IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
To speed up operations with the lpq command, it's now run in a separate
asynchronous process.
Opening the Printers folder on NT is now fast ;-) I think even faster than
with a ** server
Jeremy, you should look at that patch to include it in 2.2.3
J.F.
(This used to be commit 8ef9dff307)
activate you need to:
- install krb5 libraries
- run configure
- build smbclient
- run kinit to get a TGT
- run smbclient with the -k option to choose kerberos auth
(This used to be commit d330575856)
added ucs2_to_dos83 function.
the code should be ok now.
further test with japanese and other languages is needed at this point.
(This used to be commit 74f746fee2)
for unicode strings. The new method relies on 3 files that are mmap'd
at startup to provide the mapping tables. The upcase.dat and
lowcase.dat tables should be the same on all systems. The valid.dat
table says what characters are valid in 8.3 names, and differs between
systems. I'm committing the japanese valid.dat here, in future we need
some way of automatically installing and choosing a appropriate table.
This commit also adds my mini tdb based gettext replacement in
intl/lang_tdb.c. I have not enabled this yet and have not removed the
old gettext code as the new code is still being looked at by Monyo.
Right now the code assumes that the upcase.dat, lowcase.dat and
valid.dat files are installed in the Samba lib directory. That is not
a good choice, but I'll leave them there until we work out the new
install directory structure for Samba 3.0.
simo - please look at the isvalid_w() function and think about using
it in your new mangling code. That should be the final step to
correctly passing the chargen test code from monyo.
(This used to be commit 1c221994f1)
The problem is we were trying to use mask_match as a generic
wildcard matcher for UNIX strings (like the password prompts).
We can't do that - we need a unix_wild_match (re-added into lib/util.c)
as the ms_fnmatch semantics for empty strings are completely wrong.
This caused partial reads to be accepted as correct passwd change
responses when they were not....
Also added paranioa test to stop passwd change being done as root
with no %u in the passwd program string.
Jeremy.
(This used to be commit 9333bbeb76)
The big one is a global change to allow us to NULLify the free'ed pointer to a
former passdb object. This was done to allow idra's SAFE_FREE() macro to do
its magic, and to satisfy the input test in pdb_init_sam() for a NULL pointer
to start with.
This NULL pointer test was what was breaking the adding of accounts up until
now, and this code has been reworked to avoid duplicating work - I hope this
will avoid a similar mess-up in future.
Finally, I fixed a few nasty bugs where the pdb_ fuctions's return codes were
being ignored. Some of these functions malloc() and are permitted to fail.
Also, this caught a nasty bug where pdb_set_lanman_password(sam, NULL) acheived
precisely didilly-squat, just returning False. Now that we check the returns
this bug was spotted. This could allow different LM and NT passwords.
- the pdbedit code needs to start checking these too, but I havn't had a
chance to fix it.
I have also fixed up where some of the password changing code was using the
pdb_set functions to store *internal* data. I assume this is from a previous
lot of mass conversion work...
Most likally (and going on past experience) I have missed somthing, probably in
the LanMan password change code which I havn't yet been able to test, but this
lot is in much better shape than it was before.
If all this is too much to swallow (particularly for 2.2.2) then just adding a
sam_pass = NULL to the particular line of passdb.c should do the trick for the
ovbious bug.
Andrew Bartlett
(This used to be commit 762c8758a7)
store mangled filename in dos charset and unmangled in unicode.
clean ups
still lot to do.
againg compiled but not yet tested.
(This used to be commit 2d1aabb6d4)
Fix the NT errror codes, this time in line with WinXP/2k.
- Return the normal error codes, expect for bad user/bad password. These map
to logon failure, as a quick security hack. We follow suit.
Simplfy some of the password extraction code, the auth subsytem has the
intelegence to sort this stuff out, no need to do it here.
Move to 'global_encrypted_passwords_negotiated' to determine the use of
unencrypted hacks, replacing the current mess.
