1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-13 13:18:06 +03:00
Commit Graph

42273 Commits

Author SHA1 Message Date
Michael Adam
1d949cb0e5 s3:auth: fix function header comment for user_sid_in_group_sid()
This is embarrassing: the commit 0770a4c01b
which intended to fix an earlier copy'n'paste error, contained another
typo, fixed with this commit...

Signed-off-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Dec 11 00:04:45 CET 2012 on sn-devel-104
2012-12-11 00:04:45 +01:00
Michael Adam
c5b150b33f s3:auth: fix create_token_from_sid() to not fail in the winbindd case
Commit 1c3c5e2156 which factored
the sid-based variant out of create_token_from_username() broke
the case of a user handled by winbindd in that the "found_username"
was set to NULL which caused the function to fail with
NT_STATUS_NO_MEMORY further down.

This patch fixes the function so that the case of found_username == NULL
is cleanly separated from the NO_MEMORY case and the caller can provide
the username in this case, if required.

This fixes bug #9457.

Signed-off-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Dec 10 18:18:54 CET 2012 on sn-devel-104
2012-12-10 18:18:54 +01:00
Michael Adam
0770a4c01b s3:auth: fix header comment for user_sid_in_group_sid()
This function was created in 1c3c5e2156
and the header comment contained copy'n'paste errors from the original
function user_in_group_sid() that took the user name.

Signed-off-by: Michael Adam <obnox@samba.org>
2012-12-10 16:34:22 +01:00
Günther Deschner
f2d9589b17 s3-auth: remove crypto from serverinfo_to_SamInfoX calls.
All crypto is dealt with within the netlogon samlogon server now.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
c1fb595081 s3-rpc_server: Remove obsolete process_creds boolean in samlogon server.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
7f435bd649 s3-auth: session keys in validation level 6 samlogon replies are *not* encrypted.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
645289216e s3-rpc_server: support AES for interactive netlogon samlogon password decryption.
Still need to fix AES support for the returned validation info.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
a52115ce67 s3-rpc_server: we need to encrypt OWFs using DES in _netr_ServerGetTrustInfo().
Sumit, please check.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
306a78d97f s3-rpc_server: pass down netlogon cred state in _netr_ServerGetTrustInfo().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:08 +01:00
Günther Deschner
c6f4745c56 s3-rpc_client: use netlogon_creds_aes_encrypt in interactive netlogon samlogon.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
1362d542df s3-rpc_server: support AES decryption in netr_ServerPasswordSet2 server.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
64345018cd s3-rpc_client: support AES encryption in netr_ServerPasswordSet2 client.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Günther Deschner
ec06c81db3 s3-rpc_client: use netlogon_creds_arcfour_crypt() in init_netr_CryptPassword.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-09 19:39:07 +01:00
Andreas Schneider
df0f59f66c winbind: Make the code more readable in trustdom_list_done().
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jim McDonough <jmcd@samba.org>

Autobuild-User(master): Jim McDonough <jmcd@samba.org>
Autobuild-Date(master): Fri Dec  7 22:38:43 CET 2012 on sn-devel-104
2012-12-07 22:38:43 +01:00
Volker Lendecke
0fa3129686 s3: Fix clear_if_first for the async echo handler
A worker smbd is as not long-lived as the main smbd, but as the async
echo handler exits when the worker smbd does, passing "true" here is the
right thing to do and fixes our clear_if_first handling when the async
echo handler is active.

Reviewed-by: Christian Ambach <ambi@samba.org>

Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Fri Dec  7 11:29:36 CET 2012 on sn-devel-104
2012-12-07 11:29:36 +01:00
Andrew Bartlett
171c63c3c4 build: Install .po files for SWAT intl support 2012-12-06 13:28:46 +11:00
Scott Lovenberg
bd18d996e2 Clean up client timeout definitions [rev. 2]
The definitions for default client timeout values have been moved to client.h.  When initializing a client struct we use this value instead of the old hardcoded value.  The timeout value remains 20 seconds.

Signed-off-by: Scott Lovenberg <scott.lovenberg@gmail.com>
Reviewed by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Dec  6 03:25:58 CET 2012 on sn-devel-104
2012-12-06 03:25:58 +01:00
Michael Adam
4eb53da3fe s3:smbd: fix a cut and paste error in a debug message
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed by: Jeremy Allison <jra@samba.org>
2012-12-05 16:35:07 -08:00
Michael Adam
2013bb9b4d s3:smbd: don't apply create/directory mask and modes in apply_default_perms()
The mask/mode parameters should only apply to a situation with only
pure posix permissions.
Once we are dealing with ACLs and inheritance, we need to do it correctly.

This fixes bug #9462: Users can not be given write permissions any more by default

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed by: Jeremy Allison <jra@samba.org>
2012-12-05 16:35:07 -08:00
Richard Sharpe
943797c232 Fix bug #9460 - Samba 3.6.x and Master respond incorrectly to FILE_STREAM_INFO requests.
Ensure we check the buffer size correctly.

Reviewed by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Dec  6 01:31:08 CET 2012 on sn-devel-104
2012-12-06 01:31:08 +01:00
Jeremy Allison
1c5c492f7e Remove unused append_parent_acl().
Get rid of a large chunk of unused code.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Tue Dec  4 11:59:30 CET 2012 on sn-devel-104
2012-12-04 11:59:30 +01:00
Michael Adam
4a8028a96e s3:smbd:vfs_acl: fix a PANIC when setting an ACL fails with ACCESS_DENIED
Omission to free the talloc frame causes a panic (at least in developer mode)
in the next main event loop due to "Frame not freed in order."
(Freed frame ../source3/smbd/process.c:3617, expected ../source3/modules/vfs_acl_common.c:534.)

