1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

3472 Commits

Author SHA1 Message Date
Garming Sam
6e8fcd8833 samba_dnsupdate: Remove extra argument from debug
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13 07:29:16 +02:00
Garming Sam
f55399fb39 samba_dnsupdate: Add additional debugging
Tests are still flapping, because it claims it needs a cache rebuild.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Mar 28 00:04:54 CEST 2017 on sn-devel-144
2017-03-28 00:04:54 +02:00
Chris Lamb
bca0d8ee67 Correct "defered" typos.
Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-22 08:26:23 +01:00
Chris Lamb
5482e5426e Correct "existence" typos.
Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-22 08:26:22 +01:00
Stefan Metzmacher
383432d2cd s4:scripting: use generate_random_machine_password() for machine passwords
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12262

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-02-21 16:09:22 +01:00
Bob Campbell
625dbd208d errors: generate error codes for WERROR
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-14 09:46:23 +01:00
Bob Campbell
aad57f9f1f errors: pull out code into common file
This is a precursor to generating other types of errors.

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-14 09:46:23 +01:00
Bob Campbell
a3d1af729b errors/gen_ntstatus: generate error codes in specified files
Previously, we would append new errors on to the existing ntstatus.h and
nterr.c. We can now specify which files to write to, and it will write
all errors to those files.

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-14 09:46:22 +01:00
Andrew Bartlett
28d911aa32 gen_ntstatus.py: Add prototype to generated py_ntstatus.c
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-14 09:46:22 +01:00
Bob Campbell
99e41a377e errors: fix "generate python error codes for NTSTATUS"
Fixups according to feedback on the list.

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-14 09:46:22 +01:00
Günther Deschner
b806b69d19 errors: generate python error codes for NTSTATUS
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-14 09:46:22 +01:00
Douglas Bagnall
2ad69f4bd0 getncchanges script: use library code, not copied functions.
These functions were duplicates. To be exact, the diff -ub between what
getncchanges had, and what drs_uitls now has is this:

|@@ -1,4 +1,5 @@
|-def do_DsBind(drs):
|+def drs_DsBind(drs):
|     '''make a DsBind call, returning the binding handle'''
|     bind_info = drsuapi.DsBindInfoCtr()
|     bind_info.length = 28
|@@ -32,7 +33,8 @@
|     bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7
|     bind_info.info.supported_extensions	|= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT
|     (info, handle) = drs.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info)
|-    return handle
|+
|+    return (handle, info.info.supported_extensions)
|
|
| def drs_get_rodc_partial_attribute_set(samdb):
|@@ -43,7 +45,7 @@
|     attids = []
|
|     # the exact list of attids we send is quite critical. Note that
|-    # we do ask for the secret attributes, but set set SPECIAL_SECRET_PROCESSING
|+    # we do ask for the secret attributes, but set SPECIAL_SECRET_PROCESSING
|     # to zero them out
|     schema_dn = samdb.get_schema_basedn()
|     res = samdb.search(base=schema_dn, scope=ldb.SCOPE_SUBTREE,
|@@ -71,3 +73,4 @@
|     partial_attribute_set.attids         = attids
|     partial_attribute_set.num_attids = len(attids)
|     return partial_attribute_set

while the drs_utils code has changed in moving
drs_get_rodc_partial_attribute_set() out of the class.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-02-10 05:09:08 +01:00
Andrew Bartlett
bd8d9559bf param: Remove winbindd privileged socket directory option
This option is unused and has not been used since before Samba 4.3
when the source4/ winbindd code went away.

The associated dynconfig parameters used for the default are also removed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10066

