1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-27 14:04:05 +03:00

1871 Commits

Author SHA1 Message Date
Nadezhda Ivanova
1fc47e1228 Version 1.0 of the directory service acls module.
At this point, support for checks on LDAP add, delete, rename and modify.
Old kludge_acl is still there to handle the searches.
This module is synchronous as the async version was impossible to debug,
will be converted to async after some user testing.
2009-11-05 17:34:12 +02:00
Nadezhda Ivanova
25d9cc8383 Fixed some missing flags and bugs in the security creation.
Also, added some logging. It needs improvement, possibly ability to
turn in on and off via configuration file.
2009-11-03 13:33:30 +02:00
Nadezhda Ivanova
0abfc90ac9 Fixed a bug in object specific access checks. 2009-11-03 12:43:51 +02:00
Matthias Dieter Wallnöfer
0defcfb4f7 s4:libcli/security/access_check - Add "const" in front of "type"
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-10-22 10:02:38 +11:00
Andrew Tridgell
c3b09d18a8 s4-acl: SEC_FLAG_MAXIMUM_ALLOWED doesn't auto-apply privilege access masks 2009-10-17 13:01:03 +11:00
Andrew Tridgell
9da4af062b s4-security: honor more of the privilege access bits 2009-10-17 13:01:03 +11:00
Andrew Tridgell
4a4f420481 s4-libcli: fixed structure element bug in ntcreatexreadx
This one didn't matter until the root_fid changed the alignment of the
two structures.
2009-10-15 20:03:00 +11:00
Andrew Tridgell
3c028ff88b s4-smb: declare root_fid as a file handle
In order to implement root_fid in the s4 SMB server we need to declare
it as a handle type, just as for other fnum values in SMB. This
required some extensive (but simple) changes in many bits of code.
2009-10-15 20:03:00 +11:00
Matthias Dieter Wallnöfer
e9686985cb s4: Changes the old occurences of "lp_realm" in "lp_dnsdomain" where needed
For KERBEROS applications the realm should be upcase (function "lp_realm") but
for DNS ones it should be used lowcase (function "lp_dnsdomain"). This patch
implements the use of both in the right way.
2009-10-14 10:50:43 +02:00
Matthias Dieter Wallnöfer
44df2488e3 s4: fix various warnings (not "const" related ones) 2009-10-02 15:33:48 +02:00
Aravind Srinivasan
b529a1e987 s4/torture: Add two new SMB RAW-OPEN tests
* Add chained NTCREATEX_READX test which first tries to open/read
  a non-existant file failing on the open, then attempts the same
  operation on a file that does exist, opening and reading
  successfully.

* Add test for open_dispositions on directories.
2009-10-01 17:14:53 -07:00
Steven Danneman
1160d68062 s4/torture: Ported SMB oplock torture tests to SMB2
I've ported all applicable SMB oplock torture tests to SMB2, giving us
a good base for SMB2 oplock testing.

There are several differences between oplocks in SMB and SMB2, mostly
because of differences in W2K3 and W2K8.  The existing SMB oplock
tests all pass against W2K3, but several fail against W2K8.  These
same tests were failing in SMB2, util I reworked them.

BATCH19, BATCH20: In W2K3/SMB a setfileinfo - rename command wouldn't
cause a sharing violation or break an existing oplock.  It appears that
in W2K8/SMB2 a sharing violation is raised.

BATCH22: In W2K3/SMB when a second opener was waiting the full timeout
of an oplock break, it would receive NT_STATUS_SHARING_VIOLATION after
about 35 seconds.  This bug has been fixed in W2K8/SMB2 and instead
the second opener succeeds.

LEVELII500: Added 1 new test checking that the server returns a proper
error code when a client improperly replies to a levelII to none break
notification.

