1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

566 Commits

Author SHA1 Message Date
Volker Lendecke
2dffcde408 smbd: Remove "share_mode_entry->lease"
smbstatus was the only user, and this could be solved by adapting
share_entry_forall.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jul 27 01:42:31 CEST 2018 on sn-devel-144
2018-07-27 01:42:31 +02:00
Stefan Metzmacher
19119a5549 smbd: rename smbXsrv_client->ev_ctx into smbXsrv_client->raw_ev_ctx
That makes it clearer that no tevent_context wrapper is used here
and the related code should really run without any (active) impersonation
as before.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2018-06-18 08:59:18 +02:00
Stefan Metzmacher
71d5809188 smbd: remove xconn->client->last_session_id based set_current_user_info() caching
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2018-06-18 08:59:16 +02:00
Volker Lendecke
3bbc575644 smbd: remove "id" from share_mode_entry
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Feb 13 05:01:38 CET 2018 on sn-devel-144
2018-02-13 05:01:38 +01:00
Volker Lendecke
0b57434151 smbd: Fix channel sequence number checks for long-running requests
When the client's supplied csn overflows and hits a pending, long-running
request's csn, we panic. Fix this by counting the overflows in
smbXsrv_open_global0->channel_generation

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13215

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-01-14 10:26:05 +01:00
Stefan Metzmacher
a59c9cba31 secrets.idl: add secrets_domain_info that will be used in secrets.tdb for machine account trusts
This blob will be store in secrets.tdb. It makes it possible to store much
more useful details about the workstation trust.

The key feature that that triggered this change is the ability
to store details for the next password change before doing
the remote change. This will allow us to recover from failures.

While being there I also thought about possible new features,
which we may implement in the near future.

We also store the raw UTF16 like cleartext buffer as well as derived
keys like the NTHASH (arcfour-hmac-md5 key) and other kerberos keys.
This will allow us to avoid recalculating the keys for an in memory
keytab in future.

I also added pointer to an optional lsa_ForestTrustInformation structure,
which might be useful to implement multi-tenancy in future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-06-27 16:57:46 +02:00
Stefan Metzmacher
3b13e4d2d0 s3:libnet_join.idl: add krb5_salt to libnet_JoinCtx
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-06-27 16:57:43 +02:00
Stefan Metzmacher
03e455f5a8 s3:libnet_join.idl: return the domain_guid in libnet_JoinCtx
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-06-27 16:57:43 +02:00
Jeremy Allison
b691f6d32f s3: smbd: Fix open_files.idl to correctly ignore share_mode_lease *lease in share_mode_entry.
This is currently marked 'skip', which means it isn't stored in the
db, but printed out in ndr dump. However, this pointer can be invalid
if the lease_idx is set to 0xFFFFFFFF (invalid).

This is fixed up inside parse_share_modes(), but not until after
ndr_pull_share_mode_data() is called. If lease_idx == 0xFFFFFFFF
then ndr_print_share_mode_lease() prints an invalid value and
crashes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12793

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu May 18 03:01:40 CEST 2017 on sn-devel-144
2017-05-18 03:01:40 +02:00
Günther Deschner
31f33a3f39 s3:smbXsrv.idl: add 8 byte channel_sequence number and request counters to IDL.
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-22 00:23:21 +01:00
Günther Deschner
4a49f6fac9 s3:librpc:idl:libnet_join: add encryption types to libnet_JoinCtx.
Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-14 16:19:23 +01:00
Michael Adam
03a3aa9815 smbXsrv.idl: add create_action to smbXsrv_open
Needed for create replay.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-03 13:09:24 +01:00
Michael Adam
1eb5f1e422 librpc:smbXsrv.idl: add flags to smbXsrv_open
These flags reflect the need for and state of the replay cache.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-03 13:09:24 +01:00
Stefan Metzmacher
3590f3f562 idl:smbXsrv: add smbXsrv_connection_pass structures.
To be used for the connection passing message.

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2016-01-26 15:58:11 +01:00
Stefan Metzmacher
bae1b9401c idl:smbXsrv: add smbXsrv_client_global structures
This is for marshalling smbXsrv_client.

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2016-01-26 15:58:11 +01:00
Michael Adam
d60ffcfe44 smbXsrv: introduce bool smbXsrv_client->server_multi_channel_enabled
defaulting to false.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-01-23 00:08:36 +01:00
Ralph Boehme
9d284431fc s3:smb2_server: add signing state tracking flags
Add flags that track the signing state of all incoming and outgoing SMB2
packets and a helper function that can be used to determine whether a
session of tcon can be considered "signed".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:21 +01:00
Ralph Boehme
fe5353c82e s3:smb2_server: convert signing_required bool to flags bitmap
Use a flags bitmap for storing the signing state. This is in preparation
of a subsequent patch that adds more flags to the bitmap.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:21 +01:00
Ralph Boehme
e501c733ec s3:smb2_server: add encryption state tracking flags
Add two encryption state tracking flags that can be used to tell whether
a session or tcon is "encrypted" and add a helper function to calculate
the encryption state from those flags.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:20 +01:00
Ralph Boehme
736cd36d36 s3:smb2_server: store encryption cipher in the channel
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:20 +01:00
Ralph Boehme
bfdffea0fa s3:smb2_server: convert encryption desired and required bools to flags
This adds a bitmap smbXsrv_encrpytion_flags with flags to the
smbXsrv_session_global.tdb and smbXsrv_tcon_global.tdb that we use
instead of bools for desired and required.

