1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Commit Graph

107990 Commits

Author SHA1 Message Date
Gary Lockyer
d51253609d samba-tool tests: Tests for virtualCryptSHAxxx rounds
Add tests to for the new rounds option for the virtualCryptSHA256 and
virtualCryptSHA512 attributes.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-25 02:25:12 +02:00
Gary Lockyer
3bcd384dcf samba-tool user: Support for virtualWDigest attributes
Add new virtualWDigest attributes, these return the hashes stored in
supplementalCredentials Primary:WDigest, in a form suitable for
htdigest authentication

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-25 02:25:11 +02:00
Gary Lockyer
81312ba4e2 samba-tool user: Tests for virtualWDigest attributes
Add tests for the new virtualWDigest attributes, these return the hashes
stored in supplementalCredentials Primary:WDigest in a form suitable for
use with htdigest authentication.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-25 02:25:11 +02:00
Amitay Isaacs
f47d331e67 ctdb-daemon: Add AllowMixedVersions tunable
This allows to mix CTDB major versions in a single cluster.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Wed May 24 21:06:28 CEST 2017 on sn-devel-144
2017-05-24 21:06:28 +02:00
Amitay Isaacs
305795a323 ctdb-daemon: Do not allow mixed ctdb versions in a cluster
Extend CTDB_REQ_KEEPALIVE packet to include version and uptime.  If CTDB
versions do not match shutdown ctdb.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-05-24 17:03:28 +02:00
Amitay Isaacs
9ec302bfad ctdb-keepalive: Move ctdb_send_keepalive() to ctdb_keepalive.c
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-05-24 17:03:28 +02:00
Amitay Isaacs
075613489c ctdb-packaging: Remove mkversion.sh script
It's not used any more as the version headers are generated from waf.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-05-24 17:03:28 +02:00
Amitay Isaacs
f1ad7d075a ctdb-build: Simplify generation of version header files
Generate version headers from waf instead of separate shell script.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-05-24 17:03:28 +02:00
Amitay Isaacs
ae35bb8eaf wafsamba: Allow to specify VERSION file path
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-05-24 17:03:28 +02:00
Amitay Isaacs
f5f05a644d ctdb-readonly: Avoid a tight loop waiting for revoke to complete
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12697

During revoking readonly delegations, if one of the nodes disappears,
then there is no point re-trying revoking readonly delegation immedately.
The database needs to be recovered before the revoke operation can
succeed.

However, if the revoke is successful, then all the write requests need
to be processed immediately before the read-only requests.  This avoids
starving write requests, in case there are read-only requests coming
from other nodes.

In deferred_call_destructor, the result of revoke is not available and
deferred calls cannot be correctly ordered.  To correctly order the
deferred calls, process them in revokechild_destructor where the result
of revoke is known.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-05-24 17:03:28 +02:00
Amitay Isaacs
a50b25d0eb Revert "ctdb-readonly: Avoid a tight loop waiting for revoke to complete"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12697

This reverts commit ad758cb869.

This is an incomplete fix and introduces a regression.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-05-24 17:03:27 +02:00
Volker Lendecke
02a76d86db CVE-2017-7494: rpc_server3: Refuse to open pipe names with / inside
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12780

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Wed May 24 14:34:30 CEST 2017 on sn-devel-144
2017-05-24 14:34:30 +02:00
Andrew Bartlett
82bb44dd3b dsdb: Do not search the sam.ldb file when trying to search all partitions
The sam.ldb file does not contain the same kind of data as the partitions, we do not wish to
mix these results.  This also avoids taking out locks on the sam.ldb file.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue May 23 05:18:04 CEST 2017 on sn-devel-144
2017-05-23 05:18:04 +02:00
Andrew Bartlett
5f0e53f1b9 dsdb: Do not write the @INDEXLIST or @ATTRIBUTES records during schema refresh
Instead, write it once in the module init, if required, and after a
modify to the schema partition is detected

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-05-23 01:13:25 +02:00
Andrew Bartlett
b8ba0103bf dsdb: Take out the transaction and prepare_commit locks in the same order
We must, when starting the transaction and preparing to commit the transaction, take
out the locks in the same order across all the databases, otherwise we may deadlock.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-05-23 01:13:25 +02:00
Andrew Bartlett
c23b191ac4 ldb_tdb: Call talloc_free(options_dn) as soon as we are done with options_dn
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-05-23 01:13:25 +02:00
Andrew Bartlett
496feccad4 ldb_tdb: Provide better debugging on end_trans failures
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-05-23 01:13:24 +02:00
Andrew Bartlett
a2a1962dc0 ldb_tdb: Provide better debugging on prepare_commit failures
ltdb_index_transaction_commit() does LDB operations, sets the ldb
error string and returns LDB errors so we should not check the tdb
error code.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-05-23 01:13:24 +02:00
Andrew Bartlett
1fd8ec23c7 tdb: Improve debugging when the allrecord lock fails to upgrade
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-05-23 01:13:24 +02:00
Jeremy Allison
4c234a90a9 s3: smbd: Correctly identify a snapshot path using UCF_GMT_PATHNAME.
All our client code already does this correctly for @GMT names.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon May 22 22:49:17 CEST 2017 on sn-devel-144
2017-05-22 22:49:17 +02:00
Jeremy Allison
aa72d09b31 s3: smbd: Add UCF_GMT_PATHNAME, which represents FLAGS2_REPARSE_PATH.
This must be set by a client to use shadow copy (@GMT) paths.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:16 +02:00
Jeremy Allison
1c9183bb38 s3: smbd: Fix up the ucf_flags correctly in smb_file_rename_information().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:16 +02:00
Jeremy Allison
f2f936a961 s3: smbd: We can now remove the 'bool dfs_path' parameter from filename_convert().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:16 +02:00
Jeremy Allison
0fbf5b644d s3: smbd: Add UCF_DFS_PATHNAME which tracks the flags2 FLAGS2_DFS_PATHNAMES bit.
Set inside ucf_flags_from_smb_request(). This will allow us to
remove the req->flags2 & FLAGS2_DFS_PATHNAMES parameter from
filename_convert().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:15 +02:00
Jeremy Allison
29ec474454 s3: smbd: In ntrename OR in ucf_flags, don't overwrite.
This isn't worth a bug backport as right now the only flag that
could be overwritten is the UCF_POSIX_PATHNAMES flag, and for
a POSIX connection the client will use posix rename, not an
ntrename.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:15 +02:00
Jeremy Allison
4910febdac s3: smbd: Always use ucf_flags_from_smb_request() in place of checking by hand (in most cases).
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:15 +02:00
Jeremy Allison
f5866c66a4 s3: smbd: Split out ucf_flags_from_smb_request() from filename_create_ucf_flags().
We will use this elsewhere in later commits.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:15 +02:00
Jeremy Allison
8a2aa27f74 s3: smbd: Make it clear we only overwrite *ppath_contains_wcard if resolve_dfspath_wcard() detected a wildcard.
The API for this function specifies that *ppath_contains_wcard
must already have been initialized on entry to filename_convert()
(not a great design, but that's the way it is currently).

