1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

3245 Commits

Author SHA1 Message Date
Stefan Metzmacher
e0ab14f52a s4:dsdb/acl_read: make sure confidential attributes require CONTROL_ACCESS (bug #8620)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Nov 12 01:25:21 CET 2012 on sn-devel-104
2012-11-12 01:25:19 +01:00
Stefan Metzmacher
21dfaefda0 s4:dsdb/acl_read: fix whitespace formatting errors
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-11-12 09:42:36 +11:00
Stefan Metzmacher
f6fa7243f8 s4:dsdb/acl: only give administrators access to attributes marked as confidential (bug #8620)
The full fix will to implement and use the code of the read_acl module,
but this is better than nothing for now.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-11-12 09:42:31 +11:00
Stefan Metzmacher
ed8b27516b s4:dsdb/acl: reorganize the logic flow in the password filtering checks
This avoids some nesting levels and does early returns.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-11-12 09:42:26 +11:00
Stefan Metzmacher
54ad5c70e3 s4:dsdb/acl: fix search filter cleanup for password attributes
We need to this when we're *not* system.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-11-12 09:42:21 +11:00
Jelmer Vernooij
6073d214aa ldb_secrets_tdb_sync: Add dependency on gssapi.
This is required when building with the system heimdal, as
gssapi/gssapi_spnego.h is included.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Nov  6 05:12:28 CET 2012 on sn-devel-104
2012-11-06 05:12:28 +01:00
Jelmer Vernooij
ed6330094b dsdb: Rename _res argument to _result.
Newer versions of heimdal include a macro that is unfortunately named
'_res'. This change prevents the clash.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-11-06 13:33:09 +11:00
Volker Lendecke
26faa8fe3a dsdb: Simplify DsCrackNameOneFilter a bit
For me "else" branches clutter my flow reading code. If we do a hard
return at the end of an "if" branch, "else" is not required.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-11-06 08:27:44 +11:00
Andrew Bartlett
9dbb64563c dsdb-cracknames: Return DRSUAPI_DS_NAME_STATUS_NO_MAPPING when there is no SID
If there is no SID for an object being mapped, then there is no NT4 name.

We need to return DRSUAPI_DS_NAME_STATUS_NO_MAPPING rather than
error out with anything other than WERR_OK as the return value.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Oct 25 04:43:25 CEST 2012 on sn-devel-104
2012-10-25 04:43:25 +02:00
Andrew Bartlett
8697acd4b0 dsdb-cracknames: Always use talloc_zero()
Otherwise, we will return un-initialised values to the caller, which will
attempt to push them onto the wire.

Found by Greg Dickie <greg@justaguy.ca>.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Oct 24 05:12:04 CEST 2012 on sn-devel-104
2012-10-24 05:12:04 +02:00
Matthieu Patou
193b15efea s4-repl: make dreplsrv_partition_find_for_nc return BAD_NC only 2012-10-07 21:51:03 -07:00
Matthieu Patou
97f0b8d9c9 drs-replica-info: level_not_supported is wrong when we do support (partialy the level) 2012-10-07 21:51:02 -07:00
Matthieu Patou
f98abc7baa drs-crackname: if there is no sid do not return the domain 2012-10-07 21:51:01 -07:00
Matthieu Patou
9269870a70 Implement the LIST_INFO_FOR_SERVER input format 2012-10-07 21:51:01 -07:00
Andrew Bartlett
4d7dad1315 s4-dsdb: Remove unused variables
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Sep  1 05:10:47 CEST 2012 on sn-devel-104
2012-09-01 05:10:47 +02:00
Andrew Bartlett
01ade93c7c s4-dsdb: Remove unused tmp_ctx leaked onto long-term ldb_context
This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

Andrew Bartlett
2012-09-01 03:33:20 +02:00
Andrew Bartlett
43904cb4f5 s4-dsdb: Remove double-free in update_keytab module 2012-08-28 07:57:29 +10:00
Andrew Bartlett
8c205395c6 s4-dsdb: Add secrets_tdb_sync - an ldb module to keep secrets.tdb in sync
secrets_tdb_sync is a new ldb module designed to sync secrets.ldb
entries with the secrets.tdb file.

While not ideal to keep two copies of this data, this routine will
assist in allowing the samba-tool domain join code to operate
correctly in most cases where winbindd and smbd are used.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
Andrew Bartlett
be9a8cf4ca s4-dsdb: Remove unused variables 2012-08-23 15:02:26 +02:00
Andrew Bartlett
d1eac79690 s4-dsdb: Do not use a possibly-old loadparm context in schema reload
The loadparm context on the schema DB might have gone away already.
Pre-cache the schema refresh interval at load time to avoid worrying
about this.

