1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Commit Graph

1898 Commits

Author SHA1 Message Date
Andrew Bartlett
316fd085ad drs-fsmo: Improve handling of FSMO role takeover.
This needs to be more async, and give less scary errors.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Günther Deschner
a4dcf7b94d spoolss: Make OpenPrinterEx work with NDR64 by using UserInfo Container.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-01-16 11:42:13 +01:00
Günther Deschner
6a5afa2442 spoolss: add stubs for new JobNamedProperty dcerpc calls.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jan  7 19:06:25 CET 2013 on sn-devel-104
2013-01-07 19:06:25 +01:00
Stefan Metzmacher
f77bfed088 s4:drsuapi: try to behave more like windows for usn order (bug #9508)
We don't behave completely like a Windows server, but it's much more
identical than before.

The partition head is always the first object followed by the rest
sorted by uSNChanged.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan  1 21:09:42 CET 2013 on sn-devel-104
2013-01-01 21:09:41 +01:00
Stefan Metzmacher
16aef75c4f s4:drsuapi: make use of LDB_TYPESAFE_QSORT() and pass getnc_state
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
88833b089a s4:drsuapi: make sure we report the meta data from the cycle start (bug #9508)
We should build the final highwatermark and uptodatevector of
a replication cycle at the start of the cycle. Before we
search for the currently missing objects.

Otherwise we risk that some objects get lost.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
1f89d641d0 s4:drsuapi: check the source_dsa_invocation_id (bug #9508)
The given highwatermark is only valid relative to the
specified source_dsa_invocation_id.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
91f7f2c04f s4:drsuapi: make sure we never return the same highwatermark twice in a replication cycle (bug #9508)
If the highwatermark given by the client is not the one we expect,
we need to start a new replication cycle. Otherwise the destination dsa
skips objects and linked attribute values.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
7e511b5831 s4:drsuapi: add drsuapi_DsReplicaHighWaterMark_cmp()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
02de5b140c s4:drsuapi: always use the current uptodateness_vector
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
025c6d62f3 s4:drsuapi: avoid a ldb_dn_copy() and use talloc_move() instead
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
30be17bc5d s4:drsuapi: remove unused 'highest_usn' from drsuapi_getncchanges_state
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
551bb2ccea s4:drsuapi: move struct drsuapi_getncchanges_state to the top of getncchanges.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Günther Deschner
d8461992db s4-rpc_server: use netlogon_creds_encrypt_samlogon().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Sun Dec 16 01:34:01 CET 2012 on sn-devel-104
2012-12-16 01:34:01 +01:00
Günther Deschner
4fd7aaf2b1 s4-rpc_server: limit allowed transports for samr_ValidatePassword().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-12 11:29:33 +01:00
Michael Adam
ce895609b0 s4:rpc_server/samr: do WRONG_PASSWORD checks after the complexity checks
This matches the windows behavior.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-12-11 13:59:59 +01:00
Günther Deschner
71572632bd s4-rpc_server: support AES encryption in interactive and generic samlogon.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
01e69703fb s4-rpc_server: support AES decryption in netr_ServerPasswordSet2 server.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Gregor Beck
bcfa721a36 s3:build: move sessionid_tdb.o and conn_tdb.o to SMBD_OBJ_BASE
and use SMBD_OBJ_BASE for a couple of targets where sessionid_tdb and conn_tdb
were used.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2012-10-19 12:15:00 +02:00
Amitay Isaacs
e65a24b59f s4-rpc: dnsserver: Ignore DNS zones that are not used by RPC dnsserver
..TrustAnchors zone is not interpreted by RPC dnsserver code.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Tue Oct  9 03:21:07 CEST 2012 on sn-devel-104
2012-10-09 03:21:07 +02:00
Matthieu Patou
dc002a394b drsuapi: Validate the input parameters for the drsuapi_UpdateRefs function 2012-10-07 21:51:03 -07:00
Matthieu Patou
8be6a106ab drsuapi: check more carefully the validity of the NC
Check that both the GUID and DN are the GUID/DN of a NC if not return
WERR_DS_DRA_BAD_NC
2012-10-07 21:51:03 -07:00
Matthieu Patou
5374334d68 s4-drs: fix the logic to allow REPL_SECRET if the account has GET_ALL_CHANGES 2012-10-07 21:51:02 -07:00
Matthieu Patou
8dbba524bf s4-drs: EXOP_REPL_SECRETS can be called by RW DC as well 2012-10-07 21:51:02 -07:00
Matthieu Patou
2eae16102a drs-getncchanges: do not set the highestUsn to 0
Paragraph 4.1.10.5 says that
         if err = 0 then
         msgOut.pNC := msgIn.pNC
         msgOut.usnvecFrom := msgIn.usnvecFrom
so no need to set the highestUsn to 0
2012-10-07 21:51:01 -07:00
Matthieu Patou
303ef62b29 kcc: return invalid parameter if the taskId is not 0 2012-10-07 21:51:01 -07:00
Matthieu Patou
9269870a70 Implement the LIST_INFO_FOR_SERVER input format 2012-10-07 21:51:01 -07:00
Matthieu Patou
3dd2b804b9 getdcinfo: Check that the server object has a serverreference objects pointing to a DC object
The problem was found by the DRSR testsuite where server objects were
created in the Site container without serverrefrence attribute
triggering error in the testsuite.
2012-10-07 21:51:01 -07:00
Jelmer Vernooij
90b1a94cb4 netlogon: Per MS-NRPC, don't send unknown workstation flags back to the
client.
2012-09-26 22:12:07 +02:00
Stefan Metzmacher
f240a4c2e7 s4:rpc_server/drsuapi: use talloc_zero instead of talloc() in dcesrv_drsuapi_DsBind()
metze

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Sep 25 03:06:13 CEST 2012 on sn-devel-104
2012-09-25 03:06:13 +02:00
Stefan Metzmacher
bbac4fb42f s4:rpc_server/drsuapi: fix a crash in dcesrv_drsuapi_DsGetDomainControllerInfo_1()
metze
2012-09-25 01:14:15 +02:00
Andrew Bartlett
7213199f6e s4-repl: Use samdb_reference_dn_is_our_ntdsa() 2012-08-14 15:37:22 +02:00
Andrew Bartlett
9566786853 s4-dsdb: Add mem_ctx argument to samdb_ntds_settings_dn
As this value is calculated new each time, we need to give it a context to live on.