We need this info in the smbXsrv tdbs for smbstatus. Subsequent commits
for smbstatus will use it.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-22 07:52:20 +01:00
Michael Adam
86dd7b941c smbXsrv_session:idl: remove the preauth and gensec members
They are now taken from the pending_auth member (smbXsrv_session_auth0).

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Jul 31 01:03:13 CEST 2015 on sn-devel-104
2015-07-31 01:03:13 +02:00
Michael Adam
5e463b553b smbXsrv_session:idl: add smbXsrv_session_auth0
This contains various auth related items for a session,
in particular preauth. This is in preparation to take
the direct member preauth from smbXsrv_session and have
all session auth code operate on session->pending_auth
instead of session->preauth and friends.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2015-07-30 21:58:14 +02:00
Uri Simchoni
ed2ed1ad69 net: fix the order of DC lookup methods when joining a domain
The dsgetdcname() function is able to try just DNS lookup, just NetBIOS,
or start with DNS and fall back to NetBIOS. For "net ads join", we know
most of the time whether the name of the domain we're joining is a DNS
name or a NetBIOS name. In that case, it makes no sense to try both lookup
methods, especially that DNS may fail and we want to fall back from site-aware
DNS lookup to site-less DNS lookup, with no NetBIOS lookup in between.

This change lets "net ads join" tell libnet what is the type of the domain
name, if it is known.

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-09 12:33:25 +02:00
Michael Adam
a3ea6dbef5 smbXsrv: add bools encryption_desired to session and tcon
This is to indicate that we should sen the ENCRYPT_DATA
flag on session or tcon replies.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2015-07-07 14:05:27 +02:00
Simo Sorce
461c69bd7c s3:smb2_server: In CCM and GCM mode we can't reuse nonces
Reuse of nonces with AES-CCM and AES-GCM leads to catastrophic failure,
so make sure the server drops the connection if that ever happens.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11300

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Simo Sorce <idra@samba.org>
Autobuild-Date(master): Fri May 29 22:38:50 CEST 2015 on sn-devel-104
2015-05-29 22:38:50 +02:00
Stefan Metzmacher
4481fea86a s3:smb2_sesssetup.c: For SMB >= 3.1, derive crypto keys from preauth
This protects the full connection setup including
a posteriori verification of the negotiate messages,
by signing the final session setup response with a signing key
derived from the preauth hash and the authentication session key.

Pair-Programmed-With: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2015-05-08 13:00:28 +02:00
Jeremy Allison
13b6199a2f s3: locking: Add a memcache based lock cache.
Based on an idea by Volker to optimize cpu usage when
parsing struct share_mode_data entries.

Add a 64-bit sequence number to the share mode entry,
and after the entry is stored back in the db, cache
the in-memory version using talloc reparenting into the
memcache. The memcache key used is the same struct file_id
used as the key into the locking db.

On read, check if the locking db version sequence number
matches the in-memory cache, and if so reparent the
memcache version back onto the required memory context.

Saves all the ndr decoding when multiple accesses to the
same lock entry happen in succession.

Design also improved by Metze and Ira.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Apr 17 22:38:34 CEST 2015 on sn-devel-104
2015-04-17 22:38:34 +02:00
Andrew Bartlett
eedd127c25 librpc: Move messaging.idl to the top level
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2015-02-16 12:15:07 +01:00
Noel Power
a5d383cbd5 allow net ads join accept new osServicePack parameter
osServicePack paramater allows the default behaviour ( which is to use
the samba version string as the operatingSystemServicePack attribute )
to be overridden
Additionally make sure if blank string is passed that it is treated
as attribute deletion. This is necessary as values for the os attributes
are eventually passed to ads_modlist_add if the value is "" then the
attempt to add this attribute fails in the underlying ldap
'ldap_modfiy_ext_s' function. In this case we need to pass NULL as the
value to force deletion of the ldap attribute

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan  8 00:18:05 CET 2015 on sn-devel-104
2015-01-08 00:18:05 +01:00
Jeremy Allison
5ebb190385 s3:locking: Change the data model for leases_db to cope with dynamic path renames.
interface leases_db
{
        typedef [public] struct {
                GUID client_guid;
                smb2_lease_key lease_key;
        } leases_db_key;

        typedef [public] struct {
                file_id id;
                [string,charset(UTF8)] char *servicepath;
                [string,charset(UTF8)] char *base_name;
                [string,charset(UTF8)] char *stream_name;
        } leases_db_file;

        typedef [public] struct {
                uint32 num_files;
                [size_is(num_files)] leases_db_file files[];
        } leases_db_value;
}

