1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-27 03:21:53 +03:00
Commit Graph

29803 Commits

Author SHA1 Message Date
Andrew Bartlett
6d7e53aaac dsdb-acl: Use dsdb_get_structural_oc_from_msg() in acl_modify()
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
097fae2d1d dsdb-acl: add acl_check_access_on_objectclass() helper
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
74bfec0269 dsdb-acl: Add helper function dsdb_get_structural_oc_from_msg()
This will eventually replace get_oc_guid_from_message(), returning the full dsdb_class.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
2685a4ed66 dsdb-acl: attr is not optional to acl_check_access_on_attribute()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
d695b8abc7 dsdb-acl: dsdb_attribute_by_lDAPDisplayName() is needed for all attributes
"clearTextPassword" is the only exception.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
ddfb8fe89c dsdb-acl: introduce a 'el' helper variable to acl_modify()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
71b856a3f0 dsdb-acl: introduce a 'msg' helper variable to acl_modify()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
c2853f55fc dsdb-schema: make sure we build [system]PossibleInferiors completely
Otherwise callers like dsdb_schema_copy_shallow() will corrupt the
talloc hierarchie.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:44 +01:00
Stefan Metzmacher
1f673bf920 dsdb-schema: make sure use clean caches in schema_inferiors.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:44 +01:00
Stefan Metzmacher
c4b9ee2558 dsdb-schema: make schema_subclasses_order_recurse() static
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:44 +01:00
Matthieu Patou
f70d0ac739 Tests: remove redondent testsuites in provision
Removed provision are already tested somewhere else.

Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Matthieu Patou <mat@samba.org>
Autobuild-Date(master): Mon Jan 21 09:59:43 CET 2013 on sn-devel-104
2013-01-21 09:59:43 +01:00
Matthieu Patou
e1ab7b6804 Tests: rewrite ldap_schema to specify attributes
Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 08:21:20 +01:00
Andrew Bartlett
dda48146a2 heimdal_build: Try again to sort out the strerror_r mess
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-19 10:32:17 +01:00
Günther Deschner
3b94b64481 spoolss: make spoolss deal with ndr64 SetForm by using proper container object.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-01-17 17:11:37 +01:00
Günther Deschner
8304fe73f6 spoolss: make spoolss deal with ndr64 AddForm by using proper container object.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-01-17 17:11:37 +01:00
Günther Deschner
be8c81bfa3 s4-torture: add ndr64 spoolss_SetPrinter ndr test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-01-17 17:11:37 +01:00
Günther Deschner
e8feca012e spoolss: make spoolss deal with ndr64 ULONG_PTR of devmode_ptr and secdesc_ptr.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-01-17 17:11:37 +01:00
Matthieu Patou
e1d50a6b24 dsdb-operational: Avoid doing the ldb_attr_cmp if bypass flag is not set
Most of the time this flag is not set and so we can avoid the strcasecmp
in ldb_attr_cmp()

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 17 17:10:32 CET 2013 on sn-devel-104
2013-01-17 17:10:32 +01:00
Andrew Bartlett
a0faf16ae9 torture: Fix fsmo test to use correct -H samba-tool syntax
However, the test still does not pass.

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Andrew Bartlett
18d7e5df0e dsdb: Do not hold the transaction over the IRPC call to perform a role transfer
This avoids one samba process locking out another from the DB.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Andrew Bartlett
316fd085ad drs-fsmo: Improve handling of FSMO role takeover.
This needs to be more async, and give less scary errors.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Stefan Metzmacher
6a1025551e dsdb-acl: calculate sDRightsEffective based on "nTSecurityDescriptor"
acl_check_access_on_attribute should never be called with attr=NULL
because we don't check access on an attribute in that case

