1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-21 18:04:06 +03:00

165 Commits

Author SHA1 Message Date
Volker Lendecke
e95942ed84 r22954: More messaging_register
(This used to be commit 9b8df24107ffe3016031e5257c5680689f061886)
2007-10-10 12:22:11 -05:00
Volker Lendecke
e6383f4762 r22736: Start to merge the low-hanging fruit from the now 7000-line cluster patch.
This changes "struct process_id" to "struct server_id", keeping both is
just too much hassle. No functional change (I hope ;-))

Volker
(This used to be commit 0ad4b1226c9d91b72136310d3bbb640d2c5d67b8)
2007-10-10 12:21:52 -05:00
Gerald Carter
cfc4946ebf r22729: add help text for osver and osname options to 'net ads join' (patch from Dnailo A.)
(This used to be commit 3f588e0b65433176f8f80312c1456836717cf6de)
2007-10-10 12:21:51 -05:00
Gerald Carter
3eca3af1bc r22728: Patch from Danilo Almeida <dalmeida@centeris.com>:
When asked to create a machine account in an OU as part
of "net ads join" and the account already exists in another
OU, simply move the machine object to the requested OU.
(This used to be commit 3004cc6e593e6659a618de66f659f579e71c07f7)
2007-10-10 12:21:51 -05:00
Günther Deschner
1ee9650a1d r22479: Add "net ads keytab list".
Guenther
(This used to be commit 9ec76c542775ae58ff03f42ebfa1acc1a63a1bb1)
2007-10-10 12:19:37 -05:00
Gerald Carter
2af42eaaa3 r21888: Add the osname and osver options to 'net ads join' as discussed
on the samba-technical ml.

I'll add a 'net ads set attribute=value' utility later
rather than the original 'net ads setmachineupn' patch that
was also posted to the tech ml.
(This used to be commit 5035778ae4b3a5e445faa535c5caf00bc8d220d8)
2007-10-10 12:18:45 -05:00
Jeremy Allison
8e00e9d7a6 r21609: Fix memory leaks in error code paths (and one in winbindd_group.c).
Patch from Zack Kirsch <zack.kirsch@isilon.com>.
Jeremy.
(This used to be commit df07a662e32367a52c1e8473475423db2ff5bc51)
2007-10-10 12:18:16 -05:00
Jeremy Allison
fae01b4899 r21608: Fix a couple of memleaks in error code paths before
Coverity finds them :-)
Jeremy.
(This used to be commit cbe725f1b09f3d0edbdf823e0862edf21e16d336)
2007-10-10 12:18:16 -05:00
Simo Sorce
e9e6af5951 r21606: Implement escaping function for ldap RDN values
Fix escaping of DN components and filters around the code
Add some notes to commandline help messages about how to pass DNs

revert jra's "concistency" commit to nsswitch/winbindd_ads.c, as it was
incorrect.
The 2 functions use DNs in different ways.

- lookup_usergroups_member() uses the DN in a search filter,
and must use the filter escaping function to escape it
Escaping filters that include escaped DNs ("\," becomes "\5c,") is the
correct way to do it (tested against W2k3).

- lookup_usergroups_memberof() instead uses the DN ultimately as a base dn.
Both functions do NOT need any DN escaping function as DNs can't be reliably
escaped when in a string form, intead each single RDN value must be escaped
separately.

DNs coming from other ldap calls (like ads_get_dn()), do not need escaping as
they come already escaped on the wire and passed as is by the ldap libraries

DN filtering has been tested.
For example now it is possible to do something like:
'net ads add user joe#5' as now the '#' character is correctly escaped when
building the DN, previously such a call failed with Invalid DN Syntax.

Simo.
(This used to be commit 5b4838f62ab1a92bfe02626ef40d7f94c2598322)
2007-10-10 12:18:16 -05:00
Volker Lendecke
caf8c6a76b r21064: The core of this patch is
void message_register(int msg_type,
                      void (*fn)(int msg_type, struct process_id pid,
-                                void *buf, size_t len))
+                                void *buf, size_t len,
+                                void *private_data),
+                     void *private_data)
 {
        struct dispatch_fns *dfn;

So this adds a (so far unused) private pointer that is passed from
message_register to the message handler. A prerequisite to implement a tiny
samba4-API compatible wrapper around our messaging system. That itself is
necessary for the Samba4 notify system.

Yes, I know, I could import the whole Samba4 messaging system, but I want to
do it step by step and I think getting notify in is more important in this
step.

