]> git.ipfire.org Git - thirdparty/samba.git/log
thirdparty/samba.git
2 years agosmbXsrv_tcon.c: use DBG* macros instead of static log level numbers
Björn Jacke [Wed, 7 Jun 2023 00:30:32 +0000 (02:30 +0200)] 
smbXsrv_tcon.c: use DBG* macros instead of static log level numbers

Some log levels change because the macros don't cover all the previously used
log levels or because importance was slightly reconsidered.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agodcesrv_drsuapi.c:use DBG* macros instead of static log level numbers
Björn Jacke [Wed, 7 Jun 2023 00:23:59 +0000 (02:23 +0200)] 
dcesrv_drsuapi.c:use DBG* macros instead of static log level numbers

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosmb2_service.c: use DBG* macros instread of static log level numbers
Björn Jacke [Wed, 7 Jun 2023 00:18:21 +0000 (02:18 +0200)] 
smb2_service.c: use DBG* macros instread of static log level numbers

Some log levels change because the macros don't cover all the previously used
log levels or because importance was slightly reconsidered.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosmbXsrv_session.c: use DBG* macros instead of static log level numbers
Björn Jacke [Wed, 7 Jun 2023 00:05:57 +0000 (02:05 +0200)] 
smbXsrv_session.c: use DBG* macros instead of static log level numbers

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agodns_update.c: use DBG* macros instead of static log level numbers
Björn Jacke [Tue, 6 Jun 2023 23:50:39 +0000 (01:50 +0200)] 
dns_update.c: use DBG* macros instead of static log level numbers

Some log levels change because the macros don't cover all the previously used
log levels or because importance was slightly reconsidered.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agooplock_linux.c: use DBG macros instead of static log level
Björn Jacke [Tue, 6 Jun 2023 23:45:47 +0000 (01:45 +0200)] 
oplock_linux.c: use DBG macros instead of static log level

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agonmbd_become_lmb.c: use DBG* macros instead of static log level numbers
Björn Jacke [Mon, 12 Jun 2023 15:24:15 +0000 (17:24 +0200)] 
nmbd_become_lmb.c: use DBG* macros instead of static log level numbers

Some log levels change because the macros don't cover all the previously used
log levels or because importance was slightly reconsidered.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=4143

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agonmbd/asyncdns.c: use DBG* macros instead of static log level numbers
Björn Jacke [Mon, 12 Jun 2023 15:23:40 +0000 (17:23 +0200)] 
nmbd/asyncdns.c: use DBG* macros instead of static log level numbers

Some log levels change because the macros don't cover all the previously used
log levels or because importance was slightly reconsidered.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=4143

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agonmbd_sendannounce.c: use DBG* macros instead of static log level numbers
Björn Jacke [Mon, 12 Jun 2023 15:23:01 +0000 (17:23 +0200)] 
nmbd_sendannounce.c: use DBG* macros instead of static log level numbers

BUG: https://bugzilla.samba.org/show_bug.cgi?id=4143

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agonmbd: use DBG_ macros and raise some log levels
Björn Jacke [Tue, 6 Jun 2023 22:16:25 +0000 (00:16 +0200)] 
nmbd: use DBG_ macros and raise some log levels

BUG: https://bugzilla.samba.org/show_bug.cgi?id=4143

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosmbd: smbd_dirptr_lanman2_match_fn(): Remove "exact_match" handling
Volker Lendecke [Fri, 16 Jun 2023 11:53:25 +0000 (13:53 +0200)] 
smbd: smbd_dirptr_lanman2_match_fn(): Remove "exact_match" handling

No caller uses this anymore. The only downside here now is that we
always go directly to mask_match instead of a trying strcasecmp_m
first. I very much doubt this makes a measurable difference because
this would have been called for non-wildcard
readdirs (a.k.a. qpathinfo), and there we do this only once per
complete directory read. Also I don't believe mask_match() is
measurably more expensive than strcasecmp_m() for the usually short
filenames we're looking at here.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jun 16 17:07:46 UTC 2023 on atb-devel-224

