1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-05 09:18:06 +03:00
Commit Graph

35584 Commits

Author SHA1 Message Date
Anoop C S
08ba013a2b s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so
Early check for DEVELOPER or ENABLE_SELFTEST configure options inside
messaging_handlers.c leaves us with the following undefined reference
linkage error:

[1315/3712] Linking bin/default/source4/lib/messaging/libMESSAGING-samba4.so
/usr/bin/ld: source4/lib/messaging/messaging.c.4.o: in function
						`imessaging_init_internal':
/root/samba.git/bin/default/../../source4/lib/messaging/messaging.c:472:
		undefined reference to `imessaging_register_extra_handlers'
collect2: error: ld returned 1 exit status

This happened due to failure in including "includes.h" before checking
the above mentioned configure options.

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-01-20 00:31:25 +01:00
Gary Lockyer
60aa7b3634 group_audit: error handling in group change
Generate an appropriate log message in the event of an error
log_group_membership_changes.  As the changes have not been applied to
the database, there is no easy way to determine the intended changes.
This information is available in the "dsdbChange" audit messages, to
avoid replicating this logic for what should be a very rare occurrence
we simply log it as a "Failure"

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Jan 19 22:32:05 CET 2019 on sn-devel-144
2019-01-19 22:32:05 +01:00
Gary Lockyer
942567afda group_audit: Tests for error handling in group change
Add tests to exercise the error handling in
log_group_membership_changes.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-01-19 19:21:20 +01:00
Douglas Bagnall
f4b3229f5b s4/py_dsdb: catch/handle alloc failures in py_dsdb_normalise_attributes()
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-01-19 19:21:20 +01:00
Andreas Schneider
448d67bae7 s4:kdc: Fix size type for num_bind in kdc-heimdal
This fixes a compile error on sn-devel184.

Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Sat Jan 19 15:36:51 CET 2019 on sn-devel-144
2019-01-19 15:36:51 +01:00
Andreas Schneider
c195134e35 s4:dsdb: Fix size type for num_of_attrs in acl_read
This fixes a compile error on sn-devel184.

Signed-off-by: Andreas Schneider <asn@samba.org>
2019-01-19 12:24:18 +01:00
Andreas Schneider
9ac30e77f3 s4:dsdb: Fix size types in audit_log
audit_log.c:878:7: error: assuming signed overflow does not occur when
simplifying conditional to constant [-Werror=strict-overflow]

Signed-off-by: Andreas Schneider <asn@samba.org>
2019-01-19 12:24:18 +01:00
Andreas Schneider
48285a9c60 s4:librpc: Use C99 initializer for PyGetSetDef in py_auth
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-01-17 11:35:12 +01:00
Tim Beale
7fb93eaca7 tests: Run ntacls_backup tests against testenv with SMBv1 disabled
Just to prove that the NTACL backup works over SMBv2.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=1367

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-17 01:40:31 +01:00
Tim Beale
da33c2c4e4 tests: Run GPO commands against testenv with SMBv1 disabled
Just to prove that they work across SMBv2.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-17 01:40:30 +01:00
Tim Beale
2a7372da7b tests: Run samba_tool.gpo tests against backup testenvs
Run the GPO tests against the backup/restore testenvs.

Because the backup/restore preserves the NTACLs of the sysvol files,
running the GPO tests against the backup testenvs is a good sanity-
check. If fact it highlights that there is currently a problem with
restoring the GPO files - this shows up in 'samba-tool gpo aclcheck',
but we never noticed it until now.

NTACL backup works slightly different for offline backups, and rename
backups end up with more sysvol files, so run the tests against both
these envs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-17 01:40:30 +01:00
Tim Beale
6a29e63f32 s4:pysmb: Add error log that the s4 bindings are deprecated
We plan to delete the s4 SMB Python bindings in the next Samba release
after v4.10, but first give external consumers a heads-up, just in case
they are currently using the s4 bindings.

Note the auth_log tests still use the s4 bindings, but all user-facing
tools should now be updated to use the s3 bindings.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-17 01:40:30 +01:00
Volker Lendecke
9563fcf6ff samba_dnsupdate: With dns_hub, we don't need resolv_wrap
Best viewed with git show -b

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-15 07:53:22 +01:00
Volker Lendecke
ff2dbe24b8 dns_update: samba_dnsupdate's exit code is not an errno
This avoids confusing messages, samba_dnsupdate returns the number of
failed updates

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-15 07:53:21 +01:00
Noel Power
b6c8ef5fb7 s4/libnet: use 'et' as format for ParseTuple with python2
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-01-13 00:40:26 +01:00
Stefan Metzmacher
ea0a704177 selftest:Samba4: run the raw_protocol test with a limit of 8 auth contexts
This is much faster than exploring the limit of 2049 during autobuild.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:42 +01:00
Stefan Metzmacher
7bc6ec81c8 s4:rpc_server: implement security context multiplexing
There're some systems like Cisco ISE use security multiplexing
without checking (via bind time feature negotiation)
the server supports it.

Others like VMWare View, fallback to NT4 style netlogon
connections without using netlogon secure channel,
which then triggers an error, with "server schannel = yes",
see https://bugzilla.samba.org/show_bug.cgi?id=13464.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:41 +01:00
Stefan Metzmacher
8bd0f4405a s4:pyrpc: add py_dcerpc_ndr_pointer_deref/wrap() infrastructure
Some idl files use more than one layer of unique pointers. e.g.

