1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-27 14:04:05 +03:00

83813 Commits

Author SHA1 Message Date
Michael Adam
1d949cb0e5 s3:auth: fix function header comment for user_sid_in_group_sid()
This is embarrassing: the commit 0770a4c01bef26ec51321cd5b97aea4eab9e00a8
which intended to fix an earlier copy'n'paste error, contained another
typo, fixed with this commit...

Signed-off-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Dec 11 00:04:45 CET 2012 on sn-devel-104
2012-12-11 00:04:45 +01:00
Michael Adam
cbc6a2f5e4 pidl: change strange spelling __donnot_use_enum_* to __do_not_use_enum_*
Signed-off-by: Michael Adam <obnox@samba.org>
2012-12-10 22:15:24 +01:00
Michael Adam
c5b150b33f s3:auth: fix create_token_from_sid() to not fail in the winbindd case
Commit 1c3c5e2156d9096f60bd53a96b88c2f1001d898a which factored
the sid-based variant out of create_token_from_username() broke
the case of a user handled by winbindd in that the "found_username"
was set to NULL which caused the function to fail with
NT_STATUS_NO_MEMORY further down.

This patch fixes the function so that the case of found_username == NULL
is cleanly separated from the NO_MEMORY case and the caller can provide
the username in this case, if required.

This fixes bug #9457.

Signed-off-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Dec 10 18:18:54 CET 2012 on sn-devel-104
2012-12-10 18:18:54 +01:00
Michael Adam
0770a4c01b s3:auth: fix header comment for user_sid_in_group_sid()
This function was created in 1c3c5e2156d9096f60bd53a96b88c2f1001d898a
and the header comment contained copy'n'paste errors from the original
function user_in_group_sid() that took the user name.

Signed-off-by: Michael Adam <obnox@samba.org>
2012-12-10 16:34:22 +01:00
Stefan Metzmacher
53b736444d s4:dsdb/tests/sec_descriptor: verify the search of a windows dc join keeps working
This is a regression test for bug #9470.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Mon Dec 10 15:41:12 CET 2012 on sn-devel-104
2012-12-10 15:41:11 +01:00
Stefan Metzmacher
e617a3fecb s4:dsdb/tests/sec_descriptor: verify the nTSecurityDescriptor and sd_flags interaction
This is a regression test for bug #9470.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-10 13:53:48 +01:00
Stefan Metzmacher
6bc2caed8b s4:dsdb/operational: fix stripping of the nTSecurityDescriptor attribute
If the sd_flags control is specified, we should return nTSecurityDescriptor
only if the client asked for all attributes.

If there's a list of only explicit attribute names, we should ignore
the sd_flags control.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-10 13:53:48 +01:00
Stefan Metzmacher
22bb2fd868 s4:dsdb/acl_read: return the nTSecurityDescriptor attr if the sd_flags control is given (bug #9470)
Not returning the nTSecurityDescriptor causes a lot of problems.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-10 13:53:47 +01:00
Stefan Metzmacher
4f8558ffaf s4:dsdb/acl_read: give some variables a better name
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-10 13:53:47 +01:00
Stefan Metzmacher
db15fcfa89 s4:dsdb/acl_read: fix the calculation of the attribute array for the sub search
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-10 13:53:47 +01:00
Stefan Metzmacher
e2181617a0 s4:dsdb/acl_read: check the ldb_attr_list_copy_add() result
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-10 13:53:46 +01:00
Stefan Metzmacher
6bcafceb75 s4:dsdb/dirsync: fix potential talloc hierachy problems (bug #9470)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-10 13:53:46 +01:00
Günther Deschner
ade5bfd304 s4-torture: call the s4u2self tests with arcfour and aes.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sun Dec  9 21:24:44 CET 2012 on sn-devel-104
2012-12-09 21:24:44 +01:00
Günther Deschner
d0bad6c335 s4-torture: precalculate expected session keys from samlogon in schannel test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
f6cb8049b2 libcli/auth: support AES decryption in netlogon_creds_decrypt_samlogon().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
be296a21fc libcli/auth: remove trailing whitespace.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
f2d9589b17 s3-auth: remove crypto from serverinfo_to_SamInfoX calls.
All crypto is dealt with within the netlogon samlogon server now.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
c1fb595081 s3-rpc_server: Remove obsolete process_creds boolean in samlogon server.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
7f435bd649 s3-auth: session keys in validation level 6 samlogon replies are *not* encrypted.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
645289216e s3-rpc_server: support AES for interactive netlogon samlogon password decryption.
Still need to fix AES support for the returned validation info.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
71572632bd s4-rpc_server: support AES encryption in interactive and generic samlogon.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
a52115ce67 s3-rpc_server: we need to encrypt OWFs using DES in _netr_ServerGetTrustInfo().
Sumit, please check.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
6aec126566 s4-torture: validate owf password hash and negotiate AES in forest trust test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
83b00afe9f s4-torture: validate owf password hash and negotiate AES ServerGetTrustInfo test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
306a78d97f s3-rpc_server: pass down netlogon cred state in _netr_ServerGetTrustInfo().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
fd70870203 s4-torture: use netlogon_creds_arcfour_crypt() in samba3rpc test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
4afb7dcb43 s4-torture: exit early when join fails in samba3rpc tests.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
5089442bfd s4-torture: support AES encryption in interactive samlogon tests in rpc.samr.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
d94f012f3f s4-torture: support AES encryption in pac_verify/generic samlogon netlogon tests.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
3dffd29904 s4-torture: use names for r.in.logon_level of netlogon samlogon requests.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
7ea9da0c9f s4-torture: remove trailing whitespace in smbtorture remote_pac test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
c6f4745c56 s3-rpc_client: use netlogon_creds_aes_encrypt in interactive netlogon samlogon.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
01e69703fb s4-rpc_server: support AES decryption in netr_ServerPasswordSet2 server.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
3dc8c20b8a s4-torture: add AES support for netr_ServerPasswordSet2 tests.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
0a091604a4 s4-torture: pass down netlogon flags in netr_ServerPasswordSet2 tests.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
d1f481ffe1 s4-torture: remove trailing whitespace from netlogon test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
1362d542df s3-rpc_server: support AES decryption in netr_ServerPasswordSet2 server.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
64345018cd s3-rpc_client: support AES encryption in netr_ServerPasswordSet2 client.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
ec06c81db3 s3-rpc_client: use netlogon_creds_arcfour_crypt() in init_netr_CryptPassword.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
429600c5f3 libcli/auth: add netlogon_creds_aes_{en|de}crypt routines.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Alexander Bokovoy
b6e2be8e14 wafsamba: replace try:except: case with explicit comment about FIPS mode
Since exceptions will be caught be outer try:except: pair anyway, mark
the test of MD5 code by the comment that explains why we need to really
test it.