2 years agosmbd: Remove a smb1-only optimization findfirst/findnext
Volker Lendecke [Fri, 16 Jun 2023 11:45:57 +0000 (13:45 +0200)] 
smbd: Remove a smb1-only optimization findfirst/findnext

I don't think this is an effective optimization at all anymore. It was
intended to speed up non-wildcard readdirs after we found the correct
entry. Nowadays we do the non-wildcard readdirs by a direct fstatat,
and after we successfully found the entry dptr_ReadDirName()
immediately returns without any further action. So my very strong
guess is that this never really kicked in anymore. Not using this flag
can't be *that* bad, smb2 never used it.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Remove "a heuristic to avoid seeking the dirptr"
Volker Lendecke [Fri, 16 Jun 2023 11:32:24 +0000 (13:32 +0200)] 
smbd: Remove "a heuristic to avoid seeking the dirptr"

-- we don't seek the dirptr anymore

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolibsmb: Test smb1 mknod
Volker Lendecke [Thu, 9 Mar 2023 15:16:50 +0000 (16:16 +0100)] 
libsmb: Test smb1 mknod

Requires O_PATH to work correctly

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agopylibsmb: Add smb1_stat()
Volker Lendecke [Thu, 16 Feb 2023 16:20:55 +0000 (17:20 +0100)] 
pylibsmb: Add smb1_stat()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agopylibsmb: Add mknod()
Volker Lendecke [Thu, 16 Feb 2023 15:43:46 +0000 (16:43 +0100)] 
pylibsmb: Add mknod()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolibsmb: Add SMB1 posix cli_mknod
Volker Lendecke [Thu, 16 Feb 2023 12:41:44 +0000 (13:41 +0100)] 
libsmb: Add SMB1 posix cli_mknod

This is a dead horse, but in the future it will make it easier to test
the smb311 unix extension code.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agorpc_server: Fix talloc hierarchy in _srvsvc_NetSrvGetInfo()
Volker Lendecke [Mon, 24 Apr 2023 14:46:17 +0000 (16:46 +0200)] 
rpc_server: Fix talloc hierarchy in _srvsvc_NetSrvGetInfo()

Make ->comment a proper talloc child of the right structure.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoprofiling: Factor out functions to read smbprofile.tdb
Volker Lendecke [Wed, 31 May 2023 07:48:58 +0000 (09:48 +0200)] 
profiling: Factor out functions to read smbprofile.tdb

We don't need all of Samba just to dump contents of this tdb, make
exporting profile information cheaper.

No direct use yet, but it's a good cleanup IMHO

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoWHATSNEW: Mention removed "directory name cache size" parameter
Volker Lendecke [Wed, 14 Jun 2023 05:23:52 +0000 (07:23 +0200)] 
WHATSNEW: Mention removed "directory name cache size" parameter

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: Add a few required #includes
Volker Lendecke [Tue, 30 May 2023 11:27:00 +0000 (13:27 +0200)] 
lib: Add a few required #includes

You find them if you try to #include these files directly

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agowinbind: Fix a typo
Volker Lendecke [Wed, 26 Apr 2023 13:58:51 +0000 (15:58 +0200)] 
winbind: Fix a typo

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: Simplify two if-expressions
Volker Lendecke [Tue, 23 May 2023 08:44:40 +0000 (10:44 +0200)] 
lib: Simplify two if-expressions

This version looks easier to read to me.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Remove references to get_Protocol()
Volker Lendecke [Thu, 25 May 2023 05:50:43 +0000 (07:50 +0200)] 
smbd: Remove references to get_Protocol()

We have that available in smbXsrv_connection that is available almost
everywhere.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Modernize a DEBUG statement in smbd_dirptr_get_entry()
Volker Lendecke [Thu, 15 Jun 2023 13:41:35 +0000 (15:41 +0200)] 
smbd: Modernize a DEBUG statement in smbd_dirptr_get_entry()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agodocs: Remove seekdir/telldir reference
Volker Lendecke [Wed, 14 Jun 2023 05:20:34 +0000 (07:20 +0200)] 
docs: Remove seekdir/telldir reference

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Fix a typo
Volker Lendecke [Thu, 25 May 2023 05:31:02 +0000 (07:31 +0200)] 
smbd: Fix a typo

