1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-26 21:57:41 +03:00

48368 Commits

Author SHA1 Message Date
Volker Lendecke
45125a4db8 messaging: Fix dead but not cleaned-up-yet destination sockets
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12509

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan 10 17:40:58 CET 2017 on sn-devel-144

(cherry picked from commit e84e44ce923e5dc7529bb813e10a2890528a4ab0)

Autobuild-User(v4-5-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-5-test): Thu Jan 12 23:22:28 CET 2017 on sn-devel-144
2017-01-12 23:22:28 +01:00
Stefan Metzmacher
0996b58e7f s3:librpc/gse: make use of gss_krb5_import_cred() instead of gss_acquire_cred()
This avoids the usage of the ccselect_realm logic in MIT krb5,
which leads to unpredictable results.

The problem is the usage of gss_acquire_cred(), that just creates
a credential handle without ccache.

As result gss_init_sec_context() will trigger a code path
where it use "ccselect" plugins. And the ccselect_realm
module just chooses a random ccache from a global list
where the realm of the provides target principal matches
the realm of the ccache user principal.

In the winbindd case we're using MEMORY:cliconnect to setup
the smb connection to the DC. For ldap connections we use
MEMORY:winbind_ccache.

The typical case is that we do the smb connection first.
If we try to create a new ldap connection, while the
credentials in MEMORY:cliconnect are expired,
we'll do the required kinit into MEMORY:winbind_ccache,
but the ccselect_realm module will select MEMORY:cliconnect
and tries to get a service ticket for the ldap server
using the already expired TGT from MEMORY:cliconnect.

The solution will be to use gss_krb5_import_cred() and explicitly
pass the desired ccache, which avoids the ccselect logic.

We could also use gss_acquire_cred_from(), but that's only available
in modern MIT krb5 versions, while gss_krb5_import_cred() is available
in heimdal and all supported MIT versions (>=1.9).
As far as I can see both call the same internal function in MIT
(at least for the ccache case).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12480

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 7c3ea9fe96336483752adb821f8062a883d52998)

Autobuild-User(v4-5-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-5-test): Wed Jan 11 21:46:58 CET 2017 on sn-devel-144
2017-01-11 21:46:58 +01:00
Stefan Metzmacher
53864b1fc5 s3:librpc/gse: remove unused #ifdef HAVE_GSS_KRB5_IMPORT_CRED
We always have gss_krb5_import_cred(), it available in heimdal
and also the oldest version (1.9) of MIT krb5 that we support.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12480

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit b61a93755ca59a58775c1c8c21baee49fef42fbf)
2017-01-11 17:51:17 +01:00
Stefan Metzmacher
05534e089f s3:librpc/gse: include ccache_name in DEBUG message if krb5_cc_resolve() fails
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12480

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 6f029d58703f657e46fee35fc663128157db4d9f)
2017-01-11 17:51:17 +01:00
David Disseldorp
ceaafa7cdb smbd/ioctl: match WS2016 ReFS set compression behaviour
ReFS doesn't support compression, but responds to set-compression FSCTLs
with NT_STATUS_OK if (and only if) the requested compression format is
COMPRESSION_FORMAT_NONE.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12144

Reported-by: Nick Barrett <nick@barrett.org.nz>
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Jan  9 23:14:28 CET 2017 on sn-devel-144

(cherry picked from commit 28cc347876b97b7409d6efd377f031fc6df0c5f3)
2017-01-11 17:51:17 +01:00
Jeremy Allison
4d37a14eff s3: torture: Add test for cli_ftruncate calling cli_smb2_ftruncate.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12479

Back-port from cherry pick from commit b92cac857823ac2d29133fba2fde57cf58805b45)

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(v4-5-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-5-test): Mon Jan  9 13:38:17 CET 2017 on sn-devel-144
2017-01-09 13:38:17 +01:00
Jeremy Allison
aa690681b9 s3: libsmb: Add cli_smb2_ftruncate(), plumb into cli_ftruncate().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12479

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit e0f1ed9f450851bf5b7fec84577b50047309db3f)
2017-01-09 09:21:27 +01:00
Ralph Boehme
ca1885ad0b ctdbd_conn: remove unused fde from struct ctdbd_connection
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12485

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2017-01-09 09:21:27 +01:00
Ralph Boehme
4e6e513b32 ctdbd_conn: fix a resource leak
When reinitializing the ctdb messaging subsystem we must free the ctdb
connection fde.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12485

