1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

81627 Commits

Author SHA1 Message Date
Stefan Metzmacher
04d770adac s4:rpc_server/netlogon: add support for AES based netlogon schannel
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:39 +02:00
Stefan Metzmacher
780006db9d s4:librpc/rpc: add DCERPC_SCHANNEL_AES support
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:39 +02:00
Stefan Metzmacher
a7208de06a libcli/auth: add support for AES/HMAC-SHA256 to the netlogon schannel sign/seal
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:39 +02:00
Stefan Metzmacher
99e5241d36 libcli/auth: add support for AES/HMAC-SHA256 schannel session key support
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:39 +02:00
Stefan Metzmacher
99231181e3 s4:rpc_server/netlogon: only return STRONG_KEYS if the client asked for it
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:38 +02:00
Stefan Metzmacher
e48aabc006 s4:rpc_server/netlogon: implement netr_LogonGetCapabilities
This is also needed to support AES.

metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:38 +02:00
Stefan Metzmacher
342a2e6181 s4:librpc/rpc/dcerpc_schannel: just append NETLOGON_NEG_RODC_PASSTHROUGH as rodc
The RODC stuff doesn't depend on the schannel algorithm.

metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:38 +02:00
Stefan Metzmacher
e7c7a91130 s4:librpc/rpc/dcerpc_schannel: rework downgrade logic
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:38 +02:00
Andrew Bartlett
db33ef7be9 VERSION: Move on to beta5!
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Jul 17 06:10:52 CEST 2012 on sn-devel-104
2012-07-17 06:10:52 +02:00
Andrew Bartlett
3a6f1f9ac5 VERSION: Mark as the beta4 release 2012-07-17 12:17:07 +10:00
Andrew Bartlett
4b44002414 WHATSNEW: prepare for 4.0 beta4 2012-07-17 12:17:07 +10:00
Jelmer Vernooij
a7d5d08191 Revert "Remove XSLT script to generate image dependencies, instead rely on make"
This reverts commit c4493c22f1.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=7562

Conflicts:
	docs-xml/Makefile

Autobuild-User(master): Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date(master): Mon Jul 16 16:18:46 CEST 2012 on sn-devel-104
2012-07-16 16:18:46 +02:00
Andrew Bartlett
c92a5670e3 pytdb: Check if the database is closed before we touch it
If .close() has already been called, we have to play dead - the
self->ctx is just not valid any more, as we have been shut down to
allow some other part of Samba to open the tdb.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jul 16 13:51:52 CEST 2012 on sn-devel-104
2012-07-16 13:51:51 +02:00
Andrew Bartlett
a8e88332a3 pytdb: Check for errors parsing strings into TDB_DATA
The call to PyStringAsString() can raise an exception, and we
want to return that rather than following a NULL pointer later.

Andrew Bartlett
2012-07-16 11:58:21 +02:00
Andrew Bartlett
dff29e4aee auth/credentials: Look in the secrets.tdb for the machine account
This is for use with the -P/--machine-pass option.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Jul 15 05:41:28 CEST 2012 on sn-devel-104
2012-07-15 05:41:27 +02:00
Andrew Bartlett
6d24c899db s4-param: Use a unique header name 2012-07-15 11:49:29 +10:00
Andrew Bartlett
4b61c4891a s3-secrets: Use C99 types 2012-07-15 11:49:29 +10:00
Jeremy Allison
726ecf6a91 Fix bug #9016 - Connection to outbound trusted domain goes offline.
By the time we've gotten to init_dc_connection_network() we shouldn't
be second guessing the caller by calling winbindd_can_contact_domain().

If for some reason we do need to restrict the contact list here we
can add a condition to only contact the primary domain or domains
listed in the tdc cache, but I don't think that's neccessary.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Jul 14 03:17:57 CEST 2012 on sn-devel-104
2012-07-14 03:17:57 +02:00
Volker Lendecke
27e20d5d60 s3: Make us survive smb2.lock.rw-shared with aio enabled
schedule_aio_smb2_write can return NT_STATUS_FILE_LOCK_CONFLICT.
This is a valid error code that smb2.lock.rw-shared expects and
checks for. The code before this patch maps this to NT_STATUS_FILE_CLOSED,
masking the real, correct error message.