STREAM1: W2K8 now grants oplocks on alternate data streams.
2009-10-01 14:59:52 -07:00
Andrew Tridgell
5acd8bc01b s4-acl: fixed SD creation
Thanks for Nadya and Metze for this. The SDs were being created with
invalid fields (noticed by w2k8-r2 client when joining our domain)
2009-09-28 10:21:33 +10:00
Nadezhda Ivanova
df0d629f37 Fixed a dereferenced null pointer. 2009-09-24 18:54:14 -07:00
Nadezhda Ivanova
10c6f3f71a Initial Implementation of the DS objects access checks.
Currently disabled. The search will be greatly modified,
also the object tree stuff will be simplified.
2009-09-21 17:27:50 -07:00
Nadezhda Ivanova
6283f2caaa Initial implementation of security descriptor creation in DS
TODO's:
ACE sorting and clarifying the inheritance of object specific ace's.
2009-09-20 15:16:17 -07:00
Andrew Tridgell
92786aebf1 s4-resolve: fixed a crash bug on timeout
We were creating the name resolution context as a child of lp_ctx,
which meant when we gave up on a connection the timer on name
resolution kept running, and when it timed out the callback crashed as
the socket was already removed.
2009-09-19 08:23:03 -07:00
Matthieu Patou
aadf5e3910 pyldb: Don't segfault when invalid type is specified to as_sddl and from_sddl.
Fix bug #6723
2009-09-17 19:36:32 +02:00
Nadezhda Ivanova
d70e171719 Owner and group defaulting.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-16 07:52:05 -07:00
Andrew Tridgell
7ded0741d9 s4-security: added a new security level SECURITY_DOMAIN_CONTROLLER
This will be used as a simple way to lock down DRS replication to
administrators and domain controllers
2009-09-15 19:25:45 -07:00
Andrew Bartlett
668470c992 libcli:nbt make the lmhosts parsing code and dependicies common
This starts the process to have Samba4 use lmhosts.

Andrew Bartlett
2009-09-15 07:42:54 -07:00
Andrew Tridgell
294e7cd566 s4/libcli: when we get a DNS lookup failure show the name
When tracking down complex connection problems its useful knowing what
name lookups failed.
2009-09-11 14:07:18 +10:00
Andrew Bartlett
7496095c1b s4:libcli/ldap Explain why we set a hostname for ldapi:// connections
It is a pretty odd thing to do, and it's only because of the
restrictions of DIGEST-MD5 in Cyrus SASL that we do it.

Andrew Bartlett
2009-08-17 11:08:42 +10:00
Stefan Metzmacher
1d75a6e224 libcli/smb: move smb2_create_blob code to libcli/smb/
I want to use this in source3/smbd/

metze
2009-08-12 19:22:06 +02:00
Stefan Metzmacher
1df883aa39 libcli: move some common SMB and SMB2 stuff into libcli/smb/
This will hold code that's shared between source3 and source4.

metze
2009-08-12 18:28:32 +02:00
Stefan Metzmacher
aef96af916 s4:libcli/smb2: move SMB2_GETINFO_* flags into smb2_constants.h
metze
2009-08-07 14:56:23 +02:00
Stefan Metzmacher
acbb9da530 s4:libcli/smb2: remove unused and redundant SMB2 security flags
metze
2009-08-07 14:56:23 +02:00
Stefan Metzmacher
c2c4d489b6 s4:libcli: move SMB2 Find constants to smb2_constants.h
metze
2009-08-07 14:56:22 +02:00
Stefan Metzmacher
21d6f276fb s4:libcli/raw: we don't need to include "smb.h" explicit
metze
2009-08-07 14:56:22 +02:00
Stefan Metzmacher
93ec5d27e4 s4:libcli/raw: also include smb2_constants.h into interfaces.h
metze
2009-08-07 14:56:21 +02:00
Andrew Tridgell
e2d4ae1510 fixed several places that unnecessarily take a reference to the event context
These references were triggering the ambiguous talloc_free errors from
the recent talloc changes when the server is run using the 'standard'
process model instead of the 'single' process model. I am aiming to
move the build farm to use the 'standard' process model soon, as part
of an effort to make our test environment better match the real
deployment of Samba4.

