1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Commit Graph

534 Commits

Author SHA1 Message Date
Jelmer Vernooij
773cfba9af Avoid including libds/common/roles.h in public loadparm.h header.
Signed-Off-By: Jelmer Vernooij <jelmer@samba.org>
Reviewed-By: Andrew Bartlett <abartlet@samba.org>
Reviewed-By: Stefan Metzmacher <metze@samba.org>
2016-01-13 04:43:23 +01:00
Andrew Bartlett
374d73617d lib/tls: Add new 'tls priority' option
This adds a new option to the smb.conf to allow administrators to disable
TLS protocols in GnuTLS without changing the code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11076
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2015-07-20 03:08:26 +02:00
Kamen Mazdrashki
6214dbd574 s4-ldap: Pass on-wire transmitted control down the chain
Change-Id: Ic3a117f74e8a67c45584fdb520d92e4f0cb01c5e
Signed-off-by: Kamen Mazdrashki <kamenim@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-12-08 03:00:41 +01:00
Volker Lendecke
f5efddb9ae lib: directory_create_or_exist() does not use "uid" parameter
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-07-28 22:04:13 +02:00
Jeremy Allison
463311422c s3/s4: smbd, rpc, ldap, cldap, kdc services.
Allow us to start if we bind to *either* :: or 0.0.0.0.

Allows us to cope with systems configured as only IPv4
or only IPv6.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-By: Amitay Isaacs <amitay@gmail.com>
Reviewed-By: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Jun  7 01:01:44 CEST 2014 on sn-devel-104
2014-06-07 01:01:43 +02:00
Stefan Metzmacher
99e8bea5d5 s4:ldap_server: make use of gensec_update_ev()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-03-27 00:36:31 +01:00
Andrew Bartlett
7db0defdd2 ldapsrv: Pass struct ldb_result * rather than void *
Change-Id: Ic521cbfcf922cfe9e14c89116c097b777a86af40
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-on: https://gerrit.samba.org/35
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-03-14 12:53:11 +01:00
Stefan Metzmacher
f7883ae02a s4:lib/socket: simplify iface_list_wildcard() and its callers
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10464
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Change-Id: Ib317d71dea01fc8ef6b6a26455f15a8a175d59f6
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar  7 02:18:17 CET 2014 on sn-devel-104
2014-03-07 02:18:17 +01:00
Garming Sam
4c9e0d5add Remove NT_STATUS_IS_OK_RETURN macro from the codebase.
Following the current coding guidelines, it is considered bad practice to return from
within a macro and change control flow as they look like normal function calls.

Change-Id: I27e7597f4078f0a6c96b5dadd12454fffe33e6b2
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-03-05 16:33:21 +01:00
Benjamin Franzke
0620c79d76 s4:dsdb/rootdse: Support netlogon request
This patch adds support for a netlogon ldap style request
over the tcp socket.  This is available since win2k3+ [1].

The automatic client join & configuration daemon "realmd" makes
use of this ability.
Realmd can now be used to join a computer to a samba 4 domain.
(See also:
https://lists.samba.org/archive/samba-technical/2013-October/095606.html)

Tested with:
ldapsearch -h samba-srv -x -b '' -s base "(&(NtVer=\06\00\00\00)(AAC=\00\00\00\00))" NetLogon

And compared the result in wireshark with cldap request issued by
examples/misc/cldap.pl.

[1]: http://wiki.wireshark.org/MS-CLDAP?action=recall&rev=8

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-11-11 23:00:54 +01:00
Stefan Metzmacher
966faef9c6 auth/gensec: treat struct gensec_security_ops as const if possible.
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-10 09:19:04 +02:00
Stefan Metzmacher
71c63e85e7 auth/gensec: introduce gensec_internal.h
We should treat most gensec related structures private.

It's a long way, but this is a start.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-10 09:19:02 +02:00
Stefan Metzmacher
a1aeeee430 s4:ldap_server: call irpc_add_name() at startup (bug #9905)
We should call irpc_add_name() when we start the ldap_server task.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-06-13 12:37:04 +02:00
Matthieu Patou
85259635d6 ldap-server: sscanf result was never used to mistyped var 2012-10-07 21:51:02 -07:00
Matthieu Patou
97d0ad0c5e ldap-server: remove warning for the ret not being used 2012-10-07 21:51:02 -07:00
Jeremy Allison
4c1762c3a8 Fix debug print warning message. 2012-07-24 00:09:46 +02:00
Matthieu Patou
1521bb95a7 dsdb-schema: do not reload more often than schema_reload_interval
Samba 4 use to try to reload the schema every time dsdb_get_schema was
called (which could be 20+ time per ldb request). Now we only reload at
most every xx seconds (xx being the value of dsdb:"schema_reload_interval"
 or 120). The timestamp of the last reloaded schema is kept in the
 dsdb_schema object. There is also a timestamp in the ldb_context, that
 is used by the LDAP server to know if it has to reload the schema after
 handling the request. This is used to allow that the schema will be
 immediately reload after a schemaUpdateNow request has been issued, the
 reload can't occur in the handling of the LDAP request itself because
 we have a transaction autostarted.
2012-06-22 23:16:04 -07:00
Andrew Bartlett
b8815dc23d lib/param: Create a seperate server role for "active directory domain controller"
This will allow us to detect from the smb.conf if this is a Samba4 AD
DC which will allow smarter handling of (for example) accidentially
starting smbd rather than samba.