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>

Autobuild-User(master): Matthieu Patou <mat@samba.org>
Autobuild-Date(master): Thu Jan 17 11:21:10 CET 2013 on sn-devel-104
2013-01-17 11:21:10 +01:00
Stefan Metzmacher
ccf577da14 dsdb-acl: add helper variable 'ldb' in acl_sDRightsEffective
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:23:06 -08:00
Stefan Metzmacher
70460605c6 dsdb-acl: fix the order of special and system checks
First we check for a special dn, then for system access.
All allocations happen after this checks in order to avoid
allocations we won't use.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:20:47 -08:00
Matthieu Patou
a0c59b4da1 dsdb-acl: Do not apply ACL on special DNs to hide attributes that the user shouldn't see
This fix frequent reindexing when using python script with a
user that is not system.
The reindexing is caused by ACL module hidding (removing) attributes in
the search request for all attributes in dn=@ATTRIBUTES and because
dsdb_schema_set_indices_and_attributes checks that the list of
attributes that it just calculated from the schema is the same as the
list written in @ATTRIBUTES, if not the list is replaced and a
reindexing is triggered.

Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 00:20:45 -08:00
Stefan Metzmacher
961a1fbbbc dsdb-acl: talloc_free the private context when we pass to the next module
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:20:40 -08:00
Stefan Metzmacher
947985b259 dsdb-acl: don't call dsdb_user_password_support() if we don't use the result
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:16:24 -08:00
David Disseldorp
456724f05d torture: copychunk test suite improvements
Allow for large files in test_setup_copy_chunk():
  Write test data in 1M IOs, rather than attempting to do the whole
  thing in one go.

Add copychunk bad resume key test:
  Send a copy chunk request with an intentionally bogus resume key
  (source key handle).

Add copychunk src=dest test:
  Test copychunk requests where the source and destination handles refer
  to the same file.

Add copychunk src=dest overlap test.

Add desired access args to test_setup_copy_chunk().

Add copychunk_bad_access test:
  Open the copychunk source and destination files with differing
  desired_access values. Confirm copychunk response matches 2k8 and 2k12
  behaviour.

Add copy_chunk_src_exceed test:
  Attempts to copy more data than is present in the copychunk source
  file.

Add copy_chunk_src_exceed_multi test:
  Test whether the first chunk in a multi-chunk copychunk request is
  written to disk, where the second chunk is invalid due to src file
  overrun.

Add copy_chunk_sparse_dest test:
  Issue a request where the target offset exceeds the file size, resulting
  in a sparse region.

Add copy_chunk_max_output_sz test.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
bfe765367e torture: replace ioctl failure returns with helper calls
Also change test_ioctl_get_shadow_copy() to use torture_skip(), and
clean up test output.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
42a5a6c0f6 torture: add locking tests for copychunk
Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
3619b1a7b2 torture: skip FSCTL_SRV_ENUM_SNAPS test when not supported
If FSCTL_SRV_ENUM_SNAPS fails with NT_STATUS_NOT_SUPPORTED then skip the
test, this means we can run the full ioctl test suite as part of
autobuild.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
65983aac12 smb2_ioctl: remove ioctl error response assumptions
MS-SMB2 3.3.4.4 documents cases where a ntstatus indicating an error
should not be considered a failure. In such a case the output data
buffer should be sent to the client rather than an error response
packet.

Add a new fsctl copy_chunk test to confirm field limits are sent back
in response to an oversize chunk request.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
Günther Deschner
46b6afc69b s4-torture: add ndr64 spoolss openprinterex to ndr test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jan 16 13:26:53 CET 2013 on sn-devel-104
2013-01-16 13:26:53 +01:00
Günther Deschner
6cdf59d716 s4-torture: allow to do ndr tests with flags, not only ndr_flags.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-01-16 11:42:29 +01:00
Günther Deschner
a4dcf7b94d spoolss: Make OpenPrinterEx work with NDR64 by using UserInfo Container.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-01-16 11:42:13 +01:00
Andrew Bartlett
065c0ec162 dsdb: Add test for modification of two attributes, one permitted, one denied (bug #9554 - CVE-2013-0172)
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 8bafe08715)

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan 15 14:03:47 CET 2013 on sn-devel-104
2013-01-15 14:03:47 +01:00
Andrew Bartlett
b7b91c8594 dsdb-acl: Run sec_access_check_ds on each attribute proposed to modify (bug #9554 - CVE-2013-0172)
This seems inefficient, but is needed for correctness.  The
alternative might be to have the sec_access_check_ds code confirm that
*all* of the nodes in the object tree have been cleared to
node->remaining_bits == 0.