The references are not needed as the way that the event context is
used is as the 'top parent', so when the event context is freed then
all of the structures that were taking a reference to the event
context were actually freed as well, thus making the references
redundent.
2009-08-07 17:24:48 +10:00
Andrew Tridgell
ddd13c6816 handle large directories in smb2_deltree() 2009-08-05 15:05:13 +10:00
Matthias Dieter Wallnöfer
a08bffa358 Adds new error codes (needed for enhancing error messages for SAMBA 4 AD LDAP server) 2009-07-31 17:40:46 +02:00
Stefan Metzmacher
a3bcbd1775 s4:libcli/ldap: the tls code steals the original socket on its own now
metze
2009-07-31 14:42:05 +02:00
Stefan Metzmacher
c4274e3480 s4:libcli/ldap: add support for new Recycle Bin Feature LDAP Controls
LDAP_SERVER_SHOW_RECYCLED_OID         1.2.840.113556.1.4.2064
LDAP_SERVER_SHOW_DEACTIVATED_LINK_OID 1.2.840.113556.1.4.2065

metze
2009-07-23 18:04:31 +02:00
Matthias Dieter Wallnöfer
295c3724a3 Fix typo 2009-07-19 16:00:14 +02:00
Stefan Metzmacher
da737f2447 s4:libcli/smb2: add smb2_transport_credits_set_charge() to change the CreditsCharge value for the next request
metze
2009-07-15 10:57:32 +02:00
Stefan Metzmacher
c281638bc4 s4:libcli: move SMB2 lock flags to smb2_constants.h
metze
2009-07-02 22:25:49 +02:00
Andrew Tridgell
ddce3b5ac8 two more NT status codes that we get on DRS with w2k8-R2 2009-06-12 12:23:46 +10:00
Andrew Bartlett
9b261c008a s4:heimdal: import lorikeet-heimdal-200906080040 (commit 904d0124b46eed7a8ad6e5b73e892ff34b6865ba)
Also including the supporting changes required to pass make test

A number of heimdal functions and constants have changed since we last
imported a tree (for the better, but inconvenient for us).

Andrew Bartlett
2009-06-12 07:45:48 +10:00
Andrew Tridgell
a5003de56b fixed the encoding/decoding of the reverse attribute for server side sort 2009-06-10 11:45:53 +10:00
Sam Liddicott
ebf5523b6e s4: smbcli_transport_send hit the socket right away if possible
[Metze; "make test" on git master outputs exactly the same test summary
with our without this patch (apart from the "using seed" lines)]

If the transport socket is writable, then push the queue along
rather than wait until the caller returns back to the tevent loop.

This strategy keeps the sockets piping hot, and is particularly good
for cases where reading requests from one socket causes lots of
writes on another socket, or where lots of writes are made in a batch.

It doesn't matter if the socket is not writeable yet, packet_queue_run
will return quite cheaply in such a case.

Signed-off-by: Sam Liddicott <sam@liddicott.com>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2009-06-09 18:51:31 +02:00
Stefan Metzmacher
d153430e32 s4:libcli/smb2: add smb2_transport_credits_ask_num()
metze
2009-06-09 16:49:30 +02:00
Stefan Metzmacher
5b99fa5c4f s4:libcli/smb2: only add the 1 byte dynamic buffer padding for non compounded requests
metze
2009-06-09 16:49:30 +02:00
Stefan Metzmacher
d777879aaa s4:libcli/smb2: add support sending compounded requests
metze
2009-06-09 16:49:29 +02:00
Stefan Metzmacher
81275c84d3 s4:libcli/smb2: prepare SMB2 signing code for compounded requests
metze
2009-06-09 16:49:29 +02:00
Kai Blin
57ea909b32 libwbclient: Add async call framework. 2009-05-30 09:17:37 +02:00
Andrew Kroeger
554923ce1b s4: Add additional 2-letter SID/RID mappings.
Information from http://msdn.microsoft.com/en-us/library/aa379602(VS.85).aspx
2009-05-29 12:37:26 +10:00
Stefan Metzmacher
53df343644 s4:libcli/smb2: remove old dialect revision constants
metze
2009-05-26 09:50:50 +02:00
Stefan Metzmacher
01b05df766 s4:libcli/smb2: use new SMB2_DIVELECT_REVISION constants
Also send them in the order a windows client would
send them (the lowest first).

metze
2009-05-26 09:50:43 +02:00