IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
- removed the struct dcerpc_request_state as all the state
information is already available on the dcerpc_pipe structure, so just
use that
- added a single dcerpc_recv_data() handler for receiving packets
from the transport layer. This then does the initial decoding of
the dcerpc packet, and then looks at the packet type in order to
work out who to dispatch it to. This should allow in-flight async
rpc requests to still work while a new bind or alter context is
happening
- ensure that if the transport indicates the connection is dead that
any in-flight bind or alter context requests are given an error
- removed full_request_private and instead use separate bind_private
and alter_private pointers
- added a few comments for some bits I found hard to understand
(This used to be commit 938e372bff)
ncacn_ip_tcp/ncalrpc. The problem was that svn revision 11809 removed
the logic that forced the CONNECT auth type for authenticated binds
which don't have an explicit SIGN or SEAL flag set.
(This used to be commit e7a1f11e8b)
This also removes dcerpc_bind_auth_password, the only user of
dcerpc_bind_auth. And this was not only passwords anyway.
Andrew Bartlett, as usual: Please take a close look.
Thanks,
Volker
(This used to be commit 2ff2dae3d0)
Tridge et al, please take a close look at this. It survives my basic rpc-login
test as well as rpc-lsa, but this is critical I think.
Volker
(This used to be commit bf1a55f44c)
- add an idtree_limit to limit the max VUID we give the clients
it's UINT16_MAX (0xffff) for the SMB protocol
- add auth_time to the smbsrv_session statistics
- use the session_info as marker for finished and non-finished
session setups
metze
(This used to be commit 7eb10048b2)
them
- add a idtree_limit to the tcons substructure of smbsrv_connection
this controls what the highest TID is we give away to the client
it's UINT16_MAX (0xFFFF) for the SMB protocol
metze
(This used to be commit f3bf5a2c09)
allowing it to specify the initial read size (thus preventing
over-reading) and to stop the recv process when needed. This is used
by the dcerpc socket code, which relies on not getting packets when it
isn't ready for them
(This used to be commit f869fd674e)
not there (it's not yet on *any* call... :-)), the rpc client strictly
sequences calls to an rpc pipe. Might need some more work on the exact
sequencing semantics when a pipe with both sync and async calls is actually
deployed, but I want it in for winbind simplification.
Volker
(This used to be commit b8f324e4f0)
work again. The automatic value() is fine for the length, but cannot
be used for the size as the size is not the number of bytes being
sent, but the number of bytes that the server is allowed to use in the
reply
(This used to be commit 46e91f269c)
IDL and testsuites. The server-side of this remains a stub, we should
probably be doing ldb searches for the server reference record.
Andrew Bartlett
(This used to be commit 0141ed309a)
- Adds -rpath bin/ so you don't have to install Samba in order to use compiled binaries.
- Writes out pkg-config files when building shared libs
- Supports automatic fallback to MERGEDOBJ (which is the default) or
OBJ_LIST (if ld -r is not supported)
Building with shared libs reduces the size of the Samba binaries from
197 Mb to 60 Mb (including libraries) on my system (GCC4, with debugging).
To build with shared libraries support enabled, run:
LIBRARY_OUTPUT_TYPE=SHARED_LIBRARY ./config.status
init functions don't get called correctly yet when using shared libs, so
you won't be able to actually run anything with success :-)
Once init functions are done, I'll look at support for loading shared
modules once again.
Based on a patch by Peter Novodvorsky (nidd on IRC).
(This used to be commit 0b54405685)
files working. It doesn't quite work though. (-:
This patch also allows a struct.field format to be used in an IMPORT
statement instead of a type name.
Jelmer, what do you think?
(This used to be commit d770f85347)
- print "supplementalCredentials" also when --option="dssync:print_pwd_blobs=yes"
is used
abartlet: this field may contain the krb5 keys...
metze
(This used to be commit 26c69348ca)
Support conformant [string] arrays
Eliminate utf8string
This breaks xattr binary compatibility with previous versions - is that a
problem?