Andrew Bartlett
(This used to be commit c04f063573)
first.
Add password expiry and 'must change before first logon' support.
- This requires that the passdb be up to the job to supply the info.
(This used to be commit 53c1c5091e)
This whole area needs to be cleaned up. Should this kind of passowrd
change/check be permitted with encrypt passwords = yes?
In any case I've also had trouble testing this, as I can't find the right
software/configuration to exersise this behaviour. But its better than the
previous situation. Any assistance greatly appriciated.
Andrew Bartlett
(This used to be commit 37655b4289)
than NT_STATUS_LOGON_FAILURE. This also brings us (almost) back in line with
their implementation.
Kill off SMBENCRYPT() macro
Kill off 'nt smb support' paramater - tridge okayed this one.
Andrew Bartlett
(This used to be commit 67947bf6e3)
Add the ability for swat to run in non-root-mode (ie non-root from inetd).
- we still need some of the am_root() calls fixed however.
(This used to be commit 2c2317c56e)
some sainity, avoiding things like 'root preexec' when the connection would
otherwise already be denied (max connections).
This does change behaviour, but I think its for the best.
Andrew Bartlett
(This used to be commit 99e8a263ad)
DEBUG(). Also included are details like build date/time, location and
compiler.
This should get most of the options we set, except those that don't affect
smbd, like WITH_PAM_SMBPASSWD or WITH_WINBINDD.
This work due to Vance Lankhaar <vlankhaar@hotmail.com>
Some work needs to be done to make it only rebuild when needed (ie smbd being
rebuilt) but its in pretty good shape already.
Also fix up some printf() -> d_printf().
Andrew Bartlett
(This used to be commit beff1d2bea)
simply not doing Get_Pwnam() calls in pass_check.c
We now make *one* sys_getpnam() call in cgi.c and we always call PAM no matter
what it returns. We also no longer run the password cracker for these logins.
The truly parinod will note the slight difference in call paths, in that we only
call crypt for valid password structs (if not --with-pam). The truly parinoid
don't run SWAT either, so I don't think this is an issue.
Andrew Bartlett
(This used to be commit 9020d88493)
they can have general effect.
Fixed up workstaion support in the rest of samba, so that we can do these
checks.
Pass through the workstation for cli_net_logon(), if supplied.
(This used to be commit 7f04a139b2)
Rework the 'map to guest' code, its now possible to follow what its trying
to do...
Add an NT_STATUS_EQUAL(x,y) macro to make this stuff sane to look at.
Andrew Bartlett
(This used to be commit d618880661)
- the usersupplied_info now contains a smb_username (as it comes across on
the wire) and a unix_username (after being passed through mapping
functions)
- when doing security={server,domain} use the smb_username, otherwise use
the unix_username
(This used to be commit d34fd8ec07)
by default in Samba 3.x
- got rid of some unused parameters in Makefile.in
- declare DEBUGLEVEL in debug.h rather than in each file
(This used to be commit b8651acb9c)
replacemnt of stdio that doesn't suffer from the 8-bit filedescriptor
limit that we hit with nasty consequences on some systems
I would eventually prefer us to have a configure test to see if we need
to replace stdio, but for now this code needs to be tested widely so
I'm enabling it by default.
(This used to be commit 1af8bf34f1)
fsp->share_mode otherwise the check to see if the fsp share mode
matches the one in the db will fail when you come to delete it,
thus leaving us with a share mode on a file that isn't even open!
(This used to be commit 2020738b88)
It's a quick and ugly hack as a proof of concept: the dell powervault 705
works with a samba PDC.
I'll do a correct user enumeration later.
J.F.
