IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
all parts of a ldb_result:
@BASEINFO has 2 elements
elt[0]: val[0]: sequenceNumber = 2
elt[1]: val[0]: distinguishedName = @BASEINFO
name=foo has 2 elements
elt[0]: val[0]: foo = bar
elt[1]: val[0]: distinguishedName = name=foo
Cleanup some swig junk that was only necessary when including config.h
and function prototypes that used the PRINTF_ATTRIBUTE() macro.
Add some more comments.
(This used to be commit 9327fd07d6)
Start wrapper for ldb_search(). Currently it returns a list of swig
ldb_message objects. More unpacking of results required.
(This used to be commit 704787978a)
- VERSION: should contain the current version. Will be made part of the filename.
- SO_VERSION: should contain the latest version that this on is compatible to. Will be used for setting the soname of the shared library.
Fix sonames and use them on platforms that support them
Remove symlinking code. ldconfig will take care of creating the symlinks now
that we set the soname.
(This used to be commit 7871b07e21)
dcerpc still need fixing, the produced shared library misses some symbols.
Jelmer, can you look at it while you are playing with the build system ?
(This used to be commit af92996e30)
Applications that use LDB modules will now have to run ldb_global_init()
before they can use LDB.
The next step will be adding support for loading LDB modules from .so
files. This will also allow us to use one LDB without difference between the
standalone and the Samba-specific build
(This used to be commit 52a2356505)
This should give better behaviour in SWAT.
Fix authentication as Samba, rather than System, users in SWAT.
Andrew Bartlett
(This used to be commit 498d72c4ad)
Previously, we had to know (or guess) the host and domain guid at the
provision stage. Now we query the database post-provision, to extract
the values and fill in the zone file.
This allows us to generate a correct zone file in the Windows migration case.
In an effort to make SWAT easier to use, I have removed and renamed
some of the provision options.
I have also fixed a nasty issue in my js code. I had implictly
declared a global variable of the name 'join', with disasterious
results for any subsequent user of the string utility function:
esp exception - ASSERT at lib/appweb/ejs/ejsParser.c:2064, 0
Backtrace:
[ 0] substitute_var:20 -> list[i] = join("", list2)
[ 1] setup_file:9 -> data = substitute_var(data, subobj)
Andrew Bartlett
(This used to be commit a38ceefd11)
Doing this required reworking ejsnet, particularly so it could take a
set of credentials, not just a username and password argument.
This required fixing the ejsnet.js test script, which now adds and
deletes a user, and is run from 'make test'. This should prevent it
being broken again.
Deleting a user from ejsnet required that the matching backend be
added to libnet, hooking fortunetly onto already existing code for the
actual deletion.
The js credentials interface now handles the 'set machine account' flag.
New functions have been added to provision.js to wrap the basic
operations (so we can write a command line version, as well as the web
based version).
Andrew Bartlett
(This used to be commit a5e7c17c34)
main provision script a bit, as the argument list was getting out of
control. (It has been replaced in part with an object).
This also returns the session_info from the auth code into ejs.
We still need access control allowing only root to re-provision.
Andrew Bartlett
(This used to be commit 002cdcf3ca)
structure that is more generic than just 'IP/port'.
It now passes make test, and has been reviewed and updated by
metze. (Thankyou *very* much).
This passes 'make test' as well as kerberos use (not currently in the
testsuite).
The original purpose of this patch was to have Samba able to pass a
socket address stucture from the BSD layer into the kerberos routines
and back again. It also removes nbt_peer_addr, which was being used
for a similar purpose.
It is a large change, but worthwhile I feel.
Andrew Bartlett
(This used to be commit 88198c4881)
This should be replaced with real ACLs, which tridge is working on.
In the meantime, the rules are very simple:
- SYSTEM and Administrators can read all.
- Users and anonymous cannot read passwords, can read everything else
- list of 'password' attributes is hard-coded
Most of the difficult work in this was fighting with the C/js
interface to add a system_session() all, as it still doesn't get on
with me :-)
Andrew Bartlett
(This used to be commit be9d0cae89)
This should allow us to provision to a 'normal' LDAP server.
Also add in 'session info' hooks (unused). Both of these need to be
hooked in on the webserver.
Andrew Bartlett
(This used to be commit b349d2fbfe)
lookups in load_interfaces(). The reason was my eth0 interface was
down, and it was being interpreted as a DNS name.
This patch changes load_interfaces() to happening automatically when
interfaces are first needed instead of on the startup of every samba
binary. This means that (for example) ldbadd doesn't call
load_interfaces(), which means no slow DNS lookups.
I also reduced the number of static globals in interface.c to 1, and
changed from malloc to talloc
When you want to force a reload of the interfaces list, you now call
unload_interfaces(), which means the next call that needs the
interfaces list will reload it
(This used to be commit f79d90bd13)
dcerpc_interface_table struct rather then a tuple of interface
name, UUID and version.