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolibcli: Simplify security_token_is_sid()
Volker Lendecke [Tue, 18 Apr 2023 09:30:26 +0000 (11:30 +0200)] 
libcli: Simplify security_token_is_sid()

Avoid an explicit if-statement.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolibcli: Simplify dom_sid_dup()
Volker Lendecke [Tue, 18 Apr 2023 11:39:09 +0000 (13:39 +0200)] 
libcli: Simplify dom_sid_dup()

We have sid_copy() for this.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agos4:auth: Remove unneeded ‘sam_ctx’ parameter
Joseph Sutton [Thu, 15 Jun 2023 00:31:03 +0000 (12:31 +1200)] 
s4:auth: Remove unneeded ‘sam_ctx’ parameter

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 15 06:30:35 UTC 2023 on atb-devel-224

2 years agos4:auth: Enforce machine authentication policy for NTLM authentication
Joseph Sutton [Thu, 4 May 2023 04:43:47 +0000 (16:43 +1200)] 
s4:auth: Enforce machine authentication policy for NTLM authentication

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth: Enforce device restrictions for NTLM authentication
Joseph Sutton [Thu, 4 May 2023 04:39:55 +0000 (16:39 +1200)] 
s4:auth: Enforce device restrictions for NTLM authentication

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Log TGS-REQs in the Heimdal KDC
Joseph Sutton [Wed, 14 Jun 2023 23:24:27 +0000 (11:24 +1200)] 
s4:kdc: Log TGS-REQs in the Heimdal KDC

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/auth_log: Ensure tests continue to pass when new log types are added
Joseph Sutton [Thu, 15 Jun 2023 02:33:37 +0000 (14:33 +1200)] 
tests/auth_log: Ensure tests continue to pass when new log types are added

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/auth_log: Add support for new ‘KDC Authorization’ log type
Joseph Sutton [Wed, 14 Jun 2023 04:35:26 +0000 (16:35 +1200)] 
tests/auth_log: Add support for new ‘KDC Authorization’ log type

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth: Add new ‘KDC Authorization’ log type
Joseph Sutton [Wed, 14 Jun 2023 23:18:45 +0000 (11:18 +1200)] 
auth: Add new ‘KDC Authorization’ log type

This is similar, but not identical, to the existing ‘Authorization’
event. It will be used to log Kerberos TGS-REQs.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agolib:audit_logging: Add function to create JSON object containing auditing information
Joseph Sutton [Wed, 14 Jun 2023 23:12:22 +0000 (11:12 +1200)] 
lib:audit_logging: Add function to create JSON object containing auditing information

This can be included in logged authentications and authorizations.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Add function to perform an access check to a service
Joseph Sutton [Wed, 14 Jun 2023 23:03:00 +0000 (11:03 +1200)] 
s4:kdc: Add function to perform an access check to a service

If the ‘server_audit_info_out’ parameter is non-NULL, auditing
information will be returned so that it might be logged.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Generate auditing infomation for NTLM device restrictions
Joseph Sutton [Wed, 14 Jun 2023 23:00:38 +0000 (11:00 +1200)] 
s4:kdc: Generate auditing infomation for NTLM device restrictions

This will provide more detail to be logged.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Move NTLM device restrictions to ‘authn_policy_util’
Joseph Sutton [Wed, 14 Jun 2023 22:54:18 +0000 (10:54 +1200)] 
s4:kdc: Move NTLM device restrictions to ‘authn_policy_util’

We’re going to extend this code, and so we will require functions from
the utility module.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Add function to perform an authentication policy access check with a device
Joseph Sutton [Wed, 14 Jun 2023 22:46:55 +0000 (10:46 +1200)] 
s4:kdc: Add function to perform an authentication policy access check with a device

If the ‘audit_info_out’ parameter is non-NULL, auditing information will
be returned so that it might be logged.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Add getter functions for authn_audit_info
Joseph Sutton [Wed, 14 Jun 2023 22:37:03 +0000 (10:37 +1200)] 
s4:kdc: Add getter functions for authn_audit_info

