1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-28 07:21:54 +03:00
Commit Graph

82224 Commits

Author SHA1 Message Date
Andrew Bartlett
65976d680a s3-vfs: Set errno in xattr emulation
The caller may check this errno.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 15 18:05:33 CEST 2012 on sn-devel-104
2012-08-15 18:05:33 +02:00
Andrew Bartlett
cc3bdaaf0a s3-vfs: Avoid loops in VFS modules: call _NEXT functions in xattr emulation
We need to call the next module in the stack otherwise we will loop if
the stat call is in turn implemented in terms of extended attribute
lookup.

Andrew Bartlett
2012-08-15 16:28:03 +02:00
Andrew Bartlett
898c5e140d s3-vfs: ensure we strictly free the talloc_stackframe
We must do this when leaving the function or else in development, we
will panic.

Andrew Bartlett
2012-08-15 16:28:03 +02:00
Andrew Bartlett
f9b9433b75 s4-selftest: Fix test name for samba.tests.dcerpc.bare 2012-08-15 16:28:03 +02:00
Andrew Bartlett
fd42bc1846 librpc/idl: Make smb_acl_t public so we can pull/push it as a blob 2012-08-15 16:28:03 +02:00
Stefan Metzmacher
d2d5fb1abf libcli/smb: verify decrypted SMB2 pdus correctly
We need to make sure we got a encrypted response if we asked
for it.

If we don't get a encrypted response, we use a similar logic
as with signing to propagated wellknown errors to the higher
layer and set state->smb2.signing_skipped = true.

metze

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Aug 15 16:26:26 CEST 2012 on sn-devel-104
2012-08-15 16:26:26 +02:00
Stefan Metzmacher
7a7e9b1c76 libcli/smb: fix parsing of compounded messages within a SMB2_TRANSFORM pdu
One SMB2_TRANSFORM pdu wraps multiple SMB2 pdus.

We inject the SMB2_TRANSFORM header to each response which was wrapped
inside. This allows the next layer to verify if the SMB2 pdu was encrypted.

metze
2012-08-15 14:45:21 +02:00
Stefan Metzmacher
84f6b0f962 libcli/smb: fix smb2cli_req_compound_submit for multiple encrypted messages
There should be only one SMB2_TRANSFORM header for all compound requests.

metze
2012-08-15 14:45:05 +02:00
Stefan Metzmacher
b596a116fd s3:smb2_server: do calculations based on SMBD_SMB2_NUM_IOV_PER_REQ in smbd_smb2_request_validate()
metze
2012-08-15 14:45:04 +02:00
Stefan Metzmacher
7ffee47bc6 libcli/smb: all flags except SMB2_HDR_FLAG_ASYNC should be cleared in a cancel request.
metze
2012-08-15 14:45:04 +02:00
Andrew Bartlett
24b1143068 s3-sysacls: Remove sys_acl_free_qualifier() as it is a no-op
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 15 05:23:18 CEST 2012 on sn-devel-104
2012-08-15 05:23:18 +02:00
Andrew Bartlett
6ccfd05e72 s3-sysacls: Remove sys_acl_free_acl() and replace with TALLOC_FREE() 2012-08-15 11:44:50 +10:00
Andrew Bartlett
e25830dcd8 s3-smbd: Remove sys_acl_*() VFS wrapper functions
We no longer do struct smb_acl_t manipuations via the VFS layer,
which is now reduced to handling the get/set functions.

The only backend that implemented these functions (aside from audit)
was the vfs_default module calling the sys_acl code.  The various ACL
implementation modules either worked on the fully initilaised
smb_acl_t object or on NT ACLs.

This not only makes the operation of the posix ACL code more efficient
(as allocation and free is not put via the VFS), it makes it easier to
test and removes the fantasy that a module could safely redefine this
structure or the behaviour here.

The smb_acls.idl now defines the structure, and it is now allocated
with talloc.

These operations were originally added to the VFS in commit
3bb219161a.

Andrew Bartlett
2012-08-15 11:44:50 +10:00
Andrew Bartlett
a63a2a72eb s3-smbd: Remove unused conn argument from convert_permset_to_mode_t() 2012-08-15 11:44:50 +10:00
Andrew Bartlett
3d031f2189 s3-smbd: Call sys_acl_set_permset() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:49 +10:00
Andrew Bartlett
9f16fcfd3f s3-smbd: Call sys_acl_set_qualifier() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:49 +10:00
Andrew Bartlett
21e0b91e9c s3-smbd: Call sys_acl_set_tag_type() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:49 +10:00
Andrew Bartlett
50d147b858 s3-smbd: Call sys_acl_create_entry() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:48 +10:00
Andrew Bartlett
db544790f1 s3-smbd: Call sys_acl_add_perm() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:48 +10:00
Andrew Bartlett
631a356ea2 s3-smbd: Call sys_acl_clear_perms() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:48 +10:00
Andrew Bartlett
d78c7c32dc s3-smbd: Call sys_acl_init() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:47 +10:00
Andrew Bartlett
8b3227eb45 s3-smbd: Call sys_acl_free_acl() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:47 +10:00
Andrew Bartlett
6a46fbb393 s3-smbd: Call sys_acl_free_qualifier() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:47 +10:00
Andrew Bartlett
e019b93f0e s3-smbd: Call sys_acl_get_entry() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:46 +10:00
Andrew Bartlett
d8fb9e77ec s3-smbd: Call sys_acl_free_qualifier() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:46 +10:00
Andrew Bartlett
6a2f142b49 s3-smbd: Call sys_acl_get_qualifier() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:45 +10:00
Andrew Bartlett
d83276c13f s3-smbd: Call sys_acl_get_tagtype() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:45 +10:00
Andrew Bartlett
3b409324d3 s3-smbd: Call sys_acl_get_permset() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:45 +10:00
Andrew Bartlett
7dff34f5d0 s3-smbd: Call sys_acl_get_perm() directly rather than via the VFS
This will allow us to remove the struct smb_acl_t manipuations from the VFS layer,
which will be reduced to handling the get/set functions.