(This used to be commit 7596c708ba)
add struct nbt_peer_socket and use it instead of passing const char *addr, uint16 port everyhwere
(tridge: can you review this please, (make test works)
metze
(This used to be commit a599d7a4ae)
this is the compression algorithm used by w2k3 for DsGetNCChanges().
This algorithm isn't known yet, but it seems to be some sort of Lempel-Ziv
algorithm.
metze
(This used to be commit 694252b6e0)
problem was that the return string was declared as:
[out] astring dcname
which means "this is a non-NULL string". The server code sometimes
returned NULL however (on getdc lookup failure), which caused the NDR
marshalling code to crash. When you declare a non-pointer return value
you are promising that the value can never be NULL.
The trivial fix is to use:
[out] astring *dcname
which leaves the API alone, but includes a pointer in the wire format,
which in turn means it is valid to send a NULL string as a response.
(This used to be commit e39bac6196)
within a callback on the pipe. This should fix a problem volker
encountered with winbind. The fix invoolves making the recv_data
handler free the memory for a packet, instead of having the transport
layer free it after calling recv_data. When the transport layer freed
it, it had no way of knowing if the callback had shutdown the pipe, so
it had no way of knowing if it could safely use the pointer.
Also changed the pipe shutdown hook for the smb transport to use an
async SMB close. This ensures that when you shutdown the pipe, you
don't block waiting for the server to ack the close of the pipe fnum.
(This used to be commit c87d7f580e)
Tridge, if you have time, you might want to look at the segfault I was still
seeing. Now I store the handle to the netlogon pipe in the global winbind
state and free it on the next entry into check_machacc. The problem seems to
be that talloc_free()ing a pipe struct from within a callback function on that
pipe is not possible. I think I can live with that, but it has been not really
obvious. To reproduce the segfault you might want to look at putting a
talloc_free(state->getcreds->out.netlogon) into
wbsrv_samba3_check_machacc_receive_creds. This is called from a dcerpc
callback function.
In particular if the check failed it would be nice if I could delete the pipe
directly and not post a different event to some winbind queue.
I tried to delete the pipe from a timed event triggered immediately, but this
also fails because the inner loop seems to hit the same event again, calling
it twice.
Volker
(This used to be commit 5436d77648)
- the unknown flag 0x10 seems to mean that this name was localy registered on this
currently asked server, that flag is not present in replica records
metze
(This used to be commit ba3685c41d)
make wrepl_nbt_name a scalar type that is another
wire representation of struct nbt_name
give wrepl_name->flags a meaning
metze
(This used to be commit 5fa13d6c2b)
domain and gets the DC's name via a mailslot call.
Metze, I renamed wbsrv_queue_reply to wbsrv_send_reply in accordance with
irpc_send_reply. Having _queue_ here and _send_ there is a bit confusing. And
as everything is async anyway, the semantics should not be too much of a
problem.
Volker
(This used to be commit 4637964b19)
Generate NDR mashalling code for all idl files (why isn't this automatically by the scanner when it finds librpc/gen_ndr/{misc,dcerpc,orpc}.h in includes.h?)
(This used to be commit 01eb22b9da)
that a given set of (working) POSIX functions are available (without
prefixes to their names, etc). See lib/replace/README for a list.
Functions that behave different from their POSIX specification
(such as sys_select, sys_read, etc) have kept the sys_ prefix.
(This used to be commit 29919a7105)
I still have issues with Win2k3 SP1, and Samba4 doesn't pass it's own
test for the moment, but I'm working on these issues :-)
This required a change to the credentials API, so that the special
case for NTLM logins using a principal was indeed handled as a
special, not general case.
Also don't set the realm from a ccache, as then it overrides --option=realm=.
Andrew Bartlett
(This used to be commit 194e8f07c0)
at every single build. Run 'scons configure=1' or delete sconf.cache
to force checks to be re-run.
Jelmer, I think this stuff is cached in the .sconf_cache directory but
the message is still displayed and it looks like it caches the compiled
test object file not the actual result of the test.