(This used to be commit 9ec6a87356)
major changes include:
- added NSTATUS type
- added automatic mapping between dos and nt error codes
- changed all ERROR() calls to ERROR_DOS() and many to ERROR_NT()
these calls auto-translate to the client error code system
- got rid of the cached error code and the writebmpx code
We eventually will need to also:
- get rid of BOOL, so we don't lose error info
- replace all ERROR_DOS() calls with ERROR_NT() calls
but that is too much for one night
(This used to be commit 83d9896c1e)
drop paramaters:
status
utmp hostname
change session code to always record each vuid current on the server. The sessionid struct is no longer packed, as I couldn't get that to work ;-)
change smbstatus to show this info and less of the connections.tdb info (its not actualy that accurate).
I'll get swat doing some of this shortly.
(This used to be commit b068ad3005)
"share" instead of "\\server\share".
Fix that. Still not able to get the user list but that's something else.
Jeremy I don't think I broke anything ;-)
J.F.
(This used to be commit 59018c58e4)
smbds. This should fix one case of logs not getting rotated properly.
We may need to test this to make sure there is no big performance hit from
the extra stat call.
(This used to be commit 2501fe7c04)
link from Seattle is having problems.
I've added 3 things here to work on the fcntl spin
problem.
1). Check *all* tdb return codes... :-).
2). If we're asking ourselves to break an oplock, and we can't
find a fsp pointer that matches the entry, this is a *logic bug*
and we should abort and panic so someone with gdb can pick up
the pieces.
3). After we've broken an oplock, ensure that the entry itself
has been removed, and if not remove it ourselves. This should
not be neccessary in a correctly working environmen,t, but will
provide an added layer of robustness in error situations.
4). I hate german keyboards :-) :-).
Jeremy.
(This used to be commit 1c94fa8064)
smbd/password.c: We don't use globals here anymore
smbd/reply.c: Tidyness, global_myworkgroup must die!
smbd/service.c: Move some of the make_connection code into a helper
function.
(This used to be commit 15c87e404f)
In particuar, it moves the domain_client_validate stuff out of
auth_domain.c to somwhere where they (I hope) they can be shared
with winbind better. (This may need some work)
The main purpose of this patch was however to improve some of the
internal documentation and to correctly place become_root()/unbecome_root()
calls within the code.
Finally this patch moves some more of auth.c into other files, auth_unix.c
in this case.
Andrew Bartlett
(This used to be commit ea1c547ac8)
which I will confirm once I can find a box it would break on in the first place.
(this is the pam accounts as nobody thing we had with 2.2.0)
Andrew Bartlett
(This used to be commit 9746ad12bd)
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f3)
break code path that was invalid (ie. we were assuming
we could infer a non-levelII oplock when such an oplock
was detected - this may no longer be valid once we've
processed the break process dealing with the break will
change the state of it anyway.
This prevents the state where we get the following packet
trace :
client server
NTcreate ->
<- NTcreate resp
NTcreate ->
<- break to level II
ok - broken ->
<- break to none
Thanks to Alan Romeril for providing the trace that allowed
me to track this down.
Jeremy.
(This used to be commit c343e4f490)
on username we already know are perfectly valid, and in their final form. In
particular we don't want to do a lookup for DOMAIN\nobody, it just does not
make sense, nor should we do map_username and the like if the username is as
specified in the vuid - we have done it already.
Andrew Bartlett
(This used to be commit 7cb517329b)
not change behaviour.
This should make my later diffs smaller, where I actualy start cleaning up this
mess...
Andrew Bartlett
(This used to be commit 04f090c224)
if the password is blank. That ain't valid with encrypted passwords!
Jeremy, this changes the semantics of session setup. We no longer
automatically set guest=True when the client happens to choose their
username == the guest username. Instead we rely on the map_to_guest
code. I'm pretty sure this is now the right thing, but please look at
it carefully before putting it in 2.2
This is the bug that was causing the build farm to sometimes
fail. Basically we failed every 256 attempts - ie. when the first byte
of the encrypted password happened to be 0
(This used to be commit 4b35a3494c)
The problem is that ftruncate can't expand on VFAT, but it can on
ext2. That means our autoconf test is useless. I have recoded it to
use the alternative to ftruncate when then sys_ftruncate fails.
