1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

138448 Commits

Author SHA1 Message Date
Pavel Filipenský
731a25b5c8 docs:smbdotconf: Add parameter 'sync machine password to keytab'
BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750

Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 17:12:36 +00:00
Pavel Filipenský
3de8d29415 s3:lib: Merge library trusts_util into library ads
Function trust_pw_change() originally from library trustis_util was updated
to call functionality from ads library. This would introduce circular
dependency between the two libraries. To avoid it, trusts_util is merged
into ads.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750

Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 17:12:36 +00:00
Ralph Boehme
07c0afe91d WHATSNEW.txt: document "veto files" and "hide files"
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jul 26 11:10:42 UTC 2024 on atb-devel-224
2024-07-26 11:10:42 +00:00
Ralph Boehme
607d2c1e3e s3/lib: return error from set_namearray()
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
02ae847b45 smbd: return errors from token_contains_name()
Invalid names in "valid users", "invalid users", "read list", "write list",
"veto files" and "hide files" are logged and ignored, but a failure to contact
winbind or a DC from winbind, or a memory allocation failure, now all trigger a
failure of the tree connect.

Manually tested with smbclient with the following hack in winbindd:

---8<---
  $ git di
   source3/winbindd/winbindd_cache.c | 7 +++++++
   1 file changed, 7 insertions(+)

  diff --git a/source3/winbindd/winbindd_cache.c b/source3/winbindd/winbindd_cache.c
  index c889489dbbbc..8ccf0a28e11a 100644
  --- a/source3/winbindd/winbindd_cache.c
  +++ b/source3/winbindd/winbindd_cache.c
  @@ -1821,6 +1821,13 @@ NTSTATUS wb_cache_name_to_sid(struct winbindd_domain *domain,
          ZERO_STRUCTP(sid);
          *type = SID_NAME_UNKNOWN;

  +       if (strequal(name, "unknown")) {
  +               return NT_STATUS_OK;
  +       }
  +       if (strequal(name, "iotimeout")) {
  +               return NT_STATUS_IO_TIMEOUT;
  +       }
  +
          status = wcache_name_to_sid(domain, domain_name, name, sid, type);
          if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
                  return status;
---8<---

  veto files = ../unknown/file1/../slow/file2

  $ bin/smbclient -U slow%x //localhost/test -c quit
  $

In the log:

  [2024/03/04 15:21:33.659356,  1, pid=977167, effective(0, 0), real(0, 0)] ../../source3/lib/util_namearray.c:128(token_contains_name)
    token_contains_name: lookup_name 'unknown' failed

  veto files = ../iotimeout/file1/../slow/file2

  $ bin/smbclient -U slow%x //localhost/test -c quit
  tree connect failed: NT_STATUS_LOGON_FAILURE
  $

  [2024/03/04 15:22:15.655811,  0, pid=977177, effective(0, 0), real(0, 0)] ../../source3/lib/util_namearray.c:131(token_contains_name)
    token_contains_name: lookup_name 'iotimeout' failed NT_STATUS_NO_SUCH_DOMAIN
  [2024/03/04 15:22:15.655846,  1, pid=977177, effective(0, 0), real(0, 0)] ../../source3/smbd/uid.c:381(change_to_user_impersonate)
    change_to_user_impersonate: SMB user slow (unix user slow) not permitted access to share test.
  [2024/03/04 15:22:15.655855,  0, pid=977177, effective(0, 0), real(0, 0)] ../../source3/smbd/smb2_service.c:689(make_connection_snum)
    make_connection_snum: Can't become connected user!

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
0f27c52144 s3/lib: use lookup_name_smbconf_ex() in token_contains_name()
No change in behaviour as we still ignore lookup erros as well as a not-found
result.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
8364db8a3c s3/passdb: add lookup_name_smbconf_ex() using lookup_name_internal()
Returns NTSTATUS instead of bool. lookup_name_smbconf() becomes a thin
wrapper around lookup_name_smbconf_ex().

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
01b0b85621 s3/passdb: factor out lookup_name_internal()
lookup_name() becomes a thin wrapper around lookup_name_internal(). Prepares for
adding more callers to lookup_name_internal() that are interested in the
NTSTATUS return value to distinguish between NAME_NOT_FOUND lookup results and
real errors.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
1d6feea677 s3/passdb: use winbind_lookup_name_ex() in lookup_name() instead of winbind_lookup_name()
No change in behaviour, prepares for returning NTSTATUS instead of bool from
lookup_name().