(This used to be commit 9d001dc083)
field, instead put a zero address. Note that zero is correct (ie. we
shouldn't do the lookup) as in the client we want to send a zero for
the server to fill in. When we make this call from the server we fill
in a real IP.
(This used to be commit e54c8b5658)
data to be signed/sealed. We can use this to split the data from the
signature portion of the resultant wrapped packet.
This required merging the gsskrb5_wrap_size patch from
lorikeet-heimdal, and fixes AES encrption issues on DCE/RPC (we no
longer use a static 45 byte value).
This fixes one of the krb5 issues in my list.
Andrew Bartlett
(This used to be commit e4f2afc343)
ndr_pull_data_blob() doesn't work correct. so make them exclute each other.
jelmer, tridge: does that look correct? it fixes a problem, abartlet had
with krb5pac.idl, where the align flags are inherited from the parent, and we want to get the
[flag(NDR_REMAINING)] DATA_BLOB signature;
metze
(This used to be commit b9ea3e8f9f)
where the idl was something like this:
uint32 size;
[size_is(size+1)] wchar_t *string;
we always need a pair of NDR_PULL_NEEDED_BYTES() and ndr_pull_advance(),
with the same size passed in.
metze
(This used to be commit 8eb75bd5ac)
Kerberos CCACHE into the system.
This again allows the use of the system ccache when no username is
specified, and brings more code in common between gensec_krb5 and
gensec_gssapi.
It also has a side-effect that may (or may not) be expected: If there
is a ccache, even if it is not used (perhaps the remote server didn't
want kerberos), it will change the default username.
Andrew Bartlett
(This used to be commit 6202267f6e)
- fixed winreg_GetKeySecurity() to use a sec_info field correctly
- simplied the winreg torture code, removing the separate opens for
each hive
- added torture cleanup code in winreg test
- added 'create with security descriptor' in the winreg torture test
(This used to be commit f20695decd)
descriptor. To keep it simple I just use normal IDL buffers for now,
avoiding the complex methods metze used in spoolss. We might change
that later
Also added decoding of the security_descriptor in
winreg_GetKeySecurity() in smbtorture
(This used to be commit 439f34a962)
tree with DsGeNCChanges(), this is possible as administrator
without having a DC account joined to the domain
metze
(This used to be commit e6f92444d2)
as it isn't needed
- parse some more DsAddEntry() errors
- add some more attid constands so that all attribute that are needed
for a DsAddEntry in the DC Domain Join are mapped
- add value() for __ndr_size, to more attribute container, so that the caller
doesn't need to fill them in, that was the reason for getting an NDR_FAULT
metze
(This used to be commit a9a1a6f861)
requirements, and for better error reporting.
In particular, the composite session setup (extended security/SPNEGO)
code now returns errors, rather than NT_STATUS_NO_MEMORY. This is
seen particularly when GENSEC fails to start.
The tighter interface rules apply to NTLMSSP, which must be called
exactly the right number of times. This is to match some of our other
less-tested modules, where adding flexablity is harder. (and this is
security code, so let's just get it right). As such, the DCE/RPC and
LDAP clients have been updated.
Andrew Bartlett
(This used to be commit 134550cf75)
- with this it's also possible to talloc_free() the ndr_pull structure
and talloc_steal(ndr->current_mem_ctx); to fetch the whole data of the hierachical tree
- if the toplevel struct is a valid talloc pointer it's also possible to use
NDR_PULL_SET_MEM_CTX(ndr, mem_ctx); to the the toplevel pointer with the struct pointer
(NOTE: no callers are using this yet, but they shortly will)
metze
(This used to be commit 1a2b836958)
this copes with 2 more situations:
1) where the array is NULL, which would previously be coped with by a
if (ptr) check, but now in the deferred array bounds checking needs
to look at the array variable in the ndr code. Not nice.
2) nest the array checking along with the SCALARS vs BUFFERS checks, ensuring we don't
do array bounds checking for a buffer when in scalars only mode
(This used to be commit ad1b9867a5)
calls. The previous IDL was just a workaround for the limitations of
our older rpc infrastructure. Now that Jelmer has added much improved
string support using the charset keyword we can correctly implemenent
the unusual winreg string buffers.