To cope with upgrades from existing Samba4 installs, 'domain
controller' is a synonym of 'active directory domain controller' and
new parameters 'classic primary domain controller' and 'classic backup
domain controller' are added.

Andrew Bartlett
2012-06-15 09:18:33 +02:00
Alexander Bokovoy
2ddf89a2bc Introduce system MIT krb5 build with --with-system-mitkrb5 option.
System MIT krb5 build also enabled by specifying --without-ad-dc

When --with-system-mitkrb5 (or --withou-ad-dc) option is passed to top level
configure in WAF build we are trying to detect and use system-wide MIT krb5
libraries. As result, Samba 4 DC functionality will be disabled due to the fact
that it is currently impossible to implement embedded KDC server with MIT krb5.

Thus, --with-system-mitkrb5/--without-ad-dc build will only produce
  * Samba 4 client libraries and their Python bindings
  * Samba 3 server (smbd, nmbd, winbindd from source3/)
  * Samba 3 client libraries

In addition, Samba 4 DC server-specific tests will not be compiled into smbtorture.
This in particular affects spoolss_win, spoolss_notify, and remote_pac rpc tests.
2012-05-23 17:51:50 +03:00
Stefan Metzmacher
e425948323 s4:ldap_server: fix typo in DEBUG() message
metze
2012-04-03 17:47:31 +02:00
Andrew Bartlett
e7d5f0a357 gensec: move event context from gensec_*_init() to gensec_update()
This avoids keeping the event context around on a the gensec_security
context structure long term.

In the Samba3 server, the event context we either supply is a NULL
pointer as no server-side modules currently use the event context.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-18 13:13:33 +11:00
Matthias Dieter Wallnöfer
96a9f823ed s4:ldap_backend.c/"map_ldb_error" - handle errors similar to "PyErr_SetLdbError"
If the call was done using an error string ("add_err_string"), then use that one
without an additional "ldb_strerror()" for the definitive LDAP output.
Otherwise generate one using "ldb_strerror()".
This omits redundancies in the error string generation (twice the same
information by "ldb_strerror()").

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-10-11 08:42:07 +02:00
Andrew Tridgell
0d2d6c94d2 s4-ldap-server: disallow all modifies on global catalog port 2011-10-04 15:08:55 +11:00
Andrew Bartlett
dce23151e0 s4-ldap_server: Fix segfault on startup failure of ldap server 2011-09-27 22:43:06 +02:00
Andrew Tridgell
02872212eb s4-ldap-server: set the NO_GLOBAL_CATALOG control on non-GC operations
this makes us honor GC semantics on the two ldap ports
2011-09-22 10:00:49 +10:00
Jelmer Vernooij
292fe74971 credentials: Rename library to samba-credentials to avoid name clashes.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Thu Aug 18 22:16:38 CEST 2011 on sn-devel-104
2011-08-18 22:16:38 +02:00
Andrew Bartlett
35b309fa0c gensec: clarify memory ownership for gensec_session_info() and gensec_session_key()
This is slightly less efficient, because we no longer keep a cache on
the gensec structures, but much clearer in terms of memory ownership.
Both gensec_session_info() and gensec_session_key() now take a mem_ctx
and put the result only on that context.

Some duplication of memory in the callers (who were rightly uncertain
about who was the rightful owner of the returned memory) has been
removed to compensate for the internal copy.

Andrew Bartlett
2011-08-03 18:48:02 +10:00
Volker Lendecke
f0ff6f390a Use tevent_req_oom
This fixes a few Coverity errors
2011-06-20 12:33:24 +02:00
Andrew Bartlett
a1f04e8abc libcli/util Rename common map_nt_error_from_unix to avoid duplicate symbol
The two error tables need to be combined, but for now seperate the names.

(As the common parts of the tree now use the _common function,
errmap_unix.c must be included in the s3 autoconf build).

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Mon Jun 20 08:12:03 CEST 2011 on sn-devel-104
2011-06-20 08:12:03 +02:00
Andrew Tridgell
40dc94a53f s4-ipv6: update callers to load_interface_list() 2011-06-06 12:26:10 +10:00
Andrew Tridgell
8f3ce14ea7 s4-ipv6: use "ip" instead of "ipv4" for servers
this allows stream_setup_socket() to work with both v4 and v6
addresses
2011-06-06 12:26:10 +10:00
Andrew Tridgell
dc8c8fd9e4 s4-ipv6: use iface_list_wildcard() to listen on IPv6
when we need to listen on a wildcard address, we now listen on a list
of sockets, usually 0.0.0.0 and ::
2011-06-06 12:26:10 +10:00
Andrew Bartlett
22cb631b4f s4-interfaces Rename interfaces code so not to conflict with source3/
The iface_count, iface_n_bcast, and load_interfaces functions
conflicted with functions of the same name in source3, so the source4
functions were renamed.  Hopefully we can actually wrap one around the
other in future.

