IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
* \PIPE\unixinfo
* winbindd's {group,alias}membership new functions
* winbindd's lookupsids() functionality
* swat (trunk changes to be reverted as per discussion with Deryck)
(This used to be commit 939c3cb5d7)
NT_STATUS_NO_USER returned. We were moving to the next step in the
chain when the client wasn't. Only update when the user logs on.
(This used to be commit b01a3a4111)
tests on this as it's very late NY time (just wanted to get this work
into the tree). I'll test this over the weekend....
Jerry - in looking at the difference between the two trees there
seem to be some printing/ntprinting.c and registry changes we might
want to examine to try keep in sync.
Jeremy.
(This used to be commit c7fe18761e)
* more work on the store_values() functions for the Printers key
* add Control\Print\Monitors key to list for reg_db
(This used to be commit 89f17b41ce)
safe for using our headers and linking with C++ modules. Stops us
from using C++ reserved keywords in our code.
Jeremy
(This used to be commit 9506b8e145)
ctime_r() takes different parameters on Solaris than it does on Linux, and
it's easier to just eliminate the use of it than to write a configure test.
(This used to be commit 513ea79b2e)
as they do nothing that write_socket/read_socket don't do. Add a more useful
error message when read_socket/write_socket error out on the main client fd
for a process (ie. try and list the IP of the client that errored).
Jeremy.
(This used to be commit cbd7578e7c)
rpcclient-tester for some info-levels.
Jerry, I tried to adopt to prs_pointer() where possible and to not
interfere with your work for usrmgr.
- Add "net rpc trustdom vampire"-tool.
This allows to retrieve Interdomain Trust(ed)-Relationships from
NT4-Servers including cleartext-passwords (still stored in the local
secrets.tdb).
The net-hook was done in cooperation with Lars Mueller
<lmuelle@suse.de>.
To vampire trusted domains simply call:
net rpc trustdom vampire -S nt4dc -Uadmin%pass
Guenther
(This used to be commit 5125852939)
the function that was being used to set attributes is a core protocol
function (SMBsetatr = 0x09), it does not appear to work on win98. As a
temporary measure, when file times are to be set, this version opens the
file and uses SMBsetattrE = 0x22 instead. (The other advantage of this
function over the original one is that it supports setting access time as
well as modification time.)
The next step, the proper solution if it can be made to work, is to write
functions that use TRANS2_SET_PATH_INFO instead.
(This used to be commit bab0bf7f4f)
be left with a filename that doesn't exist on the remote machine. If we then do a findnext
with this file the server gets confused and restarts from the beginning of the directory,
causing directory listing loops. Fix this by keeping a copy of the "raw" filename data and
length and using this as the argument to findnext. This won't fix the incorrect iconv
conversion into the finfo struct but at least it ensures that directory listings always
terminate. Tested against NTFS and FAT directories.
Jeremy.
(This used to be commit 848940d5a9)
a search when listing a W2K and above server from a FATxx filesystem
only. Thanks to Steve Langasek <vorlon@debian.org> for giving me the
essential info that allowed me to reproduce and thus fix this.
Jeremy.
(This used to be commit 8227675d3d)
parsing the timestamp values correctly. It turns out they were using the
incorrect function for formatting and parsing values. Thanks to Satwik Hebbar
for reporting this and testing the patch.
(This used to be commit 9144778d09)
* BUG 2680: copy files from an MSDFS win2k root share
* BUG 2688: re-implement support for the -P (--port) option
* support connecting to an 'msdfs proxy' share on a Samba server
(This used to be commit 9e3e473632)
a directory, the errno returned could end up as ENOENT rather than ENOTDIR.
- Fixes some compiler warnings which showed up on IRIX, as reported by
James Peach.
(This used to be commit 615a62b21f)
this is to test future changes to enumeration functions...
This can successfully list users from nt4 and w2k3sp1.
Volker
(This used to be commit c73f2656fd)
Added provision for overloading some global configuration options via the new,
per-user file ~/.smb/smb.conf.append which is read after the global config
file is read (and only if the global config file was read). This leave the
original, BC behavior of ~/.smb/smb.conf which, if found, is read but causes
the global config file to not be read.
Also fixed a potential seg fault in to lp_dump_one().
