1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-04 17:47:26 +03:00

108774 Commits

Author SHA1 Message Date
Stefan Metzmacher
b10d01d14a s4:rpc_server/netlogon: check auth_level for validation level 6 already in dcesrv_netr_LogonSamLogon_check()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:03 +02:00
Stefan Metzmacher
c8d14a554e s4:librpc/rpc: add support for HttpAuthOption=negotiate
Note that rpcproxy.dll on Windows doesn't support kerberos,
it allways downgrades the connection to NTLMSSP.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:03 +02:00
Stefan Metzmacher
77b44fbe36 s4:lib/http: pass down the target service/hostname to gensec
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
d1f479e73b s4:lib/http: add HTTP_AUTH_NEGOTIATE which maps to the "http_negotiate" gensec backend
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
9fd27d7a47 s4:http/gensec: implement "http_negotiate" using GENSEC_OID_SPNEGO
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
8813295e1f s4:http/gensec: make the "NTLM" base64 wrapping more generic
We only need to know the prefix "NTLM" and the submech oid GENSEC_OID_NTLMSSP
everything else can be generic.

This should allow us to implement "Negotiate" with GENSEC_OID_SPNEGO
trivial.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
a219c359b9 s4:http/gensec: rename ntlm.c to generic.c
Check with git show -C

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
b5854ecc98 s4:librpc/rpc: pass down HTTP_AUTH_* values directly to dcerpc_pipe_open_roh_send()
They get passed to http_send_auth_request_send() unmodified.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
8d36bbe187 s4:librpc/rpc: remember the target_hostname on ncacn_http connections
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
a6ae9da98d s4:lib/http: pass a generic prefix blob to http_parse_auth_response()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
bdece1df9c s4:lib/http: use strcasecmp(h->key, "WWW-Authenticate") instead of strncasecmp()
The key is already normalized and should match completely.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
56ab5cdbe0 s4:lib/http: remove indentation level from http_parse_auth_response()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:02 +02:00
Stefan Metzmacher
e42f12c6be s4:lib/http: let http_read_response_send/recv() also consume the body if it fits into a max value
We need to consume full HTTP responses from the socket during the
authentication exchanges, otherwise our HTTP parser gets out of sync for
the next requests.

This will be important for gensec mechs which use an even number
for authentication packets.

I guess this should be done just based on the Content-Length value and
not based on the response code.

So far I saw bodies with 200 and 401 codes.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:01 +02:00
Stefan Metzmacher
7b86da08ea s4:lib/http: lower HTTP_MAX_HEADER_SIZE from UINT_MAX to 0x1FFFF
We don't need very large headers, the largest ones are
"Authorization" or "WWW-Authenticate", but 128k should be
more than enough for all headers.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-07 15:20:01 +02:00
Volker Lendecke
2b67d936c1 winbindd: Simplify an if-condition
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Mon Aug  7 09:32:09 CEST 2017 on sn-devel-144
2017-08-07 09:32:09 +02:00
Volker Lendecke
e5b0669625 winbindd: Add debug for ndr cache hit
When looking through winbind debug logs, it's highly confusing if you don't
find a call in the child that's supposed to handle it. Add a debug if the call
was handled from the cache without calling into the child.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-08-07 05:35:13 +02:00
Volker Lendecke
ed3b4661fd winbindd: Make wcache_query_user static
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2017-08-07 05:35:13 +02:00
Gary Lockyer
6d65d679f1 tests samba_tool: fix flapping user-virtualCryptSHA test
Fix flapping test, occasionally a password would be generated that failed
the password criteria, which resulted in the test user not being
created.  The tests relying on this user being present then failed.

This patch ensures that the generated password contains at least one digit,
at least one upper case letter and at least one lower case letter.
The generated passwords do not contain special characters to avoid shell
escaping issues.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Aug  7 05:34:24 CEST 2017 on sn-devel-144
2017-08-07 05:34:23 +02:00
Ralph Wuerthner
3a2a9d8d3f idmap: remove unused function idmap_is_online()
Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com>
Reviewed-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Aug  4 14:08:37 CEST 2017 on sn-devel-144
2017-08-04 14:08:37 +02:00
Andreas Schneider
977cf75166 lib: Fix integer overflowed argument issue with strtoul()
This fixes CID 1415704

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Aug  3 15:06:34 CEST 2017 on sn-devel-144
2017-08-03 15:06:34 +02:00
Martin Schwenke
edf77a112f ctdb-common: Reimplement pidfile_context_create() using pidfile_path_create()
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Wed Aug  2 07:28:44 CEST 2017 on sn-devel-144
2017-08-02 07:28:44 +02:00
Martin Schwenke
09b0398865 util: Reimplement pidfile_create() using pidfile_path_create()
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
2017-08-02 03:39:12 +02:00
Martin Schwenke
411b7c8753 util: New functions pidfile_path_create(), pidfile_fd_close()
Uses the core of CTDB's create_pidfile_context() for
pidfile_path_create(). pidfile_fd_close() is a subset of CTDB's
pidfile_context_destructor().

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
2017-08-02 03:39:11 +02:00
Martin Schwenke
59ebb29e6a ctdb-common: Rename pidfile_create() -> pidfile_context_create()
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
2017-08-02 03:39:11 +02:00
Martin Schwenke
4dbfc16bdd util: Add pidfile.* to samba-util-core
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
2017-08-02 03:39:11 +02:00
Martin Schwenke
d665b74dbb util: Clean up includes
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
2017-08-02 03:39:11 +02:00
Martin Schwenke
8731f1cfab util: pidfile_pid() should not unlink PID file
This causes a race.  If 2 callers to pidfile_create() both a find a
stale PID file using pidfile_pid().  The 1st may then return to
pidfile_create() and create a new PID file, which can then be unlinked
by the 2nd caller.