Andrew Bartlett
2011-05-08 12:57:04 +02:00
Andrew Bartlett
67905b41a9 s4-param Rename private_path() -> lpcfg_private_path()
This is consistent with lock_path()

Andrew Bartlett
2011-04-29 16:38:14 +10:00
Matthias Dieter Wallnöfer
ea12adf544 s4/ldb - remove now superflous "ldb_dn_validate" checks
If we immediately afterwards perform an LDB base operation then we don't
need an explicit "ldb_dn_validate" check anymore (only OOM makes sense).

Reviewed by: Tridge
2011-03-04 22:07:24 +01:00
Matthias Dieter Wallnöfer
1343c0723f s4:LDAP server - remove validation checks of input DNs
We should rather try to let the LDB modules perform these checks
otherwise different backends behaviour differently.

Reviewed by: Tridge
2011-03-04 08:51:38 +01:00
Günther Deschner
dc35442fb1 s4-nterr: move auth_nt_status_squash to nt_status_squash and move to nterr.c
Guenther
2011-03-04 01:18:42 +01:00
Andrew Tridgell
8dc92c8f71 ldb: use #include <ldb.h> for ldb
thi ensures we are using the header corresponding to the version of
ldb we're linking against. Otherwise we could use the system ldb for
link and the in-tree one for include

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-02-10 06:51:07 +01:00
William Brown
3b948008ce Added SSL global catalog
Reviewed-by: Andrew Bartlett
Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org>

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Tue Feb  1 20:05:39 CET 2011 on sn-devel-104
2011-02-01 20:05:39 +01:00
Andrew Bartlett
a7bdb49188 s4-ldap_server Allow multiple binds on LDAP server
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Fri Jan  7 00:02:23 CET 2011 on sn-devel-104
2011-01-07 00:02:23 +01:00
Stefan Metzmacher
b85a0d9297 s4:ldap_server: don't call ldb_req_mark_untrusted() on the privileged ldapi socket
metze
2010-12-13 15:32:04 +01:00
Stefan Metzmacher
9a1fb1351f s4:ldap_server: rename helper functions to ldapsrv_ prefix and pass ldapsrv_call
metze
2010-12-13 15:32:04 +01:00
Andrew Tridgell
f5c5fd9e82 s4-ldap: removed an incorrect talloc_move()
the parent of this session_info is either the stream_connection, or
its a system_session(). In either case reparenting it on the
ldapsrv_connection doesn't achieve anything that I can see.

The move was causing a steal on reference error because the
session_info often has multiple references.

Thanks to Metze for spotting this.

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Wed Dec  1 22:10:42 CET 2010 on sn-devel-104
2010-12-01 22:10:42 +01:00
Jelmer Vernooij
1cdc2d7dd6 service_ldap, service_smb: Lowercase output file names.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Mon Nov 22 20:28:14 CET 2010 on sn-devel-104
2010-11-22 20:28:14 +01:00
Jelmer Vernooij
1409c97899 s4: Build ldap and samba3_smb services as shared modules.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Mon Nov 15 03:04:41 UTC 2010 on sn-devel-104
2010-11-15 03:04:40 +00:00
Andrew Tridgell
ef7f4a1420 s4-server: make server sockets a child of the task context
We previously allocated sockets as direct children of the event
context. That led to crashes if a service called
task_server_terminate(), as it left the socket open and handling
events for a dead protocol.

Making them a child of the task allows the task to terminate and take
all its sockets with it.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-11-15 10:19:34 +11:00
Jelmer Vernooij
4217734a51 credentials: Lowercase library name,
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sun Nov  7 01:48:44 UTC 2010 on sn-devel-104
2010-11-07 01:48:44 +00:00
Jelmer Vernooij
0878399bd5 samdb: Lowercase library name. 2010-11-07 01:52:13 +01:00
Anatoliy Atanasov
211f6d5f55 s4/auth: Add logon_parameters to authenticate_username_pw
We need to be able to set the logon parameters in the same way as in the
ntlm server so we can handle openldap simple authentication call correctly.

Autobuild-User: Anatoliy Atanasov <anatoliy@samba.org>
Autobuild-Date: Fri Nov  5 06:32:43 UTC 2010 on sn-devel-104
2010-11-05 06:32:43 +00:00
Andrew Bartlett
4000ec24aa s4-ldap_server Don't DEBUG() at level 2 every time a caller disconnects
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Fri Nov  5 00:12:37 UTC 2010 on sn-devel-104
2010-11-05 00:12:37 +00:00
Jelmer Vernooij
3deece5591 s4: Remove the old perl/m4/make/mk-based build system.
The new waf-based build system now has all the same functionality, and
the old build system has been broken for quite some time.