These functions return various pieces of information about an audit
event that can go into audit logs.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Add functions to create structures of auditing information for authentication...
Joseph Sutton [Wed, 14 Jun 2023 22:30:34 +0000 (10:30 +1200)] 
s4:kdc: Add functions to create structures of auditing information for authentication policies

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Add helper functions to create optional int64 values
Joseph Sutton [Wed, 14 Jun 2023 22:18:38 +0000 (10:18 +1200)] 
s4:kdc: Add helper functions to create optional int64 values

These values will be used to represent TGT lifetimes, which might or
might not be present.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Add structure containing authentication policy auditing information
Joseph Sutton [Wed, 14 Jun 2023 22:18:00 +0000 (10:18 +1200)] 
s4:kdc: Add structure containing authentication policy auditing information

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Rename ‘lifetime’ to indicate that it is measured in seconds
Joseph Sutton [Wed, 14 Jun 2023 22:01:33 +0000 (10:01 +1200)] 
s4:kdc: Rename ‘lifetime’ to indicate that it is measured in seconds

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Rename authn_kerberos_client_policy::tgt_lifetime to tgt_lifetime_raw
Joseph Sutton [Wed, 14 Jun 2023 22:00:53 +0000 (10:00 +1200)] 
s4:kdc: Rename authn_kerberos_client_policy::tgt_lifetime to tgt_lifetime_raw

This more clearly indicates that it is the raw TGT lifetime value
straight from the database.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth: Move authn_policy code into auth subsystem
Joseph Sutton [Thu, 15 Jun 2023 02:59:10 +0000 (14:59 +1200)] 
auth: Move authn_policy code into auth subsystem

This ensures that this code will still be usable by other libraries and
subsystems if Samba is built with ‘--without-ad-dc’.

We also drop dependencies on ‘ldb’ and ‘talloc’ that we shouldn’t have
needed anyway.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/auth_log: Refactor waitForMessages() to use nextMessage()
Joseph Sutton [Wed, 14 Jun 2023 04:29:27 +0000 (16:29 +1200)] 
tests/auth_log: Refactor waitForMessages() to use nextMessage()

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jun 14 23:55:42 UTC 2023 on atb-devel-224

2 years agotests/auth_log: Add method to fetch the next relevant message from the messaging bus
Joseph Sutton [Wed, 14 Jun 2023 04:30:30 +0000 (16:30 +1200)] 
tests/auth_log: Add method to fetch the next relevant message from the messaging bus

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Test authentication with policy restrictions and a wrong password
Joseph Sutton [Tue, 13 Jun 2023 05:23:41 +0000 (17:23 +1200)] 
tests/krb5: Test authentication with policy restrictions and a wrong password

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Test S4U2Self followed by constrained delegation with authentication...
Joseph Sutton [Thu, 18 May 2023 00:00:29 +0000 (12:00 +1200)] 
tests/krb5: Test S4U2Self followed by constrained delegation with authentication policies

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Remove unneeded ‘dn’ parameter
Joseph Sutton [Tue, 13 Jun 2023 23:26:25 +0000 (11:26 +1200)] 
tests/krb5: Remove unneeded ‘dn’ parameter

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Fix typo
Joseph Sutton [Wed, 14 Jun 2023 03:51:09 +0000 (15:51 +1200)] 
s4:kdc: Fix typo

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Make use of KerberosCredentials.get_sid()
Joseph Sutton [Tue, 13 Jun 2023 22:51:54 +0000 (10:51 +1200)] 
tests/krb5: Make use of KerberosCredentials.get_sid()

KerberosCredentials objects now keep track of their account’s SID, which
removes the need to look it up with KDCBaseTest.get_objectSid().

