1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

3250 Commits

Author SHA1 Message Date
Stefan Metzmacher
0da13ab3ad idmap_hash: we don't need to call idmap_hash_initialize() over an over again
It's always the first function that's called from idmap_methods.

This also demonstrates that we currently always return NT_STATUS_OK,
even if we haven't mapped all map entries.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15319

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-03-10 10:38:37 +00:00
Stefan Metzmacher
2cfcff3101 idmap_hash: remove unused error checks
id_map_ptrs_init() is used in the callers in order to
set everything up as expected.

Other backends also just trust the caller.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15319

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-03-10 10:38:37 +00:00
Stefan Metzmacher
0f96c4b419 idmap_hash: fix comments about the algorithm
Only support ~ 50k users per domain.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15319

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-03-10 10:38:37 +00:00
Stefan Metzmacher
9a24570d3d idmap_hash: provide ID_TYPE_BOTH mappings also for unixids_to_sids
While sids_to_unixids returns ID_TYPE_BOTH mappings,
unixids_to_sids() returns the callers asked for, which
fills gencache with the non ID_TYPE_BOTH mappings.
As a result also the sids_to_unixids fast path via
gencache won't return ID_TYPE_BOTH mappings.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15319

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-03-10 10:38:37 +00:00
Stefan Metzmacher
a9583b5f96 idmap_autorid: fix ID_REQUIRE_TYPE for more than one SID for an unknown domain
When we see a trusted domain SID for the first time,
idmap_autorid returns ID_REQUIRE_TYPE only for the first sid
and leaves the others with ID_TYPE_NOT_SPECIFIED.
It means the winbindd parent only retries the first sid.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15318

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-03-10 10:38:37 +00:00
Stefan Metzmacher
ad242a2064 winbindd: don't call set_domain_online_request() in the idmap child
Most idmap backends don't need access to the domain controllers.
And the related code is not needed for the backends.

Commit 17c86a2c5a changed
the logic of set_domain_online_request() completely!
Instead of triggering a dc probe in the background,
it is now doing a blocking connection.
And doing this in the idmap child is completely useless.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15317

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-03-10 10:38:37 +00:00
Andreas Schneider
460fd441d7 s3:winbind: Improve warning message if we are out of autorid ranges
The message should help our users to understand what's the problem. The
message was rather cryptic before.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Feb 28 14:18:32 UTC 2023 on atb-devel-224
2023-02-28 14:18:32 +00:00
Joseph Sutton
618d95822e ldap: Cut down on string substitution
Constant strings can be inserted directly into format strings, reducing
the amount of string substitution to be performed.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08 00:03:40 +00:00
Andreas Schneider
8b7fcfa577 s3:winbind: Remove unused variable
source3/winbindd/winbindd_ads.c:1399:6: error: variable 'ret_count' set but not
    used [-Werror,-Wunused-but-set-variable]
        int ret_count;
            ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-02-06 22:51:31 +00:00
Pavel Filipenský
51d559d8f4 s3:winbind: Move tevent_req_create() before debug macros to have the right call depth
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-26 14:10:36 +00:00
Pavel Filipenský
4b6e8e1c11 s3:winbind: Deactivate call depth tracking in child winbindd
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-26 14:10:36 +00:00
Pavel Filipenský
a6c1211504 s3:winbind: Activate the call depth tracking in main winbindd
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-26 14:10:36 +00:00
Ralph Boehme
eb1d1f19a2 winbindd: add dcname arg to ChangeMachineAccount request
Existing callers will pass an empty string, later a new caller will pass an
explicit DC name taken from the wbinfo command line.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21 19:10:35 +00:00
Ralph Boehme
4a74748d32 winbindd: Add force_dc to bypass cached connection and DC lookup
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21 19:10:35 +00:00
Ralph Boehme
0fcf00121a winbindd: More simplification of cm_open_connection()
This basically moves the functionality to connect the socket to the currently
preferred DC to a new helper function connect_preferred_dc() that is called from
the renamed function find_new_dc().

find_dc() now either returns a connected to the preferred DC or a new DC until
all possible DCs are exhausted and cm_open_connection() can just call find_dc()
to get a connected socket and pass it to cm_prepare_connection().

