1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

94012 Commits

Author SHA1 Message Date
Andrew Bartlett
7db0defdd2 ldapsrv: Pass struct ldb_result * rather than void *
Change-Id: Ic521cbfcf922cfe9e14c89116c097b777a86af40
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-on: https://gerrit.samba.org/35
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-03-14 12:53:11 +01:00
Christof Schmitt
1b7f3878b5 docs: Add gpfs:recalls parameter to vfs_gpfs manpage
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Mar 14 12:49:56 CET 2014 on sn-devel-104
2014-03-14 12:49:56 +01:00
Christian Ambach
9debea56c8 s3:modules/vfs_gpfs add gpfs:recalls option
When this option is set to no, an attempt to open an offline file will
be rejected with access denied.  This helps preventing recall storms
triggered by careless applications like Finder and Explorer.

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2014-03-14 10:45:10 +01:00
Andrew Bartlett
61b978872f dsdb: Ensure to sort replPropertyMetaData as UNSIGNED, not SIGNED quantities
enum is an int, and therefore signed.  Some attributes have the high bit set.

Andrew Bartlett

Change-Id: I39a5499b7c6bbb763e15977d802cda8c69b94618
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-on: https://gerrit.samba.org/163
Reviewed-by: Kamen Mazdrashki <kamenim@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar 14 10:16:41 CET 2014 on sn-devel-104
2014-03-14 10:16:41 +01:00
Andrew Bartlett
83fbdc81cd kdc: Use correct KDC include path when building against the system heimdal
This ensures we notice any API changes at compile time.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2014-03-14 08:17:29 +01:00
Stefan Metzmacher
3632c59e25 selftest/subunithelper.py: correctly pass testsuite-uxsuccess to end_testsuite()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 13 23:49:36 CET 2014 on sn-devel-104
2014-03-13 23:49:35 +01:00
Stefan Metzmacher
fee156f5b9 selftest/subunithelper.py: correctly handle fail_immediately in end_testsuite of FilterOps
This way --fail-immediately also works if a command segfaults.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-13 21:45:13 +01:00
Stefan Metzmacher
14246953b2 selftest/subunithelper.py: correctly handle unexpected success in FilterOps
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-13 21:45:12 +01:00
Stefan Metzmacher
ab9f021931 script/autobuild: use --force-rebase option
This makes sure the current user will be the committer.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-13 21:45:12 +01:00
Jose A. Rivera
f164e81e8b lib/popt: Patch memory leak in popthelp.c
Memory created as "t" was not being free'd.

Change-Id: I5f6e20acc6c440a1cd9908aed7a90de2000f22f8
Coverity-Id: 240599
Coverity-Id: 240600
Signed-off-by: Jose A. Rivera <jarrpa@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
2014-03-13 21:45:12 +01:00
Jose A. Rivera
2dc799bccd lib/popt: Small whitespace fix for readability.
Change-Id: Ib920f7e84c0247a8f09aa4c79c65b26afb78f234
Signed-off-by: Jose A. Rivera <jarrpa@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
2014-03-13 21:45:12 +01:00
Bjoern Baumbach
2b44c85c7b s3-libads: Use the IP instead of the name.
Thix fixes 'net rpc join' against ADS.

Signed-off-by: Bjoern Baumbach <bb@sernet.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Thu Mar 13 17:06:00 CET 2014 on sn-devel-104
2014-03-13 17:06:00 +01:00
Andreas Schneider
6030fac3d1 s3-auth: Steal the memory to avoid duplication.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-03-13 15:08:26 +01:00
Andreas Schneider
4081c29d3b s3-auth: Do not leak tmp_ctx if make_server_info() fails.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-03-13 15:08:26 +01:00
Simo Sorce
cf73692f96 s3-auth: Make is_null_sid() check easier to read.
Signed-off-by: Simo Sorce <idra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-03-13 15:08:26 +01:00
Andrew Bartlett
48ffca0aca CVE-2013-4496:Revert remainder of ce895609b0
Part of this was removed when ChangePasswordUser was unimplemented,
but remove the remainder of this flawed commit.  Fully check the
password first, as extract_pw_from_buffer() already does a partial
check of the password because it needs a correct old password to
correctly decrypt the length.

Andrew Bartlett

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10245

Change-Id: Ibccc4ada400b5f89a942d79c1a269b493e0adda6
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://gerrit.samba.org/38

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Mar 13 15:06:35 CET 2014 on sn-devel-104
2014-03-13 15:06:35 +01:00
Andrew Bartlett
9f53b61f06 CVE-2013-4496:samr: Remove ChangePasswordUser
This old password change mechanism does not provide the plaintext to
validate against password complexity, and it is not used by modern
clients.  It also has quite difficult semantics to handle regarding
password lockout.