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2017-01-09 09:21:27 +01:00
Andreas Schneider
1d2284067e s3:libads: Include system /etc/krb5.conf if we use MIT Kerberos
The system /etc/krb5.conf defines some defaults like:

    default_ccache_name = KEYRING:persistent:%{uid}

We need to respect that so should include it in our own created
krb5.conf file.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12441

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 4ef772be3a7259b48253643392574fab28c37916)
2017-01-09 09:21:27 +01:00
Andreas Schneider
66fce30b0b s3:param: Add an 'include system krb5 conf' option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12441

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit f464f69b33b40c81d6ee57bebf9d59837431739b)
2017-01-09 09:21:27 +01:00
Ralph Boehme
e76e188c38 s3/smbd: remove a misleading error message
It can happen that we get 0 cleanup events, so remove this error
message.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12396

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Sep 16 16:43:16 CEST 2016 on sn-devel-144
2017-01-09 09:21:27 +01:00
Ralph Boehme
586f8b73b6 vfs_fruit: fix fruit:resource option spelling, but not behaviour
IMPORTANT
=========

this is a backport of commit 7d4b4a429955cf7fd43f3ac83990c5386ac8cd76
that only uses the spelling corrections of comments and the tests
without changing any behaviour. This greatly simplifies the backport.

Changing the option names in the tests without fixing the code means
that this patchset can't be used to run autobuild...

ORIGINAL COMMIT MESSAGE
=======================

Fix all occurences of bad spelling of "resource" as "res*s*ource" (two
s).

One of the places where this was wrong was when parsing parametric
options in the VFS connect() function in the module. As a result any
setting of

  fruit:resource=something

in smb.conf was silently ignored and the default ("file") was active.

In Samba 4.6 we accept both the wrong and the correct spelling, in Samba
4.7 the bad spelling will be removed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12412

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(adopted from commit 7d4b4a429955cf7fd43f3ac83990c5386ac8cd76)
2017-01-09 09:21:27 +01:00
Volker Lendecke
adbab18c6c winbindd: Use idmap cache in xids2sids
Typically smbd should have looked into the idmap cache itself before
contacting winbind. But winbind has internal users of this API (getpwuid
and getgrgid for example), and those need to use the cache too.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12484

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Wed Dec 28 00:06:41 CET 2016 on sn-devel-144

(cherry picked from commit 91d027554e414f371b3237110d1c92033d929992)

Autobuild-User(v4-5-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-5-test): Mon Jan  2 14:34:42 CET 2017 on sn-devel-144
2017-01-02 14:34:41 +01:00
Volker Lendecke
40a5e177ae idmap: Prime gencache after xids2sids calls
This fixes a performance regression for "hide unreadable". With an empty
gencache, we only do xid2sid calls when reading a large number of acls. We
lost caching the xid2sid calls while implmenting the multiple-id calls,
probably because at that time the bug with ID_TYPE_BOTH backends was still
pending. This patch restores the xid2sid caching hopefully correctly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12484

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit f7f49a2354c99d95a302f070fe3aa97a949063c8)
2017-01-02 10:31:16 +01:00
Volker Lendecke
71a9bf9d8c idmap: Pass up the xid2sids unix-ids from the idmap child
When asking for gid2sid with an idmap backend that does ID_TYPE_BOTH
and the sid in question is actually a user, the parent winbind needs
to know about it. The next commit will prime the gencache also after
xid2sid calls, and if we filled it with a ID_TYPE_GID entry, a later
sid2uid call would fail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12484

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 9079dc4f4501c4e868f46de41b82927b69dc78d5)
2017-01-02 10:31:16 +01:00
Stefan Metzmacher
59738fd2de samba: tag release samba-4.5.3
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iD8DBQBYSnuRbzORW2Vot+oRAmkOAKChhGoImWqVoIJluDZGUWPKn21G0wCdHtdI
 p9XvUnsXrNiuxkQD+i0zc9U=
 =J1SD
 -----END PGP SIGNATURE-----

Merge tag 'samba-4.5.3' into v4-5-test

samba: tag release samba-4.5.3
2016-12-20 08:41:11 +01:00
Jeremy Allison
80185ce75b s3: ntlm_auth: Don't corrupt the output stream with debug messages.
Calling programs expect to cleanly read from STDOUT.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12467

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 9fbd544b90c2b27985637a9bb3fa520f891f8696)