Volker
(This used to be commit c8ae60ed65dcce9660ee39c75488f2838cf9a28b)
2007-10-10 12:17:32 -05:00
Gerald Carter
fe830f22c9 r20903: Replace the hardcoded "smb.conf" string with the dyn_CONFIGFILE
(This used to be commit ff8f27108d247aa9e46176f2b29fc8d2da103906)
2007-10-10 12:17:18 -05:00
Jeremy Allison
bfd099e148 r20857: Silence gives assent :-). Checking in the fix for
site support in a network where many DC's are down.
I heard via Volker there is still a bug w.r.t the
wrong site being chosen with trusted domains but
we'll have to layer that fix on top of this.
Gd - complain if this doesn't work for you.
Jeremy.
(This used to be commit 97e248f89ac6548274f03f2ae7583a255da5ddb3)
2007-10-10 12:17:14 -05:00
Gerald Carter
db7bf9a6b6 r20173: DNS update fixes:
* Fix DNS updates for multi-homed hosts
* Child domains often don't have an NS record in
  DNS so we have to fall back to looking up the the NS
  records for the forest root.
* Fix compile warning caused by mismatched 'struct in_addr'
  and 'in_addr_t' parameters called to DoDNSUpdate()
(This used to be commit 3486acd3c3ebefae8f98dcc72d1c3d6b06fffcc7)
2007-10-10 12:16:29 -05:00
Jim McDonough
243b462b09 r20119: Update help info indicating how to use separators (forward slash only)
and properly use backslashes in "net ads join computername="
(This used to be commit cc26e2f9a155529b8ac2122bd2bec401bb516264)
2007-10-10 12:16:26 -05:00
Volker Lendecke
5f3b7ee713 r19766: Fix a const-warning. Jerry, what did you want to fix with this line?
Volker
(This used to be commit 55dc4741cfead0f21deb7ea2d28afb240505686b)
2007-10-10 12:15:54 -05:00
Gerald Carter
c2aae726ea r19762: libaddns/*[ch] code fixes donated by Centeris Corporation
(http://www.centeris.com/) under my copyright.

* Rework error reporting to use DNS_ERROR instead
  of int32
* Convert memory allocation to use talloc()
* Generalize the DNS request/response packet marshalling
* Fix the secure update requests
(This used to be commit c78798333616c3f823514df0f58da2eb3a30a988)
2007-10-10 12:15:53 -05:00
Gerald Carter
8fa0a80b49 r19754: * When using a krb5 session setup, we don't fill in the server_name
string the clis_state struct.  So call saf_store() after we
  have the short domain name in the lsa_query_inof_policy code.

* Remove unused server string in saf_delete()
(This used to be commit 3eddae2f2080f8dafec883cb9ffa2e578c242607)
2007-10-10 12:15:53 -05:00
Günther Deschner
61a38bd4b8 r19651: Fix interesting bug with the automatic site coverage in Active Directory:
When having DC-less sites, AD assigns DCs from other sites to that site
that does not have it's own DC. The most reliable way for us to identify
the nearest DC - in that and all other cases - is the closest_dc flag in
the CLDAP reply.

Guenther
(This used to be commit ff004f7284cb047e738ba3d3ad6602e8aa84e883)
2007-10-10 12:15:44 -05:00
Günther Deschner
31a63ab19f r19528: Fix container handling for "net ads user" and "net ads group" functions
along with some memleaks.

Guenther
(This used to be commit 4bad52c5b3a983418d4216a2c3f5e04926e37e94)
2007-10-10 12:15:41 -05:00
Günther Deschner
4e0f560f60 r19527: Fix double free in "net ads group add".
Guenther
(This used to be commit 08db3d3b04d91238b739e88e817bd3f800b768ee)
2007-10-10 12:15:41 -05:00
Günther Deschner
25fb86570d r19525: Fix the same error in "net ads group delete".
Guenther
(This used to be commit 94ed3e9de8671d677451d2a16977caeeb7e744d1)
2007-10-10 12:15:40 -05:00
Günther Deschner
8a9c4331a3 r19524: Stop "net ads user delete" from doing funny things.
Guenther
(This used to be commit a20e7c0315f9a06ce2139f99d035b409b066d722)
2007-10-10 12:15:40 -05:00
Günther Deschner
78f977f746 r19493: There is no point in prompting for a user's password in "net ads" when
we can't find a domain controller at all.

Guenther
(This used to be commit e691ae7da3620a7d4c0e0b1217aaae44db0b8db3)
2007-10-10 12:15:39 -05:00
Jeremy Allison
a0c84f1b12 r19257: Janitor for Guenther - as well as a little massaging to make
his patch fit SAMBA_3_0. (This is guenthers code). Make
site support work correctly in net ads join.
Jeremy.
(This used to be commit 47352b5398e67eb8f4f383dafce31c922626ae99)
2007-10-10 12:15:26 -05:00
Günther Deschner
ac080e3184 r19039: Do not segfault in "net ads printer info" when a requested printserver
does not exist.