(This used to be commit 2c5a6305bd)
1. using smbc_getxattr() et al, one may now request all access control
entities in the ACL without getting all other NT attributes.
2. added the ability to exclude specified attributes from the result set
provided by smbc_getxattr() et al, when requesting all attributes,
all NT attributes, or all DOS attributes.
3. eliminated all compiler warnings, including when --enable-developer
compiler flags are in use. removed -Wcast-qual flag from list, as that
is specifically to force warnings in the case of casting away qualifiers.
Note: In the process of eliminating compiler warnings, a few nasties were
discovered. In the file libads/sasl.c, PRIVATE kerberos interfaces
are being used; and in libsmb/clikrb5.c, both PRIAVE and DEPRECATED
kerberos interfaces are being used. Someone who knows kerberos
should look at these and determine if there is an alternate method
of accomplishing the task.
(This used to be commit 994694f7f2)
whole of samba comiles warning-free with the default compiler flags.
Temporarily defined -Wall to locate other potential problems. Found an
unused static function (#ifdefed out rather than deleted, in case it's
needed for something in progress).
There are also a number of uses of undeclared functions, mostly krb5_*.
Files with these problems need to have appropriate header files included,
but they are not fixed in this update.
oplock_linux.c.c has undefined functions capget() and capset(), which need
to have "#undef _POSIX_SOURCE" specified before including <sys/capability.h>,
but that could potentially have other side effects, so that remains uncorrected
as well.
The flag -Wall should be added permanently to CFLAGS, and all warnings then
generated should be eliminated.
(This used to be commit 5b19ede88e)
retrieve the timestamps (Win2k) and not if it used cli-getatr() to retrieve
the timestamps (Win98). Timestamps are supposed to be in GMT, and should
not have serverzone deducted from them in cli_qpathinfo2().
(This used to be commit 443d8df94c)
client against a Samba server. It never uses the "continue" flag, but always
does "new search, continue from this file" instead. Change our client code
to do the same (it appears that's all they test in W2K etc.).
Jeremy.
(This used to be commit 710bceee32)
note that this does not handle the situation where the same \\server\share
is mounted mutliple times in the dfs tree since I store a single mount
path per struct cli_state *
(This used to be commit 52c82b51ba)
* all the unix extension commands should work
* send the correct TRANS2_FINDFIRST format to 2k to
get a listing from a msdfs root share (tested against
smbd as well).
* mkdir, rmdir, etc... all seem ok.
I'm sure bugs will pop up so keep testing.
Last thing I plan on doing is to clean up the horrible
mess with connection management in smbclient and global
variables (so i can move the cli_cm_xx() routines to a
separate file).
(This used to be commit 53d6a5f9d1)
cd up and down the tree and get directory listings.
Still have to figure out how to get a directory listing on a
2k dfs root. Also have to work out some issues with relative paths
that cross dfs mount points.
We're protected from the new code paths when connecting to
a non-dfs root share ( the flag from the tcon&X is stored
in the struct cli_state* )
(This used to be commit e57fd2c5f0)
and SMBsplclose commands (BUG 2010)
* clarify some debug messages in smbspool (also from Mike)
my changes:
* start adding msdfs client routines
* enable smbclient to maintain multiple connections
* set the CAP_DFS flag for our internal clienht routines.
I actualy have a dfs referral working in do_cd() but that code
is too ugly to live so I'm not checking it in just yet.
Further work is to merge with vl's changes in trunk to support multiple
TIDs per cli_state *.
(This used to be commit 0449756309)
supported pipe. Netlogon is still special, as we open that twice, one to do
the auth2, the other one with schannel.
The client interface is completely unchanged for those who only use a single
pie. cli->pipe_idx is used as the index for everything except the "real"
client rpc calls, which have been explicitly converted in my last commit. Next
step is to get winbind to just use a single smb connection for multiple pipes.
Volker
(This used to be commit dc294c52e0)
functions so we can funnel through some well known functions. Should help greatly with
malloc checking.
HEAD patch to follow.
Jeremy.
(This used to be commit 620f2e608f)
Need to add printout functions in client and set posix acl in server.
SteveF - take a look at this for the cifsfs client !
Once this is working and tested the next step is to write this up for
the UNIX extensions spec. documents.
Jeremy.