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sun Oct 31 02:01:44 UTC 2010 on sn-devel-104
2010-10-31 02:01:44 +00:00
Andrew Tridgell
046d38faa5 s4-smbd: don't initialise process models more than once
this also removes the event_context parameter from process model
initialisation. It isn't needed, and is confusing when a process model
init can be called from more than one place, possibly with different
event contexts.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-30 23:49:00 +11:00
Nadezhda Ivanova
3003bd4037 s4-ldb: Changes the aclread module to use LDB_HANDLE_FLAG_UNTRUSTED to determine the source of the request
The aclread module used to use a control to make sure the request comes from the ldap server,
but now the rootdse filters out any unregistered controls comming from ldap, so the control is
lost. Using the LDB_HANDLE_FLAG_UNTRUSTED is a much more elegant solution.

Autobuild-User: Nadezhda Ivanova <nivanova@samba.org>
Autobuild-Date: Wed Oct 27 11:55:11 UTC 2010 on sn-devel-104
2010-10-27 11:55:11 +00:00
Jelmer Vernooij
a74e8be6d1 waf: Stop automaticaly changing dashes to underscores in library names. 2010-10-26 10:17:18 -07:00
Jelmer Vernooij
8cf61377aa waf: Remove lib prefix from libraries manually. 2010-10-26 10:17:17 -07:00
Jelmer Vernooij
5224de3f74 s4: Rename LIBCLI_LDAP to libcli_ldap. 2010-10-24 00:20:04 +00:00
Jelmer Vernooij
833480d3ad s4: Rename LIBSAMBA-* to libsamba-* 2010-10-24 00:20:04 +00:00
Andrew Tridgell
423365d5fa s4-ldap: mark all ldap:// requests as untrusted
this allows the rootdse module to filter unregistered controls

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-19 11:22:35 +11:00
Matthias Dieter Wallnöfer
1ac19c1ca3 s4:ldap_server - use error code constant
Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Mon Oct 18 20:32:40 UTC 2010 on sn-devel-104
2010-10-18 20:32:40 +00:00
Jelmer Vernooij
ea8fc8727b ldap_server: Add missing dependency on gensec_server_start. 2010-10-11 01:06:36 +02:00
Jelmer Vernooij
93126b3315 samdb: Add flags argument to samdb_connect(). 2010-10-10 23:08:49 +02:00
Stefan Metzmacher
61c7b67df9 s4:ldap_server: rewrite to socket layer to use tstream
This should make our sasl and tls handling much more robust
against partial sent pdus.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Fri Oct  8 11:55:26 UTC 2010 on sn-devel-104
2010-10-08 11:55:26 +00:00
Stefan Metzmacher
ab31d9aac9 Revert "s4:ldap_server: rewrite to socket layer to use tstream"
This reverts commit b53fbc75ac.

There are problems with problems with broken gnutls versions.

We can readd this once we have the needed configure checks to
detect the bug in gnutls. See https://bugzilla.samba.org/show_bug.cgi?id=7218.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Oct  7 10:31:18 UTC 2010 on sn-devel-104
2010-10-07 10:31:18 +00:00
Stefan Metzmacher
b53fbc75ac s4:ldap_server: rewrite to socket layer to use tstream
This should make our sasl and tls handling much more robust
against partial sent pdus.

metze
2010-10-04 19:42:19 +00:00
Nadezhda Ivanova
3d0e36bc87 s4-ldap: Added a control to apply the access checks on read via LDAP 2010-09-26 15:36:09 -07:00
Andrew Tridgell
73c3932b2d s4-ldapserver: serialise ldap server operations
This ensures that two ldap server operations cannot happen in parallel
by using packet_recv_disable() and packet_recv_enable() to disable
other interfaces during ldap calls.

This prevents problems caused by parallel ldap operations where
transactions could overlap.
2010-09-07 12:55:27 +10:00
Andrew Bartlett
f37793ef0a s4:ldap_server use talloc_unlink() to avoid talloc_free() with references
Both the session_info and the ldb can have references.

Andrew Bartlett
2010-08-18 10:08:43 +10:00
Andrew Tridgell
eed3838b48 s4-ldapserver: support controls on ldap add and rename
we need to pass the controls down to the add and rename ldb operations

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-08-17 21:21:50 +10:00
Matthias Dieter Wallnöfer
9476c43967 s4:ldap_backend.c - Windows returns WERROR codes in majuscule HEX format 2010-08-15 19:42:39 +02:00
Matthias Dieter Wallnöfer
fb58c0f365 s4:ldap_backend.c - map error codes - add a change which allows custom WERROR codes
This is strictly needed by my recent passwords work, since I want to remove
most of the password change stuff in "samr_password.c". Since AD gives us
CONSTRAINT_VIOLATION on all change problems I cannot distinguish on the SAMR
level which the real cause was about. Therefore I need the extended WERROR codes
here.
2010-08-15 19:42:39 +02:00
Matthias Dieter Wallnöfer
d6ccd4c9da s4:ldap_backend.c - fix a DS error code after WERROR change 2010-08-14 19:44:58 +02:00
Andrew Tridgell
6b266b85cf s4-loadparm: 2nd half of lp_ to lpcfg_ conversion
this converts all callers that use the Samba4 loadparm lp_ calling
convention to use the lpcfg_ prefix.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-07-16 18:24:27 +10:00
Andrew Tridgell
f9022a1a30 s4-dsdb: fixed use after free of sasl mechanisms opaque
the supportedSASLMechanisms opaque must live for at least as long as
the ldb, or we can crash when the first connection is torn down