Jeremy, do you want this for 2.2.1?
(This used to be commit 970236ee99)
This commit gets rid of all our old codepage handling and replaces it with
iconv. All internal strings in Samba are now in "unix" charset, which may
be multi-byte. See internals.doc and my posting to samba-technical for
a more complete explanation.
(This used to be commit debb471267)
server, Win9x only sends \PIPE instead of \PIPE\. Looks suspiciously like
an off-by one bug in the Win9x dce/rpc pipe code.
(This used to be commit b4a9079833)
allow us to have test targets without special configure options
- fixed make proto so that it actually does something
(This used to be commit 55109a7525)
that libsmb/ creates a local tcp socket then launches smbd as a subprocess
attached to that socket. smbd thinks it is being launched from inetd.
to use it do the following:
- compile with -DSMB_REGRESSION_TEST
- run like this (also works with smbtorture etc)
export SMBD_TEST=1
export LIBSMB_PROG=bin/smbd
smbclient //server/share -Uuser%pass
obviously you need to setup a smb.conf etc. Using --prefix to configure
is useful.
The aim of all this stuff is to add a decent set of regression tests
to the build farm, so we know if smbd actually runs correctly on all the
platforms, not just builds. We can run smbtorture, masktest, locktest etc,
plus a bunch of smbclient scripts and any new tests we write.
This doesn't help much with nmbd (at least not yet) but its a good start.
(This used to be commit 7e8e6ae9a8)
years old) bug when chainging a sessionsetup_and_X and tcon together.
The wrong username was being entered into the tdb, even though the
correct user was used for accessing files. This is related to the fact
that authorise_login() is not used for sessionsetup, but only for tcon
auths.
Jeremy.
(This used to be commit 0187cd6aef)
but the code suffered from bitrot and is not now reentrant. That means
we can get bizarre behaviour
i've fixed this by making next_token() reentrant and creating a
next_token_nr() that is a small non-reentrant wrapper for those lumps
of code (mostly smbclient) that have come to rely on the non-reentrant
behaviour
(This used to be commit 674ee2f1d1)
send unaligned unicode strings sometimes!
Fixed our handling of the workgroup name tacked on the end of the
NT1 negprot response (a unaligned unicode)
fixed a couple of places where we should be using the message_end fns instead
of pre-calculated buffer lengths
(This used to be commit 86613493a9)
Samba Users Group Japan, ensure that we don't use dos_to_unix(xx,True),
but always use dos_to_unix(xx,False) to prevent overwriting.
Jeremy.
(This used to be commit 244aec8ea6)
smbd/posix_acls.c: Attempt to fix the "lose default acl" problem in Solaris.
Needs testing.
lib/sysacls.c: Typo fix.
Jeremy.
(This used to be commit d989f8bd3e)
CAP_LARGE_READX|CAP_LARGE_WRITEX bits on negprot and out W2K
performance goes through the roof......
And as we *always* offer 64 buffers we can do this with this
simple change.....
Jeremy.
(This used to be commit c328dda0fa)
- it didn't honour the clear flag
- it locked the database (not necessary)
the previous code would do 10^6 kill() operations for 1000 people
logging in - and all with the database locked. Not very scalable.
Still haven't added the counter, that would make it really efficient
(This used to be commit 6bdbeb4a32)
the pam password change code to ensure that existing and working password
chat scripts don't break with 2.2.1. PAM password changing has to be explicitly
requested.
Allowed wildcards in pam password change matching (matches password chat
script matching). Had to add const (sorry Tim :-) to ms_fnmatch() to
stop warnings. Don't worry - the const changes are isolated and don't
cause any other warnings :-).
Jeremy.
(This used to be commit 47b4d82536)
remove global static PAM variables, and to tidy up the PAM internals code.
Now looks like the rest of Samba.
Still needs testing.
Jeremy.
(This used to be commit 1648ac64a7)