If the value is the forced value during provision, a reference is taken.

This was responsible for the memory leak in the replication process.  In the
example I was given, this DN appeared in memory 13596 times!

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug 14 10:05:14 CEST 2012 on sn-devel-104
2012-08-14 10:05:14 +02:00
Björn Jacke
13f8674a15 build: rename security → samba-security
there is a libsecurity on OSF1 which clasheѕ with our security lib. see bug #9023.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Fri Aug 10 14:22:21 CEST 2012 on sn-devel-104
2012-08-10 14:22:20 +02:00
Andrew Bartlett
8b1a9f3ebd lib/param: Remove "ntptr providor" and hard-code in s4 spoolss server
This stub codebase does not justify a merged parameter.

Andrew Bartlett

Pair-Programmed-With: Andrew Tridgell <tridge@samba.org>
2012-07-24 10:46:12 +10:00
Stefan Metzmacher
04d770adac s4:rpc_server/netlogon: add support for AES based netlogon schannel
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:39 +02:00
Stefan Metzmacher
99231181e3 s4:rpc_server/netlogon: only return STRONG_KEYS if the client asked for it
metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:38 +02:00
Stefan Metzmacher
e48aabc006 s4:rpc_server/netlogon: implement netr_LogonGetCapabilities
This is also needed to support AES.

metze

Signed-off-by: Günther Deschner <gd@samba.org>
2012-07-17 10:58:38 +02:00
Andreas Schneider
a49eb60e04 s4-lsarpc: DCERPC_FAULT_ACCESS_DENIED for tcp
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jul  6 11:50:40 CEST 2012 on sn-devel-104
2012-07-06 11:50:40 +02:00
Andreas Schneider
1744e99d0a s4-lsarpc: DCERPC_FAULT_ACCESS_DENIED for np 2012-07-06 10:00:58 +02:00
Andreas Schneider
997c780d24 s4-lsarpc: Restrict LookupSids3 to crypto connections only. 2012-07-06 10:00:58 +02:00
Andreas Schneider
1a12bbd5d8 s4-lsarpc: Restrict LookupNames4 to crypto connections only. 2012-07-06 10:00:58 +02:00
Andreas Schneider
13a7f98f9f s4-lsarpc: Don't call lsa_OpenPolicy2 in lsa_LookupSids3. 2012-07-06 10:00:58 +02:00
Andreas Schneider
9fa979c934 s4-lsaprc: Don't call lsa_OpenPolicy2 in lsa_LookupNames4. 2012-07-06 10:00:58 +02:00
Andrew Bartlett
b8815dc23d lib/param: Create a seperate server role for "active directory domain controller"
This will allow us to detect from the smb.conf if this is a Samba4 AD
DC which will allow smarter handling of (for example) accidentially
starting smbd rather than samba.

To cope with upgrades from existing Samba4 installs, 'domain
controller' is a synonym of 'active directory domain controller' and
new parameters 'classic primary domain controller' and 'classic backup
domain controller' are added.

Andrew Bartlett
2012-06-15 09:18:33 +02:00
Alexander Bokovoy
eaf9b86d60 Revert "waf-mitkrb5: enable dcerpc_server library to support OpenChange client code"
This reverts commit f8c447b1a4.

After discussing with Julien (Openchange) and Metze, I decided to revert this code.
Instead I made a patch to Openchange which allows to build client side only.

Openchange server code requires working s4 member DC and --without-ad-dc build
does not provide working provisioning even if we enable dcerpc_server and end point mapper.

Autobuild-User: Alexander Bokovoy <ab@samba.org>
Autobuild-Date: Fri Jun  1 16:46:08 CEST 2012 on sn-devel-104
2012-06-01 16:46:07 +02:00
Alexander Bokovoy
f8c447b1a4 waf-mitkrb5: enable dcerpc_server library to support OpenChange client code
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-06-01 09:29:47 +02:00
Alexander Bokovoy
2ddf89a2bc Introduce system MIT krb5 build with --with-system-mitkrb5 option.
System MIT krb5 build also enabled by specifying --without-ad-dc

When --with-system-mitkrb5 (or --withou-ad-dc) option is passed to top level
configure in WAF build we are trying to detect and use system-wide MIT krb5
libraries. As result, Samba 4 DC functionality will be disabled due to the fact
that it is currently impossible to implement embedded KDC server with MIT krb5.

Thus, --with-system-mitkrb5/--without-ad-dc build will only produce
  * Samba 4 client libraries and their Python bindings
  * Samba 3 server (smbd, nmbd, winbindd from source3/)
  * Samba 3 client libraries

In addition, Samba 4 DC server-specific tests will not be compiled into smbtorture.
This in particular affects spoolss_win, spoolss_notify, and remote_pac rpc tests.
2012-05-23 17:51:50 +03:00
Simo Sorce
302abe6190 auth and s4-rpc_server: Do not use features we currently can't implement with MIT Kerbros build 2012-05-23 17:51:49 +03:00
Simo Sorce
27549b4e31 Fix direct access to krb5_principal structure 2012-05-04 16:51:29 +02:00