As designed by metze.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec  9 03:44:04 CET 2014 on sn-devel-104
2014-12-09 03:44:04 +01:00
Jeremy Allison
5661198d71 s3:locking: prepare the data model for leases_db to cope with dynamic path renames.
interface leases_db
{
        typedef [public] struct {
                GUID client_guid;
                smb2_lease_key lease_key;
        } leases_db_key;

        typedef [public] struct {
                file_id id;
                [string,charset(UTF8)] char *servicepath;
                [string,charset(UTF8)] char *base_name;
                [string,charset(UTF8)] char *stream_name;
        } leases_db_file;

        typedef [public] struct {
                uint32 num_files;
                [size_is(num_files)] leases_db_file files[];
        } leases_db_value;
}

As designed by metze.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-12-09 01:18:08 +01:00
Stefan Metzmacher
6b2f19a5e6 s3:open_files.idl: add data structures for SMB2.1 and SMB3.0 leases.
Pair-Programmed-With: Volker Lendecke <vl@samba.org>

Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2014-12-04 05:45:09 +01:00
Volker Lendecke
14fac5dbc0 s3:locking: add leases_db infrastructure
Will enable us to solve the dynamic share path problem
with leases on [homes].

We're also able to give the correct error codes when a
lease key is re-used with a different file name.

Pair-Programmed-With: Jeremy Allison <jra@samba.org>

Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-12-04 05:45:09 +01:00
Stefan Metzmacher
768ec14b3c s3:librpc/idl: mark struct smbXsrv_client as [public]
This avoids compiler warnings about unused code.

We don't use the NDR code for this yet, will be done
when we get multi-channel support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-11-25 07:25:44 +01:00
Günther Deschner
eb8d914d91 s3-netapi: add DS_8 and WS flags to libnetapi and nltest.
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-10-24 11:30:05 +02:00
Volker Lendecke
bdebf96cab idl: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Tue Oct  7 17:03:42 CEST 2014 on sn-devel-104
2014-10-07 17:03:42 +02:00
Stefan Metzmacher
64d140197e s3:messaging: make it possible to receive a fd array from another process
In order to receive the fd array the caller needs to use
messaging_filtered_read_send/recv(). For all higher level
methods we silently close/ignore the fd array.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-24 08:44:11 +02:00
Stefan Metzmacher
cd7c24a9b1 s3:smbXsrv_session: remember the smbXsrv_connection on channel attached to a session
A session will be usable from multiple connections in future.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:13 +02:00
Stefan Metzmacher
333707fa37 s3:smbd: move smbXsrv_{session,tcon,open} tables to smbXsrv_client
These should be per client (based on the SMB >= 2.1 client_guid),
this is a preparation for multi-channel support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:12 +02:00
Stefan Metzmacher
80e226ddae s3:smbXsrv_session: change smbXsrv_session->connection to smbXsrv_session->client
A session will be usable from multiple connections in future.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:12 +02:00
Stefan Metzmacher
e23785ae37 s3:smbd: introduce 'struct smbXsrv_client' in order to prepare multi-channel support
This structure is supposed to hold the global state shared between
multiple connections from the same client.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-09-19 09:15:11 +02:00
Stefan Metzmacher
bd19fd1286 s3:smbd: remember the time of the session setup auth_time
This is the time of the last reauth.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-08-06 09:51:14 +02:00
Volker Lendecke
d7b4f863e4 messaging3: messaging_array is no longer used
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-07-28 22:04:13 +02:00
Michael Adam
cd95937369 s3: remove stat_ex.vfs_private completely
It is not used any more.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Jul 24 14:23:11 CEST 2014 on sn-devel-104
2014-07-24 14:23:11 +02:00
Andrew Bartlett
f4ab082d2b librpc/idl: Merge wbint.idl with winbind.idl so we can forward IRPC requests to internal winbind calls
Change-Id: Iba3913d5a1c7f851b93f37e9beb6dbb20fbf7e55
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-06-11 10:18:26 +02:00
Andrew Bartlett
223fbdaf38 s3-winbindd: Listen on IRPC and do forwarded DNS updates on an RODC
Change-Id: Ib87933c318f510d95f7008e122216d73803ede68
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-06-11 10:18:26 +02:00
Volker Lendecke
dcb3f2150e messaging: Nobody uses G_LOCK_RETRY anymore
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue May  6 23:01:22 CEST 2014 on sn-devel-104
2014-05-06 23:01:22 +02:00
Volker Lendecke
9e754840de smbd: Remove unused "share_mode_data->id"
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 21 21:22:24 CET 2014 on sn-devel-104
2014-03-21 21:22:24 +01:00
Volker Lendecke
84d8b2b013 smbd: Make "num_children" available by smbcontrol
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Christof Schmit <cs@samba.org>
2014-01-06 13:27:05 -07:00