Signed-off-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jul 13 21:53:51 CEST 2012 on sn-devel-104
2012-07-13 21:53:51 +02:00
Andrew Bartlett
10b818bb22 s3-auth_samba4: Explain that check_samba4_security is actually unused
Because of the evolution in the way the auth handling has been done, we do not
need this code any more.  Raw NTLM Session setup & X is done via the auth4 context
which returns a full session info.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jul 13 10:04:05 CEST 2012 on sn-devel-104
2012-07-13 10:04:05 +02:00
Andrew Bartlett
1013fab5f8 lib/util: Allocate enough space to reference blob->data[len]
Found by Thomas Hood <jdthood@gmail.com> using valgrind.

Thanks!

Andrew Bartlett
2012-07-13 08:12:17 +02:00
Andrew Bartlett
15fedb3c68 s3-auth Remove unused global_machine_account_needs_changing
This boolean was only set if the old machine account store (with an
MD4 hash in it) was returned.  We have not set that password type for
years.  If this call ever worked, it would store a plaintext password,
so we could only ever be here if we had set a password using a version
of Samba so old as not to store plaintext, and then never honered the
flag anyway.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jul 13 07:52:40 CEST 2012 on sn-devel-104
2012-07-13 07:52:40 +02:00
Andrew Bartlett
d55cde19d3 s3-auth Remove confusing reference to global_machine_password_needs_changing
This is in the trusted domain codepath, not the primary domain code path.

Andrew Bartlett
2012-07-13 06:00:17 +02:00
Geza Gemes
70de501d6a s4-provision: Provide YP/NIS subtree to allow ADUC to see and set rfc2307 attrs
When provisioning with --use_rfc2307=yes populate the subtree:
CN=ypServ30,CN=RpcServices,CN=System,${DOMAINDN} This makes it
possible to manipulate the posix attributes via ADUC

(commit message adjusted by abartlet)

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-07-13 06:00:17 +02:00
Jeremy Allison
5a9ce8b94a Use HAVE_FSYNC, we bothered to test for it.
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jul 13 04:44:42 CEST 2012 on sn-devel-104
2012-07-13 04:44:42 +02:00
Michael Adam
bf650a1b59 s4:registry:regdiff: use existing talloc context for the event context
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Jul 13 02:51:44 CEST 2012 on sn-devel-104
2012-07-13 02:51:44 +02:00
Michael Adam
342ab97506 s4:registry:regdiff: add TALLOC_CTX * argument to open_backend() 2012-07-13 00:57:20 +02:00
Michael Adam
6ee16cefc9 s4:registry: add a TALLOC_CTX argument to reg_open_remote() 2012-07-13 00:57:19 +02:00
Jeremy Allison
e454681276 Linux-specific optimization in aio_open code.
Use initial_allocation_size to allocate on disk if sent. Ignore
failures (upper level will cope).

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jul 13 00:35:48 CEST 2012 on sn-devel-104
2012-07-13 00:35:47 +02:00
Jeremy Allison
a7c63ac1b7 Set fsp->initial_allocation_size before calling open_file_ntcreate().
Allows an SMB_VFS_OPEN() vfs module to do something interesting with
the request.
2012-07-12 22:46:07 +02:00
Jeremy Allison
775014bd9c Make sure we reset fsp->initial_allocation_size to zero if we didn't create the file.
This will become important as we set fsp->initial_allocation_size before
create.
2012-07-12 22:46:07 +02:00
Jeremy Allison
cb405947ca Add an optimization to pthread aio writes to also do fsync if requested.
Should help by ensuring complete writes done in sub-thread, not in
the main thread.
2012-07-12 22:46:07 +02:00
Volker Lendecke
622eb59eb4 s3: Make us survive base-delaywrite with aio enabled
Signed-off-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jul 12 21:28:19 CEST 2012 on sn-devel-104
2012-07-12 21:28:19 +02:00
Volker Lendecke
67e7e14e62 s3: Factor out "mark_file_modified"
This is in preparation of making us survive base-delaywrite with async I/O activated

Signed-off-by: Jeremy Allison <jra@samba.org>
2012-07-12 10:13:12 -07:00
Michael Adam
1ee95e4cb1 s3: rename sid_check_is_in_our_domain() to sid_check_is_in_our_sam()
This does not check whether the given sid is in our domain, but
but whether it belongs to the local sam, which is a different
thing on a domain member server.