Autobuild-User(v4-5-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-5-test): Wed Dec 14 16:37:10 CET 2016 on sn-devel-144
2016-12-14 16:37:10 +01:00
Jeremy Allison
234de8727e s3: torture: Adds regression test case for se_access_check() owner rights issue.
This test passes against Win2K12 but fails against smbd
without the previous commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12466

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Dec 10 10:11:10 CET 2016 on sn-devel-144

(cherry picked from commit b5c0745b0c99d6cef21b5e7eb695e15aae5d4e38)
2016-12-14 12:36:16 +01:00
Jeremy Allison
692f7d080d s3: torture: Regression test case for permissions check on rename.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12460

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Dec  7 11:52:03 CET 2016 on sn-devel-144

(cherry picked from commit 52fad16f1c20109f352c25832d841ff778b2518a)
2016-12-14 12:36:16 +01:00
Jeremy Allison
55fb639a61 s3: smbd: Add missing permissions check on destination folder.
Based on code from Michael Zeis <mzeis.quantum@gmail.com>.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12460

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 91b591224ab7f8ea7b4594da9f61efef14353f7f)
2016-12-14 12:36:16 +01:00
Jeremy Allison
b6d53b69b3 s3: smbd: Make check_parent_access() available to rename code.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12460

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit beb8a73e95e768565760f79c2a16586bafb4e58c)
2016-12-14 12:36:16 +01:00
Jeremy Allison
f66b4b06fa s3: smbd: rename - missing early error exit if source and destination prefixes are different.
Noticed by Michael Zeis <mzeis.quantum@gmail.com>.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12460

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 2bfad1c9d3237ad8d174b7dc2d1e6e3c53fdb8dc)
2016-12-14 12:36:16 +01:00
Stefan Metzmacher
ff8a94caab CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG
We should only use GSS_C_DELEG_POLICY_FLAG in order to let
the KDC decide if we should send delegated credentials to
a remote server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
2016-12-09 09:55:41 +01:00
Andreas Schneider
343718c30f printing: Fix building with CUPS version older than 1.7
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12183

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Karolin Seeger <kseeger@samba.org>

Autobuild-User(v4-5-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-5-test): Tue Dec  6 14:21:49 CET 2016 on sn-devel-144
2016-12-06 14:21:49 +01:00
Andreas Schneider
10846561ba printing: Fix building with CUPS version older than 1.7
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12183

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Karolin Seeger <kseeger@samba.org>
2016-12-06 10:22:39 +01:00
Jeremy Allison
8377d8afbc s3/smbd: fix the last resort check that sets the file type attribute
The rule is, a directory (with any other attributes) should always also
set FILE_ATTRIBUTE_DIRECTORY, a file should only set
FILE_ATTRIBUTE_NORMAL if no other attributes is set.

Iow, if a file contains any existing attributes (e.g. FILE_ATTRIBUTE_HIDDEN),
don't add in the FILE_ATTRIBUTE_NORMAL attribute.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12436

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sat Nov 19 11:55:35 CET 2016 on sn-devel-144

(cherry picked from commit a0783e8dd966a0b2d24d2ca5baa6bed3fe5a7d5a)

Autobuild-User(v4-5-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-5-test): Thu Dec  1 15:16:56 CET 2016 on sn-devel-144
2016-12-01 15:16:56 +01:00
Andreas Schneider
b07e2c8fb4 s3:spoolss: Add support for COPY_FROM_DIRECTORY in AddPrinterDriverEx
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12415

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit 4d9f4bfc69a5899bdf91406dfb7efb70a530446c)
2016-11-30 12:19:32 +01:00
Günther Deschner
077711df0b spoolss: Use correct values for secdesc and devmode pointers
ULONG_PTR needs to be decoded as a uint3264 and not as a 'uint32 *'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11197

Guenther

Pair-Programmed-With: Andreas Schneider <asn@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit 73f664710a8c9b312a54d0cf41d2f4440c8b42eb)
2016-11-18 08:58:32 +01:00
Andreas Schneider
71aa6de4dc s3-printing: Allow printer names longer than 16 chars
Printers with long names are supported in the meantime. However we issue
a warning that if one printer exceeeds 15 chars we warn about it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit 2611fd02a0a6a0a0a506df70fe1a1eb4a2e76062)

