1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-13 13:18:06 +03:00
Commit Graph

84111 Commits

Author SHA1 Message Date
Günther Deschner
e8feca012e spoolss: make spoolss deal with ndr64 ULONG_PTR of devmode_ptr and secdesc_ptr.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-01-17 17:11:37 +01:00
Matthieu Patou
e1d50a6b24 dsdb-operational: Avoid doing the ldb_attr_cmp if bypass flag is not set
Most of the time this flag is not set and so we can avoid the strcasecmp
in ldb_attr_cmp()

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 17 17:10:32 CET 2013 on sn-devel-104
2013-01-17 17:10:32 +01:00
Andrew Bartlett
a0faf16ae9 torture: Fix fsmo test to use correct -H samba-tool syntax
However, the test still does not pass.

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Andrew Bartlett
18d7e5df0e dsdb: Do not hold the transaction over the IRPC call to perform a role transfer
This avoids one samba process locking out another from the DB.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Andrew Bartlett
b40d134bc1 selftest: also skip raw.search as it also spins
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Andrew Bartlett
316fd085ad drs-fsmo: Improve handling of FSMO role takeover.
This needs to be more async, and give less scary errors.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Stefan Metzmacher
6a1025551e dsdb-acl: calculate sDRightsEffective based on "nTSecurityDescriptor"
acl_check_access_on_attribute should never be called with attr=NULL
because we don't check access on an attribute in that case

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>

Autobuild-User(master): Matthieu Patou <mat@samba.org>
Autobuild-Date(master): Thu Jan 17 11:21:10 CET 2013 on sn-devel-104
2013-01-17 11:21:10 +01:00
Stefan Metzmacher
ccf577da14 dsdb-acl: add helper variable 'ldb' in acl_sDRightsEffective
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:23:06 -08:00
Stefan Metzmacher
629ce2a1ba libcli/security: don't look at the inherited type in get_ace_object_type()
The inherited_type is only used to decide if aces should be inherited
effectively or not (INHERIT_ONLY) for the specified object.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:22:32 -08:00
Stefan Metzmacher
70460605c6 dsdb-acl: fix the order of special and system checks
First we check for a special dn, then for system access.
All allocations happen after this checks in order to avoid
allocations we won't use.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:20:47 -08:00
Matthieu Patou
a0c59b4da1 dsdb-acl: Do not apply ACL on special DNs to hide attributes that the user shouldn't see
This fix frequent reindexing when using python script with a
user that is not system.
The reindexing is caused by ACL module hidding (removing) attributes in
the search request for all attributes in dn=@ATTRIBUTES and because
dsdb_schema_set_indices_and_attributes checks that the list of
attributes that it just calculated from the schema is the same as the
list written in @ATTRIBUTES, if not the list is replaced and a
reindexing is triggered.

Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 00:20:45 -08:00
Stefan Metzmacher
961a1fbbbc dsdb-acl: talloc_free the private context when we pass to the next module
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:20:40 -08:00
Stefan Metzmacher
947985b259 dsdb-acl: don't call dsdb_user_password_support() if we don't use the result
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
2013-01-17 00:16:24 -08:00
David Disseldorp
8e63a72ec1 smb2_ioctl: copychunk request max output validation
Check that the copychunk ioctl request maximum output specified by the
client is large enough to hold copychunk response data.

Reviewed by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan 17 00:59:44 CET 2013 on sn-devel-104
2013-01-17 00:59:44 +01:00
David Disseldorp
bf07c33dac smb2_ioctl: track copychunk response output state
Treat the response data independent to the status.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
cb323281c1 smb2_ioctl: copychunk CHECK_READ and CHECK_WRITE
[MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request, specifies
that the copychunk destination file handle be granted FILE_WRITE_DATA
and FILE_READ_DATA access.

FILE_READ_DATA access must also be granted on the copychunk source file,
which may be done implicitly with execute permission.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
456724f05d torture: copychunk test suite improvements
Allow for large files in test_setup_copy_chunk():
  Write test data in 1M IOs, rather than attempting to do the whole
  thing in one go.

