1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-09 09:57:48 +03:00

49210 Commits

Author SHA1 Message Date
Jeremy Allison
02599c3933 s3: lib: Add canonicalize_absolute_path().
Resolves any invalid path components (.) (..)
in an absolute POSIX path.

We will be re-using this in several places.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-01-30 18:39:18 +01:00
Jeremy Allison
39678ed6af s3: smbd: Correctly canonicalize any incoming shadow copy path.
Converts to:

@GMT-token/path/last_component

from all incoming path types. Allows shadow_copy modules
to work when current directory is changed after removing
last component.

Ultimately when the VFS ABI is changed to add a timestamp
to struct smb_filename, this is where the parsing will be
done.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-01-30 18:39:18 +01:00
Andrew Bartlett
26ffc20cef build: vfs_posix_eadb is only built with the AD DC enabled
This was found building a static smbd without the AD DC

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Mon Jan 30 17:24:26 CET 2017 on sn-devel-144
2017-01-30 17:24:26 +01:00
Noel Power
1820209b9e s3/rpc_server/mdssvc: Generate flex/bison files in build
Build the generated files at build time instead of using a committed version
generated at some point in the past.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12528

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sat Jan 28 13:26:01 CET 2017 on sn-devel-144
2017-01-28 13:26:01 +01:00
Ralph Boehme
9a3b64a24c vfs_fruit: checks wrong AAPL config state and so always uses readdirattr
readdirattr should only be enabled if the client enables it via AAPL
negotitiation, not for all clients when vfs_fruit is loaded.

Unfortunately the check in fruit_readdir_attr() is

  if (!config->use_aapl) {
    return SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
  }

This uses the wrong config state "use_aapl" which is always true by
default (config option "fruit:aapl").

We must use "nego_aapl" instead which is only true if the client
really negotiated this feature.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12541

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Jan 28 01:49:11 CET 2017 on sn-devel-144
2017-01-28 01:49:09 +01:00
Ralph Boehme
21d030e5bd selftest: add test for global "smb encrypt=off"
Test various combinations of having encryption globally turned off and
enabled (desired/required) on a share, with SMB1 UNIX Extensions and SMB3.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-27 22:00:17 +01:00
Ralph Boehme
b0b418c225 s3/smbd: ensure global "smb encrypt = off" is effective for share with "smb encrypt = desired"
If encryption is disabled globally, per definition we shouldn't allow
enabling encryption on individual shares.

The behaviour of specifying

[Global]
  smb encrypt = off

[share]
  smb encrypt = desired

must be an unecrypted tree connect to the share "share".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-27 22:00:17 +01:00
Ralph Boehme
6ae63d42f5 s3/smbd: ensure global "smb encrypt = off" is effective for SMB 3.1.1 clients
If encryption is disabled globally, per definition we shouldn't allow
enabling encryption on individual shares.

The behaviour of setting

[Global]
  smb encrypt = off

[share]
  smb encrypt = required

must be to completely deny access to the share "share".

This was working correctly for clients when using SMB 3 dialects <
3.1.1, but not for 3.1.1 with a negprot encryption context.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-27 22:00:17 +01:00
Ralph Boehme
43a90cee46 s3/smbd: ensure global "smb encrypt = off" is effective for SMB 1 clients
If encryption is disabled globally, per definition we shouldn't allow
enabling encryption on individual shares.

The behaviour of setting

[Global]
  smb encrypt = off

[share_required]
  smb encrypt = required

[share_desired]
  smb encrypt = desired

must be to completely deny access to the share "share_required" and an
unencrypted connection to "share_desired".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-27 22:00:17 +01:00
Stefan Metzmacher
348bcca768 selftest/Samba3: use "server min protocol = SMB3_00" for "ktest"
This verifies that clients can still connect with that setting.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12540

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jan 27 12:03:39 CET 2017 on sn-devel-144
2017-01-27 12:03:39 +01:00
Stefan Metzmacher
c207f2a989 s3:smbd: allow "server min protocol = SMB3_00" to go via "SMB 2.???" negprot
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12540