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Keep track of account SIDs
Joseph Sutton [Tue, 13 Jun 2023 23:21:43 +0000 (11:21 +1200)] 
tests/krb5: Keep track of account SIDs

This prevents having to look them up in the database when tests need
them.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Fix overlong lines
Joseph Sutton [Tue, 13 Jun 2023 22:59:41 +0000 (10:59 +1200)] 
tests/krb5: Fix overlong lines

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Add a couple of authentication policy tests
Joseph Sutton [Tue, 13 Jun 2023 22:58:12 +0000 (10:58 +1200)] 
tests/krb5: Add a couple of authentication policy tests

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Test authentication logging of TGT lifetimes
Joseph Sutton [Tue, 13 Jun 2023 23:02:28 +0000 (11:02 +1200)] 
tests/krb5: Test authentication logging of TGT lifetimes

It is useful to test a combination of device restrictions and TGT
lifetime restrictions so that we can check what TGT lifetime values end
up in the logs.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Cache created authentication policies
Joseph Sutton [Tue, 13 Jun 2023 23:12:15 +0000 (11:12 +1200)] 
tests/krb5: Cache created authentication policies

View with ‘git show -b’.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/krb5: Keep track of the type of each created account
Joseph Sutton [Tue, 13 Jun 2023 23:13:00 +0000 (11:13 +1200)] 
tests/krb5: Keep track of the type of each created account

This allows us to determine which parts of an authentication policy
apply to a particular account, which will be necessary to test audit
logging.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agolibrpc/idl: Add authentication policy event IDs
Joseph Sutton [Tue, 13 Jun 2023 23:28:40 +0000 (11:28 +1200)] 
librpc/idl: Add authentication policy event IDs

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Consolidate assignments to r->error_code and final_ret
Joseph Sutton [Tue, 13 Jun 2023 23:37:03 +0000 (11:37 +1200)] 
s4:kdc: Consolidate assignments to r->error_code and final_ret

This makes it clearer that we are assigning a value to both together.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: Don’t log authentication failures as successes
Joseph Sutton [Tue, 13 Jun 2023 23:58:13 +0000 (11:58 +1200)] 
s4:kdc: Don’t log authentication failures as successes

If a client was authorized, we would ignore the Kerberos error code and
just log the return value of authsam_logon_success_accounting().

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/auth_log: Properly expect authentication failures
Joseph Sutton [Wed, 14 Jun 2023 03:28:39 +0000 (15:28 +1200)] 
tests/auth_log: Properly expect authentication failures

These authentications are actually failing (due to RESPONSE_TOO_BIG
errors), but our authentication logging infrastructure hides this.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/auth_log: Make samba.tests.auth_log test executable
Joseph Sutton [Wed, 14 Jun 2023 01:47:20 +0000 (13:47 +1200)] 
tests/auth_log: Make samba.tests.auth_log test executable

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4/scripting/bin: Add NT_STATUS_OK to list of definitions
Joseph Sutton [Fri, 26 May 2023 03:14:22 +0000 (15:14 +1200)] 
s4/scripting/bin: Add NT_STATUS_OK to list of definitions

Add NT_STATUS_OK to our pre-generated list of status codes. Ensure it
goes first in the list to ensure that code that previously found this
error code in ‘special_errs’ maintains the same behaviour by falling
back to ‘nt_errs’.

This makes NT_STATUS_OK available to Python code using the ‘ntstatus’
module.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoselftest: Remove duplicate knownfails
Joseph Sutton [Wed, 14 Jun 2023 01:40:50 +0000 (13:40 +1200)] 
selftest: Remove duplicate knownfails

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoselftest: Fix typo
Joseph Sutton [Thu, 8 Jun 2023 04:17:30 +0000 (16:17 +1200)] 
selftest: Fix typo

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoparam: Remove reference to unrecognized parameter ‘directory name cache size’
Joseph Sutton [Wed, 14 Jun 2023 03:06:08 +0000 (15:06 +1200)] 
param: Remove reference to unrecognized parameter ‘directory name cache size’

This parameter was removed in commit
c37d6be2db8ee30d632275e7b1c156a8b5d791a7.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool ou: Remove unused variables
Joseph Sutton [Thu, 8 Jun 2023 01:46:05 +0000 (13:46 +1200)] 
samba-tool ou: Remove unused variables

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool ou: Remove unused import
Joseph Sutton [Thu, 8 Jun 2023 01:45:17 +0000 (13:45 +1200)] 
samba-tool ou: Remove unused import

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool: Fix typo
Joseph Sutton [Thu, 8 Jun 2023 01:44:59 +0000 (13:44 +1200)] 
samba-tool: Fix typo