Guenther
(This used to be commit 359315021df3a4dbfe5142e529e3efdbc49e405c)
2007-10-10 12:15:04 -05:00
Günther Deschner
88a98e35c7 r19003: Finally activate "net ads gpo".
For those who are interested, try

        net ads gpo refresh mybox$

to get your machine related GPOs downloaded to /var/lib/samba/gpo_cache.
Detailed information about GPOs is currently only printed when setting a
higher debuglevel then 0.

Guenther
(This used to be commit d086babf9d2592f041cc35db3d60b4452ea953f5)
2007-10-10 12:14:55 -05:00
Günther Deschner
0d12a35e6b r18817: Enable the build of the gpo tool but do not make it available yet.
Guenther
(This used to be commit 927cda5d31e9cb02105df3cfc06f5cb273233747)
2007-10-10 12:01:03 -05:00
Jeremy Allison
dc14e67a6b r18467: Some sites allow an account to be deleted, but not
disabled. Cope with both - print appropriate messages.
Jeremy.
(This used to be commit 2c003a4463ff59c477fa2558f869444cfa75e3a8)
2007-10-10 11:51:43 -05:00
Jeremy Allison
8c2c5c5d1d r18446: Add the ldap 'leave domain' code - call this as
a non-fatal error path if the 'disable machine
account' code succeeded.
Jeremy.
(This used to be commit f47bffa21ec1caf5ec3a6ec77af801df0b63d83a)
2007-10-10 11:51:42 -05:00
Günther Deschner
a58dc69813 r18170: Make sure to actually get the printing data before trying to publish it
in AD.

Guenther
(This used to be commit 1bb29acb3bf40afdb5bc196ab7dbc642e2fdd680)
2007-10-10 11:43:30 -05:00
Volker Lendecke
ee0e397d6f r18019: Fix a C++ warnings: Don't use void * in libads/ for LDAPMessage anymore.
Compiled it on systems with and without LDAP, I hope it does not break the
build farm too badly. If it does, I'll fix it tomorrow.

Volker
(This used to be commit b2ff9680ebe0979fbeef7f2dabc2e3f27c959d11)
2007-10-10 11:39:49 -05:00
Jeremy Allison
4dcda274ef r17941: Fix print out of client site name.
Jeremy.
(This used to be commit b8cedcac933fef9370bd42d1ff7c35c5c27103d1)
2007-10-10 11:39:00 -05:00
Jeremy Allison
2abab7ee6d r17928: Implement the basic store for CLDAP sitename
support when looking up DC's. On every CLDAP
call store the returned client sitename (if
present, delete store if not) in gencache with
infinate timeout. On AD DNS DC lookup, try looking
for sitename DC's first, only try generic if
sitename DNS lookup failed.
I still haven't figured out yet how to ensure
we fetch the sitename with a CLDAP query before
doing the generic DC list lookup. This code is
difficult to understand. I'll do some experiments
and backtraces tomorrow to try and work out where
to force a CLDAP site query first.
Jeremy.
(This used to be commit ab3f0c5b1e9c5fd192c5514cbe9451b938f9cd5d)
2007-10-10 11:38:59 -05:00
Gerald Carter
5693e6c599 r17798: Beginnings of a standalone libaddns library released under
the LGPL.   Original code by Krishna Ganugapati <krishnag@centeris.com>.
Additional work by me.

It's still got some warts, but non-secure updates do
currently work.  There are at least four things left to
really clean up.

1. Change the memory management to use talloc() rather than
   malloc() and cleanup the leaks.
2. Fix the error code reporting (see initial changes to
   dnserr.h)
3. Fix the secure updates
4. Define a public interface in addns.h
5. Move the code in libads/dns.c into the libaddns/ directory
   (and under the LGPL).

A few notes:

* Enable the new code by compiling with --with-dnsupdate
* Also adds the command 'net ads dns register'
* Requires -luuid (included in the e2fsprogs-devel package).
* Has only been tested on Linux platforms so there may be portability
  issues.
(This used to be commit 36f04674aeefd93c5a0408b8967dcd48b86fdbc1)
2007-10-10 11:38:48 -05:00
Volker Lendecke
900fe6a625 r17603: Make net_ads_join_ok return NTSTATUS.
Thanks to Michael Adam <ma@sernet.de>

hop, hop, hop... ;-)

Volker
(This used to be commit 47facab798bdc6e20b2620972f1b8f2338fac239)
2007-10-10 11:38:42 -05:00
Volker Lendecke
01c77cefef r17602: Make check_ads_config return NTSTATUS, set some error codes in net_ads_join.
Thanks to Michael Adam <ma@sernet.de>

Volker
(This used to be commit 27cca861507afa9caf694ef89e543c86de01c2cd)
2007-10-10 11:38:42 -05:00
Volker Lendecke
8b39f5ef37 r17591: machine_account is unused, and ctx must be freed. Thanks Michael
(This used to be commit a347f8a9c480cf09abac9144e04ab2b13457e3b0)
2007-10-10 11:38:41 -05:00
Volker Lendecke
20ad622b98 r17585: Don't let ads_status throw away the error information.
Thanks to Michael Adam <ma@sernet.de>.