Andrew Bartlett
2012-08-23 15:02:25 +02:00
Matthias Dieter Wallnöfer
c4b9c3aba8 s4:samldb LDB module - remove unused "member" attribute from search filter
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-22 01:31:57 +02:00
Matthias Dieter Wallnöfer
c8bfb8eb09 s4:dsdb - always fail if a search filter could not be parsed
A NULL string/expression returns the generic "(objectClass=*)" filter

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-22 01:31:55 +02:00
Matthias Dieter Wallnöfer
5f8006cb64 s4:dsdb_sort_objectClass_attr - simplify memory context handling
Do only require the out memory context and build the temporary one in
the body of the function. This greatly simplifies the callers.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-22 01:31:55 +02:00
Matthias Dieter Wallnöfer
166a7d37f7 s4:dsdb_sort_objectClass_attr - use "data_blob_string_const" for setting values
As shown in commit c8e6d8b487 this looks easier and in any case we can
treat schema context data like global data.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-22 01:31:55 +02:00
Andrew Bartlett
2e1ab13f6e s4-dsdb: Use tmp_ctx in kccsrv_check_deleted to avoid leaking memory onto part->dn
The confusing use of do_dn as a memory context while legitimate
created a bug when it was copied and modified to search on a DN from
long-term state.

By always using a temporary memory context it is clear what paramter
is the memory context.

This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 17 18:24:10 CEST 2012 on sn-devel-104
2012-08-17 18:24:09 +02:00
Andrew Bartlett
26bfe70def s4-kcc: Avoid use-after-free of dn and add tmp_ctx
By using a tmp_ctx we are clearer about allocating temporary memory.

Andrew Bartlett
2012-08-17 16:41:26 +02:00
Andrew Bartlett
a7b8e9f562 s4-dsdb: Ensure we always free tmp_ctx in schema refresh check
This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

In that log, over 2.5 days this particular allocation was repeated:

1715099     talloc_new: ../source4/dsdb/samdb/ldb_modules/schema_load.c:120 contains      0 bytes in   1 blocks

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 17 06:21:18 CEST 2012 on sn-devel-104
2012-08-17 06:21:17 +02:00
Stefan Metzmacher
4ee602c7f0 s4:dsdb/repl: fix the usage of 'GC/' prefixed principal names
The "serverReference" attribute is available on the "server" object
not on the "nTDSA" object.

This allows connections to RODCs, as they don't have a
E3514235-4B06-11D1-AB04-00C04FC2DCD2/${NTDSGUID}/${DNSDOMAIN}
principal.

Pair-Programmed-With: Björn Baumbach <bb@sernet.de>

metze

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Aug 14 18:57:41 CEST 2012 on sn-devel-104
2012-08-14 18:57:41 +02:00
Andrew Bartlett
108c8b758a s4-dsdb: Use samdb_dn_is_our_ntdsa()
This uses a GUID based comparison, and avoids re-fetching the
samdb_ntds_settings_dn each time.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
d582e1bef6 s4-dsdb: Add samdb_dn_is_our_ntdsa()
This is like samdb_reference_dn_is_our_ntdsa but without the attribute de-reference.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
773d0367a6 s4-dsdb: Use samdb_reference_dn_is_our_ntdsa() 2012-08-14 15:37:22 +02:00
Andrew Bartlett
1e127b270c s4-dsdb: Add helper function samdb_reference_dn_is_our_ntdsa()
We often want to know if we own an FSMO role (for example).  This tries to be more
efficient by comparing the GUID, rather than the string DN, as this does not need
to be re-fetched each time.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
3c8d8f206b s4-dsdb: Use ldb_dn_copy() rather than talloc_reference()
As the normal case (outside provision) uses a copy, this avoids a case
where a caller might modify a global variable accidentily.