This removes the requirement for having a global list of DCE/RPC interfaces,
except for these parts of the code that use that list explicitly
(ndrdump and the scanner torture test).
This should also allow us to remove the hack that put the authservice parameter
in the dcerpc_binding struct as it can now be read directly from
dcerpc_interface_table.
I will now modify some of these functions to take a dcerpc_syntax_id
structure rather then a full dcerpc_interface_table.
(This used to be commit 8aae0f168e)
backend.
The idea is that every time we open an LDB, we can provide a
session_info and/or credentials. This would allow any ldb to be remote
to LDAP. We should also support provisioning to a authenticated ldap
server.
(They are separate so we can say authenticate as foo for remote, but
here we just want a token of SYSTEM).
Andrew Bartlett
(This used to be commit ae2f3a64ee)
This merges Samba4 up to current lorikeet-heimdal, which includes a
replacement for some Samba-specific hacks.
In particular, the credentials system now supplies GSS client and
server credentials. These are imported into GSS with
gss_krb5_import_creds(). Unfortunetly this can't take an MEMORY
keytab, so we now create a FILE based keytab as provision and join
time.
Because the keytab is now created in advance, we don't spend .4s at
negprot doing sha1 s2k calls. Also, because the keytab is read in
real time, any change in the server key will be correctly picked up by
the the krb5 code.
To mark entries in the secrets which should be exported to a keytab,
there is a new kerberosSecret objectClass. The new routine
cli_credentials_update_all_keytabs() searches for these, and updates
the keytabs.
This is called in the provision.js via the ejs wrapper
credentials_update_all_keytabs().
We can now (in theory) use a system-provided /etc/krb5.keytab, if
krb5Keytab: FILE:/etc/krb5.keytab
is added to the secrets.ldb record. By default the attribute
privateKeytab: secrets.keytab
is set, pointing to allow the whole private directory to be moved
without breaking the internal links.
(This used to be commit 6b75573df4)
functionalities into groups of subcontexts of net subcontext just the
way it's done in net tool. This way we can pass common arguments when
creating subcontext. Also, this may allow easier writing net tool
completely as a script.
At the moment there's a name resolve code segfault to be fixed.
rafal
(This used to be commit 25310d0592)
This patch changes the way lsb_search is called and the meaning of the returned integer.
The last argument of ldb_search is changed from struct ldb_message to struct ldb_result
which contains a pointer to a struct ldb_message list and a count of the number of messages.
The return is not the count of messages anymore but instead it is an ldb error value.
I tryed to keep the patch as tiny as possible bu as you can guess I had to change a good
amount of places. I also tried to double check all my changes being sure that the calling
functions would still behave as before. But this patch is big enough that I fear some bug
may have been introduced anyway even if it passes the test suite. So if you are currently
working on any file being touched please give it a deep look and blame me for any error.
Simo.
(This used to be commit 22c8c97e6f)
js arrays are a special type of object where the length property is
automatic, and cannot be modified manually. Our code was manually
setting length, which made it abort when someone passed in a real ejs
array. To fix this we need to create real arrays instead of objects,
and remove the code that manually sets the length
(This used to be commit ebdd1393fd)
so you can use them in search filters,
only for administration not used inside the winserver code
- fix the samba3 ugrade scripts to create a correct samba4 wins.ldb
metze
(This used to be commit 9f3b6746d8)
I still have issues with Win2k3 SP1, and Samba4 doesn't pass it's own
test for the moment, but I'm working on these issues :-)
This required a change to the credentials API, so that the special
case for NTLM logins using a principal was indeed handled as a
special, not general case.
Also don't set the realm from a ccache, as then it overrides --option=realm=.
Andrew Bartlett
(This used to be commit 194e8f07c0)
searches in ldb to be more ldap compliant, but broke the wins server
and the ejs ldb code. This fixes those up so 'make test' passes again.
(This used to be commit dff660c23c)
if we fail to erase a ldb during provision by traversing
and deleting records (an in-place erase) then just unlink it
and start it again. This makes provisioning much more robust
to changes in ldb that make it not backward compatible with
old DBs.
(This used to be commit 173655aec2)
Write out new smb.conf file. Parameters that have disappeared
between Samba 3 and 4 will optionally be prefixed with 'samba3:'
(This used to be commit 27eefbd905)
Currently uses the prefix "param" for all functions and structures; suggestions for better ones are welcome...
Remove old smb.conf-parsing code from libsamba3.
(This used to be commit 414e5f7f6d)
Kerberos CCACHE into the system.
This again allows the use of the system ccache when no username is
specified, and brings more code in common between gensec_krb5 and
gensec_gssapi.
It also has a side-effect that may (or may not) be expected: If there
is a ccache, even if it is not used (perhaps the remote server didn't
want kerberos), it will change the default username.
Andrew Bartlett
(This used to be commit 6202267f6e)
- fixed ncacn_ip_tcp to use the generic async name resolution methods,
so NBT names now work (as requested several times by abartlet!)