Do it for both hashlib.md5 and md5 modules.

Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Sat Dec  8 18:41:07 CET 2012 on sn-devel-104
2012-12-08 18:41:07 +01:00
Alexander Bokovoy
56d9c8c4bf wafsamba: Make sure md5 is really work before using it or overriding the hash function
In FIPS mode importing md5 Python module will not cause any error but calling md5.md5()
function will throw ValueError since md5 is not available.

Make sure md5.md5() actually works and if not, fall back to use hash replacement that
we already have in wafsamba.

Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Sat Dec  8 13:30:07 CET 2012 on sn-devel-104
2012-12-08 13:30:07 +01:00
Ricky Nance
b4ae73f58c samba-tool processes: Make the output a bit neater
Reviewed-By: Jelmer Vernooij <jelmer@samba.org>

Autobuild-User(master): Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date(master): Sat Dec  8 03:34:29 CET 2012 on sn-devel-104
2012-12-08 03:34:29 +01:00
Andreas Schneider
df0f59f66c winbind: Make the code more readable in trustdom_list_done().
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jim McDonough <jmcd@samba.org>

Autobuild-User(master): Jim McDonough <jmcd@samba.org>
Autobuild-Date(master): Fri Dec  7 22:38:43 CET 2012 on sn-devel-104
2012-12-07 22:38:43 +01:00
Tsukasa Hamano
16d725b4f5 Fix bug #9471 - SEGV when using second vfs module.
Don't use default_classname_table when we obviously shoud be using
classname_table.

Reviewed by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Dec  7 17:51:50 CET 2012 on sn-devel-104
2012-12-07 17:51:50 +01:00
Stefan Metzmacher
734d14b548 s4:dsdb/descriptor: fix replication of NC heads
The sub NC heads maybe replicated with the parent partition,
if we don't need to recalculate the nTSecurityDescriptor attribute in that
case, the replication of the of the sub partition should handle that.

This fixes error messages like this:
descriptor_sd_propagation_recursive: DC=ForestDnsZones,DC=s40dom,DC=base not found under DC=s40dom,DC=base

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-07 16:04:40 +01:00
Stefan Metzmacher
8021247895 s4:dsdb/acl_read: improve debugging for fatal error
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-07 16:04:26 +01:00
Stefan Metzmacher
14b5b72904 s4:dsdb/acl_read: keep the ldb_message of the sub search (bug #9470)
Some modules might not allocate values on the correct memory context.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-07 14:28:25 +01:00
Stefan Metzmacher
3535f8effe s4:dsdb/schema_data.c: correctly move the CN=Aggregate attributes to msg->elements[i].values (bug #9470)
We should keep the talloc hierarchy sane.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-07 14:28:25 +01:00
Stefan Metzmacher
944b6863a7 s4:dsdb/schema: fix dsdb_schema_set_el_from_ldb_msg() (bug #9470)
We should always update the ts_last_change.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-07 14:28:24 +01:00