1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-26 10:04:02 +03:00

2264 Commits

Author SHA1 Message Date
Jelmer Vernooij
5548d3d41e Add missing dependencies for com_err. 2010-10-05 00:38:35 +02:00
Jelmer Vernooij
9eab95bd08 heimdal: Fix name of hx509 library. 2010-10-05 00:38:34 +02:00
Matthias Dieter Wallnöfer
6320cface9 s4:dsdb/common/util.c - change the usage of the RECYCLED control
Use it only in conjunction with the DELETE one to allow the functions to work
also against Windows < 2008R2. This is really important for the vampire
operation.

Also mark the RECYCLED control as non-critical (so that it's simply ignored by
older Windows'es).

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Mon Oct  4 16:10:11 UTC 2010 on sn-devel-104
2010-10-04 16:10:11 +00:00
Matthias Dieter Wallnöfer
24282adb9a s4:ldap.py - test allowed system flags restriction
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 16:50:06 +00:00
Matthias Dieter Wallnöfer
ca08cde150 s4:objectclass LDB module - introduce allowed system flags restriction
Let us do the distinction by real use and provision by the RELAX flag

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 16:50:06 +00:00
Matthias Dieter Wallnöfer
4e8206eb4c s4:urgent_replication.py - fix up the system flags handling
And relax some more object creations due to the enforced system flags rules.
2010-10-03 16:50:06 +00:00
Matthias Dieter Wallnöfer
a095a08e25 s4:deletetest.py - enhance the tests
- Integrate the ldap.py delete protection testing code and enhance it
- Demonstrate the DISALLOW_MOVE_ON_DELETE system flag

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:19 +00:00
Matthias Dieter Wallnöfer
b2385e3725 s4:ldap.py - remove the delete tests
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:19 +00:00
Matthias Dieter Wallnöfer
e3081b92c1 s4:dsdb - substitute the "show_deleted" with the "show_recycled" control
We intend to see always all objects with the "show_deleted" control specified.
To see also recycled objects (beginning with 2008_R2 function level) we need to
use the new "show_recycled" control.

As far as I see this is only internal code and therefore we don't run into
problems if we do substitute it.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:18 +00:00
Matthias Dieter Wallnöfer
46282da011 s4:dsdb/common/util.c - introduce "DSDB_SEARCH_SHOW_RECYCLED" flag
This is needed since starting with 2008_R2 function level we get another type
of hidden objects which aren't seen by the "show_deleted" control: recycled
objects.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:18 +00:00
Matthias Dieter Wallnöfer
779b97325a s4:subtree_rename LDB module - also already deleted objects have to be renamed
This is needed if the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag was specified
and the parent is renamed.

To be able to do this we also need to relax the constraint checks (using the
"isDeleted" proof).

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:18 +00:00
Matthias Dieter Wallnöfer
69b7a87e98 s4:show_deleted LDB module - also support the "show_recycled" control
MS-ADTS 3.1.1.3.4.1 and MS-ADTS 3.1.1.5.5

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:18 +00:00
Matthias Dieter Wallnöfer
e1509ec623 s4:repl_meta_data LDB module - consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:18 +00:00
Matthias Dieter Wallnöfer
2b4f652899 s4:subtree_delete LDB module - it is only responsible for non-deleted objects
The deleted objects (tombstones, recycled & deleted objects) are handled by
"repl_meta_data".

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:18 +00:00
Matthias Dieter Wallnöfer
4768280614 s4:objectclass LDB module - fix the "crossRef" delete protection
This is what Windows does

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:18 +00:00
Matthias Dieter Wallnöfer
6c9b25ea5c s4:objectclass LDB module - fix the delete behaviour of server containers
A typo prevented the right behaviour.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-03 15:23:18 +00:00
Matthias Dieter Wallnöfer
64be07bc70 s4:dsdb_dn_val_rmd_flags - memmem - scan the whole string for occourences
Do this as in "dsdb_dn_is_upgraded_link_val". There is really no reason to
truncate before search.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Oct  3 10:45:39 UTC 2010 on sn-devel-104
2010-10-03 10:45:39 +00:00
Matthias Dieter Wallnöfer
bb81760e82 s4:ldap.py - delete the right object after test completition 2010-10-03 12:05:13 +02:00
Matthias Dieter Wallnöfer
f9244a15c7 s4:ldap.py - fix "system only" test
A part was missing
2010-10-03 12:05:13 +02:00
Matthias Dieter Wallnöfer
14c660da32 s4:acl_read LDB module - fix counter type 2010-10-03 12:05:13 +02:00
Andrew Tridgell
32ec1b36e0 s4-kcc: silence "Testing kcctpl_create_intersite_connections" message
Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Sun Oct  3 04:51:44 UTC 2010 on sn-devel-104
2010-10-03 04:51:44 +00:00
Kamen Mazdrashki
657d4d8812 s4-test-dsdb_schema_info.py: Get rid of global module variables 2010-10-03 01:24:57 +03:00
Kamen Mazdrashki
83a15155eb s4-test-dsdb_schema_info.py: Simplify connection SamDB
by using samba.tests.connect_samdb() helper
2010-10-03 01:24:57 +03:00
Andrew Tridgell
eadd28233d s4-repl: use the GC principal name for DRS replication connection
this is required when talking to RODCs (for notify calls), and is good
practice for all DCs

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-01 22:31:58 -07:00
Andrew Tridgell
ee15dc9692 s4-dsdb: added dsdb_search_by_dn_guid()
this is more efficient than first searching for the DN, then doing a
search. We should look at using this in lots of existing code

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-01 21:09:51 -07:00
Andrew Tridgell
23a8fad22b s4-drs: fixed comparison login in replicated renames
we need to ensure we only ever compare USNs from the same originating
invocation ID.

