1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00

33535 Commits

Author SHA1 Message Date
Love Hornquist Astrand
c6dfb4e1cc HEIMDAL: don't bother seeing q if not sent
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12986

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from heimdal commit 19f9fdbcea11013cf13ac72c416f161ee55dee2b)

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Aug 28 15:10:54 CEST 2017 on sn-devel-144

(cherry picked from commit dd3e06f14ec1788a59e4c6ba4ea165fd77b9135e)
2017-12-23 21:16:25 +01:00
Love Hornquist Astrand
03c69a536d HEIMDAL: allow optional q in DH DomainParameters
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12986

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from heimdal commit e8317b955f5a390c4f296871ba6987ad05478c95)

(cherry picked from commit 9f245aafdca8397df7dc050e25cfd858aeb1cc7f)
2017-12-23 21:16:25 +01:00
Stefan Metzmacher
e39dcec5e1 s4:kdc: only map SDB_ERR_NOT_FOUND_HERE to HDB_ERR_NOT_FOUND_HERE
HDB_ERR_NOT_FOUND_HERE indicated a very specific error on an RODC.

We should not map any error to HDB_ERR_NOT_FOUND_HERE,
we should just pass errors along unmapped.

Otherwise we'll hit the logic bug in:

    if (ret == KDC_PROXY_REQUEST) {
        uint16_t port;

        if (!sock->kdc_socket->kdc->am_rodc) {
            DEBUG(0,("kdc_udp_call_loop: proxying requested when not RODC"));
                    talloc_free(call);
            goto done;
        }

And just don't send an error message to the client.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13132

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Dec  6 23:16:54 CET 2017 on sn-devel-144

(cherry picked from commit aaa946bb9eb8088389b8ffdec460023f1961616c)
2017-12-22 18:11:19 +01:00
Ralph Boehme
b7f5e69abc s4/torture: fruit: in test_adouble_conversion() also check stream list and AFPINFO_STREAM
This reveals that the conversion doesn't work properly with
fruit:metadata=stream.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13155

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit 7b00b558761b6564928289efcf835e9b9cc86a89)
2017-12-05 10:32:11 +01:00
Ralph Boehme
775ec5ecc8 s4/torture: fruit: remove use of localdir from test_adouble_conversion test
The previous use of localdir and torture_setup_local_file() was
motivated by the fact that by default vfs_fruit rejects access to files
with a "._" prefix.

Since a previous commit allowed SMB access to ._ files, rewrite the
test_adouble_conversion() test to create the ._ AppleDouble file over
SMB.

This also renders torture_setup_local_file() obsolete.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13155

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit ebbffd80862d7d7b025eca219bc0c8f818585ac9)
2017-12-05 10:32:11 +01:00
Ralph Boehme
dba33c9ec9 selftest: add "fruit:veto_appledouble = no" to fruit shares
This is needed for a subsequent commit that modifies an existing test to
write a ._ file over SMB instead of using the ugly local creation hack.

SMB acces of ._ files requires "fruit:veto_appledouble = no", so let's
set it.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13155

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit 3f9b45a410384904d64bdd0d68ff2a5bc25bd3e9)
2017-12-05 10:32:11 +01:00
Ralph Boehme
de13adb40d s4/torture: let write_stream() deal with stream=NULL
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13155

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit ac880848a905a3840b69af2cb1d842d307401a07)
2017-12-05 10:32:10 +01:00
Ralph Boehme
90ed82ba17 selftest: run AppleDouble sidecar-file conversion test runs against all fruit shares
This needs for work in all possible fruit configs, so test it.

This currently fails with stream_depot, as we don't propely copy over
the resourcefork data from the ._ file to the stream.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13155

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit e28dd6a0ce753a880b2512eb62661411b20f763b)
2017-12-05 10:32:10 +01:00
Ralph Boehme
79b3ea5797 s4/torture: use torture_assert_goto in a vfs.fruit test
No change in behavior.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13155

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 9af9c5c073d88b126aebd4a2d7a1a1971527fbf4)
2017-12-05 10:32:10 +01:00
Ralph Boehme
51e21a3cd4 s4/torture: rework stream names tests usage of local xattr call
Previously this test, that tests for correct conversion of ':' in stream
names, only worked with streams_xattr with "fruit:metadata" set to
"netatalk".