The missing features in both implementations (by design) were:

 - the password complexity checks (no plaintext)
 - the minimum password length (no plaintext)

Additionally, the source3 version did not check:

 - the minimum password age
 - pdb_get_pass_can_change() which checks the security
   descriptor for the 'user cannot change password' setting.
 - the password history
 - the output of the 'passwd program' if 'unix passwd sync = yes'.

Finally, the mechanism was almost useless, as it was incorrectly
only made available to administrative users with permission
to reset the password.  It is removed here so that it is not
mistakenly reinstated in the future.

Andrew Bartlett

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10245

Change-Id: If2edd3183c177e5ff37c9511b0d0ad0dd9038c66
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://gerrit.samba.org/37
2014-03-13 10:26:03 +01:00
Stefan Metzmacher
76e5ea3a2c CVE-2013-4496:s3:auth: fix memory leak in the ACCOUNT_LOCKED_OUT case.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10245

Change-Id: Iabf22753effd80086d7956619a3dae830e487da8
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-on: https://gerrit.samba.org/161
2014-03-13 10:21:47 +01:00
Andrew Bartlett
824add8aaf CVE-2013-4496:s3-samr: Block attempts to crack passwords via repeated password changes
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10245

Change-Id: Ic31774275f07e003e7c2682a856ccb2d5a7939de
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-on: https://gerrit.samba.org/162
2014-03-13 10:21:16 +01:00
Gustavo Zacarias
29d779c702 smbreadline: switch to new-style readline typedef
Function, CPFunction, CPPFunction and VFunction typedefs are considered
old-style (deprecated) starting from readline 4.2 (circa 2001).
Compatibility typedefs have been in place up to readline 6.2 but were
removed with the 6.3 release thus causing builds to break.
Switch to the new-style specific prototyped typedef.

Return value is unused so the callback should still be void (see
readline/input.c around line 456 in version 6.3).

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 13 00:21:47 CET 2014 on sn-devel-104
2014-03-13 00:21:44 +01:00
Jeremy Allison
9c677fff0b s4: smbtorture: Add a proper change_notify going async followed by tdis test.
[Bug 10344] SessionLogoff on a signed connection with an outstanding notify request crashes smbd.

https://bugzilla.samba.org/show_bug.cgi?id=10344

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Mar 12 20:12:58 CET 2014 on sn-devel-104
2014-03-12 20:12:56 +01:00
Jeremy Allison
3a727d5d39 s4: smbtorture: Update the torture_smb2_notify_ulogoff test to demonstrate the problem.
[Bug 10344] SessionLogoff on a signed connection with an outstanding notify request crashes smbd.

https://bugzilla.samba.org/show_bug.cgi?id=10344

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2014-03-12 09:27:38 -07:00
Stefan Metzmacher
95f96a8108 s3:smb2_tcon: cancel and wait for pending requests on tdis
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10344
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-12 09:27:38 -07:00
Stefan Metzmacher
7c26475d58 s3:smb2_sesssetup: cancel and wait for pending requests on logoff
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10344

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-12 09:27:38 -07:00
Jeremy Allison
195c2d8480 s3:smb2_tcon: split smbd_smb2_tdis into an async *_send/recv pair.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10344

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2014-03-12 09:27:37 -07:00
Jeremy Allison
506817dfc9 s3:smb2_sesssetup: split smbd_smb2_logoff into an async *_send/recv pair.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10344

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2014-03-12 09:27:37 -07:00
Stefan Metzmacher
4d1d288b89 s3:smb2_lock: return RANGE_NOT_LOCKED instead of CANCELLED for logoff and tdis
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-12 09:27:37 -07:00
Stefan Metzmacher
b498937761 s3:smb2_lock: fix whitespaces/tabs in smbd_smb2_lock_cancel()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-12 09:27:37 -07:00
Stefan Metzmacher
0e4f23991f s4:torture/smb2: accept NT_STATUS_RANGE_NOT_LOCKED after smb2_logoff/tdis
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-12 09:27:37 -07:00
Günther Deschner
9c8badc2a5 s3-net: add a new "net ads kerberos pac save" tool.
Use "filename=string" to define a file where to save the unencrypted PAC to.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Mar 12 13:02:59 CET 2014 on sn-devel-104
2014-03-12 13:02:59 +01:00
Günther Deschner
9e01f3cbc4 s3-net: modify the current "net ads kerberos pac" command.
Rename it to "net ads kerberos pac dump" and add a "type=num" option to allow
dumping of individial pac buffer types. Ommitting type= or using type=0 will
dump the whole PAC structure on stdout.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-12 10:57:27 +01:00
Günther Deschner
a8c2807a26 s3-kerberos: let kerberos_return_pac() return a PAC container.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-12 10:13:20 +01:00
Günther Deschner
1270e35ba7 s3-kerberos: return a full PAC in kerberos_return_pac().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-12 10:13:20 +01:00
Günther Deschner
35a1ed22f6 s3-net: allow to provide custom local_service in "net ads kerberos pac".
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-12 10:13:20 +01:00
Günther Deschner
9725a86e60 s3-net: change the way impersonation principals are used in "net ads kerberos pac".
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-12 10:13:20 +01:00
Günther Deschner
baed403983 auth/kerberos: fix a typo.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-12 10:13:20 +01:00
Günther Deschner
932490ae08 s3-libads: pass down local_service to kerberos_return_pac().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-12 10:13:19 +01:00
Jeremy Allison
41d8d99d8a CVE-2013-6442: s3:smbcacls - ensure we don't lose an existing ACL when setting owner or group owner.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10327
Bug 10327 - CVE-2013-6442: smbcacls --chown | --chgrp dacl regression