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Jul 12 18:36:02 CEST 2012 on sn-devel-104
2012-07-12 18:36:02 +02:00
Michael Adam
c43505b621 s3: rename sid_check_is_domain() to sid_check_is_our_sam()
This does not check whether the given sid is the domain sid,
but whether it is the sid of the local sam, which is different
for a domain member server.
2012-07-12 16:43:51 +02:00
Michael Adam
ac2644b776 s3:passdb: remove commented out pdb_lookup_names code
This code is lying there unused since more than five years now.
2012-07-12 16:43:51 +02:00
Björn Jacke
19e80027b4 s3/torture: adjust dependency to fix build when no winbind was build before
Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Thu Jul 12 14:44:14 CEST 2012 on sn-devel-104
2012-07-12 14:44:14 +02:00
Björn Jacke
b865cddee7 s3: make log message of FSCTL_IS_VOLUME_DIRTY more clear 2012-07-12 12:47:30 +02:00
Björn Jacke
a93f56a069 test: fix compile warning on test summary 2012-07-12 12:47:29 +02:00
Ralph Wuerthner
2cc38ac413 mkversion: Remove quotes around SAMBA_VERSION_VENDOR_PATCH string
This fixes a build error in source3/smbd/trans2.c when
SAMBA_VERSION_VENDOR_PATCH is set (as integer value).

Signed-off-by: Amitay Isaacs <amitay@gmail.com>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Thu Jul 12 04:03:08 CEST 2012 on sn-devel-104
2012-07-12 04:03:08 +02:00
Ralph Wuerthner
73ede3241e s3:vfs_gpfs: fix ACL length calculation
GPFS 3.5 introduces ACL enhancements which are breaking our ACL length
calculations.

Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com>

Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Wed Jul 11 21:28:23 CEST 2012 on sn-devel-104
2012-07-11 21:28:23 +02:00
Christof Schmitt
35ab9bea0f s3:vfs_gpfs: Check softquota before gracetime
gpfs_quotactl can return a non-zero softquota gracetime even when no
softquota has been set. This could lead to "disk full" being reported to
a client. The easiest fix is to check for a valid softquota before
checking the softquota gracetime.
2012-07-11 19:38:47 +02:00
Michael Adam
149cae8428 build: fix some indentation (tabs/vs spaces) in source3/wscript
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jul 11 19:37:12 CEST 2012 on sn-devel-104
2012-07-11 19:37:12 +02:00
Michael Adam
5231d70fe5 build: fix waf checks for seteuid on non-Linux platforms
An indentation error had linux-specific checks called on non-linux
with the effect that "#define USE_LINUX_THREAD_CREDENTIALS 1"
was effective.
2012-07-11 08:44:45 -07:00
Jeremy Allison
8ee30be431 Add in the threaded async open engine.
Fixes all issues raised originally. This code
will only do threaded opens with thread-specific
credentials (Linux for now) and changes credentials
before doing the call. Also only fires on O_CREAT|O_EXCL
so will only create new files, never open old ones
async.

Volker, this is isolated enough that it shouldn't
prevent you from refactoring it into a new module
when the aio pread/pwrite code is moved into the
default aio path.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jul 11 08:04:56 CEST 2012 on sn-devel-104
2012-07-11 08:04:56 +02:00
Jeremy Allison
d81e20653b Move set_thread_credentials_permanently() to set_thread_credentials()
as we need to keep the saved set uid/gid otherwise there is an
interaction with open[at]() and NO_ATIME returning EPERM. As this
is meant for threaded code inside the process we don't need
to do an irreverisble change anyway.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jul 11 03:54:00 CEST 2012 on sn-devel-104
2012-07-11 03:54:00 +02:00
Jeremy Allison
b25619175f Fix typo we've had for a long time in set_re_uid() in the USE_SETRESUID case.
We only set the real euid, not the effective one. This is not
a security issue as this is *only* used in the quota code, and
only between code that brackets it with save_re_uid()/restore_re_uid(),
Also this is not used on most platforms (we use USE_SETREUID by
preference) but it's better to have this right. Bug to follow to get this
fixed in 3.6.next and 3.5.next.
2012-07-10 16:50:51 -07:00
Jeremy Allison
6d903bf189 Cope with a (non-security) open race we've had for ever as NTCreateX isn't atomic on POSIX.
On open without create, the file did exist, but some
other (local or NFS) process either renamed/unlinked
and re-created the file with different dev/ino after
we walked the path, but before we did the open. We
could retry the open but it's a rare enough case it's
easier to just fail the open to prevent creating any
problems in the open file db having the wrong dev/ino
key.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jul 10 21:57:33 CEST 2012 on sn-devel-104
2012-07-10 21:57:33 +02:00
Jeremy Allison
69a3e947b6 Now we have a guaranteed indication of a file being created, use it to set the create disposition correctly. 2012-07-10 09:39:36 -07:00