In order to have test coverage for fruit shares with other configs,
split the test into two:

one test creates the stream over SMB and run against all shares, the
other one is the unmodified existing test and is only run against the
share with streams_xattr and fruit:metadata=netatalk.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13155

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 75a3c0f3b1f843ba9a7838aa7a1c311fc262f8c7)
2017-12-05 10:32:10 +01:00
Jeremy Allison
c5d7a7d8af s4: torture: kernel oplocks. Add smb2.kernel-oplocks.kernel_oplocks8
Test if the server blocks whilst waiting on a kernel lease held by
a non-smbd process.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13121

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sat Nov 11 20:12:26 CET 2017 on sn-devel-144

(cherry picked from commit ad82557e1355107920ae80fd6a0df0f16d1bdb6c)

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Tue Nov 14 16:39:11 CET 2017 on sn-devel-144
2017-11-14 16:39:11 +01:00
Christof Schmitt
8212d1356e torture: Add testcase for compound CREATE-WRITE-CLOSE request
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13047

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 508aebf40abe83b6319700260c405ada0566a46b)
2017-11-14 12:39:14 +01:00
Ralph Wuerthner
df214a3808 s4: torture: Add smb2 FIND_and_set_DOC test case.
Regression tests doing an SMB2_find followed by
a set delete on close and then close on a directory.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13118

Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Sun Nov  5 12:31:12 CET 2017 on sn-devel-144

(cherry picked from commit 44c018bdcc2d81aaf667d11c0c8fae209419ddd7)
2017-11-13 10:34:16 +01:00
Jeremy Allison
38f0d93533 s4: torture: kernel_oplocks. Create a regression test case for bug #13058.
It implements the following test case:

1. client of smbd-1 opens the file and sets the oplock.
2. client of smbd-2 tries to open the file. open() fails(EAGAIN) and open is deferred.
3. client of smbd-1 sends oplock break request to the client.
4. client of smbd-1 closes the file.
5. client of smbd-1 opens the file and sets the oplock.
6. client of smbd-2 calls defer_open_done(), sees that the file lease was not changed
			and does not reschedule open.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13058

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
(cherry picked from commit 15597a95ecd2d1c2b7edce4942d489c95796951f)
2017-11-13 10:34:15 +01:00
Andreas Schneider
35b1523155 s4:pyparam: Fix resource leaks on error
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13101

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit e56626e864492831a3dbbca2d4fb8f3281547a90)
2017-11-02 13:01:22 +01:00
Ralph Boehme
c7726ee0f5 s4/torture: vfs_fruit: test xattr unpacking
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13076

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Oct 13 21:44:02 CEST 2017 on sn-devel-144

(cherry picked from commit 5f52a0fbe8c9f52c6fed206fd5cd47bd0de867a1)
2017-10-25 08:43:03 +02:00
Ralph Boehme
d61101b568 s4/torture: vfs_fruit: replace AppleDouble data blob with xattr data
The osx_adouble_w_xattr datablob is used to test conversion from sidecar
._ file metdata to Samba compatible ._ file.

The previous data blob didn't contain xattr data, the new one does.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13076

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit c5b25d40e1ab3906805538abdb8f07a934c629f7)
2017-10-25 08:43:03 +02:00
Ralph Boehme
f5b02e3e63 s4/torture: add a test for rename change notification with inotify enabled
This is already fixed in master by
5eccc2fd0072409f166c63e6876266f926411423~10..5eccc2fd0072409f166c63e6876266f926411423.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12903

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Aug 26 05:05:08 CEST 2017 on sn-devel-144

(backported from commit 51f40a0e1d10069f55a5884ff1579e8f15f10a1e)
2017-10-25 08:43:01 +02:00
David Disseldorp
96a8f4c716 torture/ioctl: test set_compression(format_none)
This test case was overlooked in the previous bso#12144 update -
set compression requests with format=COMPRESSION_FORMAT_NONE should
succeed if the server / backing storage doesn't offer compression
support.
Confirm that Samba matches Windows Server 2016 ReFS behaviour here.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12144