Review-with: git show -w

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
3a13b90cee s3/passdb: add winbind_lookup_name_ex()
Differs from winbind_lookup_name() by

- returning NTSTATUS instead of bool, so callers can distinguish between
STATUS_NAME_NOT_FOUND lookup results and real errors.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
5d3c6dbf61 s3-errormap: add WBC_ERR_NOT_MAPPED -> NT_STATUS_NONE_MAPPED
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
1b63d503fc s3-errormap: move map_nt_error_from_wbcErr() back into errormap.c
This basically reverts commit 313db81ad3.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
02da9704a0 s3/rpc_client: fix handling of NT_STATUS_SOME_NOT_MAPPED
In this case names that couldn't be resolved will be have a NULL sid pointer
which would trigger a crash in sid_copy().

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
148a102800 winbindd: let LookupNames return NT_STATUS_OK and SID_NAME_UNKNOWN for unmapped names
Previously LookupNames would fail if a name could not be translated, so winbindd
clients like libwbclient couldn't differentiate between not being able to talk
to a DC and just an unkown name.

As a visible change this alters

  $ bin/wbinfo -n Idontexist
  failed to call wbcLookupName: WBC_ERR_DOMAIN_NOT_FOUND
  Could not lookup name Idontexist

to

  $ bin/wbinfo -n Idontexist
  failed to call wbcLookupName: WBC_ERR_SOME_NOT_MAPPED
  Could not lookup name Idontexist

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
12c5adb49a libwbclient: prepare wbcCtxLookupName() for dealing with WBC_SID_NAME_UNKNOWN
This changes the wbcErr from WBC_ERR_DOMAIN_NOT_FOUND to WBC_ERR_NOT_MAPPED.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
315ee3801b libwbclient: add error WBC_ERR_NOT_MAPPED
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
21b9eb5b8c winbindd: properly initialize sid and type in wb_cache_name_to_sid()
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
cbd4aee50b winbindd: collapse two if expressions
No change in behaviour.

After calling set_domain_offline() domain->offline will be set to false, iow
everytime

  if (!domain->internal && was_online)

is true,

  if (!domain->internal &&
      !domain->online &&
      was_online)

will also true, so we can drop the second if expression.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
6baf9547e5 winbindd: reformatting
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
dc95763757 winbindd: rename variable old_status to was_online in wb_cache_name_to_sid()
A lot easier to make sense of the complex logic when using this name.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
89a26b50f4 CI: add a test for per-user (and per-group) veto files
Not adding a specific test for per-user hide files as that uses the exact same
mechanism as the per-user veto files.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
7e835339da CI: fix test file cleanup
Test files are stored beneath "$SHAREPATH/dir1", not "$SHAREPATH/dir_1".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
b8b2f21835 s3/lib: add per-user support to set_namearray()
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
02e7c70ab3 smbd: move token_contains_name() to util_namearray.c and make it public
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:31 +00:00
Ralph Boehme
2f273a5085 selftest: add groups "group1" and "group2" to Samba3
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
c4ede22db0 s3/lib: move set_namearray() to util_namearray.c
Needed to fix circular dependencies between samba-passdb, secrets3 and
samba3util (iirc).

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
8ab29157b9 smbd: maintain veto_list and hide_list in the vuid cache
Prepares for adding per-user support to both options. I don't think it makes
sense also adding per-user support to "veto oplock files" and "aio write behind"
so I'm ignoring those.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
cfa9a73319 smbd: prepare free_conn_session_info_if_unused() for more cleanup logic
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
630f1228d1 smbd: move target code out of loop body
Reduces indentation of the code code that is run in this function and prepares
for adding more of it.

Review with: git show -w

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
7fc74c7883 s3/lib: modernize set_namearray()
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
f564fcb7c1 s3/lib: move path_to_strv() to util_path.c
More callers are coming.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
0c6725a73c s3/lib: remove name_compare_entry typedef
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
a1c1057f62 selftest: remove net groupmap delete stuff
Likely not needed anymore since we now cleanup the fileserver env.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
5160da2997 selftest: ensure the "fileserver" test environment is removed before provisioning
This was likely taken by copy/paste from somewhere else where it might have made
sense.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
a1d5df4203 selftest: setup "fileserver" testenv specific directories after calling provision()
This ensures provision() can remove st/fileserver/* from previous runs.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
2cd9da518d selftest: setup "simpleserver" testenv specific directories after calling provision()
This ensures provision() can remove st/simpleserver/* from previous runs.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Ralph Boehme
25ff9e5963 selftest: remove check for $no_delete_prefix
provision_ctdb() was always called with $no_delete_prefix undefined
from  setup_ctdb(), so we can just remove the check.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-26 10:06:30 +00:00
Douglas Bagnall
8903876f65 libcli:security: allow spaces after BAD:
In AD_DS_Classes_Windows_Server_v1903.ldf from
https://www.microsoft.com/en-us/download/details.aspx?id=23782, we see

  defaultSecurityDescriptor: O:BAG:BAD: (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPLCLORC;;;AU)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15685