Volker
(This used to be commit ea3a4142a0f2140d8743a50518ae94df2d84d972)
2007-10-10 11:38:41 -05:00
Volker Lendecke
db21dceb43 r17557: Change net_join_domain to return NTSTATUS instead of int.
Thanks to Michael Adam <ma@sernet.de>.

Volker
(This used to be commit c4e10afadb39ff562287ab2294df0a1f83b28908)
2007-10-10 11:38:39 -05:00
Volker Lendecke
c804dd0117 r17551: Move some DEBUG to d_printf in interactive functions and return
NO_LOGON_SERVERS if no domain controller was found.

Thanks to Michael Adam <ma@sernet.de>.

Volker
(This used to be commit d44599de3a61707a32851f37ddfb2425949622f8)
2007-10-10 11:38:38 -05:00
Gerald Carter
e5f6544df1 r17383: Patch from Michael Adams <ma@sernet.de> to catch
some memory leaks on error paths in net_ads_join()
(This used to be commit 24de2d83ff1d27400a89985126edee588bc415f3)
2007-10-10 11:38:29 -05:00
Gerald Carter
20c09b75fa r17258: Cleanup the 'net ads help join' output and document createupn
and createcomputer options
(This used to be commit 87be77bf35635fc925e1be36073571f8c6ec3e81)
2007-10-10 11:38:22 -05:00
Gerald Carter
188e7ac756 r17158: Add two new options to 'net ads join'
* createupn=[host_upn@realm]
  * createcomputer=<ou path top to bottom> (this was previously
    the only arg)
(This used to be commit 75054e984e5ca7249b1327630db9d09da974a54e)
2007-10-10 11:38:17 -05:00
Gerald Carter
02f272f3c6 r17149: Fail the join if we cannot set any SPNs for the machine account.
Disable the one we created and whine.
(This used to be commit 1a7e81a4a8955e643d1c8a54365221a9e2ed8a12)
2007-10-10 11:38:16 -05:00
Günther Deschner
9c160dd9a7 r17086: Re-add ability to contact remote domain controllers with the "net ads"
toolset.

In 3.0.23 all those commands have been limited to the DC of our primary
domain. Also distinguish calls that may go to remote DCs (search, info,
lookup, etc.) from those that should only go to our primary domain
(join, leave, etc.).

Guenther
(This used to be commit d573e64781667993478a289580fa65c34e847f64)
2007-10-10 11:38:10 -05:00
Gerald Carter
060b155cd2 r16952: New derive DES salt code and Krb5 keytab generation
Major points of interest:

* Figure the DES salt based on the domain functional level
  and UPN (if present and applicable)
* Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC
  keys
* Remove all the case permutations in the keytab entry
  generation (to be partially re-added only if necessary).
* Generate keytab entries based on the existing SPN values
  in AD

The resulting keytab looks like:

ktutil:  list -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32)
   2    6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5)
   3    6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5)
   4    6           host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32)
   5    6           host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5)
   6    6           host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5)
   7    6               suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32)
   8    6               suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5)
   9    6               suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5)

The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName)
and the sAMAccountName value.  The UPN will be added as well if the machine has
one. This fixes 'kinit -k'.

Tested keytab using mod_auth_krb and MIT's telnet.  ads_verify_ticket()
continues to work with RC4-HMAC and DES keys.
(This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2007-10-10 11:19:15 -05:00
Jeremy Allison
fbdcf2663b r16945: Sync trunk -> 3.0 for 3.0.24 code. Still need
to do the upper layer directories but this is what
everyone is waiting for....

Jeremy.
(This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8)
2007-10-10 11:19:14 -05:00
Günther Deschner
10252f270e r16453: Fix another memleak.
Guenther
(This used to be commit 49fb1a3ebc44602302c347195752891bf28c7037)
2007-10-10 11:18:55 -05:00
Jeremy Allison
300acb99ad r16284: Start fixing up gcc4 -O6 warnings on an x86_64 box. size_t != unsigned
int
in a format string.
Jeremy.
(This used to be commit face01ef01e1a3c96eae17c56cadf01020d4cb46)
2007-10-10 11:17:31 -05:00
Günther Deschner
e942ca4e0a r16261: Smaller fixes for net ads password.
Guenther
(This used to be commit 689ae22c80a890278610d9ada1eb4fa5e37bd5ce)
2007-10-10 11:17:28 -05:00