Reported-by: Nick Barrett <nick@barrett.org.nz>
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 6fde123176409e261d955e24b3d28e5124f33bed)

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Fri Sep 22 13:36:22 CEST 2017 on sn-devel-144
2017-09-22 13:36:22 +02:00
Ralph Boehme
534ee869f7 s4/torture: additional tests for kernel-oplocks
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
(backported from commit bbc225de83e7b0e5eaeb1b843532d1f0fca91a3c)
2017-08-14 14:36:20 +02:00
Ralph Boehme
c3177accbc s4/torture: reproducer for kernel oplocks issue with streams
test_smb2_kernel_oplocks3() wouldn't have failed without the patches,
I'm just adding it to have at least one test that tests with 2
clients. All other tests use just one client.

test_smb2_kernel_oplocks4() is the reproducer.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12791

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
(backported from commit a334fff8a8c779704ee04ae784024efb67a6e9c9)
2017-08-14 14:36:20 +02:00
Andrew Bartlett
f2a06000cc s4-cldap/netlogon: Match Windows 2012R2 and return NETLOGON_NT_VERSION_5 when version unspecified
The previous patch set this incorrectly to NETLOGON_NT_VERSION_1

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11392

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 0554bc237f1b84d672d36781bead8b2c33f2e5a4)

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Tue Aug  1 12:15:22 CEST 2017 on sn-devel-144
2017-08-01 12:15:22 +02:00
Arvid Requate
0ee93fee3a s4-dsdb/netlogon: allow missing ntver in cldap ping
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11392

Signed-off-by: Arvid Requate <requate@univention.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 88db634ed84647e5105c4b4fdf37d5892bebfd8d)
2017-08-01 08:12:19 +02:00
Arvid Requate
38d8f3c70d s4:torture/ldap: Test netlogon without NtVer
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11392

Signed-off-by: Arvid Requate <requate@univention.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 22a94b728bd5d513b2002b62c129271d2210ed73)
2017-08-01 08:12:19 +02:00
Günther Deschner
1714d0cfa2 vfs_fruit: add fruit:model = <modelname> parametric option
fruit:model = iMac
fruit:model = MacBook
fruit:model = MacPro
fruit:model = Xserve

will all display a different icon inside Finder.

Formerly, we used "Samba" which resulted in a "?" icon in Finder, with
the new default "MacSamba" we appear with a computer box icon at least.

Guenther

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12840

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Jul 12 03:17:57 CEST 2017 on sn-devel-144

(cherry picked from commit 259e1706e3206b215e136ea9d5beef4c9e3fcdee)
2017-07-23 22:25:23 +02:00
Garming Sam
80aeac8bd0 dnsserver: Stop dns_name_equal doing OOB read
This has been the cause of a large number of flakey autobuilds. Every
now and again dns_name_equal would not be equal between two empty
strings, thus causing failures.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12813

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun  1 19:34:38 CEST 2017 on sn-devel-144

(cherry picked from commit 5ccfd38156ddf2435df15600638cde8ed020958f)
2017-07-13 20:01:25 +02:00
Andrew Bartlett
04676d6feb selftest: Do not enable inbound replication during replica_sync
Instead we should use the forced=True to only do a very specific
replication, and so avoid noise from any other DC also live
on the network.  This extra replication in turn causes (and this
patch fixes) flapping replica_sync tests.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12753

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Apr 22 05:19:11 CEST 2017 on sn-devel-144

(cherry picked from commit 52349a7e69a933cbfe410241c7ad80d012886e02)
2017-07-13 20:01:25 +02:00
Stefan Metzmacher
b528634c83 Merge branch 'v4-6-stable' into v4-6-test 2017-07-12 13:32:22 +02:00
Jeffrey Altman
9b0972c8e4 CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation
In _krb5_extract_ticket() the KDC-REP service name must be obtained from
encrypted version stored in 'enc_part' instead of the unencrypted version
stored in 'ticket'.  Use of the unecrypted version provides an
opportunity for successful server impersonation and other attacks.

Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.