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:12 +01:00
Stefan Metzmacher
ee30821eca CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss
This is just an example script that's not directly used by samba,
but we should avoid sending delegated credentials to dns servers.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
2016-12-20 07:51:14 +01:00
Garming Sam
c1a316bea6 samba_dnsupdate: Raise after the error count is incremented
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Tue Nov 22 05:59:40 CET 2016 on sn-devel-144
2016-11-22 05:59:40 +01:00
Garming Sam
f4d6e2ab70 samba_dnsupdate: cmd._run doesn't have Exceptions
It returns a return code of -1 instead.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-11-22 02:10:16 +01:00
Garming Sam
5889f399da upgradeprovision: Remove objectCategory from constructed attrs
The new dbcheck rules identify an error where the GUID of the
objectCategory does not exist (pointing to a non-existent schema
object). As objectClass was not copied over either, it makes sense not
to copy over the objectCategory.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12297
2016-11-22 02:10:16 +01:00
Günther Deschner
1bbf299cc1 s4-scripting: make w32err_code.py work with recent html table changes.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-28 00:04:16 +02:00
Günther Deschner
8f056d07ab hresult: add new HRESULT_FROM_WERROR macro
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2016-09-26 20:24:18 +02:00
Christian Ambach
064d240323 s4:samba_spnupdate: do not attempt to parse log level, use parsed value
The log level parameter can contain debug class specific entries.
Do not attempt to parse this as int, but use the values that the
debugging system already parsed

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9945
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Wed Sep 14 23:15:18 CEST 2016 on sn-devel-144
2016-09-14 23:15:18 +02:00
Garming Sam
ddc059397d samba_upgradedns: Check for both accounts in BIND_DLZ upgrade
Signed-off-by: Garming Sam <garming@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10882

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Aug 29 08:53:14 CEST 2016 on sn-devel-144
2016-08-29 08:53:13 +02:00
Günther Deschner
9c5cd9922b hresult: create enough space for the hresult_errstr message.
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-23 01:06:24 +02:00
Günther Deschner
beb99b8061 s4-scripting: let gen_hresult.py tolerate empty lines.
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-23 01:06:24 +02:00
Andrew Bartlett
1ce7721b17 Revert "source4/scripting: add an option to samba_dnsupdate to add ns records."
This reverts a totally unnecessary change to samba_dnsupdate. The self test
environment does the correct things with NS records now.

This reverts commit af08cb2eee.

Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jun 27 04:13:04 CEST 2016 on sn-devel-144
2016-06-27 04:13:04 +02:00
Richard Sharpe
af08cb2eee source4/scripting: add an option to samba_dnsupdate to add ns records.
Add a --add-ns option to samba_dnsupdate and use that, but only when --use-file has been specified, to add an NS record to the file produced.

This allows us to make progress in the self tests and is an interim fix.

Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Rowland Penny <repenny241155@gmail.com>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jun 21 00:51:02 CEST 2016 on sn-devel-144
2016-06-21 00:51:01 +02:00
Andrew Bartlett
ba22d29144 selftest: Always set up a resolv.conf and use it in samba_dnsupdate
This allows samba_dnsupdate to be tested without resolv_wrapper.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:14 +02:00
Andrew Bartlett
26b475fb32 samba_dnsupdate: Give the administrator more detail when DNS lookups fail
This avoids treating server errors identically to name-not-present status values

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:14 +02:00
Andrew Bartlett
8f1659e540 samba_dnsupdate: Implement RPC <ZONE> prefix in dns_update_list
This allows us to update the stub records as well as the zone itself.

Based on a proposed syntax by metze.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:14 +02:00
Andrew Bartlett
b1ab37ec5b samba_dnsupdate: Simplify logic and add more verbose debugging
By reducing the intendation this code is a little clearer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:13 +02:00
Andrew Bartlett
72d5fa79a0 samba_dnsupdate: Allow admin to force a particular IP into samba_dnsupdate
This should help in deployements beyind NAT.

It will also help in testing.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:13 +02:00
Andrew Bartlett
c9aefa93c1 samba_dnsupdate: Add a mode that calls samba-tool dns, rather than nsupdate
This mode is more likely to work when we change hostname or IP

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 04:40:13 +02:00
Andreas Schneider
789ec34007 samba_dnsupdate: Work around a bug in nsupdate
The doio_send() function of bind fails on a short write with sendmsg().

