.
* | Fix compiler warning.Rafal Szczesniak2003-07-131-11/+21
| |
* | moving more code around.Gerald Carter2003-07-111-0/+148
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * move rid allocation into IDMAP. See comments in _api_samr_create_user() * add winbind delete user/group functions I'm checking this in to sync up with everyone. But I'm going to split the add a separate winbindd_allocate_rid() function for systems that have an 'add user script' but need idmap to give them a RID. Life would be so much simplier without 'enable rid algorithm'. The current RID allocation is horrible due to this one fact. Tested idmap_tdb but not idmap_ldap yet. Will do that tomorrow. Nothing has changed in the way a samba domain is represented, stored, or search in the directory so things should be ok with previous installations. going to bed now.
* | Add constVolker Lendecke2003-07-101-1/+1
| |
* | and so it begins....Gerald Carter2003-07-072-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * remove idmap_XX_to_XX calls from smbd. Move back to the the winbind_XXX and local_XXX calls used in 2.2 * all uid/gid allocation must involve winbindd now * move flags field around in winbindd_request struct * add WBFLAG_QUERY_ONLY option to winbindd_sid_to_[ug]id() to prevent automatic allocation for unknown SIDs * add 'winbind trusted domains only' parameter to force a domain member server to use matching users names from /etc/passwd for its domain (needed for domain member of a Samba domain) * rename 'idmap only' to 'enable rid algorithm' for better clarity (defaults to "yes") code has been tested on * domain member of native mode 2k domain * ads domain member of native mode 2k domain * domain member of NT4 domain * domain member of Samba domain * Samba PDC running winbindd with trusts Logons tested using 2k clients and smbclient as domain users and trusted users. Tested both 'winbind trusted domains only = [yes|no]' This will be a long week of changes. The next item on the list is winbindd_passdb.c & machine trust accounts not in /etc/passwd (done via winbindd_passdb)
* | Fixes to our LDAP/vampire codepaths:Andrew Bartlett2003-07-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Try better to add the appropriate mapping between UID and SIDs, based on Get_Pwnam() - Look for previous users (lookup by SID) and correctly modify the existing entry in that case - Map the root user to the Admin SID as a 'well known user' - Save the LDAPMessage result on the SAM_ACCOUNT for use in the next 'update' call on that user. This means that VL's very nice work on atomic LDAP updates now really gets used properly! - This also means that we know the right DN to update, without the extra round-trips to the server. Andrew Bartlett
* | This patch cleans up some of our ldap code, for better behaviour:Andrew Bartlett2003-07-041-1/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We now always read the Domain SID out of LDAP. If the local secrets.tdb is ever different to LDAP, it is overwritten out of LDAP. We also store the 'algorithmic rid base' into LDAP, and assert if it changes. (This ensures cross-host synchronisation, and allows for possible integration with idmap). If we fail to read/add the domain entry, we just fallback to the old behaviour. We always use an existing DN when adding IDMAP entries to LDAP, unless no suitable entry is available. This means that a user's posixAccount will have a SID added to it, or a user's sambaSamAccount will have a UID added. Where we cannot us an existing DN, we use 'sambaSid=S-x-y-z,....' as the DN. The code now allows modifications to the ID mapping in many cases. Likewise, we now check more carefully when adding new user entires to LDAP, to not duplicate SIDs (for users, at this stage), and to add the sambaSamAccount onto the idmap entry for that user, if it is already established (ensuring we do not duplicate sambaSid entries in the directory). The allocated UID code has been expanded to take into account the space between '1000 - algorithmic rid base'. This much better fits into what an NT4 does - allocating in the bottom part of the RID range. On the code cleanup side of things, we now share as much code as possible between idmap_ldap and pdb_ldap. We also no longer use the race-prone 'enumerate all users' method for finding the next RID to allocate. Instead, we just start at the bottom of the range, and increment again if the user already exists. The first time this is run, it may well take a long time, but next time will just be able to use the next Rid. Thanks to metze and AB for double-checking parts of this. Andrew Bartlett
* | Removed strupper/strlower macros that automatically map to ↵Jeremy Allison2003-07-035-24/+24
| | | | | | | | | | | | | | strupper_m/strlower_m. I really want people to think about when they're using multibyte strings. Jeremy.
* | Added fix for Japanese case names in statcache - these can changeJeremy Allison2003-07-022-2/+49
| | | | | | | | | | size on upper casing. Based on patch from monyo@home.monyo.com. Jeremy.
* | Fix poptOption definition for --no-pass and --kerberos options. The 'value'Tim Potter2003-07-021-2/+2
| | | | | | | | | | | | | | field for an option should be set to an identifier to use in a switch statement or zero if the the arg field is to be updated only. This fixes smbclient -k always prompting for a password which we don't need.
* | Different fix for memleak just committed. This belongs intoVolker Lendecke2003-07-011-2/+0
| | | | | | | | | | | | tdb_search_list_free. Volker
* | Fix two memory leaks. tdb_search_keys allocates space for the keyVolker Lendecke2003-07-011-0/+2
| | | | | | | | | | | | | | | | | | | | strings. Running 'net cache list' or secrets_get_trusted_domains through valgrind gives a *huge* amount of invalid reads of one byte beyond the indicated string length in libc's strncpy. Annoying... Volker
* | Fix a segfault found by metze & valgrind...Volker Lendecke2003-07-011-3/+5
| | | | | | | | | | | | Don't overwrite past the end of a string. Volker
* | * fix the trustdom_cache to work when winbindd is not running.Gerald Carter2003-07-011-0/+21
| | | | | | | | | | smbd will update the trustdom_cache periodically after locking the timestamp key
* | fix for platforms that don't have unsetenv().Gerald Carter2003-06-301-2/+2
| | | | | | | | | | we now have to check the value for _NO_WINBINDD. "1" enables, and != "1" disables (use "0" by convention).