(This used to be commit 1bd3f13344)
for bug #1717.The rest of the code needed to call this patch has not yet been
checked in (that's my next task). This has not yet been tested - I'll do this
once the rest of the patch is integrated.
Jeremy.
(This used to be commit 7565019286)
return a size_t, not an ssize_t, and we had better left shift the upper
part of the write count, not right shift it.
(This used to be commit 3eb33fbc64)
setprinter calls inside the net-tool.
This is usefull to mimic the same queries a windows-client does. At
least win2k returns WERR_IO_PENDING when printer is published via
setprinter, samba returns WERR_OK but this does not hurt.
Guenther
(This used to be commit 69b745fb98)
'..' from all #include preprocessor commands. This fixes bugzilla #1880
where OpenVMS gets confused about the '.' characters.
(This used to be commit 7f161702fa)
security descriptor for a file. Return an error in this case instead
of panicing trying to unpack a zero length buffer. Found by Brett
Funderburg.
(This used to be commit 588de0d4a8)
info level. Outputs data on the file in the same format the the
stat command in Linux. Should be useful to people wanting to learn
how to parse the UNIX extension output.
Yes I will add the docs later :-).
Jeremy.
(This used to be commit b25cc59641)
heimdal 0.6.1rc3 had a bug causing winbindd to die, heimdal version
0.6.1 and higher have that fixed (thanks to Love from Heimdal).
SuSE has been informed about this possible pitfall, any other vendors
that ship with heimdal-0.6.1rc3 to be notified ?
Guenther
(This used to be commit 6239a5bec9)
using our own implementation of krb5_lookup_kdc with heimdal. Also,
heimdals krb5_krbhst_next() obviously does not retrieve the struct
addrinfo in the krb5_krbhst_info-struct, using
krb5_krbhst_get_addrinfo() instead.
Guenther
(This used to be commit cca660e109)
consists of a 16 byte salt, followed by the 16 byte MD5 hash of
the concatination of the salt plus the NThash of the historical
password. Allows these to be exposed in LDAP without security issues.
Jeremy.
(This used to be commit 82e4036aaa)
pointless. With a well-known session key, we may as well put the
password change directly on the wire, with it's own 'crypted with old
password' as the protection.
This should fix some 'long password change' issues, against Samba in
particular.
Andrew Bartlett
(This used to be commit 554a913287)
On systems with /dev/urandom, this avoids a change to secrets.tdb for every fork().
For other systems, we now only re-seed after a fork, and on startup.
No need to do it per-operation. This removes the 'need_reseed'
parameter from generate_random_buffer().
Andrew Bartlett
(This used to be commit 36741d3cf5)
This memset could well have clobbered bits of the stack, because
session_key changed from
char session_key[16];
to
DATA_BLOB session_key
Andrew Bartlett
(This used to be commit 54248a405c)
then is the client supports it (current clients supported are Samba and
CIFSVFS - detected by the negprot strings "Samba", "POSIX 2" and a bare
"NT LM 0.12" string) then the setting of the per packet flag smb_flag
FLAG_CASELESS_PATHNAMES is taken into account per packet. This allows
the linux CIFS client to use Samba in a case sensitive manner.
Additional command in smbclient "case_sensitive", toggles the
flag in subsequent packets.
Docs to follow.
Jeremy.
(This used to be commit cf84c0fe1a)
We would start the trans2 state, which is fine, but never pull the
expected reply off the packet queue.
I'm not sure if this is still a major problem after jra's recent 'no
duplicate mids on the list' change, but I think this is correct
anyway.
(This used to be commit ee23a4237d)
message, or we mess up the signing sequence number.... Also improve sign error
reporting. Also when deferring an open that had been deferred due to an oplock
break, don't re-add the mid to the pending sign queue or we increment the sequence
number twice and mess up signing again...
I can now bounce between 2 WinXP/Win2003 boxes opening Excel spreadsheets with
signing turned on and get correct "file in use" messages.
Jeremy.
(This used to be commit 1745ce4e2c)
because not only does it not work on Heimdal, but also since ccaches
created within samba are memory-based, so we shouldn't touch a
FILE-based one (it was probably created via kinit or similar).
(This used to be commit 5971b0980c)
bug 1208. Based on a fix from Guether Deschener.