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Thu Jul 25 06:27:27 UTC 2024 on atb-devel-224
2024-07-25 06:27:26 +00:00
Jo Sutton
97677b1588 selftest: Move MIT Kerberos knownfails to separate files in their own directory
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Jo Sutton <jsutton@samba.org>
Autobuild-Date(master): Tue Jul 23 23:47:43 UTC 2024 on atb-devel-224
2024-07-23 23:47:43 +00:00
Jo Sutton
198b6e3fc5 selftest: Move Heimdal Kerberos knownfails to separate files in their own directory
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2024-07-23 22:42:39 +00:00
Jo Sutton
f7cb87cb55 selftest: Consolidate MIT Kerberos knownfails into a single file
There is no longer any meaningful distinction between the two files.

Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2024-07-23 22:42:39 +00:00
Stefan Metzmacher
34c586680e s3:tests: let modprinter.pl use $TMPDIR
We should avoid using /tmp in selftest

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jul 23 13:53:13 UTC 2024 on atb-devel-224
2024-07-23 13:53:13 +00:00
Andreas Schneider
92ea6b00e7 third_party: Update pam_wrapper to version 1.1.7
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9705

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-07-23 12:44:32 +00:00
Stefan Metzmacher
6481fab912 selftest:Samba3: don't use PAM_WRAPPER_KEEP_DIR and PAM_WRAPPER_DEBUGLEVEL
They are both only for debugging problems.

In normal runs we don't need them and this avoids leaving to many
/tmp/pam.* directories arround.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9705

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-07-23 12:44:32 +00:00
Martin Schwenke
ead5a3111f ctdb-daemon: Use ctdb_parse_node_address() in ctdbd
While here, fix a trivial memory leak (ctdbd will exit anyway if this
function fails).

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Tue Jul 23 12:39:18 UTC 2024 on atb-devel-224
2024-07-23 12:39:18 +00:00
Martin Schwenke
181cc097ef ctdb-daemon: Use ctdb_read_nodes() in ctdbd
ctdb_control_getnodesfile() calls ctdb_read_nodes(), which returns a
struct ctdb_node_map rather than the old version, so update associated
marshalling.  While here modernise a debug message and wrap the
function arguments.

For ctdb_load_nodes_file() to use ctdb_read_nodes(), tweak
convert_node_map_to_list() to also use the modern node map structure.

Remove unused copy of ctdb_read_nodes_file().

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
2024-07-23 11:37:34 +00:00
Martin Schwenke
5d2a864c0b ctdb-protocol: Move ctdb_node_map_* to protocol_api.h
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
2024-07-23 11:37:34 +00:00
Martin Schwenke
fe97d04f18 ctdb-tests: Use ctdb_read_nodes() in the fake ctdbd
Remove unused copy of ctdb_read_nodes_file().

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
2024-07-23 11:37:34 +00:00
Martin Schwenke
3d52258d8a ctdb-tools: Use ctdb_read_nodes() in the ctdb tool
Remove unused copy of ctdb_read_nodes_file().

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
2024-07-23 11:37:34 +00:00
Martin Schwenke
45da2281aa ctdb-conf: Add a common node address handling module
These functions are intended to be used in ctdbd, the ctdb tool and
fake_ctdbd, replacing the different copies in each place.

ctdb_read_nodes() will replace ctdb_read_nodes_file().  The name
change is intentional - in future the location may be something other
than a simple filename.

The static copies of ctdb_read_nodes_file() and node_map_add() are
slightly sanitised versions of those in tools/ctdb.c, with a call to
ctdb_parse_node_address().  A bit more care is taken in node_map_add()
to avoid undefined behaviour if talloc_realloc() fails.

ctdb_parse_node_address() will replace ctdb_parse_address().  There is
an obvious argument change, since the ctdb context argument was
unused.  It can only fail on an invalid node address, so return a
bool.  This function might be changed later to allow the input address
string to include an optional port.

Where to put this module isn't entirely clear.  It could go in common,
so be part of ctdb-util.  However, if it later needs
ctdb-conf (e.g. to allow the node list location to be configurable)
then there would be a direct cyclic dependency.  This is configuration
handling, so conf/ seems sane.  However, I didn't want to put it into
the ctdb-conf target, since some code might need to parse a nodes list
but not need to parse ctdb.conf.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
2024-07-23 11:37:34 +00:00