1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

32724 Commits

Author SHA1 Message Date
Volker Lendecke
f5e95af59b rpc_server: Fix CID 1362565 Improper use of negative value
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-06-07 14:34:11 +02:00
Andrew Bartlett
1a87c9b599 repl: Avoid use-after-free when working with the working_schema
The original schema must live as long as the working_schema
as the working_schema starts as a shallow-copy of schema.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11953

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Jun  7 14:33:39 CEST 2016 on sn-devel-144
2016-06-07 14:33:38 +02:00
Andrew Bartlett
c4afb1d3bd selftest: Add a reverse variation to ReplicateMoveObject3
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Samba <garming@catalyst.net.nz>
2016-06-07 10:28:11 +02:00
Andrew Bartlett
889f33d47f selftest: Assert replPropertyMetaData values before and after replication
This covers renames, addition of attributes, and the delete.

We also confirm the results via DRS.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-07 10:28:11 +02:00
Andrew Bartlett
374a01119d dsdb: Fix rename and RDN handling for replPropertyMetaData
This matches Windows 2012R2, which both has the RDN not sorted last and has it updated with the local
invocation_id and a local version.

The RDN attribute, unlike name, is not replicated over DRS, so the impact for interopability extends only to
the incorrect RDN values that we were finding with dbcheck (values that did not match the name values).

Finally, we always force the RDN to match the name attribute, which avoids issues
in dbcheck where these diverge.  As such, we can finally remove dbcheck as a
flapping test, last re-added in e4bab3a828

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-07 10:28:10 +02:00
Andrew Bartlett
a8430d15a5 dsdb: Fix incorrect sorting of replPropertyMetaData with RDN last
Per tests against Windows 2012R2 the RDN is not sorted last and is
instead sorted normally with all the other elements.

The RDN attribute, unlike name, is not replicated over DRS, so this
has no interopability impact.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-07 10:28:10 +02:00
Andrew Bartlett
225cef9851 dsdb: Show initial replicated modify as well as resolved modify in repl_meta_data
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-07 10:28:10 +02:00
Andrew Bartlett
9dcc62eb78 selftest: Add more tests to cover attribute changes vs DN renames
This covers a bug where unrelated attribute changes would reverse a rename

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-07 10:28:10 +02:00
Andrew Bartlett
5fee4aa907 dsdb: Use replmd_replPropertyMetaData1_new_should_be_taken in replmd_replicated_apply_search_callback()
This is the primary handler for renames

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-07 10:28:10 +02:00
Andrew Bartlett
f0aa1d8b80 dsdb: Use replmd_replPropertyMetaData1_new_should_be_taken in replmd_replicated_apply_merge()
This is the main handler for attribute conflicts

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-07 10:28:10 +02:00
Andrew Bartlett
b28d8d4278 dsdb: Use replmd_replPropertyMetaData1_new_should_be_taken in replmd_replicated_handle_rename()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-07 10:28:10 +02:00
Andrew Bartlett
dae543e04e dsdb: Use replmd_replPropertyMetaData1_new_should_be_taken in replmd_op_possible_conflict_callback()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-07 10:28:10 +02:00
Andrew Bartlett
f709261c73 dsdb: Add new helper function replmd_replPropertyMetaData1_new_should_be_taken()
This will allow the test for "name" and the actual DN to be consistent,
and so avoids dbcheck errors when CN and name do not match the DN

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-07 10:28:10 +02:00
Andrew Bartlett
8f1557a2c4 selftest: Run the krb5.kdc test on a more selective basis
The previous tests would take 20mins, the new set of tests take around 7 mins and still cover
the important combinations, given that it is the same KDC code in each environment

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-07 10:28:10 +02:00
Andrew Bartlett
ae3d0fecd6 selftest: Add tests to show that we can not create duplicate schema entries
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jun  6 20:32:54 CEST 2016 on sn-devel-144
2016-06-06 20:32:54 +02:00
Andrew Bartlett
8f93bfc75c samldb: Make checks for schema attributes much more strict
This avoids corrupting Samba when invalid schema is imported