Found by Rob van der Linde <rob@catalyst.net.nz>.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agopyldb: Check for allocation failure in py_ldb_dn_get_parent()
Joseph Sutton [Wed, 14 Jun 2023 22:07:56 +0000 (10:07 +1200)] 
pyldb: Check for allocation failure in py_ldb_dn_get_parent()

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agopyldb: Raise an exception if ldb_dn_get_parent() fails
Joseph Sutton [Tue, 6 Jun 2023 01:56:32 +0000 (13:56 +1200)] 
pyldb: Raise an exception if ldb_dn_get_parent() fails

Such a failure could be caused by situations other than memory errors,
but a simple indication of failure is all that ldb_dn_get_parent() gives
us to work with.

We keep the old behaviour of returning None if the DN has no components,
which an existing test (ldb.python.api.DnTests.test_parent_nonexistent)
expects.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoselftest: Assert trust realm is not None
Joseph Sutton [Thu, 25 May 2023 22:10:02 +0000 (10:10 +1200)] 
selftest: Assert trust realm is not None

This is consistent with the other tests in this file.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotests/auth_log: Factor out isRemote()
Joseph Sutton [Tue, 23 May 2023 22:31:53 +0000 (10:31 +1200)] 
tests/auth_log: Factor out isRemote()

This makes waitForMessages() easier to read.

View with ‘git show -b’.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agopython:safe_tarfile: Improve safe extract()
Andreas Schneider [Tue, 6 Jun 2023 13:38:12 +0000 (15:38 +0200)] 
python:safe_tarfile: Improve safe extract()

This also checks for symlinks and hardlinks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15390

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agopython:safe_tarfile: Implement safer extractall()
Andreas Schneider [Tue, 6 Jun 2023 13:30:20 +0000 (15:30 +0200)] 
python:safe_tarfile: Implement safer extractall()

This also checks for symlinks and hardlinks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15390

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agopython:safe_tarfile: Set extraction_filter for pythons providing it
Andreas Schneider [Tue, 6 Jun 2023 13:29:06 +0000 (15:29 +0200)] 
python:safe_tarfile: Set extraction_filter for pythons providing it

It should be available for Python >= 3.11.4 but also has been
backported.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15390

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agopython:tests: Adopt safe_tarfile for extraction_filter raises
Andreas Schneider [Tue, 6 Jun 2023 14:06:57 +0000 (16:06 +0200)] 
python:tests: Adopt safe_tarfile for extraction_filter raises

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15390

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agos4-server: Call dsdb_check_and_update_fl() during startup transaction.
Andrew Bartlett [Wed, 31 May 2023 02:38:02 +0000 (14:38 +1200)] 
s4-server: Call dsdb_check_and_update_fl() during startup transaction.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agoselftest: Add unit tests of the DC startup FL check/update code
Andrew Bartlett [Thu, 8 Jun 2023 21:17:39 +0000 (09:17 +1200)] 
selftest: Add unit tests of the DC startup FL check/update code

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agopython/tests: Make helpful, stateless methods @classmethod and @staticmethod
Andrew Bartlett [Wed, 14 Jun 2023 22:49:32 +0000 (10:49 +1200)] 
python/tests: Make helpful, stateless methods @classmethod and @staticmethod

This allows them to be used in setUpClass in tests.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agodsdb: Add routine to check the DB vs lp functional levels
Andrew Bartlett [Wed, 31 May 2023 02:33:08 +0000 (14:33 +1200)] 
dsdb: Add routine to check the DB vs lp functional levels

This will be called at server startup (as well as from Python tests)

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agodsdb: Indicate in rootdse.c why samdb_ntds_settings_dn() is not used
Andrew Bartlett [Wed, 31 May 2023 02:29:57 +0000 (14:29 +1200)] 
dsdb: Indicate in rootdse.c why samdb_ntds_settings_dn() is not used

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agoselftest: Split up tests in dsdb.py to avoid creating a user when not required
Andrew Bartlett [Thu, 1 Jun 2023 04:04:57 +0000 (16:04 +1200)] 
selftest: Split up tests in dsdb.py to avoid creating a user when not required