Jelmer, note the little comment I put on winreg_StringBuf() about why
I couldn't use [value()] for the length field.
This also fixes EnumKey() and EnumValue() to use NTTIME fields for the
last_changed_time. I don't know why we were using a pair of uint32's,
as it is just a NTTIME.
(This used to be commit 8354b01612)
the ndr_pull/push/print functions for it in the ntacl-lsm module
- fix compiler warnings in the ldap_encode_ndr_* code
metze
(This used to be commit 83d65d0d7e)
- map the result code from rpc calls into the ejs objects
- treat winreg_String like lsa_String, hiding the length elements
(This used to be commit 2f6311c9a3)
- Convert to use lsa_String instead of eventlog_String.
- Copy across some constants.
- Implement idl and testcase for ClearEventLog() function
(This used to be commit 352b21af3f)
Values that are deferred but don't contain deferred data don't
need NDR_BUFFERS
Parse::Pidl::Samba::NDR::Parser:
Only use manually written array access functions when the array
functions are faster then the autogenerated ones. Makes ndr_basic.c
a bit shorter.
(This used to be commit cad40815dc)
- Fixes annoying array-of-pointers bug in pidl.
- No longer "inherit" alignment thru subcontexts
- Use "Image Object" as example DCOM object, rather then the "My Computer" object, which is built-in and can't be accessed remotely as far as I can see
(This used to be commit bd706d4964)
S390. This is an attempt to avoid the panic we're seeing in the
automatic builds.
The main fixes are:
- assumptions that sizeof(size_t) == sizeof(int), mostly in printf formats
- use of NULL format statements to perform dn searches.
- assumption that sizeof() returns an int
(This used to be commit a58ea6b385)
functions we don't need. That is a lot of functions, as ejs is only
client side, so it only needs push functions for [out] vars, and pull
functions for [in] vars
added irpc and srvsvc IDL to list of available pipes.
(This used to be commit c7a9dbe70a)
of null credentials to use if cmdline_credentials is not setup
- hide the length and size elements of a lsa_String from js scripts,
so you can use a lsa_String just as an ordinary string without
knowing its a structure. We won't do this with all structures, just
a few core ones that are used often enough to warrant it.
- make sure returned ldb arrays have a length property
(This used to be commit 12d2092dd8)
now push/pull a sample PAC, and still have the same byte buffer.
(Metze set up the string code, and probably already has a similar
patch).
Unfortunetly win2k3 still doesn't like what we provide, but every step helps.
Also use data_blob_const() when we are just wrapping data for API
reasons.
Andrew Bartlett
(This used to be commit e7c8076fc1)
(I have included the krbtgt key from my test network).
It turns out the krbtgt signature is over the 16 (or whatever,
enc-type dependent) bytes of the signature, not the entire structure.
Also do not even try to use Kerberos or GSSAPI on an IP address, it
will only fail.
Andrew Bartlett
(This used to be commit 3b9558e82f)
- added auto generation of a header with prototypes for public ejs functions
- make public functions non-static
- fixed allocation of fixed sized arrays
- added 'noejs' flag indicating that a typedef will be handled manually by ejs
- added manual functions for sid and GUID, so they show up as nice
strings in ejs scripts
This allows ejs to bring in samr, security, lsa and misc IDL functions
(This used to be commit a8cb2dbdcc)
- we now use an ndr_token_list, for the nbt string label pointer offsets
this avoids to scan the whole buffer
- we need to check for already send string on a per component basis
not only for the fullname
e.g.
w2k3 response this in the CLDAP netlogon replies
forest: w2k3.vmnet1.vm.base
dns_name: sub1.
pdc_dns_name: w2k3-104.
and this will be interpreted like
forest: w2k3.vmnet1.vm.base
dns_name: sub1.w2k3.vmnet1.vm.base
pdc_dns_name: w2k3-104.w2k3.vmnet1.vm.base
metze
(This used to be commit d18303a0e2)
- allow comparison function to be passed for ndr_token_retrive_cmp_fn(),
this is for matching the keys, if NULL is passed, the old behavior
tok->key == key is used
metze
(This used to be commit 019f3dc767)
actually a uint16 * without the [string] attribute, a la the the
system_name argument to samr_Connect().