Autobuild-User(v4-5-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-5-test): Mon Nov 14 16:18:40 CET 2016 on sn-devel-144
2016-11-14 16:18:40 +01:00
Andreas Schneider
6958a2481c s3-printing: Correctly encode CUPS printer URIs
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12183

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit c160ae9afb222466c50ae170447a6a0805f7169f)
2016-11-14 12:29:12 +01:00
Michael Adam
0d08df68a2 vfs:glusterfs: preallocate result for glfs_realpath
https://bugzilla.samba.org/show_bug.cgi?id=12404

This makes us independent of the allocation
method used inside glfs_realpath.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Oct 22 00:28:41 CEST 2016 on sn-devel-144

(cherry picked from commit 92a0a56c3852726e0812d260e043957c879aefa4)

Autobuild-User(v4-5-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-5-test): Mon Nov  7 12:44:46 CET 2016 on sn-devel-144
2016-11-07 12:44:46 +01:00
Andreas Schneider
0cc06c4cce s3-winbind: Do not return NO_MEMORY if we have an empty user list
The domain child for the MACHINE ACCOUNT might fail with
NT_STATUS_NO_MEMORY because an emtpy user list is returned.

*pnum_info is already set to 0 at the beginngin so we should just
declare victory here!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12405

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit e714dc03e0ccf9ec17da6bacc1bcfcaea7518e22)
2016-11-04 11:47:09 +01:00
Stefan Metzmacher
ffa364bcd0 s3:smbd: only pass UCF_PREP_CREATEFILE to filename_convert() if we may create a new file
This fixes a regression introduced by commit
f98d10af2a05f0261611f4cabdfe274cd9fe91c0
(smbd: Always use UCF_PREP_CREATEFILE for filename_convert calls to resolve a path for open)

The main problem was that Windows client seem to verify
the access to user.V2\ntuser.ini is rejected with NT_STATUS_ACCESS_DENIED,
using the machine credentials.

Passing UCF_PREP_CREATEFILE to filename_convert() triggers a code path
that implements a dropbox behaviour. A dropbox is a directory with only -wx permissions,
so get_real_filename fails with EACCESS, it needs to list the directory.
EACCESS is ignored with UCF_PREP_CREATEFILE.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10297

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Oct 25 05:33:36 CEST 2016 on sn-devel-144

(cherry picked from commit 759416582c54a16aacbef0e0dfe4649bddff8c5e)
2016-10-31 12:39:10 +01:00
Jeremy Allison
351c726fcb s3: vfs: streams_depot. Use conn->connectpath not conn->cwd.
conn->cwd can change over the life of the connection,
conn->connectpath remains static.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12387

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Mon Oct 24 23:52:48 CEST 2016 on sn-devel-144

(cherry picked from commit 1366385d1c3e9ac0556e954864e60e72f6906942)
2016-10-31 12:39:09 +01:00
Jeremy Allison
8f8c4b1bdb s3: selftest: Add test for orphan 'lost-XXX' directories in streams_depot.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12384

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Oct 21 04:48:52 CEST 2016 on sn-devel-144

(cherry picked from commit ad60b8cc48b1095ce97170eed3d09fca7181a3bc)
2016-10-31 12:39:09 +01:00
Jeremy Allison
bfa537d5e2 s3: vfs: Remove files/directories after the streams are deleted.
By the time we get to SMB_VFS_UNLINK/SMB_VFS_RMDIR the ACL
checks have already been done.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12384

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit b17c9fdc51c10313eed32d6e078ed7050a342d0f)
2016-10-31 12:39:09 +01:00
Jeremy Allison
71d5a11ea3 s3: torture: vfstest. unlink cmd must be stream aware.
Otherwise the following patch breaks vfstest stream-depot test.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12384

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 4e93ea2340b7589769d55085aaa71070a2d7e416)
2016-10-31 12:39:09 +01:00
Uri Simchoni
bd1aa3b632 smbd: in ntlm auth, do not map empty domain in case of \user@realm
When mapping user and domain during NTLM authentication, an empty domain
is mapped to the local SAM db. However, an empty domain may legitimately
be used if the user field has both user and domain in upn@realm format.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12375

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 3f82db56cbf2727abd465e28ac02ad2242b47c29)
2016-10-31 12:39:09 +01:00
Uri Simchoni
351cbb6c01 winbindd: do not modify credentials in NTLM passthrough
When doing NTLM validation of credentials, do not modify the
credentials - they might be used in the calculation of
the response.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12375

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 8e88b56ebc314a5e3a722d63ca23b4a49b7ac2dc)
2016-10-31 12:39:09 +01:00
Uri Simchoni
e310d4cb51 selftest: test NTLM user@realm authentication
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12375

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 6e4c66e339d2eb11c5cb981aac2e20fcff464025)
2016-10-31 12:39:09 +01:00
Ralph Wuerthner
af7f99f2a5 ctdb-conn: add missing variable initialization
Avoid potential crash in TALLOC_FREE(hdr).

Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 4194c0797f78293fe48105ce5af70f36a3c233a8)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12372
ctdb: bad free in ctdbd_migrate()
2016-10-31 12:39:09 +01:00
Jeremy Allison
f7ed6b2929 s3: libsmb: Fix cut and paste error using the wrong structure type.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12383

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Oct 19 14:33:53 CEST 2016 on sn-devel-144

(cherry picked from commit c21a6eda370fa0b0698a5e1fd565bd2e014d326a)

Autobuild-User(v4-5-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-5-test): Thu Oct 20 14:45:29 CEST 2016 on sn-devel-144
2016-10-20 14:45:29 +02:00
Stefan Metzmacher
152041ee78 s3:libads: don't use MEMORY:ads_sasl_spnego_bind nor set "KRB5CCNAME"
Most callers just set "KRB5CCNAME", but leave ads->auth.ccache_name = NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12369

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Oct 13 00:35:21 CEST 2016 on sn-devel-144

(cherry picked from commit a5f895a53016af71db53967062728fec5bc307ca)
2016-10-20 10:45:29 +02:00
Stefan Metzmacher
58f41cf4db s3:libads: don't use MEMORY:ads_sasl_gssapi_do_bind nor set "KRB5CCNAME"
Most callers just set "KRB5CCNAME", but leave ads->auth.ccache_name = NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12369

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 890b1bbdb8e965c4ff6e35214acc96ffbbff5dfd)
2016-10-20 10:45:29 +02:00
Björn Baumbach
0b7656b3fa s3-printing: fix migrate printer code (bug 8618)
Removed path from driver files.
We only need the basenames.
(cherry picked from commit d61993043fcb7676a58658476421f5f4ff1a3fea)
(cherry picked from commit 9f07ef2249dc21eab37cd5888623e6edc84b2b59)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=8618

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Oct  5 19:19:39 CEST 2016 on sn-devel-144

(cherry picked from commit eb7555397fd4e9f66e041179aadff59f2a39d14f)
2016-10-20 10:45:29 +02:00
Jeremy Allison
92bc3963a9 s3: cldap: cldap_multi_netlogon_send() fails with one bad IPv6 address.
Analysis by: Rebecca Gellman <rebecca@starfleet-net.co.uk>

Ignore cldap_socket_init() failure when sending
multiple cldap netlogon requests. Allow cldap_netlogon_send()
to catch the bad address and correctly return through a
tevent subreq.

Make sure cldap_search_send() copes with cldap parameter == NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12381

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Oct 18 02:16:20 CEST 2016 on sn-devel-144

(cherry picked from commit 44a7040500d74551b48eba04f5d0bedb1ec35ba6)
2016-10-20 10:45:27 +02:00
Andreas Schneider
d465cabc8e s3-utils: Fix loading smb.conf in smbcquotas
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12364

Pair-Programmed-With: Uri Simchoni <uri@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit c7bcbd166d23b6ebcc2d968b76b0640b9a9beebb)
2016-10-20 10:45:27 +02:00
Uri Simchoni
bed424f735 ntquotas: support "freeing" an empty quota list
This avoids dereferencing a null pointer if there's
an attempt to free an empty list.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12307

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit dd8a0578d8c9f562a4f13a90f4fe51f66058dd02)
2016-10-20 10:45:27 +02:00
Noel Power
a54e4e7aec s3/winbindd: using default domain with user@domain.com format fails
For example for samba client joined to a windows AD DC the following
commands fail if 'winbind use default domain = yes'
   getent passwd user@domain.com
   ssh -o user=user@domain.com localhost

The same commands succeed if the setting above has the default 'no' value

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12298

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Oct  3 23:37:44 CEST 2016 on sn-devel-144

(cherry picked from commit 7c786f89820dc1f8e2a7e8da1b80042dd69b7188)
2016-10-20 10:45:27 +02:00