Change-Id: I45ef61e8a46e0f6588d64b5bd572a24c7432547c

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12894
(based on heimdal commit 6dd3eb836bbb80a00ffced4ad57077a1cdf227ea)

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2017-07-12 10:47:11 +02:00
Douglas Bagnall
e550c8ae7d ndr tests: silence a harmless warning
gcc 7.

"duplicate ‘const’ declaration specifier [-Wduplicate-decl-specifier]"

Signed-off-by: Douglas Bagnall <douglas@halo.gen.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit f1b2d356585d43f2bac24d5c32cbef4a90c43f36)
2017-06-08 13:03:23 +02:00
Andreas Schneider
123bfe0250 s4:torture: Fix comparison between pointer and zero character constant
Fixes building with GCC 7.1

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12827

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit 1f4b07e5942235bddcfa999b3575f719752d81c4)
2017-06-08 13:03:23 +02:00
Ralph Boehme
4fc1e91306 s4/torture: test for bug 12798
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12798

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit bd43939ec07a2fc6858d1265fc75a68a7cd96f58)
2017-06-02 10:01:16 +02:00
Ralph Boehme
30586d36be vfs_fruit: lp_case_sensitive() does not return a bool
lp_case_sensitive() returns an int, not a bool, so with the default
setting of "Auto" by default we set the AAPL flag
SMB2_CRTCTX_AAPL_CASE_SENSITIVE.

This caused the client to believe the volume is case sensitive where it
wasn't, leading to an error when trying to rename files changing only
the case of the name.

Also fix the existing torture test that verifies AAPL context
negotiation and actually expected the server to return "case sensitive",
while the Samba default is really "case insensitive".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12749

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 36612723b2b18675116b6197183bdfe5e1d9e06f)
2017-04-28 09:12:27 +02:00
Ralph Boehme
3cd5d41333 s4/torture: vfs_fruit: test for bug 12565
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12565

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 893fc5abbe0a1b63ebd81f442a8d544572ed76a9)
2017-04-20 12:23:17 +02:00
Uri Simchoni
07437b080d selftest: tests for vfs_fruite file-id behavior
The test is in its own suite because it validates
our hackish workaround rather than some reference
implementation behavior.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12715

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sun Mar 26 23:31:08 CEST 2017 on sn-devel-144

(cherry picked from commit b6baf35ebde68db75515910ede26e74bb8313284)

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Tue Mar 28 16:14:58 CEST 2017 on sn-devel-144
2017-03-28 16:14:58 +02:00
Karolin Seeger
0cfe9fa893 samba: tag release samba-4.6.1
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iD8DBQBY04UubzORW2Vot+oRAl3GAJ0WIQXaLDiHn6mdNhuIsBwi8WHBswCfZzet
 l3K1PSH5fiSKlTWF5mzwG/4=
 =5aXb
 -----END PGP SIGNATURE-----

Merge tag 'samba-4.6.1' into v4-6-test

samba: tag release samba-4.6.1
2017-03-23 10:16:34 +01:00
Ralph Boehme
76099445c8 CVE-2017-2619: s4/torture: add SMB2_FIND tests with SMB2_CONTINUE_FLAG_REOPEN flag
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:48:40 +01:00
Stefan Metzmacher
bef55822f0 s4:kdc: disable principal based autodetected referral detection
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12554

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 3314bf52aaef60ef5cc1110587b53064df7c475d)
2017-03-17 08:50:30 +01:00
Stefan Metzmacher
b84c967eae HEIMDAL:kdc: make it possible to disable the principal based referral detection
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12554

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 209886e95c3afe1e4e50bacc30b40a543856a7a0)
2017-03-14 12:18:27 +01:00
Andreas Schneider
82898b87a5 s4:gensec_gssapi: Correctly handle external trusts with MIT
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12554

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 2dd4887648bf006a577e03fc027e881738ca04ab)
2017-03-14 12:18:27 +01:00
Andreas Schneider
be1e1586eb s4:gensec_gssapi: Use smb_krb5_get_realm_from_hostname()
With credentials for administrator@FOREST1.EXAMPLE.COM
this patch changes the target_principal for
the ldap service of host dc2.forest2.example.com
from

  ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM

to

  ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM

Typically ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM
should be used in order to allow the KDC of FOREST1.EXAMPLE.COM
to generate a referral ticket for
krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM.