* | - added LOCALE patch from vorlon@debian.org (Steve Langasek) (bug #122)Andrew Tridgell2003-06-301-0/+24
| | | | | | | | | | | | - changed --enable-developer debug to use -gstabs as it makes the samba binaries about 10x smaller and is still quite functional for samba debugging
* | Here's the code to make winbindd work on a Samba DCGerald Carter2003-06-291-3/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to handle domain trusts. Jeremy and I talked about this and it's going in as working code. It keeps winbind clean and solves the trust problem with minimal changes. To summarize, there are 2 basic cases where the deadlock would occur. (1) lookuping up secondary groups for a user, and (2) get[gr|pw]nam() calls that fall through the NSS layer because they don't exist anywhere. o To handle case #1, we bypass winbindd in sys_getgrouplist() unless the username includes the 'winbind separator'. o Case #2 is handled by adding checks in winbindd to return failure if we are a DC and the domain matches our own. This code has been tested using basic share connections, domain logons, and with pam_winbind (both with and without 'winbind use default domain'). The 'trustdomain' auth module should work as well if an admin wants to manually create UNIX users for acounts in the trusted domains. Other misc fixes: * we need to fix check_ntlm_password() to be able to determine if an auth module is authoritative over a user (NT_STATUS_WRONG_PASSWORD, etc...). I worked around my specific situation, but this needs to be fixed. the winbindd auth module was causing delays. * fix named server mutex deadlock between trust domain auth module and winbindd looking up a uid * make sure SAM_ACCOUNT gets stored in the server_info struct for the _net_sam_logon() reply. Configuration details: The recommended method for supporting trusts is to use winbind. The gets us around some of the server mutex issues as well. * set 'files winbind' for passwd: and group: in /etc/nsswitch.conf * create domain trusts like normal * join winbind on the pdc to the Samba domain using 'net rpc join' * add normal parameters to smb.conf for winbind * set 'auth method = guest sam winbind' * start smbd, nmbd, & winbindd Problems that remain: * join a Windows 2k/XP box to a Samba domain. * create a 2-way trust between the Samba domain and an NT domain * logon to the windows client as a user from theh trusted domain * try to browse server in the trusted domain (or other workstations). an NT client seems to work ok, but 2k and XP either prompt for passwords or fail with errors. apparanently this never got tested since no one has ever been able to logon as a trusted user to a Samba domain from a Windows client.
* | large change:Gerald Carter2003-06-253-26/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | *) consolidates the dc location routines again (dns and netbios) get_dc_list() or get_sorted_dc_list() is the authoritative means of locating DC's again. (also inludes a flag to get_dc_list() to define if this should be a DNS only lookup or not) (however, if you set "name resolve order = hosts wins" you could still get DNS queries for domain name IFF ldap_domain2hostlist() fails. The answer? Fix your DNS setup) *) enabled DOMAIN<0x1c> lookups to be funneled through resolve_hosts resulting in a call to ldap_domain2hostlist() if lp_security() == SEC_ADS *) enables name cache for winbind ADS backend *) enable the negative connection cache for winbind ADS backend *) removes some old dead code *) consolidates some duplicate code *) moves the internal_name_resolve() to use an IP/port pair to deal with SRV RR dns replies. The namecache code also supports the IP:port syntax now as well. *) removes 'ads server' and moves the functionality back into 'password server' (which can support "hostname:port" syntax now but works fine with defaults depending on the value of lp_security())
* | Patch to move functions directly from pdb_ldap.c into lib/smbldap.cAndrew Bartlett2003-06-251-4/+729
| | | | | | | | | | | | The functions are unchanged. Next step is to make idmap_ldap use them. Andrew Bartlett
* | * set domain->last_status = NT_STATUS_SERVER_DISABLED on an ads_connect() ↵Gerald Carter2003-06-231-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | failure * Fix code to use winbind_rpc methods for trusted mixed mode or NT4 domains ( does no one ever test this? ) * add in LDAP code to get the sequence number for rpc based seqnum update. ( this is needed if the DC is upgraded and samba is not reconfigured to use security = ads; it's not pretty but it works (from app_head) ) * fix bug that caused us to enumerate domain local groups in domains other than our own
* | merge of the netsamlogon caching code from APPLIANCE_HEADGerald Carter2003-06-211-23/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This replaces the universal group caching code (was originally based on that code). Only applies to the the RPC code. One comment: domain local groups don't show up in 'getent group' that's easy to fix. Code has been tested against 2k domain but doesn't change anything with respect to NT4 domains. netsamlogon caching works pretty much like the universal group caching code did but has had much more testing and puts winbind mostly back in sync between branches.
* | This patch works towards to goal of common code shared between idmap_ldapAndrew Bartlett2003-06-211-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | and pdb_ldap. So far, it's just a function rename, so that the next patch can be a very simple matter of copying functions, without worrying about what changed in the process. Also removes the 'static' pointers for the rebind procedures, replacing them with a linked list of value/key lookups. (Only needed on older LDAP client libs) Andrew Bartlett
* | Const fixes by metzeVolker Lendecke2003-06-172-6/+6
| | | | | | | | Volker
generated by cgit (git 2.34.1) at 2025-09-30 20:55:55 +0000