See https://bugzilla.redhat.com/show_bug.cgi?id=1250921

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-16 04:40:13 +02:00
Garming Sam
de2e955e3e samba_dnsupdate: Fix typo in -no-substitutions name
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-16 04:40:13 +02:00
Stefan Metzmacher
8841b1e641 s4:scripting/devel: make use of the generic arcfour_encrypt() and string_to_byte_array() functions
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11699

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-02-03 08:33:11 +01:00
Andrew Bartlett
dc20c307cc samba_upgradedns: Set correct permissions on secrets.keytab for BIND9
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2015-12-15 08:42:20 +01:00
Andrew Bartlett
308d645f34 samba_upgradedns: Improve search for existing accounts in secrets.ldb
We should actually check for the combination of both an account in secrets.ldb
and sam.ldb, but this is at least an improvement.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2015-12-15 08:42:20 +01:00
Andrew Bartlett
d38e22184e samba_dnsupdate: Simplify logic and add more verbose debugging
By reducing the intendation this code is a little clearer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2015-12-15 08:42:20 +01:00
Andrew Bartlett
9bbb468dcb samba_dnsupdate: Expand output when --verbose is set
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2015-12-15 08:42:20 +01:00
Mathieu Parent
c315fce17e Fix various spelling errors
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Nov  6 13:43:45 CET 2015 on sn-devel-104
2015-11-06 13:43:45 +01:00
Douglas Bagnall
4346fe6a02 KCC: allow --test-all-reps-from to work with --import-ldif
The ldif files lack information that a normal database has, which means
the ldif import function has to use some trickery to set the local DSA.
Once the local DSA is thus set, the fake database is a bit useless from
the point of view of other DSAs. We get around this by re-importing it
each time.

This is doing something slightly different than the normal samdb
--test-all-reps-from, in that the changes are not preserved between each
DSA's run. With the samdb database (unless using --readonly), the later
DSA's will see changes the early ones made. The ordering is arbitrary.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Oct 29 08:11:54 CET 2015 on sn-devel-104
2015-10-29 08:11:54 +01:00
Douglas Bagnall
8bdfb256d6 KCC: samba_kcc --tmpdb X won't run if X already exists
Part of an ongoing safety campaign, making it harder to overwrite
your valuable things while keeping it easy enough to test crazy schemes.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-10-29 05:08:16 +01:00
Douglas Bagnall
e29fba640b KCC: with --import-ldif, don't default to standard DB url
Before samba_kcc would always assume `-H /usr/local/whatever`, and this
interacted badly with the likes of `--test-all-reps-from` and
`--forget-intersite-links`.  When I say badly, I mean it crashed because
the file is absent on my dev machine.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-10-29 05:08:16 +01:00
Douglas Bagnall
46ac3a5308 KCC: kcc.import_ldif doesn't need creds
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-10-29 05:08:16 +01:00
Douglas Bagnall
b93205ebe4 KCC: whitespace for pep8
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-10-29 05:08:16 +01:00
Douglas Bagnall
8fe9992cff KCC: load samdb before calling kcc.run()
kcc.run() is a mega-function that does nearly everything, including
loading the database. The --list-valid-dsas and --test-all-reps-from
tasks also want to load the database, but not do all that other run()
stuff, so it makes sense to pull it out. When the samdb has not been
loaded, run() will still load it -- this avoids having to change all
the tests.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-10-29 05:08:15 +01:00
Douglas Bagnall
ad009be329 KCC: shift --test-all-reps-from call to after kcc loading
This is in an effort to allow --test-all-reps-from to work with
--import-ldif (though so far it doesn't for other reasons). Rather than
replicate all the ldif loading logic within test_all_reps_from, we just
wait delay the test_all_reps_from() call.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-10-29 05:08:15 +01:00
Douglas Bagnall
a9ddca042c KCC: Simplify RNG seeding logic, dropping the default value
There is no particular justification for the previous default, other
than being deterministic makes testing more reliable. The algorithms
using randomness do not assume determinism.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-10-29 05:08:15 +01:00
Douglas Bagnall
acd77283cc KCC: default to not loading new samdb when we already have one
This should make things simpler in the --import-ldif case.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-10-29 05:08:15 +01:00
Andrew Bartlett
e8bab905d3 samba_upgradedns: Remove unused variable
dnssecret is not used at any point later in the script

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-10-20 20:22:22 +02:00
Günther Deschner
d8b2421767 s4-scripting: fix minor indent issue for hresult generation.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-09-30 23:51:12 +02:00