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-07-02 12:49:04 +10:00
Andrew Tridgell
2671b5aeb0 s4-dsdb: fixed spelling of supportedSASLMechanisms
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-07-02 12:49:04 +10:00
Stefan Metzmacher
bdfba236e9 s4:ldap_server: don't start if we can't bind to port 389
metze
2010-06-28 09:58:13 +02:00
Matthias Dieter Wallnöfer
449370db54 s4:ldap_backend.c - now also the LDAP server supports controls on delete operations 2010-06-20 18:52:31 +02:00
Matthias Dieter Wallnöfer
9803c89ee2 s4:ldap_backend.c - move function "ldb_mod_req_with_controls" to a better place in the code
Under the "add" and over the "delete" function.
2010-06-20 18:52:30 +02:00
Matthias Dieter Wallnöfer
c8d2c5fff0 s4:ldap_backend.c - add some newlines to make logs easier to read 2010-06-20 18:52:27 +02:00
Matthias Dieter Wallnöfer
7cbe3035d9 s4:ldap_backend.c - more customisations to match Windows Server error behaviour on renames 2010-06-19 17:53:23 +02:00
Matthias Dieter Wallnöfer
c9ef9da12f s4:ldap_backend.c - fix crash bugs when we got in error situations with "res" still set to "NULL" 2010-06-18 10:03:19 +02:00
Matthias Dieter Wallnöfer
e7fef1ac84 s4:ldap_backend.c - fix a small error (use "ModifyResponse" rather than "AddResponse") 2010-06-18 10:03:19 +02:00
Stefan Metzmacher
6dbcffb51d s4:lib: merge LDB_WRAP and LDBSAMBA and make LDBSAMBA a library.
This is needed to remove samba specifc symbols from the bundled
ldb, in order to get the ABI right.

metze

Signed-off-by: Andreas Schneider <asn@samba.org>
2010-06-16 14:07:28 +02:00
Matthias Dieter Wallnöfer
f3f91063bd s4:ldap_server/ldap_backend.c - send back also the extended error message if it exists
This message often contains suggestions how to fix issues.
2010-06-06 20:46:29 +02:00
Andrew Bartlett
c8a23147fe s4:libcli/ldap Rename ldap.h to libcli_ldap.h
It is a problem if a samba header is called ldap.h if we also want
to use OpenLDAP's ldap.h

Andrew Bartlett
2010-05-21 17:39:15 +10:00
Anatoliy Atanasov
f84aeea739 s4/rodc: Support read-only database
Check on modify if we are RODC and return referral.
On the ldap backend side now we pass context and ldb_modify_default_callback
to propagate the referral error to the client.
2010-05-04 18:32:18 +02:00
Andrew Bartlett
2c193fe91a s4:auth Remove event context from anonymous_session()
This should always return a simple structure with no need to consult a
DB, so remove the event context, and simplfy to call helper functions
that don't look at privilages.

Andrew Bartlett
2010-04-11 13:36:04 +10:00
Andrew Tridgell
b690fedef5 s4-waf: removed the AUTOGENERATED markers
we won't be using the mk -> wscript generator again
2010-04-06 20:27:16 +10:00
Andrew Tridgell
f9eae32f4b s4-waf: mark the wscript files as python so vim/emacs knows how to highlight them 2010-04-06 20:27:11 +10:00
Andrew Tridgell
845e0cbe6f build: commit all the waf build files in the tree 2010-04-06 20:26:48 +10:00
Matthias Dieter Wallnöfer
ec536a0121 s4:ldap_server - make it "signed-safe"
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-02-25 08:17:12 +11:00
Matthias Dieter Wallnöfer
545889a048 s4:LDAP server - Enable support for returning referrals through it
This is needed for my work regarding the referrals when the domain scope control
isn't specified.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-02-25 08:16:54 +11:00
Nadezhda Ivanova
ea365af4f5 Added freeing a successful req so it doesnt croud the ldb context 2009-12-18 17:57:08 +02:00
Nadezhda Ivanova
4330efe0f2 Removed ldb_modify_ctrl from ldb, implemented as a static in ldap_backend. 2009-12-15 20:29:20 +02:00
Nadezhda Ivanova
a760f169f4 Some changes to allow processing of ldap controls on modify requests.
ldap_backend used to filter out ldap controls on modify. Also, modified
python binding for ldap_modify to allow writing tests for such controls.
2009-11-20 13:22:38 +02:00
Andrew Tridgell
54bd30f706 s4-samdb: reduce the number of samdb opens at startup
Using common parameters means that the ldb_wrap code can return a
reference rather than a new database
2009-10-25 17:19:03 +11:00
Andrew Tridgell
4ad0397d8a s4-ldbwrap: added re-use of ldb contexts in ldb_wrap_connect()
This allows us to reuse a ldb context if it is open twice, instead
of going through the expensive process of a full ldb open. We can
reuse it if all of the parameters are the same.