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Sat Oct  2 01:45:19 UTC 2010 on sn-devel-104
2010-10-02 01:45:19 +00:00
Andrew Tridgell
6e846ca1f3 s4-kcc: remove stale repsTo entries in the KCC
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-02 01:04:17 +00:00
Andrew Tridgell
f6bc4c08b1 s4-rpmd: fixed a use after realloc bug
we could use old_el after the base message had been re allocated, due
to adding timestamps. We need to re-find the element before using it

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-01 10:44:24 -07:00
Andrew Tridgell
4beff4d7ba s4-dsdb: fail the transaction instead of asserting on error
It is more useful to fail the transaction and give the user an error
message than to assert when we have an error in the repl_meta_data
module

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-01 10:44:24 -07:00
Andrew Tridgell
c03d02d28e s4-rodc: don't set SPECIAL_SECRET_PROCESSING on EXOP_REPL_SECRET
otherwise we don't get the secrets!

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-30 20:11:15 -07:00
Andrew Tridgell
57f67701a6 s4-dsdb: silence the domainFunctionality not setup warning 2010-09-30 14:36:11 -07:00
Andrew Tridgell
1a9f5b45f8 s4-drepl: don't call UpdateRefs on a RODC
we use the ADD_REF bit in getncchanges instead

Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
2010-09-29 22:12:57 -07:00
Andrew Tridgell
287e35f4cf s4-drepl: fixed the checking of replica_flags in the drepl server
we were incorrectly avoiding a getncchanges when WRIT_REP was not set

Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
2010-09-29 22:12:57 -07:00
Andrew Tridgell
4d551753d6 s4-kcc: fixed the replica_flags in repsFrom in the kcc
if our calculated replica_flags doesn't match the ones in our repsFrom
then update it

Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
2010-09-29 22:12:57 -07:00
Andrew Tridgell
1f3f75f747 s4-samldb: also set a password on the krbtgt_NNNN account
when we setup the krbtgt_NNNN account using the DCPROMO_OID control,
we also need to set an initial password for this account

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-29 16:36:23 -07:00
Nadezhda Ivanova
3b0d6fda38 s4-rodc: RODC should not accept requests for role transfer
A RODC cannot assume a role, and unwillingToPerform must be
returned if such request is sent via LDAP
2010-09-29 03:09:15 +00:00
Andrew Tridgell
d4939ce4fc s4-drs: moved the drs_ObjectIdentifier handling to dsdb_dn.c
this will be used outside of the drs server.

This also fixes the handling of the ndr_size elements of the
drs_ObjectIdentifier
2010-09-28 11:36:40 -07:00
Nadezhda Ivanova
6caa512815 s4-dsdb: adapted check_access_on_dn for use in drs. 2010-09-28 11:36:40 -07:00
Andrew Bartlett
88abf441d0 s4-dsdb Add ldb_reset_err_string() when we set error codes.
If we don't we could show an old, incrorrect error
2010-09-29 04:23:07 +10:00
Andrew Bartlett
063b61289d s4-dsdb Make samdb_reference_dn() use dsdb_search() and DSDB_SEARCH_ONE_ONLY
This simplifies the function.  While doing so, also change the error
string setting to set a really clear error string for the failure to find
and failure to parse cases.

Andrew Bartlett
2010-09-29 04:23:07 +10:00
Andrew Bartlett
8b57482fa8 s4-dsdb Fix segfault in error case in rootdse module 2010-09-29 04:23:07 +10:00
Andrew Tridgell
0bbbfa04f6 s4-dns: implemented RODC DNS update in dns update task
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-27 22:55:05 -07:00
Andrew Tridgell
1587b46fa0 s4-ldb: removed an unused variable 2010-09-27 22:55:04 -07:00
Andrew Tridgell
17aa2b3294 s4-kcc: fixed a incorrect context to kcctpl_get_all_bridgehead_dcs 2010-09-27 22:55:04 -07:00
Andrew Tridgell
e313667983 s4-dsdb: added samdb_find_site_for_computer() and samdb_find_ntdsguid_for_computer()
these will be used by the new RODC dns update code

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-27 22:55:04 -07:00
Andrew Tridgell
396cdd6343 s4-kcc: don't print "Testing kcctpl_create_intersite_connections"
log level 0 is excessive for this!
2010-09-27 23:18:23 +00:00
Nadezhda Ivanova
aeedd29d39 s4-ldb: Added ldb_request_replace_control
It is the same as ldb_request_add_control, except it will replace
an existing control.

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Mon Sep 27 19:00:38 UTC 2010 on sn-devel-104
2010-09-27 19:00:38 +00:00
Nadezhda Ivanova
99ac4e92ff s4-ldbmodules: Added new module aclread to handle access checks on LDAP search
It is currently enabled only if the request comes from the LDAP server, and is
disabled  by default. Use acl:search=true in smb.conf to enable it.
It filters out all objects the user is not allowed to see, and all attributes
the user does not have RP on. Extended access not supported yet.
2010-09-26 15:36:09 -07:00
Nadezhda Ivanova
93ba17285d s4-tests: Added tests for search checks on attributes
The ACL reach tests are in the knowfail because aclread module is not
enabled by default
2010-09-26 15:36:09 -07:00
Nadezhda Ivanova
3e08965369 s4-tests: Removed search tests with anonymous credentials as they fail againts Windows
These tests will fail in make test as well if the acl_read module is enabled.
2010-09-26 15:36:09 -07:00