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2016-06-06 16:36:23 +02:00
Andrew Bartlett
cccd20ff55 Remove the try/catch from urgent_replication.py
This meant that for ages, the duplicate OID was unnoticed, and when the syntax
was corrected recently, this caused the test to run, and so cause trouble

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-06 16:36:23 +02:00
Andrew Bartlett
f7eb865cd9 selftest: Assert that name, the RDN attribute and actual RDN are in sync
This allows us to catch such errors here, rather than just on dbcheck later

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-06 16:36:23 +02:00
Andrew Bartlett
39ac5ad90f selftest: Add another test case to replica_sync test
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-06 16:36:23 +02:00
Andrew Bartlett
4271692d86 repl: Do not report all replication failures at level 0
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:23 +02:00
Andrew Bartlett
ca37c7146c selftest/drs: Show we return the correct 3 objects for DRSUAPI_EXOP_FSMO_RID_ALLOC
This does not depend on DRSUAPI_DRS_GET_ANC.

This test is not new, but it was not previously being run.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:23 +02:00
Andrew Bartlett
c5ed894006 selftest: initial version of new repl_move test
This tests complex rename and modify combinations in a way that
demonstrated a number of replication failures, due to incorrect
handling in Samba when the parent of the record changes.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-06 16:36:23 +02:00
Andrew Bartlett
9aa2d44462 dsdb: Give the objectGUID ahead of LDIF dump of replicated changes
This can help isolate which object this is when the object is involved
in a rename.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:23 +02:00
Andrew Bartlett
90581b2613 dsdb: Simplify replmd_op_possible_conflict_callback behaviour
The previous behaviour of this code was to overwrite the req->callback of the original, failed request.

This is a problem for many reasons - including that ldb_module_done() may already have been
called on that pointer.

The correct pattern is to create a new request, and to call ldb_module_done() on the parent
request (the one in ar->req) not in this one, in the error case.

We use the passed in new callback either as the callback to call on success, or
as the callback to the ADD request.  We overwrite it with replmd_op_name_modify_callback
in the rename remote case, as before, but no longer modify req->callback as
this will not be used again.

This is less tricky and a little simpler to follow, as we also remove the
now unused handling for RENAME, which is in a separate routine now

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:23 +02:00
Andrew Bartlett
8938f384b7 dsdb: Split rename case out of replmd_op_possible_conflict_callback
This avoids running this code path, originally written for the add case, in
a semi-async manner in the rename case, which caused both bugs and complexity.

This does create a deal of duplicated code, but it is easier to follow because
there are no longer special cases for ADD and RENAME in the "common" code and
the behaviour of ldb_module_done() and the callbacks is well defined and expected

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-06 16:36:23 +02:00
Andrew Bartlett
e1dcd45d9e repl_meta_data: Give more information on replication rename behaviour
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:22 +02:00
Andrew Bartlett
7773116f90 repl_meta_data: Fail to replicate over local objects not NC_HEAD with a all-zero parentGUID
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:22 +02:00
Andrew Bartlett
fb9f5264ef dsdb: Give more errors in operational module when building the parentGUID
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:22 +02:00
Andrew Bartlett
1e21a5ad61 dsdb: Clearly fail to replicate objects not NC_HEAD with a all-zero parentGUID
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:22 +02:00
Andrew Bartlett
449271defc repl: Enforce that we have parent objects for all replicated objects
The creating of replicated objects without their parent object allows database corruption as they can end up under
the wrong object.  We need to re-try the replication with the DRSUAPI_DRS_GET_ANC flag
set to get the objects in tree order.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 16:36:22 +02:00
Andrew Bartlett
2d67128814 dsdb: Move operational below repl_meta_data so we can query parentGUID
This avoids re-adding the same code in repl_meta_data or making a shared subroutine

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-06 16:36:22 +02:00
Andrew Bartlett
4d26210806 dsdb: Cache our local invocation_id at the start of each request
This avoids fetching it over and over again

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jun  6 12:25:14 CEST 2016 on sn-devel-144
2016-06-06 12:25:14 +02:00
Andrew Bartlett
ee80da56b9 repl: Retry replication of the schema on WERR_DS_DRA_SCHEMA_MISMATCH
This makes us replicate the schema, and then go back to what we asked to replicate
originally, when the schema changes.  This should make the replication much more
robust after schema changes

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
db15993401 dbcheck: Find and fix a missing Deleted Objects container
Older Samba versions could delete this.  This patch tries very hard
to put back the original object, with the original GUID, so that
if another replica has the correct container, that we just merge
rather than conflict.