Creating a user is CPU intensive, particularly when a password is set
so avoid doing so if not required.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agoselftest: Specify that DCs prepared with prepare_dc_testenv() to be 2016 capable
Andrew Bartlett [Tue, 13 Jun 2023 01:33:10 +0000 (13:33 +1200)] 
selftest: Specify that DCs prepared with prepare_dc_testenv() to be 2016 capable

This allows the backup/restore process to pass once the DC startup
code confirms what DC level the domain functional level in the DB
is expecting.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2 years agodocs-xml: remove completely outdated Samba-Developers-Guide
Björn Jacke [Wed, 7 Jun 2023 00:49:49 +0000 (02:49 +0200)] 
docs-xml: remove completely outdated Samba-Developers-Guide

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jun 14 12:21:50 UTC 2023 on atb-devel-224

2 years agovfs: Remove vfs telldir/seekdir functions
Volker Lendecke [Fri, 9 Jun 2023 15:33:02 +0000 (17:33 +0200)] 
vfs: Remove vfs telldir/seekdir functions

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jun 14 00:26:55 UTC 2023 on atb-devel-224

2 years agosmbd: Remove the offset argument from ReadDirName()
Volker Lendecke [Sat, 10 Jun 2023 13:29:35 +0000 (15:29 +0200)] 
smbd: Remove the offset argument from ReadDirName()

Nobody does anything with this anymore, we just call ReadDirName() in
sequence or do a RewindDir(). So we don't have to look at offsets as
given by the file system anymore.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Remove unused dptr_SearchDir() and the dir cache
Volker Lendecke [Fri, 9 Jun 2023 14:52:48 +0000 (16:52 +0200)] 
smbd: Remove unused dptr_SearchDir() and the dir cache

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Do the "skip to resume name" in call_trans2findnext()
Volker Lendecke [Fri, 9 Jun 2023 14:47:19 +0000 (16:47 +0200)] 
smbd: Do the "skip to resume name" in call_trans2findnext()

This is SMB1-only logic that can be removed from dir.c

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Make dptr_ReadDirName() public
Volker Lendecke [Fri, 9 Jun 2023 14:38:32 +0000 (16:38 +0200)] 
smbd: Make dptr_ReadDirName() public

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Add dptr_struct->last_name_sent
Volker Lendecke [Fri, 9 Jun 2023 13:22:31 +0000 (15:22 +0200)] 
smbd: Add dptr_struct->last_name_sent

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Remove unused _prev_offset arg from smbd_dirptr_get_entry()
Volker Lendecke [Fri, 9 Jun 2023 13:05:07 +0000 (15:05 +0200)] 
smbd: Remove unused _prev_offset arg from smbd_dirptr_get_entry()

Neither of the two callers looked at the result.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Remove unused dptr_SeekDir()
Volker Lendecke [Fri, 9 Jun 2023 12:53:52 +0000 (14:53 +0200)] 
smbd: Remove unused dptr_SeekDir()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Avoid dptr_SeekDir() when overflowing the dir buffer
Volker Lendecke [Fri, 9 Jun 2023 12:52:11 +0000 (14:52 +0200)] 
smbd: Avoid dptr_SeekDir() when overflowing the dir buffer

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Add smbd_dirptr_push_overflow()
Volker Lendecke [Sat, 27 May 2023 11:20:56 +0000 (13:20 +0200)] 
smbd: Add smbd_dirptr_push_overflow()

This saves the result of smbd_dirptr_get_entry() for later retrieval
in case we could not marshall it to the output buffer. Return this
entry when calling smbd_dirptr_get_entry() again.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agosmbd: Simplify dptr_ReadDirName()
Volker Lendecke [Tue, 13 Jun 2023 13:42:19 +0000 (15:42 +0200)] 
smbd: Simplify dptr_ReadDirName()

While trying to understand the ReadDirName() at the end of
dptr_ReadDirName() in a code path that was supposed to be just a
"stat"-style readdir with a non-wcard mask I came to the conclusion
that this was there to find dptr->wcard with a mangled
name. get_real_filename_at() already takes care of name mangling, so I
think I could eliminate a source of confusion by using it.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>