The change relies on callers using talloc_unlink() or free of a parent
to close a ldb context.
2009-10-23 14:52:17 +11:00
Andrew Tridgell
05f93c3e8f s4-dsdb: add a static samdb_credentials
Similarly to system_session(), this creates a static
samdb_credentials()
2009-10-23 14:52:17 +11:00
Andrew Tridgell
98e4393df9 s4-dsdb: create a static system_session context
This patch adds a system_session cache, preventing us from having to
recreate it on every ldb open, and allowing us to detect when the same
session is being used in ldb_wrap
2009-10-23 14:52:17 +11:00
Matthias Dieter Wallnöfer
ee0204cfcc s4:ldap server - remove unused error handlings
Those error cases should be handled by LDB itself to be available on all
connection methods and not only over LDAP.
2009-10-08 00:18:06 +02:00
Matthias Dieter Wallnöfer
767fce6fcc s4:LDB/LDAP - Re-allow renames
The main problem is that the "rdn_name" module launches on a rename request also
a modification one with the "special attributes" which can't be changed directly.
An introduced flag helps to bypass the restriction.
2009-10-02 21:27:46 +02:00
Andrew Bartlett
737f21bd9d s4:ldap_server Ensure we don't segfault when sent a NULL new RDN
The Microsoft testsuite tried to rename
cn=administrator,cn=users,... into "",cn=users... which didn't go so well.

Andrew Bartlett
2009-10-02 12:45:06 +02:00
Andrew Tridgell
46b7374098 s4-ldap: fixed spelling 2009-09-28 10:24:19 +10:00
Jelmer Vernooij
6a79ad7664 gensec: Avoid exposing lp_ctx on the API level. 2009-09-26 20:55:18 +02:00
Andrew Tridgell
e9a589feac s4-server: kill main daemon if a task fails to initialise
When one of our core tasks fails to initialise it can now ask for the
server as a whole to die, rather than limping along in a degraded
state.
2009-09-18 18:05:55 -07:00
Andrew Bartlett
093148c1f0 s4:ldap_server Correct removal of talloc_steal()
This corrects commit 7a82aed71b.  The
steal did not set ent->attributes, so it was incorrect to assign to
ent->attributes.

Andrew Bartlett
2009-08-14 13:12:35 +10:00
Andrew Bartlett
7a82aed71b s4:ldap_server Remove another talloc_steal (with references)
This talloc_steal also conflicts with the ldb_map code, and like the
previous commit, is rudundent given the talloc_steal of the whole msg
above.

Andrew Bartlett
2009-08-14 12:57:46 +10:00
Andrew Bartlett
5c3cf58a84 s4:ldap_server Don't talloc_steal (with references) in ldap_backend
There may or may not be a need to take a reference to the 'name' in
the ldb_map code, but given we seal the whole msg just above here, it
makes no senst to steal the name, but not the values.

Andrew Bartlett
2009-08-14 12:48:10 +10:00
Stefan Metzmacher
f224089138 s4:ldap_server: make sure we shutdown the tls socket before stream_terminate_connection() removes the fd event
This fixes a crash bug where tls_destructor() relies on the fd event still being there.

metze
2009-08-05 10:10:14 +02:00
Günther Deschner
7048165e7a s4-ldap_server: fix generated error string in map_ldb_error().
Guenther
2009-08-04 00:16:37 +02:00
Matthias Dieter Wallnöfer
04ea52f867 s4: Enhances the LDAP server to display error messages like Windows Server
Those error messages also include the WERROR code of the failed operation(s) in this
manner: <error code eight chars in HEX>: <further error message>

This also addresses bug #4949
2009-07-31 17:41:04 +02:00
Stefan Metzmacher
471e67a733 s4:ldap_server: the tls code steals the original socket on its own now
metze
2009-07-31 14:42:04 +02:00
Andrew Tridgell
2d981919b8 use a talloc_unlink() as ops may have a reference 2009-07-01 15:15:37 +10:00
Volker Lendecke
17a65541bd Reenable the LDAPI socket for the merged build
It seems that the samba4 part of the merged build does not pick up the
DEVELOPER flag from the s3 configure.

Jelmer, can you fix that properly?

Thanks,

Volker
2009-06-24 16:30:55 +02:00
Andrew Bartlett
ec47444a7e Allow developers access the the privilaged ldapi socket for the moment
This allows us some time to get the EXTERNAL bind working
2009-06-19 15:31:54 +10:00
Andrew Bartlett
dcc9ae6995 s4:ldapsrv Place the 'privilaged' ldapi socket under an #ifdef
This makes it clear to our users that this particular implementation
isn't final (all parties are agreed that an EXTERNAL bind is the right
way to do this, but it has not been implemented yet).