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Dec  4 09:03:25 CET 2012 on sn-devel-104
2012-12-04 09:03:25 +01:00
Michael Adam
61e8b80c85 s3:passdb: fix building pdb_ldap as shared module
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Dec  3 19:12:29 CET 2012 on sn-devel-104
2012-12-03 19:12:29 +01:00
Andreas Schneider
de1288e13e smbget: Use new samba_getpass() function.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:10 +01:00
Andreas Schneider
353e83e4ee util: Use new samba_getpass() function for passwd util.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:10 +01:00
Andreas Schneider
7f4af3d1fb ntlm_auth: Use new samba_getpass() function.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:09 +01:00
Andreas Schneider
270d721d36 net: Use samba_getpass() function in net util.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:09 +01:00
Andreas Schneider
0d5f5424b4 net: Use new samba_getpass() function for 'net rpc'.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:09 +01:00
Andreas Schneider
bed60120d4 net: Use new samba_getpass() function for 'net ads'.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:09 +01:00
Andreas Schneider
1ded99cd14 torture: Use new samba_getpass() in masktest.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:09 +01:00
Andreas Schneider
531af0af1a torture: Use new samba_getpass() in smbtorture3.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:09 +01:00
Andreas Schneider
17bcdb5200 torture: Use new samba_getpass() in locktest2.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:09 +01:00
Andreas Schneider
3c79f85b6e util: Use new samba_getpass() function.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:08 +01:00
Andreas Schneider
85b1b840cb smbclient: Use new samba_getpass() function.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:08 +01:00
Andreas Schneider
27a1327b49 util: Add a UNIX platform independent samba_getpass().
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:08 +01:00
Michael Adam
99efe8480e s3:selftest: extend sids2xids test script to cope with "ID_TYPE_BOTH mappings
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Mon Dec  3 10:47:17 CET 2012 on sn-devel-104
2012-12-03 10:47:16 +01:00
Michael Adam
93c0c0749a s3:passdb: don't look into group mappings in legacy_sid_to_unixid()
The backends (tdbsam and ldapsam) do this.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:31 +01:00
Michael Adam
5fbdc5f35a s3:passdb:pdb_ldap: treat "Unix User" and "Unix Group" in sid_to_id()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:31 +01:00
Michael Adam
a0f4129448 s3:passdb:pdb_ldap: pre-validate sid with sid_check_object_is_for_passdb()
instead of sid_check_sid_is_in_our_sam). This allows for builtin sids,
wellknown sids and "Unix User" and "Unix Group" domains.

This broadens up the check moved here in commit
02e25b2a43.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:30 +01:00
Michael Adam
671f534e5e s3:passdb: add sid_check_object_is_for_passdb()
Variant of sid_check_is_for_passdb() that only checks for objects
in the various domains, not for the domain sids themselves.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:30 +01:00
Michael Adam
d96aeded61 s3:passdb: factor pdb_sid_to_id_unix_users_and_groups() out of pdb_default_sid_to_id()
The special treatment of the "Unix User" and "Unix Group" pseudo domains
can be reused.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:30 +01:00
Michael Adam
ef0ed56eb1 s3:passdb: don't bail out in pdb_default_sid_to_id() if sid is not in our sam
This code treats the own sam, builtin, wellknown, and sids from the
"Unix User" and "Unix Group" pseudo-domains.

This reverts part of commit 02e25b2a43.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:30 +01:00
Michael Adam
2d3f7e3141 s3:winbindd: use the new sid_check_is_for_passdb() in idmap_find_domain_with_sid()
This is more correct than the original one:
It also hands the wellknown and "Unix Users" and "Unix Groups" sids to passdb
for id mapping.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:29 +01:00
Michael Adam
845a142107 build the new sid_check_is_for_passdb() function into passdb
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:29 +01:00
Michael Adam
fecdf48aaf s3:lib: add utility function sid_check_is_for_passdb()
This function checks whether the given sid should be treated
by passdb (e.g. for id mapping).

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:29 +01:00
Michael Adam
e3ee397140 s3:winbindd: remove unused function idmap_backends_sid_to_unixid()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:28 +01:00
Michael Adam
7f2f29647a s3:test:wbinfo_sids2xids: test the results with singular calls with filled and with empty cache
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:28 +01:00
Michael Adam
25018d8ae6 s3:test: fix intialization of WBINFO in test_wbinfo_sids2xids.sh
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:28 +01:00
Michael Adam
a1411a884c s3:idmap_autorid: force mapping type to ID_TYPE_BOTH for sid->unixid mapping
This is to remove problems with the same unix-id being used both
as a uid and a gid.

The autorid backend will map a given number to the same SID, no matter whether this
is a uid or a gid. This will prime the idmap cache with mappings.
The sid-to-u/gid mapping, when not going through the cache, instead checks for
the type of the sid and only allows unix ids of the corresponding type.
Hence the rid backend will give different results, depending on whether the
cache is filled or not.

This patch lets the autorid backend always create sid->id mappings of type both.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:28 +01:00
Michael Adam
55607f0f33 s3:idmap_rid: force mapping type to ID_TYPE_BOTH for sid->unixid mapping
This is to remove problems with the same unix-id being used both
as a uid and a gid.

The rid backend will map a given number to the same SID, no matter whether this
is a uid or a gid. This will prime the idmap cache with mappings.
The sid-to-u/gid mapping, when not going through the cache, instead checks for
the type of the sid and only allows unix ids of the corresponding type.
Hence the rid backend will give different results, depending on whether the
cache is filled or not.

This patch lets the rid backend always create sid->id mappings of type both.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03 08:48:27 +01:00