The problem is that KDCs only return such referral tickets
if there's a forest trust between FOREST1.EXAMPLE.COM
and FOREST2.EXAMPLE.COM. If there's only an external domain
trust between FOREST1.EXAMPLE.COM and FOREST2.EXAMPLE.COM
the KDC of FOREST1.EXAMPLE.COM will respond with S_PRINCIPAL_UNKNOWN
when being asked for ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM.

In the case of an external trust the client can still ask
explicitly for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM
and the KDC of FOREST1.EXAMPLE.COM will generate it.

From there the client can use the
krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM
ticket and ask a KDC of FOREST2.EXAMPLE.COM for a
service ticket for ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM.

With Heimdal we'll get the fallback on S_PRINCIPAL_UNKNOWN behavior
when we pass ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM as
target principal. As _krb5_get_cred_kdc_any() first calls
get_cred_kdc_referral() (which always starts with the client realm)
and falls back to get_cred_kdc_capath() (which starts with the given realm).

MIT krb5 only tries the given realm of the target principal,
if we want to autodetect support for transitive forest trusts,
we'll have to do the fallback ourself.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12554

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 3781eb250173981a8890b82d1ff9358f144034cd)
2017-03-14 12:18:27 +01:00
Andreas Schneider
43bc67a79b s4:gensec_gssapi: Move setup of service_principal to update function
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12554

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit bf6358bf035e7ad48bd15cc2164afab2a19e7ad6)
2017-03-14 12:18:27 +01:00
Andreas Schneider
825bfed5cb s4:gensec-gssapi: Create a helper function to setup server_principal
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12554

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 8f7c4529420316b553c80cd3d19b6996525b029a)
2017-03-14 12:18:27 +01:00
Stefan Metzmacher
202604daaa s4:gensec_gssapi: require a realm in gensec_gssapi_client_start()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 3a870baee8d9dbe5359f04a108814afc27e57d46)
2017-03-14 12:18:26 +01:00
Stefan Metzmacher
22e473e2e5 s4:gensec_gssapi: the value gensec_get_target_principal() should overwrite gensec_get_target_hostname()
If gensec_get_target_principal() has a value, we no longer have to verify
the gensec_get_target_hostname() value, it can be just an ipadress.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 48bcca566ebb3a5385b15b0525d7fbdd06361e04)
2017-03-14 12:18:26 +01:00
Ralph Boehme
5acfa04814 s4/torture: some tests for kernel oplocks
Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit fd03420c4f59d3248b80d07a302d1404ce78b09f)
2017-03-14 10:51:47 +01:00
Stefan Metzmacher
53b73f18a1 s4:ldap_server: match windows in the error messages of failing LDAP Bind requests
This is important for some applications to detect the
NT_STATUS_PASSWORD_MUST_CHANGE condition correctly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9048

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 81ccdad9d045a7a6d6a569d1685bb0bf4e64d12a)
2017-03-06 19:40:23 +01:00
Ralph Boehme
f355f68397 s4/torture: vfs_fruit: add stream with illegal ntfs characters to copyile test
This ensures a stream with illegal NTFS characters mapped to the Unicode
private range like

  :foo\xef\x80\xa2bar:$DATA

that is stored as an xattr name

  user.DosStream.foo:bar:$DATA

if "fruit:encoding = native" is set, is copied by the special fruit
copy_chunk request.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12427

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit c7a79a9b35225f41eeae961ab340882c7d49f0c4)
2017-03-06 19:40:22 +01:00
Ralph Boehme
d35e6f6dc8 s4/torture: vfs_fruit: test invalid AFPINFO_STREAM_NAME
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12427

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 8b7e88f368ce793699fc57272e74d0815219a250)
2017-03-06 19:40:22 +01:00
Ralph Boehme
0631c0e4e0 s4/torture: change shares in used torture_suite_add_2ns_smb2_test()
torture_suite_add_2ns_smb2_test wan't used, change it to use the default
share as share 1 and a second share taken from torture option
"torture:share2".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12427

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 08dc5b4673a955f365095824275e67b2ea8fc31e)
2017-03-06 19:40:22 +01:00