Outstanding pieces:
- Heimdal FILE-based ccaches don't actually remove creds properly, so we
need to code a check for this
- what if ticket expires between our check and when we use it?
Guenther has coded up fixes for these parts, but I still need
to review them, as I'm not totally comfortable with the solutions.
(This used to be commit ef008b9710)
with more correct NTLMSSP support in client and server, but it will do
for now.
Also implement LANMAN password only in the classical session setup code, but
#ifdef'ed out. In Samba4, I'll make this run-time so we can torture it.
Lanman passwords over 14 dos characters long could be considered
'invalid' (they are truncated) - so SMBencrypt now returns 'False' if
it generates such a password.
Andrew Bartlett
(This used to be commit 565305f7bb)
normally takes as it's param entry the filename to
be acted upon.... Unless it's UNIX extensions create
hardlink, or UNIX extensions create symlink. Then it's
param -> newfile name
data -> oldfile name.
This caused me to stuff them up in 3.0.2 (and the
client commands link and symlink). Fixed them, everything
is now called oldname and newname - thus specifying which
name should already exist (hint - the old one...) and which
will be created (newname).
Jeremy.
(This used to be commit 21cc6ab7e8)
all authentication to members of this particular group.
Also implement an option to allow ntlm_auth to get 'squashed' error codes,
which are safer to communicate to remote network clients.
Andrew Bartlett
(This used to be commit eb1c1b5eb0)
We use cli_state.smb_rw_error to pass this specific case into cli_close_connection()
from smbmount as smb_rw_error can have only selected number of states and
it is ignored in cli_close_connection().
Compiled and tested by Lars Mueller from SuSE on x86, x86_64, ppc, ppc64, s390 and
s390x.
(This used to be commit 738666ce0a)
For a (very) long time, we have had a bug in Samba were an NTLMv2-only
PDC would fail, because it converted the password into NTLM format for
checking.
This patch performs the direct comparison required for interactive
logons to function in this situation. It also removes the 'auth flags', which
simply where not ever used.
Natrually, this plays with the size of structures, so rebuild, rebuild
rebuild...
Andrew Bartlett
(This used to be commit 9598593bcf)
another NTLMv2 combination.
We should allow the NTLMv2 response to be calculated with either the domain
as supplied, or the domain in UPPER case (as we always did in the past).
As a client, we always UPPER case it (as per the spec), but we also
make sure to UPPER case the domain, when we send it. This should give
us maximum compatability.
Andrew Bartlett
(This used to be commit 1e91cd0cf8)
ago.
This patch re-adds support for 'optional' SMB signing. It also ensures that
we are much more careful about when we enable signing, particularly with
on-the-fly smb.conf reloads.
The client code will now attempt to use smb signing by default, and disable
it if the server doesn't correctly support it.
Andrew Bartlett
(This used to be commit e27b5cbe75)
Winbind tickets expired. We now check the expiration time, and acquire
new tickets. We couln't rely on renewing them, because if we didn't get
a request before they expired, we wouldn't have renewed them. Also, there
is a one-week limit in MS on renewal life, so new tickets would have been
needed after a week anyway. Default is 10 hours, so we should only be
acquiring them that often, unless the configuration on the DC is changed (and
the minimum is 1 hour).
(This used to be commit c2436c433a)
Don't use nstrings to hold workgroup and netbios names. The problem with them is that MB netbios
and workgroup names in unix charset (particularly utf8) may be up to 3x bigger than the name
when represented in dos charset (ie. cp932). So go back to using fstrings for these but
translate into nstrings (ie. 16 byte length values) for transport on the wire.
Jeremy.
(This used to be commit b4ea493599)
there are multiple "."'s in the name.
This code is protected with an #ifdef TRUNCATE_NETBIOS_NAME and this
is #define'd to 1 directly above. Should we also get rid of the #ifdef?
(This used to be commit 0375dace24)
boolean parameter that allows broken iconv conversions to work. Gets rid of the
nasty errno checks in mangle_hash2 and check_path_syntax and allows correct
return code checking.
Jeremy.
(This used to be commit 7b96765c23)
on an initial open the desired_access field *must* contain DELETE_ACCESS,
simply having it map from a GENERIC_ALL won't do. Fixes delete on close test.
Jeremy.