Andrew Bartlett
2009-06-19 14:36:06 +10:00
Volker Lendecke
256b227b27 Allow access as SYSTEM on a privileged ldapi connection
This patch creates ldap_priv/ as a subdirectory under the private dir with the
appropriate permissions to only allow the same access as the privileged winbind
socket allows. Connecting to ldap_priv/ldapi gives SYSTEM access to the ldap
database.
2009-06-06 13:10:30 +02:00
Volker Lendecke
f6535d3f3f Fix some nonempty blank lines 2009-05-29 09:48:55 +02:00
Stefan Metzmacher
f6b0a99cef libcli/ldap: move generic ldap control encoding code to ldap_message.c
As they can we static there, we pass the specific handlers as parameter
where we need to support controls.

metze
2009-02-24 17:55:41 +01:00
Andrew Tridgell
bb7e6f0f51 Worked around a problem with select/poll/epoll and gnutls
Our packet layer relies on the event system reliably telling us when a
packet is available. When we are using a socket layer like TLS then
things get a bit trickier, as there may be bytes in the encryption
buffer which could be read even if there are no bytes at the socket
level. The GNUTLS library is supposed to prevent this happening by
always leaving some data at the socket level when there is data to be
processed in its buffers, but it seems that this is not always
reliable.

To work around this I have added a new packet option
packet_set_unreliable_select() which tells the packet layer to not
assume that the socket layer has a reliable select, and to instead
keep trying to read from the socket until it gets back no data. This
option is set for the ldap client and server when TLS is negotiated.

This seems to fix the problems with the ldaps tests.
2009-02-18 17:37:45 +11:00
Andrew Bartlett
71632a1697 Remove auth/ntlm as a dependency of GENSEC by means of function pointers.
When starting GENSEC on the server, the auth subsystem context must be
passed in, which now includes function pointers to the key elements.

This should (when the other dependencies are fixed up) allow GENSEC to
exist as a client or server library without bundling in too much of
our server code.

Andrew Bartlett
2009-02-13 10:24:16 +11:00
Stefan Metzmacher
d9c30894a1 s4:service_stream: s/private/private_data
metze
2009-02-02 13:09:00 +01:00
Stefan Metzmacher
0fadddf8d4 s4:ldap_server: s/private/private_data
metze
2009-02-02 13:08:40 +01:00
Stefan Metzmacher
183c379fe5 s4:lib/tevent: rename structs
list=""
list="$list event_context:tevent_context"
list="$list fd_event:tevent_fd"
list="$list timed_event:tevent_timer"

for s in $list; do
	o=`echo $s | cut -d ':' -f1`
	n=`echo $s | cut -d ':' -f2`
	r=`git grep "struct $o" |cut -d ':' -f1 |sort -u`
	files=`echo "$r" | grep -v source3 | grep -v nsswitch | grep -v packaging4`
	for f in $files; do
		cat $f | sed -e "s/struct $o/struct $n/g" > $f.tmp
		mv $f.tmp $f
	done
done

metze
2008-12-29 20:46:40 +01:00
Jelmer Vernooij
928fd47c3d s4: Fix subsystem for various services in samba daemon. 2008-12-22 19:04:55 +01:00
Andrew Bartlett
e4ccd69d49 s4:ldap_server: return the extended dn to the LDAP client if available
This uses an early peek at the extended_dn_control (in the request) to see what output
format to use.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2008-12-17 12:29:26 +11:00
Andrew Bartlett
109719de03 Remove restrictions on number of DN components in LDAP server
There is no reason for these restrictions to be in the LDAP server -
they belong in the LDB layer.  When accepting 'extended' or
'alternate' DNs we can't tell anyway.

Andrew Bartlett
2008-11-17 10:06:18 +11:00
Jelmer Vernooij
1e053df95c Remove use of global_loadparm for disabled gensec backends. 2008-11-02 19:28:17 +01:00
Jelmer Vernooij
b034c519f5 Add gensec_settings structure. This wraps loadparm_context for now, but
should in the future only contain some settings required for gensec.
2008-11-02 02:05:48 +01:00
Jelmer Vernooij
9565999755 Fix include paths to new location of libutil. 2008-10-11 21:31:42 +02:00
Simo Sorce
b2901da479 LDB ASYNC: misc changes 2008-09-29 04:22:20 +02:00
Simo Sorce
83b0c5d43f Fix nasty bug that would come up only if a client connection to a remote
ldap server suddenly dies.
We were creating a wrong talloc hierarchy, so the event.fde was not
freed automatically as expected. This in turn made the event system call
the ldap io handlers with a null packet structure, causing a segfault.
Fix also the ordering in ldap_connection_dead()
Thanks to Metze for the huge help in tracking down this one.
2008-09-24 01:43:57 -04:00
Jelmer Vernooij
6a689c23e8 Rename smbd -> samba.
This reverts commit 05ea5e23cf.

Conflicts:

	source4/smbd/server.c
2008-09-24 03:16:15 +02:00
Simo Sorce
508527890a Merge ldb_search() and ldb_search_exp_fmt() into a simgle function.
The previous ldb_search() interface made it way too easy to leak results,
and being able to use a printf-like expression turns to be really useful.
2008-09-23 18:17:46 -04:00
Stefan Metzmacher
1d92b2211c s4: allways initialize the process model before it's used
metze
2008-09-22 18:16:09 +02:00
Jelmer Vernooij
05ea5e23cf Revert "Rename smbd -> samba."
This reverts commit 0e9008be35.
2008-09-21 21:32:40 +02:00
Jelmer Vernooij
0e9008be35 Rename smbd -> samba. 2008-09-21 21:26:40 +02:00
Matthias Dieter Wallnöfer
8ac5db1246 LDAP Server: Don't create the SASL SECBLOB output object twice
Removes one "talloc" creation of the output object.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2008-09-19 16:33:47 +02:00
Andrew Bartlett
376b2a29d6 Don't keep an extra ldb around forever.
We just open it to figure out if we need to be a Global Catalog server.