Initialising the pointer to NULL is sufficient and we still pass the
RPC-WINREG test against win2k3.
(This used to be commit 407d962dac)
- add a new 'sptr' (simple-full) pointer type to simulate what we need to support pipes
like epmapper and mgmt that uses 'ptr' full pointer in their spec
- I runned make test and test_w2k3.sh with this, all fine
does we have any other pipe using 'unique' pointer where we need 'ptr'?
btw: jelmer, what does 'ignore' pointers do? they are allowed in pidl but not implemented!
metze
(This used to be commit d19068bfb2)
this is ifdef'ed out currently because we use 'unique' pointers in the epmapper pipe,
where we should use 'ptr' full pointers.
metze
(This used to be commit ccc9d9267a)
- move to handmodified pull/push code for PAC_BUFFER
to get the _ndr_size field and the subcontext size right
- after looking closely to the sample w2k3 PAC in our torture test (and some more in my archive)
I found out that the first uint32 before the netr_SamInfo3 was also a pointer,
(and we passed a NULL pointer there before, so I think that was the reason why the windows clients doesn't want our PAC)
w2k3 uses this for unique pointers:
ptr = ndr->ptr_count * 4;
ptr |= 0x00020000;
ndr->ptr_count;
- do one more pull/push round with the sample PAC
metze
(This used to be commit 0eee179415)
much closer.
This changes PIDL to allow a subcontext to have a pad8 flag, saying to
pad behind to an 8 byte boundary. This is the only way I can explain
the 4 trainling zeros in the signature struct.
Far more importantly, the PAC code is now under self-test, both in
creating/parsing our own PAC, but also a PAC from my win2k3 server.
This required changing auth_anonymous, because I wanted to reuse the
anonymous 'server_info' generation code.
I'm still having trouble with PIDL, particulary as surrounds value(),
but I'll follow up on the list.
Andrew Bartlett
(This used to be commit 50a54bf4e9)
the ejs_echo.c code is the stuff that needs to be auto-generated by
pidl. It only does echo_AddOne so far.
We also need a table for registering these calls. The code is
hard-wired for echo_AddOne for now.
(This used to be commit b1ea58ddc4)
We now generate the PAC, and can verifiy both our own PAC and the PAC
from Win2k3.
This commit adds the PAC generation code, spits out the code to get
the information we need from the NETLOGON server back into a auth/
helper function, and adds a number of glue functions.
In the process of building the PAC generation code, some hints in the
Microsoft PAC specification shed light on other parts of the code, and
the updates to samr.idl and netlogon.idl come from those hints.
Also in this commit:
The Heimdal build package has been split up, so as to only link the
KDC with smbd, not the client utils.
To enable the PAC to be veified with gensec_krb5 (which isn't quite
dead yet), the keyblock has been passed back to the calling layer.
Andrew Bartlett
(This used to be commit e2015671c2)
in the ncacn_np trnaport
it's now supported to use the ip address in smbtorture for ncacn_np tests
that use dcerpc_server_name(),
and we can now pass the dns host name in the tree connect when we have the dns name
on the smbtorture command line
metze
(This used to be commit e29edbc7e6)
they slightly changed the semantics of value() in pidl, which broke
a optimisation hack in some of our IDL files.
I've changed the idl files to remove the hack for now. Sometime we
need to find a better way to handle these :-)
(This used to be commit 765f75ea63)
structure in ndr_push_*() and ndr_print_*(). The push and print
functions really should not modify the structure.
metze, to make this work I had to change your spoolss hand
marshaller. Can you please check it is OK? I think that the IN and OUT
sides of that function are not ever called on the same structure, so I
think that attempt at remembering the value by assigning to
r->in._offered was not doing anything anyway, but please correct me if
I have misunderstood it.