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:15 +02:00
Jeremy Allison
0e1c0684c2 s3: smbd: Remove ugly use of discard_const that previously was hidden in resolve_dfspath_wcard().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:15 +02:00
Jeremy Allison
2647eedb61 s3: smbd: Remove bool dfs_pathnames paramter from resolve_dfspath_wcard().
Start cleaning up the pathname parsing to move flags2 checks into UCF_FLAGS
function.

NB. This now only sets *ppath_contains_wcard inside resolve_dfspath_wcard()
if dfs_redirect() sets path_contains_wcard to true, which is a change
from the previous code which could potentially set *ppath_contains_wcard
to an uninitialized value if dfs_redirect() returned without setting
path_contains_wcard.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-05-22 18:41:15 +02:00
Stefan Metzmacher
27324112b6 s4:libcli/ldap: just use gensec_update() in ldap_bind_sasl()
We're in a blocking/sync call, we should avoid using nested event loops for
this. As far as I can see ldap_bind_sasl() is only called from command line
tools, which are ok to block.

Resolving this requires also resolving the general case in LDB, as that is the
API this is used from.  We would need ldb_connect_send() and ldb_connect_recv()
at a start.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon May 22 01:12:23 CEST 2017 on sn-devel-144
2017-05-22 01:12:23 +02:00
Stefan Metzmacher
3c2e02968e s4:libcli/smb2: make smb2_session_setup_spnego_* completely async
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
2c3e99d169 s4:librpc: simplify dcerpc_connect_timeout_handler() logic
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
2c4e21cd6e s4:librpc: make use of gensec_update_send() in bind_auth_next_step()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
65655f2484 s4:librpc: use gensec_update_send() in dcerpc_bind_auth_send()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
f31c55fd9b s4:rpc_server: implement async AUTH3 using gensec_update_send/recv
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
0f55829940 s4:rpc_server: implement async ALTER_CONTEXT using gensec_update_send/recv
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
2681370cea s4:rpc_server: implement async BIND using gensec_update_send/recv
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
c449313df7 s4:rpc_server: remove unused dcesrv_auth_{bind_ack,auth3,alter_ack}()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
b680e9e0ea s4:rpc_server: make use of dcesrv_auth_prepare_auth3() in dcesrv_auth3()
It means we also need to call gensec_update_ev() and dcesrv_auth_complete()
directly in dcesrv_auth3(). Doing that will make it easier to make dcesrv_auth3()
async in the next commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
aa2df9efb5 s4:rpc_server: make use of dcesrv_auth_prepare_alter_ack() in dcesrv_alter()
It means we also need to call gensec_update_ev() and dcesrv_auth_complete()
directly in dcesrv_alter(). Doing that will make it easier to make dcesrv_alter()
async in the next commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
7274dffa75 s4:rpc_server: make use of dcesrv_auth_prepare_bind_ack() in dcesrv_bind()
It means we also need to call gensec_update_ev() and dcesrv_auth_complete()
directly in dcesrv_bind(). Doing that will make it easier to make dcesrv_bind()
async in the next commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
5a408bbdc8 s4:rpc_server: make use of dcesrv_auth_reply() in dcesrv_alter()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
d698c83946 s4:rpc_server: split out dcesrv_auth_reply() from dcesrv_bind()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:13 +02:00
Stefan Metzmacher
6cc8d7880d s4:rpc_server: remove useless TALLOC_FREE(call->context) from dcesrv_bind()
This is not needed if we're terminating the connection anyway.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:12 +02:00
Stefan Metzmacher
bcf33f3cb6 s4:rpc_server: split out dcesrv_auth_prepare_alter_ack()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:12 +02:00
Stefan Metzmacher
352b5ecca3 s4:rpc_server: split out dcesrv_auth_prepare_auth3()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:12 +02:00
Stefan Metzmacher
f65625e4e7 s4:rpc_server: split out dcesrv_auth_prepare_bind_ack()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:12 +02:00
Stefan Metzmacher
9f5110b5b5 s4:rpc_server: make use of dcesrv_auth_complete() in dcesrv_auth_auth3()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:12 +02:00
Stefan Metzmacher
f3be27c79c s4:rpc_server: prepare dcesrv_auth_complete() for AUTH3
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-21 21:05:12 +02:00