1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-25 06:04:04 +03:00

28126 Commits

Author SHA1 Message Date
Andrew Bartlett
d8f98933fd pydsdb: provide a am_pdc hook like am_rodc to python scripts 2011-12-07 03:09:08 +01:00
Andrew Bartlett
dbbb626dc0 s4-dns Use match-by-key in GSSAPI server if principal is not specified
This allows dlz_bind9 to match on exactly the same key as bind9 itself

Andrew Bartlett

Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Wed Dec  7 02:20:10 CET 2011 on sn-devel-104
2011-12-07 02:20:10 +01:00
Andrew Bartlett
0344e7278b auth: Allow a NULL principal to be obtained from the credentials
This is important when trying to let GSSAPI search the keytab.

Andrew Bartlett
2011-12-07 10:43:52 +11:00
Amitay Isaacs
b9f4febd40 dlz_bind9: Add command line options for URL and debug
To specify debug level, use -d <level> in named.conf.
To specify sam db, use -H <path/to/sam.ldb> in named.conf.

The default log level is set to 0. The log level specified in smb.conf
is not used. To set log level, use -d option.
2011-12-07 10:43:52 +11:00
Amitay Isaacs
de9a4ca831 dlz_bind9: Set debugging output to stderr 2011-12-07 10:43:52 +11:00
Amitay Isaacs
ce19bfcc6b dlz_bind9: Use client supplied credentials for DNS record update
This creates the DNS records with correct owner and group settings.
2011-12-07 10:43:31 +11:00
Amitay Isaacs
d3d365daab dlz_bind9: For creating a child entry, use only SEC_ADS_CREATE_CHILD
The member servers in AD do not have access to modify the parent, but
do have access to create child DNS records.
2011-12-07 10:41:26 +11:00
Jelmer Vernooij
de4b8943bf Install (platform-independent) python scripts to the PYTHONDIR rather than PYTHONARCHDIR. 2011-12-06 21:08:15 +01:00
Matthieu Patou
5bfd6251eb s4-drs: do not try to contact for replication servers that are not anymore in reps*
Servers connection can be removed from repsTo and respFrom either due to
DC demote or topology change by the KCC, if a server is removed from the
reps* it must be effectivly removed from the list of server that we will
contact for getNcChanges and for replicaSync.

Autobuild-User: Matthieu Patou <mat@samba.org>
Autobuild-Date: Mon Dec  5 19:56:09 CET 2011 on sn-devel-104
2011-12-05 19:56:09 +01:00
Matthieu Patou
059523e203 s4-resolver: do not use all the A and AAAA records, those after a NS are not the one we want to use 2011-12-05 18:23:08 +01:00
Matthieu Patou
2f8a84bb7b s4-drs: mark WERR_DS_DRA_BUSY as a non error in DsReplicaUpdateRefs 2011-12-05 18:23:07 +01:00
Matthieu Patou
105d388c9b s4: add blackbox test for the demote function 2011-12-05 18:23:07 +01:00
Matthieu Patou
a8c89fa7d2 samba-tool: refuse to demote if the current DC has still roles 2011-12-05 18:23:07 +01:00
Matthieu Patou
f44e1a753a samba-tool: add a function to cleanly demote a DC
samba-tool domain demote allow the local DC to properly demote against
Microsoft and Samba DC.
2011-12-05 18:23:07 +01:00
Matthieu Patou
fc42b0ab41 s4-python: factorize the definition of get_dsServiceName 2011-12-05 18:23:07 +01:00
Matthieu Patou
093dac4331 s4-python: externalize some function to the drs_utils module so that they can be reused 2011-12-05 18:23:07 +01:00
Matthieu Patou
9e3ee2bf6a s4-python: rename conflicting variable with the import option 2011-12-05 18:23:06 +01:00
Kai Blin
c326b37358 s4 dns: Test SOA queries
Autobuild-User: Kai Blin <kai@samba.org>
Autobuild-Date: Sat Dec  3 20:52:51 CET 2011 on sn-devel-104
2011-12-03 20:52:51 +01:00
Jelmer Vernooij
05bc4de083 Revert making public of the samba-module library.
This library was tiny - containing just two public functions than were
themselves trivial. The amount of overhead this causes isn't really worth the
benefits of sharing the code with other projects like OpenChange. In addition, this code
isn't really generically useful anyway, as it can only load from the module path
set for Samba at configure time.

