1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

468 Commits

Author SHA1 Message Date
Andrew Bartlett
9ed7555c82 nsswitch: Remove fallback setting of WINBINDD_SOCKET_DIR
This is the original cause of the wbc NT_STATUS_OBJECT_NAME_NOT_FOUND issues in recent git master, as the
build was able to progress without the correct path being set as an override.

Andrew Bartlett

Change-Id: I1dbc7350695756356e869199b589eb781eb5c673
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Mar  5 18:34:48 CET 2014 on sn-devel-104
2014-03-05 18:34:48 +01:00
Andreas Schneider
f26db53273 nsswitch: Fix idmap rfc2307 test with system ldb.
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2014-02-21 15:59:28 +01:00
Volker Lendecke
efed82cb69 krb5_locator: Slightly simplify code
This makes it a bit easier to read for me

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Kai Blin <kai@samba.org>
2014-02-20 11:43:08 -08:00
Garming Sam
63c24977ba param: rename lp function and variable from 'lockdir' to 'lock_directory'
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-02-07 16:19:10 -08:00
Garming Sam
2c2f175b0d Revert "pam_winbind: fix segfault in pam_sm_authenticate()"
This reverts commit ec0f51b200.

A more generic fix is now in use.

Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jan 15 01:37:38 CET 2014 on sn-devel-104
2014-01-15 01:37:38 +01:00
Garming Sam
3a814e329b pam_winbind: Do not honour require_membership_of in the acct module parameters
This needs a password to work, and it confuses users for it to appear to be valid here.

Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2014-01-14 23:44:26 +01:00
Garming Sam
6f4ec0c041 pam_winbind: Fix segfault caused by invalid configuration options
This is a better fix for 8564 and will allow ec0f51b200 to be reverted.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=8564

Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2014-01-14 23:44:26 +01:00
Andreas Schneider
541164d47a wbinfo: Fix a memory leak in wbinfo_ping_dc().
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2014-01-09 20:42:54 +01:00
Jeremy Allison
b0ba4a5621 CVE-2013-4408:s3:Ensure LookupSids replies arrays are range checked.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:46 +01:00
Noel Power
f62683956a fail authentication for single group name which cannot be converted to sid
furthermore if more than one name is supplied and no sid is converted
then also fail.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=8598

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Fri Nov 29 15:45:11 CET 2013 on sn-devel-104
2013-11-29 15:45:11 +01:00
Volker Lendecke
ffae8a13b6 pam_winbind: Use strlcat in safe_append_string
We have that available via libreplace, so use it.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Thu Nov 28 14:33:32 CET 2013 on sn-devel-104
2013-11-28 14:33:32 +01:00
Noel Power
01cae099e0 handle later iniparser version assigning a zero length string value for 'key='
older iniparser versions ( like that used in upstream samba ) ignore 'key='
entries, the key is not entered into the dictionary at all. Later
versions of iniparse specifically handle the following special cases

* key=
* key=;
* key=#

by assigning a value of "" ( a zero length string ) to the key
in the dictionary.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Wed Nov 20 16:12:13 CET 2013 on sn-devel-104
2013-11-20 16:12:13 +01:00
Michael Adam
00c674985f wbinfo: fix output of wbinfo --sid-to-name for sids of type DOMAIN
to print only the domain name and not "DOMIN\<SID>".

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-13 11:40:28 +01:00
Michael Adam
f7240932af wbinfo: fix output of "--lookup-sids" to use the configured winbind separator
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-13 11:40:28 +01:00
Michael Adam
fdf28f0898 wbinfo: fix ouptput of --lookup-sids for sids of type DOMAIN
To print only the domain name and not "DOMIN\<SID>".

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-13 11:40:28 +01:00
Volker Lendecke
c6909887c2 nsswitch: Fix short writes in winbind_write_sock
We set the socket to nonblocking and don't handle EAGAIN right. We do
a poll anyway, so wait for writability, which should fix this.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10195
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-10-21 17:52:35 +02:00
Christian Ambach
20b64eae75 waf: replace dependency to libintl with samba_intl
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Mon Aug 12 00:46:34 CEST 2013 on sn-devel-104
2013-08-12 00:46:34 +02:00
Jeff Layton
ba9d8612e3 wbclient: fix conversion logic in wbcSidToStringBuf
Might as well fix it to handle large authority values properly. Also
correct some of the formatting.