(This used to be commit 5c6f8b1053)
As well as avoiding DOS charset issues, this scheme returns useful error
codes, that we can map back via the pam interface.
This patch also cleans up the interfaces used for password buffers, to
avoid duplication of code.
Andrew Bartlett
(This used to be commit 2a2b1f0c87)
Found by Fran Fabrizio <fran@cis.uab.edu>.
Add to the *start* of the list not the end of the list.
This ensures that the *last* send sequence with this mid
is returned by preference.
This can happen if the mid wraps and one of the early
mid numbers didn't get a reply and is still lurking on
the list.
Jeremy.
(This used to be commit 25d739978f)
- setup_logging() in smbclient to be interactive (remove the timestamps)
- Fix bad return value in pull_ucs2( needs more testing to make sure this
didn't break something else) that caused clistr_pull() to always read
the same string from the buffer (pull_usc2() could return -1 if the original
source length was given as -1)
- increment some debugging messages to avoid printing them out so often
(This used to be commit 79fe75dcdf)
domains, this patch ensures that we always use the ADS backend when
security=ADS, and the remote server is capable.
The routines used for this behaviour have been upgraded to modern Samba
codeing standards.
This is a change in behaviour for mixed mode domains, and if the trusted
domain cannot be reached with our current krb5.conf file, we will show
that domain as disconnected.
This is in line with existing behaviour for native mode domains, and for
our primary domain.
As a consequence of testing this patch, I found that our kerberos error
handling was well below par - we would often throw away useful error
values. These changes move more routines to ADS_STATUS to return
kerberos errors.
Also found when valgrinding the setup, fix a few memory leaks.
While sniffing the resultant connections, I noticed we would query our
list of trusted domains twice - so I have reworked some of the code to
avoid that.
Andrew Bartlett
(This used to be commit 7c34de8096)
test for a valid length to fail...
This should fix 'security=server' and hosts-equiv failures picked up by
the build farm.
Andrew Bartlett
(This used to be commit 39311495de)
would attempt to supply a password to the 'inside' NTLMSSP, which the
remote side naturally rejected.
Andrew Bartlett
(This used to be commit da408e0d5a)
DNS names (realms) from NetBIOS domain names.
Until now, we would experience delays as we broadcast lookups for DNS names
onto the local network segments.
Now if DNS comes back negative, we fall straight back to looking up the
short name.
Andrew Bartlett
(This used to be commit 32397c8b01)
it out onto the wire. Avoids valgrind warnings because the fstrcpy() causes
part of the wire buffer to be 'marked'.
Andrew Bartlett
(This used to be commit 53d802c72a)
it sent 'INVALID_PARAMETER', when it was us as the server that could not
come up with a session key. Instead, allow normal authentication to take
place, but do not setup a session key.
Andrew Bartlett
(This used to be commit e5abd93d79)
- Fill in the 'backup' idea of a domain, if the DC didn't supply one. This
doesn't seem to occour in reality, hence why we missed the typo.
lib/charcnv.c:
lib/smbldap.c:
libads/ldap.c:
libsmb/libsmbclient.c:
printing/nt_printing.c:
- all the callers to pull_utf8_allocate() pass a char ** as the first
parammeter, so don't make them all cast it to a void **
nsswitch/winbind_util.c:
- Allow for a more 'correct' view of when usernames should be qualified
in winbindd. If we are a PDC, or have 'winbind trusted domains only',
then for the authentication returns stip the domain portion.
- Fix valgrind warning about use of free()ed name when looking up our
local domain. lp_workgroup() is maniplated inside a procedure that
uses it's former value. Instead, use the fact that our local domain is
always the first in the list.
Andrew Bartlett
(This used to be commit 494781f628)
subsystem into a seperate file - ntlm_check.c.
This allows us to call these routines from ntlm_auth. The purpose of this
exercise is to allow ntlm_auth (when operating as an NTLMSSP server) to
avoid talking to winbind. This should allow for easier debugging.
ntlm_auth itself has been reorgainised, so as to share more code between
the SPNEGO-wrapped and 'raw' NTLMSSP modes. A new 'client' NTLMSSP mode
has been added, for use with a Cyrus-SASL module I am writing (based on vl's
work)
Andrew Bartlett
(This used to be commit 48315e8fd2)