Add copychunk bad resume key test:
  Send a copy chunk request with an intentionally bogus resume key
  (source key handle).

Add copychunk src=dest test:
  Test copychunk requests where the source and destination handles refer
  to the same file.

Add copychunk src=dest overlap test.

Add desired access args to test_setup_copy_chunk().

Add copychunk_bad_access test:
  Open the copychunk source and destination files with differing
  desired_access values. Confirm copychunk response matches 2k8 and 2k12
  behaviour.

Add copy_chunk_src_exceed test:
  Attempts to copy more data than is present in the copychunk source
  file.

Add copy_chunk_src_exceed_multi test:
  Test whether the first chunk in a multi-chunk copychunk request is
  written to disk, where the second chunk is invalid due to src file
  overrun.

Add copy_chunk_sparse_dest test:
  Issue a request where the target offset exceeds the file size, resulting
  in a sparse region.

Add copy_chunk_max_output_sz test.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
c3cc51e8a2 smb2_ioctl: only pass through to VFS on a valid fsp
A null fsp is dereferenced on VFS call.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
bfe765367e torture: replace ioctl failure returns with helper calls
Also change test_ioctl_get_shadow_copy() to use torture_skip(), and
clean up test output.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
42a5a6c0f6 torture: add locking tests for copychunk
Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
a7c2f13d7a smb2_ioctl: perform locking around copychunk requests
For each chunk in a copychunk request, take a read and write lock on
the source and destination files respectively.

Also change the resume key format to use a combination of the persistent
and volatile handles. Thanks to Metze for his help on this.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
7ca8663e31 smbd: split out file_fsp_get from file_fsp_smb2
Obtain the files_struct from smb2req, persistent_id and
volatile_id.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
3619b1a7b2 torture: skip FSCTL_SRV_ENUM_SNAPS test when not supported
If FSCTL_SRV_ENUM_SNAPS fails with NT_STATUS_NOT_SUPPORTED then skip the
test, this means we can run the full ioctl test suite as part of
autobuild.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
bc59ebf523 selftest: enable samba3.smb2.ioctl tests against s3fs
These tests are now expected to pass with copy-chunk support now
implemented.

This effectively reverts 632b1042ae.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
65983aac12 smb2_ioctl: remove ioctl error response assumptions
MS-SMB2 3.3.4.4 documents cases where a ntstatus indicating an error
should not be considered a failure. In such a case the output data
buffer should be sent to the client rather than an error response
packet.

Add a new fsctl copy_chunk test to confirm field limits are sent back
in response to an oversize chunk request.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
e38d9f71d9 smb2_ioctl: add support for FSCTL_SRV_COPYCHUNK
SMB2 clients can issue FSCTL_SRV_COPYCHUNK requests in order to copy
data between files on the server side only, rather than reading data
then writing back from the client. FSCTL_SRV_COPYCHUNK is used by
default for Explorer SMB2 file copies on Windows Server 2012.

2.2.32.1 SRV_COPYCHUNK_RESPONSE in [MS-SMB2] describes the requirement
for the server to provide maximum copychunk request size limits in ioctl
responses carrying STATUS_INVALID_PARAMETER.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:07 +01:00
David Disseldorp
ef00eb90e5 s3-vfs: add copy_chunk vfs hooks
copy_chunk copies n bytes from a source file at a specific offset to a
destination file at a given offset. This interface will be used in
handling smb2 FSCTL_SRV_COPYCHUNK ioctl requests.

Use a pread/pwrite loop in vfs_default, so that requests referring to
the same src and dest file are possible.

Provide send and receive hooks for copy chunk VFS interface, allowing
asynchronous behaviour.