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-27 08:09:15 +01:00
Stefan Metzmacher
5c7523890d s3:libsmb: use a local got_kerberos_mechanism variable in cli_session_creds_prepare_krb5()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-01-27 08:09:15 +01:00
Stefan Metzmacher
022fb7ea14 s3:client: don't use cli->use_kerberos && cli->got_kerberos_mechanism in smbspool.c
We already know if we want to use kerberos and there's no point
in altering the error message if we tried but failed to use kerberos.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-01-27 08:09:15 +01:00
Andreas Schneider
9d60ad53b8 rpc_server: Allow to configure the port range for RPC services
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12521

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2017-01-27 08:09:15 +01:00
Andreas Schneider
35dfa5c6e2 rpc_server: Use the RPC TCPIP ports of Windows
Since Windows Server 2008 Microsoft uses a different port range for RPC
services. Before it was 1024-65535 and they changed it to 49152-65535.

We should use the same range as these are the ports the firewall in AD
networks normally allow.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12521

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2017-01-27 08:09:15 +01:00
Volker Lendecke
9b0fc295ef winbind: Don't add duplicate IDs in wbinfo -r
We look at the netsamlogon_cache entry twice: Once in queryuser and
once in lookupusergroups_cached. This can add the group SID twice.

Use add_sid_to_array_unique to avoid this.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jan 24 02:36:19 CET 2017 on sn-devel-144
2017-01-24 02:36:19 +01:00
Volker Lendecke
18332a1743 winbind: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-23 22:46:13 +01:00
Ralph Boehme
326765923f s3/smbd: check for invalid access_mask smbd_calculate_access_mask()
This makes us pass "base.createx_access".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12536

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-23 22:46:13 +01:00
Ralph Boehme
a3781d1cfe selftest: also run test base.createx_access against ad_dc
Fails currently, will be made to work in the next commit.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12536

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-23 22:46:13 +01:00
Andrew Bartlett
bd8d9559bf param: Remove winbindd privileged socket directory option
This option is unused and has not been used since before Samba 4.3
when the source4/ winbindd code went away.

The associated dynconfig parameters used for the default are also removed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10066

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:12 +01:00
Volker Lendecke
b4ed72a2d3 s3/lib: Use ms_fnmatch_protocol in mask_match
This avoids the talloc/free through push_ucs2_talloc

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:12 +01:00
Volker Lendecke
66cba9939b s3/locking: Avoid a talloc for nonexisting fetch_share_mode_unlocked
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:11 +01:00
Volker Lendecke
27daed8fcf smbd: Streamline get_ea_names_from_file
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:11 +01:00
Volker Lendecke
f827650c65 smbd: Fix an indentation
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:11 +01:00
Volker Lendecke
c687924eed smbd: Fix a few signed/unsigned hickups
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:11 +01:00
Volker Lendecke
13958236a9 lib: Avoid a "includes.h"
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:11 +01:00
Volker Lendecke
6faf30b31c smbd: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:11 +01:00
Volker Lendecke
9af73f62ce lib: Add lib/util/server_id.h
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-22 18:30:11 +01:00
Björn Jacke
5059c8e2e3 vfs_default: unlock the right file in copy chunk
Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Sat Jan 21 17:00:54 CET 2017 on sn-devel-144
2017-01-21 17:00:54 +01:00
Björn Jacke
fe149d7b01 vfs_fruit: fix a typo
Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2017-01-21 13:15:19 +01:00
Ralph Boehme
35460d92bb s3/rpc_server/mdssvc: prefix public flex and bison global symbols
This fixes a clash with a parser in Heimdal when building with
--nonshared-binary=smbd/smbd:

...
[3139/3620] Linking default/source3/smbd/smbd
...
default/source4/heimdal/lib/hx509/sel-lex_116.o: In function `yy_get_previous_state':
/usr/build/packages/samba-4.5/bin/../source4/heimdal/lib/hx509/sel-lex.c:1122:multiple definition of `yyin'
default/source3/rpc_server/mdssvc/sparql_lexer_28.o:/usr/build/packages/samba-4.5/bin/sparql_lexer.c:1149:first defined here
...