Otherwise, I fear that write access to one attribute will become write
access to all attributes.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit d776fd807e)
2013-01-15 12:14:25 +01:00
Andrew Bartlett
95c891cf44 dsdb: Make linked_attributes module GUID based for renames
This ensures that when we have the backlink out of sync with the forward link (perhaps due
to another operation that has put the backlink handling in an end-of-transaction
TODO list in repl_meta_data) that we do not error out, we just cope as well as we can.

The GUID is the unique identifier, not the DN.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sat Jan 12 12:52:28 CET 2013 on sn-devel-104
2013-01-12 12:52:28 +01:00
Arvid Requate
bdc172aca5 s4-resolve: Fix parsing of IPv6/AAAA in dns_lookup (bug #9555)
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-12 10:32:28 +01:00
Andrew Bartlett
edbc26bca8 scripting/samba_upgradedns: Only look for IPv4/IPv6 addresses if we actually them
This allows the script to be used to create/remove the samba-specific dns-SERVER account
when we do not need to create the in-directory partition.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 10 20:56:50 CET 2013 on sn-devel-104
2013-01-10 20:56:50 +01:00
Andrew Bartlett
051a1a9c64 samba-tool classicupgrade: Do not print the admin password during upgrade
This changes the code to only set and show a new password if no admin
user is found during the upgrade.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 10 16:55:23 CET 2013 on sn-devel-104
2013-01-10 16:55:23 +01:00
Andrew Bartlett
5e0fcb04a4 s4-idmap: Remove requirement that posixAccount or posixGroup be set for rfc2307
This change matches the source3/idmap/idmap_ad.c code, and allows this
feature to work with only the setting of the UID/GID in Active
Directory Users and Computers.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-10 14:52:56 +01:00
Andrew Bartlett
c9d2ca585e selftest: Add test for rfc2307 mapping handling
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-10 14:52:52 +01:00
Andrew Bartlett
5812eb3c1d dsdb-acl: give error string if we can not obtain the schema
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-10 14:52:49 +01:00
Andrew Bartlett
99d872ee92 s4-dbcheck: Allow forcing an override of an old @MODULES record
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-10 14:52:45 +01:00
Andreas Schneider
1aa0503401 Use the new directory_create_or_exist_strict() function.
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-09 09:11:20 +01:00
Björn Baumbach
4d1fd0b7da samba_dnsupdate: set KRB5_CONFIG for nsupdate command
Let nslookup use krb5.conf, which is set in our KRB5_CONFIG.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-09 09:11:20 +01:00
Stefan Metzmacher
8d9a77f864 s4:lib/messaging: terminate the irpc_servers_byname() result with server_id_set_disconnected() (bug #9540)
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-09 09:11:20 +01:00
Matthieu Patou
2cc6f9ce7f libnet-vampire: reports Exops as they rather than sync on some partitions
Instead of showing:
Partition[CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com]
objects[1] linked_values[8]
Report a exop based on CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com
as
Exop on CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com, ...

Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-By: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Matthieu Patou <mat@samba.org>
Autobuild-Date(master): Wed Jan  9 09:01:30 CET 2013 on sn-devel-104
2013-01-09 09:01:30 +01:00
Matthieu Patou
0c86126d16 libnet: set the invocation_id earlier in order to avoid annoying messages
At that moment we have all the information to set the invocation id so
let's set it, it will avoid useless messages about missing invocation
id.

Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-By: Andrew Bartlett <abartlet@samba.org>
2013-01-09 07:19:54 +01:00