Adding a new library was breaking the API/ABI anyway, so OpenChange had to be
updated to cope with the new situation one way or another. I've added a simpler
(compatible) routine for loading modules to OpenChange, which is less than 100 lines of code.

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sat Dec  3 08:36:33 CET 2011 on sn-devel-104
2011-12-03 08:36:30 +01:00
Andrew Tridgell
3c4af39aa5 s4-ntvfs: added allow_override check based on use of NT ACL
This disables the posix permission override if the calculated
permissions did not come from a NT ACL.

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Thu Dec  1 05:14:49 CET 2011 on sn-devel-104
2011-12-01 05:14:49 +01:00
Andrew Tridgell
d1274f7f62 s4-ntvfs: fixed a unix ACL mapping bug
the ACL mapping code was incorrectly allowing creation of directories
in some situations where it should be denied by the unix permissions
2011-12-01 13:40:54 +11:00
Jelmer Vernooij
7c1a884396 s4-tests: Use long option names in test list script, to prevent 'eating' --list argument when e.g. is not set. 2011-11-30 22:58:04 +01:00
Jelmer Vernooij
64cfb79cd5 s4-testlist: Write diagnostic info to stderr, and purely test info to stdout. 2011-11-30 22:58:04 +01:00
Matthias Dieter Wallnöfer
456c69f95e s4:lib/tls - call "gnutls_transport_set_lowat" only on GNUTLS < 3.0
This function call together with the lowat feature has been removed in release
3.0 as described in this mailing list post:
http://old.nabble.com/gnutls_transport_set_lowat-deprecated-td32554230.html.

Since we do not make any use of lowat (esprimed by each function call)
we are free to simply omit it on v3.0 and later.

This addresses bug #8537.

Reviewed by: abartlet + metze

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Wed Nov 30 20:11:14 CET 2011 on sn-devel-104
2011-11-30 20:11:14 +01:00
Stefan Metzmacher
de553b52f2 s4:gensec/spnego: only try the mechs that match the client given ones
Windows-Members of NT4/Samba3 domains, send

MechTypes:
1.3.6.1.4.1.311.2.2.10 [NTLMSSP]
1.2.840.48018.1.2.2    [krb5 broken]
1.2.840.113554.1.2.2   [krb5]

MechToken for NTLMSSP.

This patch makes sure we start NTLMSSP with the given MechToken,
instead of trying to pass the NTLMSSP MechToken to the krb5 backend
first. As that would fail the authentication with an error
instead of trying fallbacks.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Nov 30 17:03:29 CET 2011 on sn-devel-104
2011-11-30 17:03:29 +01:00
Stefan Metzmacher
4afbda221c s4:libcli/raw: implement on top of smbXcli_conn/req
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Nov 30 15:13:36 CET 2011 on sn-devel-104
2011-11-30 15:13:36 +01:00
Stefan Metzmacher
99ef6a4bec s4:libcli: do the nbss session request within smbcli_sock_connect_*()
metze
2011-11-30 13:41:09 +01:00
Stefan Metzmacher
52dd549eb6 s4:libcli/raw: remove unused functions
metze
2011-11-30 13:41:08 +01:00
Stefan Metzmacher
b21f344079 s4:libcli: use smbcli_sock_connect() in smbcli_socket_connect()
metze
2011-11-30 13:41:08 +01:00
Stefan Metzmacher
4877be53df s4:libcli: move smbcli_transport_establish() logic into smbcli_socket_connect()
metze
2011-11-30 13:41:08 +01:00
Stefan Metzmacher
b51c92a903 s4:libcli: convert smbcli_transport_connect_* to tevent_req
metze
2011-11-30 13:41:08 +01:00
Stefan Metzmacher
706e10820d s4:lib/socket: add socket_connect_multi_ex_*
This add an async establish hook, that gets called
before a connection success is detected.

This can be used to do a NBT session request
and it makes sure that we don't cancel the connection
on port 445, just because the tcp connect on port
139 worked.

metze
2011-11-30 13:41:08 +01:00
Andrew Bartlett
12ce07e53b s4-kdc: Add hdb plugin for samba4, to allow kadmin to work
This will help users who are used to the kadmin interface, and could
be extended to import existing MIT or Heimdal keys into a Samba4 AD
domain.