Andrew Bartlett
2012-08-15 11:44:44 +10:00
Andrew Bartlett
0705391ed0 s3-smbd: Move smb_acl_t declaration to smb_acl.idl
This will allow us to marshall this into and from an NDR blob on disk, which will
allow us to fake up ACL support during make test, and to test the NT ACL emulation
using python bindings via the VFS.

Andrew Bartlett
2012-08-15 11:44:44 +10:00
Andrew Bartlett
d5a8e58bfb pidl: Add mode_t as an alias so we can marshall posix ACL structures 2012-08-15 11:44:44 +10:00
Andrew Bartlett
dcfb6aad16 s3-smbd: Change allocation of smb_acl_t to talloc()
The acl element is changed to be a talloc child, and is no longer one element
longer than requested by virtue of the acl[1] base pointer.

This also avoids one of the few remaining cases of over-allocation of a structure.

Andrew Bartlett
2012-08-15 11:44:43 +10:00
Christof Schmitt
47082ad3fa libwbclient: Add test for wbcPingDc2
The internal domain used in 'make test' does not report a DC name, so
just add tests similar to the old wbcPingDc call.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-15 11:44:43 +10:00
Christof Schmitt
4c8616f0c8 wbinfo: Improve output of wbinfo --ping-dc
Use wbcPingDc2 to get the DC name and print it.

Cleanup error messages: Remove "Could not ping our DC", there is always
a more specific message.  Avoid printing "failed to call wbcPingDc" in
case the ping has been attempted and it returns an error, the error is
already printed.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-15 11:44:43 +10:00
Christof Schmitt
bdb1f23e1d libwbclient: Add wbcPingDc2
Add wbcPingDc2 that optionally returns the DC that was attempted to
ping. wbcPing is implemented as a wrapper around wbcPingDc2.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-15 11:44:42 +10:00
Christof Schmitt
bd23c8f1ce s3-winbind: Return the DC name from DC_PING
The DC that was attempted to ping is useful for troubleshooting. Return
the DC name in the response to the wbclient.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-15 11:44:42 +10:00
Christof Schmitt
7baa7091b7 s3-winbind: Pass ping-dc result to client
The client checks for an error code in response.data.auth.nt_status,
make sure the result is stored there.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-15 11:44:42 +10:00
Andrew Bartlett
807fb16086 selftest: Add knownfail for samba3.winbind.wbclient.wbcPingDc2
The soon-to-be-added command also fails against the s4 winbind.

Andrew Bartlett
2012-08-15 11:44:14 +10:00
Stefan Metzmacher
4ee602c7f0 s4:dsdb/repl: fix the usage of 'GC/' prefixed principal names
The "serverReference" attribute is available on the "server" object
not on the "nTDSA" object.

This allows connections to RODCs, as they don't have a
E3514235-4B06-11D1-AB04-00C04FC2DCD2/${NTDSGUID}/${DNSDOMAIN}
principal.

Pair-Programmed-With: Björn Baumbach <bb@sernet.de>

metze

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Aug 14 18:57:41 CEST 2012 on sn-devel-104
2012-08-14 18:57:41 +02:00
Stefan Metzmacher
4e5e302a10 s4:samba-tool/drs: print the dns name of the server belonging to a connection
Pair-Programmed-With: Björn Baumbach <bb@sernet.de>

metze
2012-08-14 17:17:29 +02:00
Arvid Requate
a74ca56c48 s4:ntp_signd: fix SEGV if SID cannot be found
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug 14 17:16:54 CEST 2012 on sn-devel-104
2012-08-14 17:16:54 +02:00
Andrew Bartlett
ff5d177a69 s3-passdb: Silence scary DEBUG(0) message on first use of secrets.tdb databases
When pdb_samba4 first opens this databse, this message is printed.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
108c8b758a s4-dsdb: Use samdb_dn_is_our_ntdsa()
This uses a GUID based comparison, and avoids re-fetching the
samdb_ntds_settings_dn each time.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
d582e1bef6 s4-dsdb: Add samdb_dn_is_our_ntdsa()
This is like samdb_reference_dn_is_our_ntdsa but without the attribute de-reference.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
773d0367a6 s4-dsdb: Use samdb_reference_dn_is_our_ntdsa() 2012-08-14 15:37:22 +02:00
Andrew Bartlett
7213199f6e s4-repl: Use samdb_reference_dn_is_our_ntdsa() 2012-08-14 15:37:22 +02:00
Andrew Bartlett
1e127b270c s4-dsdb: Add helper function samdb_reference_dn_is_our_ntdsa()
We often want to know if we own an FSMO role (for example).  This tries to be more
efficient by comparing the GUID, rather than the string DN, as this does not need
to be re-fetched each time.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
3c8d8f206b s4-dsdb: Use ldb_dn_copy() rather than talloc_reference()
As the normal case (outside provision) uses a copy, this avoids a case
where a caller might modify a global variable accidentily.

As suggested by metze.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
0668f98d11 s4-libnet: Prepare libnet_BecomeDC for samdb_reference_dn() returning an extended DN
Remote LDAP servers will not accept an extended DN with other components.

Andrew Bartlett
2012-08-14 15:37:22 +02:00
Andrew Bartlett
fd0394d85d s4-libnet: Improve debugging of libnet_BecomeDC LDAP errors 2012-08-14 15:37:22 +02:00