The existing "wrong dn" check can then put any deleted objects
under this container correctly.

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
0f28c96d88 repl: Remove duplicated delete of sAMAccountType
This causes the version number in replPropertyMetaData to be
incorrectly bumped twice, because it is implied by not being in the
list of attributes to be preserved.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
de8fb1f1ed dsdb: Allow "cn" to be missing on schema import
This avoids a segfault when we remove the duplication of this value from dsdb_convert_object_ex()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
c6ed444ac7 selftest: Make replica_sync test pass against Windows 2012R2
The tests that invoke --local will not pass, naturally, but otherwise it works

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
ca2e038aa5 samba-tool domain join: Set drsuapi.DRSUAPI_DRS_GET_ANC during initial repl
This is needed so that we get parents before children.

We need this to ensure that we always know the correct parent for a
new child object, rather than just trusting the DN string

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
d103aabcf5 dsdb: Only search the provided partition for the object GUID
We know which NC this is in, so save searching all the backends.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
65a35acbf3 repl: Pass in the full partition DN to dsdb_replicated_objects_convert()
When we were processing an EXOP, we would pass in a DN specific to that
operation, but this stopped repl_meta_data from finding the parent object

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
5967852aa0 repl: Allow GetNCChanges DRSUAPI_EXOP_REPL_OBJ to succeed against a deleted object
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-06 08:50:09 +02:00
Andrew Bartlett
21b4f67acd dsdb: Remove incorrect RDN attid check in replmd_replPropertyMetaDataCtr1_verify
On windows, the RDN is not sorted last.  Additionally, the check should have been
against dsdb_attribute_get_attid(), not just ->attributeID_id

By including this in earlier versions of Samba, we allow a backport of Samba
databases from Samba 4.5, where this will be sorted in the same way
as Windows 2012R2.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11842
2016-06-06 08:50:08 +02:00
Andrew Bartlett
5c6a97769c selftest: Use random OIDs from under the Samba OID arc
The urgent_replication.py test used the OID of uid, and this caused
other tests to fail

The other random OIDs should have been from under our arc, not under
iso.member-body.us

We split up the range a little to avoid some of the birthday paradox,
in the tests that create multiple OIDs.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz
2016-06-06 08:50:08 +02:00
Bob Campbell
82a10942d4 samba_spnupdate: do not interpret failure count as unix error code
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Fri Jun  3 11:02:26 CEST 2016 on sn-devel-144
2016-06-03 11:02:26 +02:00
Bob Campbell
5c008e0216 samba_dnsupdate: do not interpret failure count as unix error code
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2016-06-03 07:27:22 +02:00
Andrew Bartlett
0b4c741b9c build: Build less of Samba when building --without-ntvfs-fileserver
We would build, but not use, many components of the NTVFS file server
even when we asked not to.  They would then consume disk, but not be
of any use

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-02 16:36:15 +02:00
Andrew Bartlett
90665713ab repl: Do not consider userPassword differences to matter in rpc.dssync
userPassword is also not shown over LDAP

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-02 16:36:15 +02:00
Andrew Bartlett
b816ca3e0f torture: Only walk over objects actually converted in drs.dssync
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-02 16:36:15 +02:00
Andrew Bartlett
2679bdc45b dsdb: Improve syntax clarity
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-02 16:36:15 +02:00
Andrew Bartlett
5fe59f3e63 dsdb: Use DRSUAPI_ATTID_isDeleted constant in repl_meta_data
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-02 16:36:15 +02:00