To use, add to your krb5.conf

[kdc]

database = {
   dbname = samba4:
}

or

[kdc]

database = {
   dbname = samba4:/usr/local/samba/etc/smb.conf
}

And copy hdb_samba4.so from PREFIX/modules/hdb to your Heimdal lib directory

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Wed Nov 30 03:22:11 CET 2011 on sn-devel-104
2011-11-30 03:22:11 +01:00
Stefan Metzmacher
6b5cfa39f2 s4:libcli/raw: copy smbcli_transport_connect_* to clisocket.c
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Nov 29 17:34:52 CET 2011 on sn-devel-104
2011-11-29 17:34:52 +01:00
Stefan Metzmacher
b3d3395e01 s4:libcli/raw: add transport->ev as copy of transport->socket->event.ctx
We'll remove transport->socket soon, but removing transport->ev
will take a bit longer.

metze
2011-11-29 16:00:08 +01:00
Stefan Metzmacher
511dc9358d s4:torture: use tctx->ev as event context for polling
metze
2011-11-29 16:00:08 +01:00
Stefan Metzmacher
46f0b73c8a s4:gentest: get the tid from the smbcli_tree struct
metze
2011-11-29 16:00:08 +01:00
Stefan Metzmacher
04fa5b4957 s4:libcli/smb2: make sure only one idle event runs at a time
metze
2011-11-29 16:00:08 +01:00
Stefan Metzmacher
f9f261cb60 s4:python: add --machinepass option to 'samba-tool domain join'
metze
2011-11-29 09:21:25 +01:00
Stefan Metzmacher
4edbc719e5 s4:python/samba/join.py: add optional 'machinepass' parameter to join_*()
metze
2011-11-29 09:21:25 +01:00
Stefan Metzmacher
948f091a22 s4:python/samba/join.py: add optional 'machinepass' parameter to class dc_join
metze
2011-11-29 09:21:25 +01:00
Stefan Metzmacher
f8fbc4163b s4:py_net: add optional 'machinepass' parameter to py_net_join_member()
metze
2011-11-29 09:21:25 +01:00
Stefan Metzmacher
fe69c589e8 s4:libnet: make it possible to join with a given machine password
metze
2011-11-29 09:21:25 +01:00
Stefan Metzmacher
677f5246f1 s4:libnet/py_net: ZERO_STRUCT() struct libnet_Join_member in py_net_join_member()
metze
2011-11-29 09:21:25 +01:00
Stefan Metzmacher
1764607150 s4:torture/rpc: use talloc_zero() in torture_join_domain()
metze
2011-11-29 09:21:25 +01:00
Stefan Metzmacher
5baa44345f s4:libnet: use talloc_zero(struct libnet_JoinDomain) in libnet_Join_member()
metze
2011-11-29 09:21:25 +01:00
Andrew Bartlett
2bff209128 s4-samba-tool: Add --principal argument to samba-tool domain exportkeytab
This allows only a particular principal to be exported to the keytab.
This is useful when setting up unix servers in a Samba controlled
domain.

Based on a request by Gémes Géza <geza@kzsdabas.hu>

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Nov 29 09:20:55 CET 2011 on sn-devel-104
2011-11-29 09:20:54 +01:00
Amitay Isaacs
8eef716598 s4-provision: Fix the security ace for DnsAdmins group on DNS records
Find the objectSid for DnsAdmins group and use that instead of a fixed sid.

Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Tue Nov 29 07:38:06 CET 2011 on sn-devel-104
2011-11-29 07:38:05 +01:00
Amitay Isaacs
2e4bf8bfcd s4-repl: Check if GC SPN exists before using it for replication
Sometimes windows DC will set up dNSHostname before setting up
GC SPN and that causes replication errors since samba tries to
use GC SPN, which does not yet exist locally.

Pair-Programmed-With: Andrew Tridgell <tridge@samba.org>
2011-11-29 16:00:36 +11:00
Amitay Isaacs
1e935d1bdc s4-provision: Make BIND9_DLZ as the default backend for DNS 2011-11-29 16:00:36 +11:00