Consequently, PID file creation can not depend on creating the file,
so drop O_EXCL from the call to open().

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
2017-08-02 03:39:11 +02:00
Volker Lendecke
a70ab5f020 winbindd: Simplify two debug msgs
With DBG_DEBUG we get the function name automatically, DEBUGADD is also
not necessary here

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Aug  1 11:45:34 CEST 2017 on sn-devel-144
2017-08-01 11:45:34 +02:00
Volker Lendecke
69187d92e5 winbindd: Simplify wcache_cached_creds_exist
No need to fetch, use tdb_exists

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:22 +02:00
Volker Lendecke
9be8fc2c0a winbindd: Make wcache_lookup_usergroups static
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:22 +02:00
Volker Lendecke
7736e592ff winbindd: Fix indentation
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:22 +02:00
Volker Lendecke
604f1cede6 winbindd: Make init_wcache static
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:21 +02:00
Volker Lendecke
91d4151bdf winbindd: Make wcache_lookup_useraliases static
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:21 +02:00
Volker Lendecke
8f0bd85cfa winbindd: Make wcache_name_to_sid static
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:21 +02:00
Volker Lendecke
d8f85c0f33 winbindd: Make wcache_lookup_groupmem static
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:21 +02:00
Volker Lendecke
bbdfb51296 winbindd: Make wcache_flush_cache static
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:21 +02:00
Volker Lendecke
0f65bb7c5c winbindd: Fix a few signed/unsigned hickups
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
2017-08-01 07:53:21 +02:00
Andrew Bartlett
d5750f0163 dsdb: Fix dsdb_next_callback to correctly use ldb_module_done() etc
If we do not call ldb_module_done() then we do not know that up_req->callback()
has been called, and ldb_next_request() will call the callback again.

If called twice, the new ldb_lock_backend_callback() in ldb 1.2.0 will segfault.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12904

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug  1 07:52:38 CEST 2017 on sn-devel-144
2017-08-01 07:52:38 +02:00
Ian Stakenvicius
5b316a4c7a waf: disable-python - fix talloc wscript if bundling disabled
The pytalloc-util dependency logic in lib/talloc/wscript on a
standalone build checks for pytalloc-util in a manner that will
fail if bundling is disabled, this causes issues on
--disable-python builds of ldb, tevent, and samba.

This patch restructures the logic to skip checks if python
is disabled, instead just setting the temporary state variable
'using_system_pytalloc_util' to False

Successfully tested patch on ldb-1.1.31 and above, tevent-0.9.33,
and samba-4.7_rc3

Signed-off-by: Ian Stakenvicius <axs@gentoo.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-08-01 03:59:24 +02:00
Andrew Bartlett
39c6274084 dsdb: Do not force a re-index of sam.ldb on upgrade to 4.7
This means that no compatibleFeatures or incompatibleFeatures will be honoured
until a re-index, but that can be triggered when these features are set.

New databases will still get this support.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12855
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-08-01 03:59:24 +02:00
Volker Lendecke
8ab6e51def lib: Fix an error path memleak
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jul 31 13:49:02 CEST 2017 on sn-devel-144
2017-07-31 13:49:01 +02:00
Volker Lendecke
9607b66a93 lib: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-07-31 10:03:27 +02:00
Volker Lendecke
9927e19965 lib: Fix 1415704 CID Integer overflowed argument
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-07-31 10:03:27 +02:00
Ralph Boehme
33e7fac3c7 docs/vfs_fruit: remove period outside of the <para> tag
Period that is outside of the <para> tag causes unneccessary vertical
space in the htmlman output. (Paragraph including only one period will
be created.)

From matsuand <michio_matsuyama@yahoo.co.jp>.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Jul 29 15:09:37 CEST 2017 on sn-devel-144
2017-07-29 15:09:37 +02:00
Richard Sharpe
2186d4d317 Add a test for unsetting Delete-on-Close before the close by DoC opener.
Windows semantics says that any unset of Delete-on-Close before the client
that opened for Delete-on-Close closes the file is silently ignored and the file
is still deleted on the last close. This test tests that in a single open case.

Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Jul 28 11:47:06 CEST 2017 on sn-devel-144
2017-07-28 11:47:06 +02:00
Richard Sharpe
886c26238a Fix incorrect error messages:unsetting not setting.
The error messages are wrong and could give testers the wrong idea.

Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
2017-07-28 07:53:25 +02:00
Andrew Bartlett
1ea6b5168f s4-rpc_server: Improve debug of new endpoints
This helps us know what process model is required and what one is in use.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12939

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jul 28 04:12:08 CEST 2017 on sn-devel-144
2017-07-28 04:12:08 +02:00
Andrew Bartlett
bc48c4b54b s4-rpc_server: ensure we get a new endpoint for netlogon
If we share the single process RPC servers with the multi-process RPC servers
on the same endpoint, they will default to running in an single process

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12939

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-07-28 00:25:15 +02:00
Andrew Bartlett
0554bc237f s4-cldap/netlogon: Match Windows 2012R2 and return NETLOGON_NT_VERSION_5 when version unspecified
The previous patch set this incorrectly to NETLOGON_NT_VERSION_1

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-07-28 00:25:15 +02:00
Arvid Requate
88db634ed8 s4-dsdb/netlogon: allow missing ntver in cldap ping
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11392

Signed-off-by: Arvid Requate <requate@univention.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-07-28 00:25:15 +02:00