Check whether the request source offset + length exceeds the current
size. Return STATUS_INVALID_VIEW_SIZE under such a condition, matching
Windows server behaviour.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:06 +01:00
David Disseldorp
2bde963688 smb2_ioctl: add FSCTL_SRV_REQUEST_RESUME_KEY support
Use existing ioctl IDL infrastructure for marshalling. Support for this
ioctl is a prerequisite for FSCTL_SRV_COPYCHUNK handling.
The client-opaque resume key is constructed using the server side
dev/inode file identifier.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:06 +01:00
David Disseldorp
14bd6c8b09 smb2_ioctl: split ioctl handler code on device type
Add per device type ioctl handler source files for FSCTL_DFS,
FSCTL_FILESYSTEM, FSCTL_NAMED_PIPE and FSCTL_NETWORK_FILESYSTEM.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:06 +01:00
David Disseldorp
958b21c28d smb2_ioctl: split ioctl handlers into separate funtions
Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-16 23:15:06 +01:00
Michael Adam
9ba44cc610 build(waf): fix the abi_match for the pdb library
The global wildcard match is automatically added by the parsing code
if the global match list is empty. Specifying an explicit '*' as the only
global match lets the parsing code add a second '*' to the local list,
which is an error tolerated on my linux by ld (the GNU linker), but
not by the stricter GNU ELF linker "gold".

Pair-Programmed-With: Gregor Beck <gbeck@sernet.de>

Signed-off-by: Gregor Beck <gbeck@sernet.de>
Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Wed Jan 16 21:31:00 CET 2013 on sn-devel-104
2013-01-16 21:31:00 +01:00
Günther Deschner
46b6afc69b s4-torture: add ndr64 spoolss openprinterex to ndr test.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jan 16 13:26:53 CET 2013 on sn-devel-104
2013-01-16 13:26:53 +01:00
Günther Deschner
6cdf59d716 s4-torture: allow to do ndr tests with flags, not only ndr_flags.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-01-16 11:42:29 +01:00
Günther Deschner
a4dcf7b94d spoolss: Make OpenPrinterEx work with NDR64 by using UserInfo Container.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-01-16 11:42:13 +01:00
Volker Lendecke
6bb7bf9ebb test: dbwrap_tool requires --persistent for the registry now
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Jan 15 16:31:35 CET 2013 on sn-devel-104
2013-01-15 16:31:35 +01:00
Michael Adam
7f65434559 docs: document the "--persistent" option in dbwrap_tool(1)
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:20 +01:00
Michael Adam
770b1aafa0 s3:dbwrap_tool: add --persistent switch and mode for non-persistent DBs
This changes the default for dbwrap_tool to open a DB as non-persistent.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:20 +01:00
Michael Adam
11850e4605 dbwrap: add dbwrap_is_persistent()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:20 +01:00
Michael Adam
d67911bafc docs: document the command line options in dbwrap_tool(1)
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:20 +01:00
Michael Adam
f3f878f7a0 docs: use the popt.common.samba.client entity in samba-tool(8)
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Michael Adam
cdc18f92cc docs: use the entities popt.common.samba.server and stdarg.help in samba(8)
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Michael Adam
2d30e5deaf docs: add popt.common.samba.server and popt.common.samba.client entities
These are comprised by the popt.common.samba entity and the stdarg.server.debug
or the stdarg.client.debut entity, respectively.
The difference is only in the default value of the debug level setting.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Michael Adam
2ab3a96d26 docs: fix the stdarg.configfile entity to print a "=" sign after the long option
This makes the appearance equal to the other options like --debuglevel or
--log-basename.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Michael Adam
e3db3db784 docs: use the stdarg.option entity in the popt.common.samba entity
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Michael Adam
c9b95eb205 docs: add an entity stdarg.option for the "--option" command line parameter
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Björn Baumbach
d61d2af372 wafsamba: use additional xml catalog file (bug #9512)
Add additional "/usr/local/share/xml/catalog" catalog file
platforms (used by freebsd).
Fix manual page build on freebsd.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Björn Baumbach
07660ac01a smb.conf(5): client min protocol: add hint at list of available protocols
And fix the format.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Björn Baumbach
d6ec1ef6cc smb.conf(5): server min protocol: add hint at list of available protocols
And fix the format.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Björn Baumbach
41955b711f build(waf)-libreplace: remove redundant check for flistea function
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00
Björn Baumbach
cabc89a1e7 ntlm_auth(1): fix many format issues and and make examples visible
"<example>" is no child of "<para>". So these examples were not visible.
Using a varlist instead may be not the best way but it does look nice.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2013-01-15 14:49:19 +01:00