Signed-off-by: Jeff Layton <jlayton@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-07-31 15:16:04 -07:00
Jeff Layton
1a4ec0b885 wbclient: fix conversion logic in wbcStringToSid
Signed-off-by: Jeff Layton <jlayton@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-07-31 15:15:47 -07:00
Andreas Schneider
f908e6b0c5 nsswitch: Add OPT_KRB5CCNAME to avoid an error message.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10048

Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jul 26 17:40:26 CEST 2013 on sn-devel-104
2013-07-26 17:40:25 +02:00
Günther Deschner
73e6feff9b wbinfo: allow to define a custom krb5ccname for kerberized pam auth.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-07-23 15:39:14 -07:00
Andreas Schneider
33bce26fcf nsswitch: Don't enumerate all domains with wbinfo -u|-g.
By default wbinfo -u|-g should only enumerate the domain winbindd is
joined to. The command can be harmfull if you have e.g. 30 domains and
700k users. Then the parent will collect all information and the
oom-killer will kill winbind. As we still want to support it, you can
enable it the old behaviour with wbinfo --domain='*' -u. This is
a measure that sysadmins don't shoot themself.

https://bugzilla.samba.org/show_bug.cgi?id=10034

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jul 18 11:54:58 CEST 2013 on sn-devel-104
2013-07-18 11:54:56 +02:00
Bill Parker
9b58da9866 Fix bug 10025 - Lack of Sanity Checking in calls to malloc()/calloc().
In reviewing various files in Samba-4.0.7, I found a number
of instances where malloc()/calloc() were called without the
checking the return value for a value of NULL, which would
indicate failure.

(NB. The changes needed to ccan, iniparser, popt and heimdal
will be reported upstream, not patched inside Samba).

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Source <idra@samba.org>
2013-07-17 16:12:19 -07:00
Christian Ambach
e65c53226c nsswitch: fix a comment
the beginning if is only ifdef LINUX now, not the long list this comment refers to

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-06-25 12:53:28 +02:00
Andrew Bartlett
2c70b0edcf nsswitch: Remove #if SAMBA_BUILD_ >= 4 now we only have the waf build
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-05-28 12:17:12 +10:00
Christian Ambach
1a7bd5e12c nsswitch: fix some typos
Signed-off-by: Christian Ambach <ambi@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri May 17 01:09:33 CEST 2013 on sn-devel-104
2013-05-17 01:09:33 +02:00
David Disseldorp
0fa404c7d5 Bug 9807 - wbinfo: fix segfault in wbinfo_pam_logon
wbinfo_pam_logon() incorrectly assumes that wbcLogonUser() always
returns an allocated wbcAuthErrorInfo struct on failure.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Apr 17 21:29:29 CEST 2013 on sn-devel-104
2013-04-17 21:29:29 +02:00
Andreas Schneider
9624ca4f88 BUG 9735: Fix winbind seperator in upn to username conversion.
Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Mar 22 16:18:06 CET 2013 on sn-devel-104
2013-03-22 16:18:06 +01:00
Christof Schmitt
6ac0bdc451 Add testcase for idmap_rfc2307 module
Create a new test environment with 'idmap config DOMAIN : backend =
rfc2307'. A new test script adds LDAP records and queries them again for
the mapped uid and gid.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Mar  9 08:18:43 CET 2013 on sn-devel-104
2013-03-09 08:18:43 +01:00
Richard Sharpe
11d1286323 Correct the name of the nss_winbind module for FreeBSD by creating a symlink
from the FreeBSD required name to the built module.

Signed-off-by: Timur Bakeyev <timur@FreeBSD.org>
Reviewed-by: Andrew Bartlett <abartlett@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>

Autobuild-User(master): Richard Sharpe <sharpe@samba.org>
Autobuild-Date(master): Fri Mar  8 05:04:04 CET 2013 on sn-devel-104
2013-03-08 05:04:04 +01:00
Andreas Schneider
301a3cb4af wbinfo: Fix several memory leaks.
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2013-02-22 16:36:13 +01:00
Andrew Bartlett
613f49ab8b build: Remove includes.h dep in winbind client libraries
Our LGPL winbind client libs do not link against our server-side code, and
should not use the server-side includes.h.