While at it reorder the args of find_dc() and make the only real out arg "fd"
the last one.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21 19:10:35 +00:00
Ralph Boehme
7315c5f4a5 winbindd: simplify cm_open_connection()
Simplify to retry logic: if cm_prepare_connection() succeeded just exit the
retry loop, only if it failed check the "retry" variable.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21 19:10:35 +00:00
Ralph Boehme
ccb6b75482 winbindd: simplify find_new_dc()
Remove the dcname and pss args from find_new_dc(). The caller passes in the
domain anyway, so let's fill in domain->dcname and domain->dcaddr directly.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21 19:10:35 +00:00
Ralph Boehme
2e496efe8c winbindd: do an early exit in cm_open_connection()
Best viewed with git show -w. No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-21 19:10:35 +00:00
Günther Deschner
39e8489dfc s3-librpc: add ads.idl and convert ads_struct to talloc.
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-16 20:38:32 +00:00
Volker Lendecke
4156d37db1 winbind: Save lines with talloc_asprintf_addbuf()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-14 04:32:34 +00:00
Volker Lendecke
f25b6de771 winbind: Save an intermediate NULL check with talloc_asprintf_addbuf()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-14 04:32:34 +00:00
Volker Lendecke
7870e82cb4 lib: Fix whitespace
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-14 04:32:34 +00:00
Ralph Boehme
fc57b88e6a smbd: remove process shortname arg from reinit_after_fork()
All callers pass NULL anyway, so it isn't used anymore.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-14 01:38:29 +00:00
Ralph Boehme
096295a6fe winbindd: Use process_set_title() instead of setproctitle()
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-14 01:38:29 +00:00
Stefan Metzmacher
d60828f639 CVE-2022-38023 s3:winbindd: also allow per domain "winbind sealed pipes:DOMAIN" and "require strong key:DOMAIN"
This avoids advising insecure defaults for the global options.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-12-13 13:07:29 +00:00
Pavel Filipenský
f5d77cb627 s3:winbind: Avoid unnecessary locking in wb_parent_idmap_setup_send()
A function in tevent environment can span over several context loop iterations.
Every iteration 'unschedules' the current code and a different functions can
access not yet fully initialized structures.

A locking is used to avoid this. In tevent, we use tevent queues as a locking
mechanism. Every function trying to access lock protected data, puts itself to
a queue. The function must remove itself from the queue only after the complete
work is done.

A good coding practise is to lock only the smallest code path and not to use the
locking if not needed.

wb_parent_idmap_setup_send() uses queue "wb_parent_idmap_config_queue" for:
- testing if the setup is ready
- setting up all idmap domains

But "testing if the setup is ready" can be coded as an atomic operation without
needing a lock.

Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Nov  4 10:06:28 UTC 2022 on sn-devel-184
2022-11-04 10:06:28 +00:00
David Mulder
8b55dabf55 winbind: Add smbconf fallback for gpupdate_callback
We should use the configfile specified, but also
fallback if none is specified.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-10-27 18:18:36 +00:00
David Mulder
ea1f53fc8b winbind: Fix user gpupdate called with NULL smb.conf
Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-10-27 18:18:36 +00:00
David Mulder
284afec29f winbind: Enforce user group policy when enabled
This only enforces user group policy at logon.
We should also enforce this policy every 90 to
120 minutes, but a logoff will need to cancel the
timer and we cannot have multiple timers if there
are multiple sessions for the same user.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Oct 21 18:48:18 UTC 2022 on sn-devel-184
2022-10-21 18:48:18 +00:00
David Mulder
211a6a63cc winbind: Fix potential memory leak in winbind gpupdate
Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-10-21 17:47:37 +00:00
Michael Tokarev
3ce1d2fde5 Fix spelling mistakes.
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Sep 12 02:29:32 UTC 2022 on sn-devel-184
2022-09-12 02:29:32 +00:00
Noel Power
1788b59bc0 s3/winbindd: Fix bad access to sid array (with debug level >= info)
==6436==    at 0xA85F95B: dom_sid_string_buf (dom_sid.c:444)
==6436==    by 0xA85FBF2: dom_sid_str_buf (dom_sid.c:515)
==6436==    by 0x17EDF8: wb_lookupusergroups_recv (wb_lookupusergroups.c:115)
==6436==    by 0x17F964: wb_gettoken_gotgroups (wb_gettoken.c:123)
==6436==    by 0x56AD332: _tevent_req_notify_callback (tevent_req.c:141)
==6436==    by 0x56AD493: tevent_req_finish (tevent_req.c:193)
==6436==    by 0x56AD5C0: tevent_req_trigger (tevent_req.c:250)
==6436==    by 0x56AC119: tevent_common_invoke_immediate_handler (tevent_immediate.c:190)
==6436==    by 0x56AC268: tevent_common_loop_immediate (tevent_immediate.c:236)
==6436==    by 0x56B678A: epoll_event_loop_once (tevent_epoll.c:919)
==6436==    by 0x56B31C3: std_event_loop_once (tevent_standard.c:110)
==6436==    by 0x56AA621: _tevent_loop_once (tevent.c:825)
==6436==
==6436== Invalid read of size 1
==6436==    at 0xA85F95B: dom_sid_string_buf (dom_sid.c:444)
==6436==    by 0xA85FBF2: dom_sid_str_buf (dom_sid.c:515)
==6436==    by 0x17EDF8: wb_lookupusergroups_recv (wb_lookupusergroups.c:115)
==6436==    by 0x17F964: wb_gettoken_gotgroups (wb_gettoken.c:123)
==6436==    by 0x56AD332: _tevent_req_notify_callback (tevent_req.c:141)
==6436==    by 0x56AD493: tevent_req_finish (tevent_req.c:193)
==6436==    by 0x56AD5C0: tevent_req_trigger (tevent_req.c:250)
==6436==    by 0x56AC119: tevent_common_invoke_immediate_handler (tevent_immediate.c:190)
==6436==    by 0x56AC268: tevent_common_loop_immediate (tevent_immediate.c:236)
==6436==    by 0x56B678A: epoll_event_loop_once (tevent_epoll.c:919)
==6436==    by 0x56B31C3: std_event_loop_once (tevent_standard.c:110)
==6436==    by 0x56AA621: _tevent_loop_once (tevent.c:825)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15160
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Aug 31 15:07:31 UTC 2022 on sn-devel-184
2022-08-31 15:07:31 +00:00
Pavel Filipenský
04d4bc5494 s3: Zero memory of idmap_fetch_secret() users
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Andreas Schneider
3469895aca s3:winbind: Implement dcerpc_samr_chgpasswd_user4 for PamAuthChangePassword
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jul 28 12:47:31 UTC 2022 on sn-devel-184
2022-07-28 12:47:31 +00:00
Volker Lendecke
d7fe63c91a winbind: Fix a "format string is not a string literal" warning
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-07-23 23:29:38 +00:00
Volker Lendecke
1ae9f5d3f7 winbind: Fix the 32-bit build
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-07-23 23:29:38 +00:00
Pavel Filipenský
1a897f1b71 s3:winbind: Add additional debug level check to wb_lookupsids_send()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jul 21 14:41:53 UTC 2022 on sn-devel-184
2022-07-21 14:41:53 +00:00
Pavel Filipenský
a2f30eede4 s3:winbind: Add additional debug level check to winbindd_getsidaliases_send()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
47c48fd020 s3:winbind: Add additional debug level check to winbindd_getgroups_recv()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
4a61e6dc53 s3:winbind: Add additional debug level check to wb_gettoken_recv()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
213570a0dd s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_getsidaliases.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
aa5ddc23ad s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_xids_to_sids.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
1b6b6f7d8a s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_sids_to_xids.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
189f5790c0 s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_list_users.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
9873b4fd0a s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_list_groups.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
1ff8bbd297 s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_getusersids.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
98b1f42a97 s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_getuserdomgroups.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
fb4f1e3717 s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_getpwent.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
ec8b50e049 s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_getgroups.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00
Pavel Filipenský
23b0842b63 s3:winbind: Change '%u' to '%PRIu32' for uint32_t in winbindd_getgrnam.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-07-21 13:47:31 +00:00