- changed resolve_name() to take an event_context, so it doesn't cause
the whole process to block
- cleaned up the talloc_find_parent_bytype() calls to go via a cleaner
event_context_find() call
(This used to be commit b3d491b210)
call is returning a boolean anyway).
Unfortunately the new GetOptions syntax loses the ability for the caller to know why the
command line arguments were bad. Maybe we would be better always returning an object and
having an is_error element?
(This used to be commit 516ba6d20b)
to add/remove keys and values in the future.
add it to the standard tests, ensuring that we know if winreg
breaks. This is particularly important as winreg uses such unusual IDL
constructs
(This used to be commit e4ca36bda3)
interfaces to RPC. This makes large blobs of data much saner. Tim, you
will probably want to do the same for the smb_interfaces.h generated
code.
Next we will need ways of extracting different data types from these
blobs, for example asking for the blob to be interpreted as a utf16
string, or as a little-endian integer. That will allow for registry
scripting to be quite sane.
(This used to be commit a8bca2e8e2)
calls. The previous IDL was just a workaround for the limitations of
our older rpc infrastructure. Now that Jelmer has added much improved
string support using the charset keyword we can correctly implemenent
the unusual winreg string buffers.
Jelmer, note the little comment I put on winreg_StringBuf() about why
I couldn't use [value()] for the length field.
This also fixes EnumKey() and EnumValue() to use NTTIME fields for the
last_changed_time. I don't know why we were using a pair of uint32's,
as it is just a NTTIME.
(This used to be commit 8354b01612)
- map the result code from rpc calls into the ejs objects
- treat winreg_String like lsa_String, hiding the length elements
(This used to be commit 2f6311c9a3)
This is rather like AJAX, but passes around javascript objects between
the client and server, taking advantage of the fact that we have the
same language on both client and server.
(This used to be commit 5f9e00fb7f)
- support whitespace
- support "include " keyword
- move swig stuff to .mk file
- support autogenerated makefile portions (use "include echo foo|")
(This used to be commit 43779c09b6)
Autogenerate list of binaries (rather then having them hardcoded in build/smb_build/makefile.pm)
Add INSTALLDIR keyword to .mk files
(This used to be commit ce0935112b)
calls. This changes the generated RPC and IRPC calls to use the 'this'
object pointer instead of requiring the passing of the object on each
call. So typical usage is now:
var echo = echo_init();
var io = irpcObj();
status = echo.connect("ncacn_np:server");
assert(status.is_ok);
io.input.in_data = 7;
status = echo.AddOne(io);
assert(status.is_ok);
(This used to be commit f7b49ecd08)
templating support for foreignSecurityPrincipals to the samdb module.
This is an extension beyond what microsoft does, and has been very
useful :-)
The setup scripts have been modified to use the new template, as has
the SAMR and LSA code.
Other cleanups in LSA remove the assumption that the short domain name
is the first component of the realm.
Also add a lot of useful debug messages, to make it clear how/why the
SamSync may have gone wrong. Many of these should perhaps be hooked
into an error string.
Andrew Bartlett
(This used to be commit 1f071b0609)
user_info strcture in auth/
This moves it to a pattern much like that found in ntvfs, with
functions to migrate between PAIN, HASH and RESPONSE passwords.
Instead of make_user_info*() functions, we simply fill in the control
block in the callers, per recent dicussions on the lists. This
removed a lot of data copies as well as error paths, as we can grab
much of it with talloc.
Andrew Bartlett
(This used to be commit ecbd2235a3)
This ensures the templating code is used, and also makes it clearer
what I need to duplicate in the vampire area.
Also fix a silly bug in the template application code (the samdb
module) that caused templates to be compleatly unused (my fault, from
my commit last night).
Andrew Bartlett
(This used to be commit 4a8ef7197f)
- get rid of redundeny dyn_CONFIGFILE argument to lp_load()
- fixed provisioning to work with completely pristine install,
creating an initial smb.conf is none is present
- added lp.set() and lp.reload() to loadparm ejs object interface
(This used to be commit c2691ef712)
into an object. To keep existing code working I have added:
string_init(global);
into base.js. That brings the functions into the global scope for our
existing scripts
(This used to be commit a978484738)
callers to optionally supply an existing object to add the properties
to. So you can do:
var rpc = samr_init();
lsa_init(rpc);
and you end up with 'rpc' having both the samr and lsa functions and
constants available.
(This used to be commit 6a1ed328e2)
- tried to make the ejs_userAuth() call work for the sam, not just for
unix auth. I didn't get this working. Andrew, when you get a chance
can you see what I'm doing wrong? I suspect its because we aren't
supplying a challenge, but a challenge doesn't really make sense in a
'is this username/password' correct call.
(This used to be commit 9e07c08a71)
- for stream tasks, returns the number of connections
- for non-stream tasks, returns "RUNNING"
For both, return "DISABLED" or "NOT RESPONDING" appropriately
(This used to be commit 78d6303814)