As suggested by metze.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
fd0394d85d s4-libnet: Improve debugging of libnet_BecomeDC LDAP errors 2012-08-14 15:37:22 +02:00
Stefan Metzmacher
c47d73f6c4 s4:dsdb/repl: ldb_errstring() takes a 'struct ldb_context' not 'int'
metze

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Aug 14 13:58:31 CEST 2012 on sn-devel-104
2012-08-14 13:58:31 +02:00
Stefan Metzmacher
0b926a27d8 s4:dsdb/repl: make sure instanceType_e is not changed by a reallocation
Pair-Programmed-With: Björn Baumbach <bb@sernet.de>

metze
2012-08-14 10:47:26 +02:00
Stefan Metzmacher
d81d6afd6f s4:dsdb/repl: avoid reallocation of msg->elements
The index into the elements needs to match between
msg->elements and md->ctr.ctr1.array, which means we should
pre-allocate them with the same size.

Pair-Programmed-With: Björn Baumbach <bb@sernet.de>

metze
2012-08-14 10:40:55 +02:00
Andrew Bartlett
9566786853 s4-dsdb: Add mem_ctx argument to samdb_ntds_settings_dn
As this value is calculated new each time, we need to give it a context to live on.

If the value is the forced value during provision, a reference is taken.

This was responsible for the memory leak in the replication process.  In the
example I was given, this DN appeared in memory 13596 times!

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug 14 10:05:14 CEST 2012 on sn-devel-104
2012-08-14 10:05:14 +02:00
Andrew Bartlett
0f2a87b547 s4-dsdb: Improve memory handling in dsdb_schema_from_ldb_results() by adding a tmp_ctx 2012-08-14 08:27:19 +02:00
Andrew Bartlett
1f7477349f s4-dsdb: Improve memory handling in kccsrv_add_connection() 2012-08-14 08:27:19 +02:00
Andrew Bartlett
77990c1831 s4-dsdb: Improve memory handling in kccsrv_find_connections() by adding a tmp_ctx 2012-08-14 08:27:19 +02:00
Andrew Bartlett
f74e7b5606 s4-dsdb: Add const 2012-08-14 08:27:19 +02:00
Andrew Bartlett
4631723c98 s4-dsdb: Take more care in handling of global schema memory
This reworks dsdb_replicated_objects_commit() to have a proper local tmp_ctx and
to be more careful about what schema is set (only setting a global schema if
the original schema was global).

In particular, the new working_schema is not given a talloc reference
to the old schema.  This ensures that the old schema can go away when
no longer used.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Aug 11 10:31:57 CEST 2012 on sn-devel-104
2012-08-11 10:31:57 +02:00
Andrew Bartlett
329e374938 s4-dsdb: Remove support for per-partition sequence numbers
These sequence numbers were only used for telling if the schema was
changed, and are no longer directly related to the replication USN.

The per-partition replication USN can be obtained from the
@REPLCHANGED record on the per-partition database, and this is done
with an ldb_search().

Andrew Bartlett
2012-08-11 12:53:42 +10:00
Andrew Bartlett
2d21a9bf5e s4-dsdb: Use only the replication USN for schema reload.
This way we do not track both the partition seq number and the
replication USN for schema reload purposes.

We only need one indication of actual data change, and the replication
per-partition sequence number is no more expensive to obtain than the
ldb per-partition sequence number.

Andrew Bartlett
2012-08-11 12:53:42 +10:00
Björn Jacke
13f8674a15 build: rename security → samba-security
there is a libsecurity on OSF1 which clasheѕ with our security lib. see bug #9023.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Fri Aug 10 14:22:21 CEST 2012 on sn-devel-104
2012-08-10 14:22:20 +02:00
Andrew Bartlett
fdd07e87c6 s4-dsdb: Explain better what records are written during schema set
This is controlled by setting write_indices_and_attributes.

Andrew Bartlett
2012-08-10 10:18:28 +10:00
Andrew Bartlett
d799b25dd3 s4-dsdb: Remove strcasecmp() fallback in replmd_ldb_message_element_attid_sort
In all callers, we must already have a attributeID for each of the
values or else we would have already given an error, or could not have
obtained the message over DRS.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Aug  9 11:39:54 CEST 2012 on sn-devel-104
2012-08-09 11:39:54 +02:00
Andrew Bartlett
8dd09ef46d s4-dsdb: Do not reload partition metadata except on transaction start
This ensures that we do not add objects that should go into a partition, but we
simply return that an object is not present if the connection was created
before the partition was loaded.  It is rare to create a new partition.

Andrew Bartlett
2012-08-09 10:01:04 +02:00
Andrew Bartlett
ef87b4e4f1 s4-pydsdb: Provide control of if we should write index attributes when reloading a schema
This allows us to carefully control the loading of the schema.

Andrew Bartlett
2012-08-09 06:39:20 +02:00