Andrew Bartlett
(This used to be commit f13572d9e9)
2008-07-16 11:11:25 +10:00
Andrew Bartlett
532899386b Use secrets.ldb to store credentials to contact LDAP backend.
This makes Samba4 behave much like Samba3 did, and use a single set of
administrative credentials for it's connection to LDAP.

Andrew Bartlett
(This used to be commit e396a59788)
2008-07-15 15:07:13 +10:00
Stefan Metzmacher
0a391223ac ldap_server: allow modifies to the root dse record and pass them to the ldb layer
metze
(This used to be commit 3da6f7f95d)
2008-07-02 10:32:02 +02:00
Jelmer Vernooij
4c70cda986 Fix a couple (well, little more than that..) of typos.
(This used to be commit a6b5211994)
2008-05-18 23:02:47 +02:00
Jelmer Vernooij
4c8756f147 Create prototype headers from Makefile directory, without smb_build in the middle.
(This used to be commit f4a77b96f9)
2008-05-18 22:30:08 +02:00
Jelmer Vernooij
03643aec88 Use variables for source directory in a couple more places.
(This used to be commit c41bd3005f)
2008-05-18 19:54:27 +02:00
Jelmer Vernooij
cc9c4aaa8d Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-gmake3
Conflicts:

	source/Makefile
	source/auth/config.mk
	source/auth/gensec/config.mk
	source/build/m4/public.m4
	source/build/make/python.mk
	source/build/make/rules.mk
	source/build/smb_build/header.pm
	source/build/smb_build/main.pl
	source/build/smb_build/makefile.pm
	source/dsdb/config.mk
	source/dsdb/samdb/ldb_modules/config.mk
	source/kdc/config.mk
	source/lib/events/config.mk
	source/lib/events/events.c
	source/lib/ldb/config.mk
	source/lib/nss_wrapper/config.mk
	source/lib/policy/config.mk
	source/lib/util/config.mk
	source/libcli/smb2/config.mk
	source/libnet/config.mk
	source/librpc/config.mk
	source/nbt_server/config.mk
	source/ntptr/ntptr_base.c
	source/ntvfs/posix/config.mk
	source/ntvfs/sysdep/config.mk
	source/param/config.mk
	source/rpc_server/config.mk
	source/rpc_server/service_rpc.c
	source/scripting/ejs/config.mk
	source/scripting/python/config.mk
	source/smb_server/config.mk
	source/smbd/server.c
	source/torture/config.mk
	source/torture/smb2/config.mk
	source/wrepl_server/config.mk
(This used to be commit 13bbd42068)
2008-04-25 10:04:20 +01:00
Jelmer Vernooij
21fc767378 Specify event_context to ldb_wrap_connect explicitly.
(This used to be commit b4e1ae07a2)
2008-04-17 12:23:44 +02:00
Jelmer Vernooij
ffc5cbfe80 Move object files lists to makefile rather than smb_build.
(This used to be commit 5628d58990)
2008-04-14 16:53:00 +02:00
Jelmer Vernooij
b5d84a74d1 Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-gmake3
Conflicts:

	source/auth/credentials/config.mk
	source/auth/gensec/config.mk
	source/build/smb_build/makefile.pm
	source/heimdal_build/config.mk
	source/lib/events/config.mk
	source/lib/nss_wrapper/config.mk
	source/lib/policy/config.mk
	source/lib/registry/config.mk
	source/lib/socket_wrapper/config.mk
	source/lib/tdb/config.mk
	source/lib/tls/config.mk
	source/lib/util/config.mk
	source/libcli/config.mk
	source/libcli/ldap/config.mk
	source/libnet/config.mk
	source/librpc/config.mk
	source/param/config.mk
	source/rpc_server/config.mk
	source/scripting/ejs/config.mk
	source/smbd/process_model.mk
(This used to be commit 760378e029)
2008-04-08 03:45:06 +02:00
Jelmer Vernooij
afe3e8172d Install public header files again and include required prototypes.
(This used to be commit 47ffbbf674)
2008-04-02 04:53:27 +02:00
Jelmer Vernooij
f41b9a9dde Rename libsamba-config to libsamba-hostconfig.
(This used to be commit c46b7e90e3)
2008-04-01 15:08:30 +02:00
Andrew Bartlett
1c1c6fca66 Fix more valgrind issues.
This passes down the timeout more consistantly, and ensures that no
matter how the modules screw up, we don't free() the memory we are
going to write into the ASN1 packet until we actually write it out.

Andrew Bartlett
(This used to be commit eefd46289b)
2008-03-29 13:32:15 +11:00