If you really do need to remember something on those structures I'd
suggest the ndr_token_store() and ndr_token_retrieve() functions,
which are used by pidl for just this sort of thing.
(This used to be commit eee528be97)
does finally answer the request and it is on the smb transport that we
don't die in the callback code as the rpc request state is gone.
(This used to be commit d47477c5c3)
- fix some typos in EnumPrintServerForms()/GetPrintServerForms()
- add AddPrintServerForms()/SetPrintServerForms() and DeletePrintServerForms
metze
(This used to be commit 7390638842)
- this is an abstraction layer for print services,
like out NTVFS subsystem for file services
- all protocol specific details are still in rpc_server/spoolss/
- like the stupid in and out Buffer handling
- checking of the r->in.server_name
- ...
- this subsystem can have multiple implementation
selected by the "ntptr providor" global-section parameter
- I currently added a "simple_ldb" backend,
that stores Printers, Forms, Ports, Monitors, ...
in the spoolss.db, and does no real printing
this backend is basicly for testing, how the spoolss protocol
works
- the interface is just a prototype and will be changed a bit
the next days or weeks, till the simple_ldb backend can
handle all calls that are used by normal w2k3/xp clients
- I'll also make the api async, as the ntvfs api
this will make things like the RemoteFindFirstPrinterChangeNotifyEx(),
that opens a connection back to the client, easier to implement,
as we should not block the whole smbd for that
- the idea is to later implement a "unix" backend
that works like the current samba3 code
- and maybe some embedded print server vendors can write there own
backend that can directly talk to a printer without having cups or something like this
- the default settings are (it currently makes no sense to change them :-):
ntptr providor = simple_ldb
spoolss database = $private_dir/spoolss.db
metze
(This used to be commit 455b5536d4)
event_context for the socket_connect() call, so that when things that
use dcerpc are running alongside anything else it doesn't block the
whole process during a connect.
Then of course I needed to change any code that created a dcerpc
connection (such as the auth code) to also take an event context, and
anything that called that and so on .... thus the size of the patch.
There were 3 places where I punted:
- abartlet wanted me to add a gensec_set_event_context() call
instead of adding it to the gensec init calls. Andrew, my
apologies for not doing this. I didn't do it as adding a new
parameter allowed me to catch all the callers with the
compiler. Now that its done, we could go back and use
gensec_set_event_context()
- the ejs code calls auth initialisation, which means it should pass
in the event context from the web server. I punted on that. Needs fixing.
- I used a NULL event context in dcom_get_pipe(). This is equivalent
to what we did already, but should be fixed to use a callers event
context. Jelmer, can you think of a clean way to do that?
I also cleaned up a couple of things:
- libnet_context_destroy() makes no sense. I removed it.
- removed some unused vars in various places
(This used to be commit 3a3025485b)
- add EnumMonitors() server code and return "Standard TCP/IP Port"
- add parsing for opening Ports and Monitors with OpenPrinterEx()
metze
(This used to be commit 08e6de37bc)
- use the same names as etherel (offered,needed) for the buffer sizes
(and they are really independently used)
metze
(This used to be commit f5532a5b74)
Add notes on mailslots
Add TODO list for pidl, including some plans on switching
over to using [string] attributes for pidl.
(This used to be commit fca195ce07)
management system I proposed on samba-technical a couple of days
ago. Essentially it is a very lightweight way for any code in Samba to
make IDL based rpc calls to anywhere else in the code, without the
client or server having to go to the trouble of setting up a full rpc
service.
It can be used with any of our existing IDL, but I expect it will
mostly be used for a new set of Samba specific management calls.
The LOCAL-IRPC torture test demonstrates how it can be used by calling
the echo_AddOne() call over this transport.
(This used to be commit 3d589a0995)
(maybe we could add them to elements latter...)
with this property all relative pointers from inside the struct or union
are relative to the struct/union start
metze
(This used to be commit c0dd18326c)