The fix is to use namespace prefixes in the parser and the lexer as
described here:
<https://www.gnu.org/software/bison/manual/html_node/Multiple-Parsers.html>

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12528

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sat Jan 21 13:13:19 CET 2017 on sn-devel-144
2017-01-21 13:13:19 +01:00
Ralph Boehme
7933c2a60f s3/rpc_server/mdssvc: use flex noyyalloc noyyrealloc
Redefine the symbols used for malloc and realloc in the flex source
instead of running sed over the generated one.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12528

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2017-01-21 09:26:15 +01:00
Ralph Boehme
98d05dcac3 smbcontrol: add ringbuf-log
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Jan 20 22:33:14 CET 2017 on sn-devel-144
2017-01-20 22:33:14 +01:00
Ralph Boehme
be8e90f27a s3/rpc_server: move rpc_modules.c to its own subsystem
The source file rpc_modules.c was used in two places which lead to the
following build error when configuring with '--nonshared-binary=smbd/smbd':

  ERROR: source source3/rpc_server/rpc_modules.c is in more than one
  subsystem of target 'smbd/smbd': ['RPC_SERVICE', 'MDSSD']

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12524

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Noel Power <nopower@suse.com>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 20 15:00:45 CET 2017 on sn-devel-144
2017-01-20 15:00:45 +01:00
Aurelien Aptel
ca5d36d842 s3/winbindd: fix invalid free
coverity fix.

TALLOC_FREE() might be called on uninitialized 'rids' at the end of the
function in case of an early error. Initialize it to NULL to turn the
TALLOC_FREE() to a noop in this case.

Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jan 18 17:19:39 CET 2017 on sn-devel-144
2017-01-18 17:19:39 +01:00
Jeremy Allison
e1874bbf26 winbind: Fix CID 1398534 Dereference before null check
Make all query_user_list backends consistent.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 13 13:33:37 CET 2017 on sn-devel-144
2017-01-13 13:33:37 +01:00
Günther Deschner
b9199945e7 s3-spoolss: globally set print server environment/architecture.
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-01-12 15:35:13 +01:00
Günther Deschner
92fc6a6c25 s3-spoolss: make us appear as a 64bit print server.
This makes us behave like all recent windows systems.

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-01-12 15:35:13 +01:00
Günther Deschner
d6a9377b6d s3-spoolss: Use a more accurate DefaultSpoolDirectory
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-01-12 15:35:13 +01:00
Günther Deschner
03a4741bc7 spoolss: allow truncated driver version in spoolss_driver_version_to_qword()
This has been seen in real life Konica driver defintions.

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-01-12 15:35:13 +01:00
Andreas Schneider
34218e0448 s3-spoolss: Fix architecture handling in spoolss_DeletePrinterDriverEx call
Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
2017-01-12 15:35:13 +01:00
Stefan Metzmacher
4b295b106c wscript: remove executable bits for all wscript* files
These files should not be executable.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jan 11 20:21:01 CET 2017 on sn-devel-144
2017-01-11 20:21:01 +01:00
Volker Lendecke
f16908c454 winbind: Fix CID 1398530 Resource leak
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jan 11 04:38:25 CET 2017 on sn-devel-144
2017-01-11 04:38:25 +01:00
Volker Lendecke
e8008fb36d winbind: Fix CID 1398530 Resource leak
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-11 00:49:22 +01:00
Volker Lendecke
24a81937d0 winbind: Fix CID 1398531 Resource leak
Not really a leak due to talloc, but this way it's clear

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-11 00:49:22 +01:00
Volker Lendecke
5f024a0079 winbind: Fix CID 1398533 Resource leak
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-11 00:49:22 +01:00
Volker Lendecke
4495535cb5 winbind: Fix CID 1398533 Resource leak
Not really a leak due to talloc, but this way it's clear

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-11 00:49:22 +01:00
Anoop C S
3a864fc952 s3/smb2_read: Better fallback for incorrectly configured sendfile setups
When "use sendfile" is enabled but not supported by the underlying VFS
module then fallback to normal copy and print out a warning for the
admin.

Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Pair-Programmed-With: Michael Adam <obnox@samba.org>
Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-11 00:49:22 +01:00
Volker Lendecke
e84e44ce92 messaging: Fix dead but not cleaned-up-yet destination sockets
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12509

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan 10 17:40:58 CET 2017 on sn-devel-144
2017-01-10 17:40:58 +01:00
Stefan Metzmacher
dde30ab89c s3:winbindd: talloc_steal the extra_data in winbindd_list_users_recv()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12501

Pair-Programmed-With: Andreas Schneider <asn@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
2017-01-10 09:58:18 +01:00