This removes a build-time dep on talloc that was brought in via includes.h as
this code also does not use talloc.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-02-22 08:46:35 +01:00
Ira Cooper
63a7d3817f nsswitch: Fix two bitfield constants being the same.
WBFLAG_PAM_AUTH_PAC and WBFLAG_BIG_NTLMV2_BLOB
are the same causing errors in NTLMv2 authentication.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 18 22:13:09 CET 2013 on sn-devel-104
2013-01-18 22:13:09 +01:00
Jeremy Allison
d814cfac01 Sort winbind request flags. Ira saw we have a duplicate.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed by: Ira Cooper <ira@wakeful.net>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-18 11:28:40 -08:00
Andrew Bartlett
c9d2ca585e selftest: Add test for rfc2307 mapping handling
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-10 14:52:52 +01:00
Andreas Schneider
f8a5abf960 libwbclient: Fix null check in process_domain_info_string().
Found by Coverity.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2012-12-21 13:56:00 +01:00
Andreas Schneider
24a897f029 nsswitch: Fix wbclient BAIL macros.
In the code you normally use:

BAIL_ON_WBC_ERROR;

but the last ; is statement never reached, so dead code.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2012-12-21 13:56:00 +01:00
Andreas Schneider
1dc414e4d2 nsswitch: Fix pam_get_{item,data} build warnings.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2012-12-12 15:00:02 +01:00
Andreas Schneider
de22df1419 nsswitch: Remove unused variable in _pam_winbind_change_pwd().
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2012-12-12 15:00:02 +01:00
Andreas Schneider
b8ed2efb50 nsswitch: Cleanup code in parse_wbinfo_domain_user().
Found by Coverity.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2012-12-12 15:00:02 +01:00
Andreas Schneider
04c0d4878e wbinfo: Use new samba_getpass() function.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:08 +01:00
Andrew Bartlett
f22e15d9d5 build: Do not install testing binaries
These binaries are for developer or selftest use, and are not
supported for installation onto the system.  The autoconf build does
not install these binaries, and so neither should the waf build.

Andrew Bartlett

Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Nov 22 12:00:36 CET 2012 on sn-devel-104
2012-11-22 12:00:36 +01:00
David Disseldorp
ec0f51b200 pam_winbind: fix segfault in pam_sm_authenticate()
Ensure the potentially null winbind context is not dereferenced on
cleanup.

https://bugzilla.samba.org/show_bug.cgi?id=8564

Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Oct 26 22:40:57 CEST 2012 on sn-devel-104
2012-10-26 22:40:57 +02:00
Andreas Schneider
1f017efeed waf: Create a libnss_winbind.so symlink.
This fixes bug #9299.
2012-10-22 09:04:21 +02:00
Andrew Bartlett
1f267ca10e nsswitch: Build nss_winbind on all supported platforms
This matches what the autoconf build can do.

Andrew Bartlett
2012-10-03 14:25:57 +02:00
Andrew Bartlett
0e037bfc60 selftest: Always build a linux-style nss_winbind for nss_wrapper 2012-10-03 14:25:57 +02:00
Ira Cooper
6dbe0aad26 s3: Fix libnss_winbind.so's build on Illumos/Solaris
Due to not building and linking in the winbind_nss_solaris bits in addition
to the linux bits, nss was broken on Solaris.

Autobuild-User(master): Ira Cooper <ira@samba.org>
Autobuild-Date(master): Sun Sep 30 22:56:30 CEST 2012 on sn-devel-104
2012-09-30 22:56:29 +02:00
Andrew Bartlett
968da5f890 nsswitch: Add waf tests for solaris special cases
These are in configure.in for autoconf.  Found in the config.h comparison on
the smbtorture4 build.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Sep 26 11:50:10 CEST 2012 on sn-devel-104
2012-09-26 11:50:10 +02:00
Andrew Bartlett
914b02be5a libwbclient: bump ABI to 0.11 as wbcAuthenticateUserEx now provides PAC parsing
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Sep 21 06:37:15 CEST 2012 on sn-devel-104
2012-09-21 06:37:15 +02:00
Christof Schmitt
1bc2f28b94 winbind: Extend wbcAuthenticateUserEx to provide PAC
With this new interface, external applications that have authenticated
to an ADS can pass the PAC from the Kerberos ticket to
wbcAuthenticateUserEx. winbindd decodes and extracts the info3
information for the external application. If winbindd can verify the PAC
signature, the info3 from the PACis also added to the netsamlogon_cache.

The info3 data can be used by the external application to get the uid
and primary gid. The data in netsamlogon_cache allows to retrieve the
complete group list through the NSS function getgrouplist.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-09-20 19:49:32 -07:00