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Mar 11 22:55:54 CET 2014 on sn-devel-104
2014-03-11 22:55:53 +01:00
Volker Lendecke
8c01dbc058 gencache: Add gencache values to memcache
gencache_parse calling tdb shows up in profiles when we do a lot of open/close
traffic with large ACLs. For every file we convert unix ids to sids, and in the
domain member case this goes through gencache.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Mar 11 19:56:47 CET 2014 on sn-devel-104
2014-03-11 19:56:46 +01:00
Ralph Boehme
80e5ae1cef vfs_catia: add chmod()
Clients using UNIX extensions need chmod() to go through catia.

Signed-off-by: Ralph Boehme <rb@sernet.de>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Mar 11 13:39:17 CET 2014 on sn-devel-104
2014-03-11 13:39:17 +01:00
Ralph Boehme
e7856ed58d Add usable stream name defines
Add stream name defines that are usable with Samba's way of storing
stream names internally.

Signed-off-by: Ralph Boehme <rb@sernet.de>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
2014-03-11 10:12:57 +00:00
Ralph Boehme
8424d35919 Fix a typo
Signed-off-by: Ralph Boehme <rb@sernet.de>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
2014-03-11 10:11:33 +00:00
Garming Sam
cff0f8e75f samba-tool: make provision check for bind version
(small corrections and TODO added following Jelmer's review by abartlet)
Signed-off-by: Garming Sam <garming@catalyst.net.nz>

Change-Id: Iba9a709641dad9f2ae05df0b26ac4cd2ebfc84f0
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Mar  9 02:52:50 CET 2014 on sn-devel-104
2014-03-09 02:52:49 +01:00
Andrew Bartlett
05d01f4224 build: Make order of arguments clearer by explicitly making the list of functions to look for a python list
Change-Id: I19bbd3b34548258201dabdc0ec8dc049e28d0049
Reviewed-by: David Disseldorp <ddiss@samba.org>
Tested-by: Thomas Schulz <schulz@adi.com>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Mar  8 05:53:08 CET 2014 on sn-devel-104
2014-03-08 05:53:07 +01:00
Andrew Bartlett
11cb110e2f build: Do not rely on sys.platform for ACL tests, combine UnixWare and Solaris ACL tests
This avoids issues with whatever sys.platform may return, fixes the
order of arguments to the CHECK_FUNCS_IN call, and only runs after
Linux-style POSIX ACL detection fails.

Andrew Bartlett

Change-Id: I930dff1e03c1cd1ceb8f3a35823ceb805694b66a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Tested-by: Thomas Schulz <schulz@adi.com>
2014-03-08 03:54:08 +01:00
Noel Power
3ac9cb3d17 For FSRVP use textual error messages instead of hex error codes
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Mar  8 03:52:44 CET 2014 on sn-devel-104
2014-03-08 03:52:42 +01:00
Noel Power
05daf6a25e Add missing FSRVP_E_UNSUPPORTED_CONTEXT constant
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-03-07 16:36:47 -08:00
Günther Deschner
a8c0de35f7 s3-kerberos: remove unused kdc_name from create_local_private_krb5_conf_for_domain().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Mar  7 18:43:57 CET 2014 on sn-devel-104
2014-03-07 18:43:57 +01:00
Günther Deschner
168627e187 s3-kerberos: remove print_kdc_line() completely.
Just calling print_canonical_sockaddr() is sufficient, as it already deals with
ipv6 as well. The port handling, which was only done for IPv6 (not IPv4), is
removed as well. It was pointless because it always derived the port number from
the provided address which was either a SMB (usually port 445) or LDAP
connection. No KDC will ever run on port 389 or 445 on a Windows/Samba DC.
Finally, the kerberos libraries that we support and build with, can deal with
ipv6 addresses in krb5.conf, so we no longer put the (unnecessary) burden of
resolving the DC name on the kerberos library anymore.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-07 16:16:54 +01:00
Stefan Metzmacher
f7883ae02a s4:lib/socket: simplify iface_list_wildcard() and its callers
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10464
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Change-Id: Ib317d71dea01fc8ef6b6a26455f15a8a175d59f6
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar  7 02:18:17 CET 2014 on sn-devel-104
2014-03-07 02:18:17 +01:00