    NTSTATUS lsa_GetUserName(
            [in,unique] [string,charset(UTF16)] uint16 *system_name,
            [in,out,ref] lsa_String **account_name,
            [in,out,unique] lsa_String **authority_name
            );

In order to specify *io.in.authority_name = NULL,
we need to wrap the pointer value (lsa_String or None)
into an base.ndr_pointer() object.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:41 +01:00
Stefan Metzmacher
ae467704f3 s4:pyrpc: make use of pytalloc_get_type() in py_dcerpc_syntax_init_helper()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:41 +01:00
Stefan Metzmacher
4bb3a66ae1 s4:rpc_server/lsa: specify \\pipe\lsass as ncacn_np_secondary_endpoint
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:41 +01:00
Stefan Metzmacher
98d5872293 s4:rpc_server: make it possible to specify ncacn_np_secondary_endpoint
Even a connect to \\pipe\lsarpc should return a secondary_address
of '\\pipe\\lsass'. But that will be implemented in a following commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:41 +01:00
Stefan Metzmacher
b3659fb52d s4:rpc_server: only share assoc group ids on the same transport
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:41 +01:00
Stefan Metzmacher
c192dc1c9d s4:rpc_server: don't replace '\\pipe\\' with '\\PIPE\\'
This is not what Windows returns (at least for \\pipe\lsass).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:40 +01:00
Stefan Metzmacher
975e8e1f25 s4:rpc_server: fix DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN negotiation to match Windows
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:40 +01:00
Stefan Metzmacher
6f53c99372 s4:rpc_server: SMB_ASSERT(auth->auth_finished); in order to get auth details
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
e9eb8e6a44 s4:rpc_server: only pass context to op_bind() hooks
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
70b00c7567 s4:rpc_server: only use context within op_bind() hooks and dcesrv_interface_bind_*() functions
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
28f4cb442c s4:rpc_server: remove unused dcesrv_connection_context->private_date
dcesrv_iface_state_{create,find}_{assoc,conn}() should be used instead.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
792b6b9d69 s4:rpc_server: remove unused dcesrv_assoc_group->proxied_id
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
2ed7db445b s4:rpc_server/winreg: don't cache an ldb connection per presentation context
We should do this per context handle, as these are available on all
connections of the association group.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
9616f6b8bc s4:rpc_server/remote: make use dcesrv_iface_state_{store,find}_{assoc,conn}() helpers
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
9d387919f6 s4:rpc_server/remote: introduce struct dcesrv_remote_call
This holds the state for async requests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
a8134191ec s4:rpc_server/remote: defer the connect to the first client request
This means we have a chance to use delegated credentials from the client
if available, as the authentication is already completed.

Before we only ever used the transport inherited credentials
via SMB or anonymous.

Note: most times we still fallback to anonymous...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
199d4ba7ac s4:rpc_server/remote: fail the connection if the remote server don't support MPX
If we already negotiated with our client to support concurent multiplexing (MPX),
we need a remote connection that also supports it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:39 +01:00
Stefan Metzmacher
3a17389e1b s4:rpc_server/remote: add dcerpc_remote:allow_anonymous_fallback option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:38 +01:00
Stefan Metzmacher
23d1393a5f s4:rpc_server/remote: reformat code to get "dcerpc_remote:use_machine_account"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:38 +01:00
Stefan Metzmacher
d9b88ccd81 s4:rpc_server/remote: reformat code to get "dcerpc_remote:binding"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:38 +01:00
Stefan Metzmacher
1f348d077b s4:rpc_server/remote: remote_op_bind already has the table available
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:38 +01:00
Stefan Metzmacher
965abe8e1a s4:rpc_server/remote: introduce remote_get_private()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:38 +01:00
Stefan Metzmacher
245a0ef73f s4:rpc_server/dnsserver: make use of dcesrv_iface_state_{create,find}_conn()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:38 +01:00
Stefan Metzmacher
5cbcc78a40 s4:rpc_server/netlogon: make use of dcesrv_iface_state_{create,find}_conn()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:38 +01:00
Stefan Metzmacher
c76a5be87b s4:rpc_server: add dcesrv_iface_state_{store,find}_{assoc,conn}() helpers
They can be used instead of
dcesrv_connection_context->private_data and
dcesrv_assoc_group->proxied_id.

This is the first step to hide internal details of
the core dcerpc server from the interface implementations.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:38 +01:00
Stefan Metzmacher
38e0c06abc s4:rpc_server: move bind_time_features to dcesrv_assoc_group
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:37 +01:00
Stefan Metzmacher
6b02b94d03 s4:rpc_server: add a min_auth_level to context handles
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:37 +01:00
Stefan Metzmacher
d8293acdb4 s4:rpc_server: replace dce_conn->allow_request with auth->auth_finished
They both had the same lifetime and the disconnect case is now
caught by auth->auth_invalid = true.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:37 +01:00
Stefan Metzmacher
13e52cc929 s4:rpc_server: replace dce_conn->allow_auth3 with auth->auth_started
auth3 is allowed if auth_started is true and auth_finished is false.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:37 +01:00
Stefan Metzmacher
0191516efc s4:rpc_server: set auth_invalid = true on disconnect
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:37 +01:00
Stefan Metzmacher
b46df3a85c s4:rpc_server: split out log_successful_dcesrv_authz_event()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:37 +01:00
Stefan Metzmacher
76976eab01 s4:rpc_server: add some protection checks to dcesrv_auth_prepare_gensec()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:37 +01:00
Stefan Metzmacher
2640f60e88 s4:rpc_server: split out dcesrv_auth_prepare_gensec()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:37 +01:00