]> git.ipfire.org Git - thirdparty/samba.git/log
thirdparty/samba.git
9 years agoVERSION: Bump version up to 4.3.12...
Stefan Metzmacher [Thu, 7 Jul 2016 14:49:23 +0000 (16:49 +0200)] 
VERSION: Bump version up to 4.3.12...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(v4-3-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-3-test): Fri Jul  8 10:51:50 CEST 2016 on sn-devel-104

9 years agoMerge tag 'samba-4.3.11' into v4-3-test
Karolin Seeger [Thu, 7 Jul 2016 09:23:17 +0000 (11:23 +0200)] 
Merge tag 'samba-4.3.11' into v4-3-test

samba: tag release samba-4.3.11

9 years agoVERSION: Disable git snapshots for the 4.3.11 release. samba-4.3.11
Karolin Seeger [Tue, 5 Jul 2016 10:36:33 +0000 (12:36 +0200)] 
VERSION: Disable git snapshots for the 4.3.11 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
9 years agoWHATSNEW: Add release notes for Samba 4.3.11.
Karolin Seeger [Tue, 5 Jul 2016 10:34:21 +0000 (12:34 +0200)] 
WHATSNEW: Add release notes for Samba 4.3.11.

CVE-2016-2119: Client side SMB2 signing downgrade
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Karolin Seeger <kseeger@samba.org>
9 years agoCVE-2016-2019: s3:selftest: add regression tests for guest logins and mandatory signing
Stefan Metzmacher [Thu, 28 Apr 2016 00:24:52 +0000 (02:24 +0200)] 
CVE-2016-2019: s3:selftest: add regression tests for guest logins and mandatory signing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>
9 years agoCVE-2016-2019: s3:libsmb: add comment regarding smbXcli_session_is_guest() with manda...
Stefan Metzmacher [Thu, 28 Apr 2016 00:36:35 +0000 (02:36 +0200)] 
CVE-2016-2019: s3:libsmb: add comment regarding smbXcli_session_is_guest() with mandatory signing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>
9 years agoCVE-2016-2019: libcli/smb: don't allow guest sessions if we require signing
Stefan Metzmacher [Wed, 20 Apr 2016 09:26:57 +0000 (11:26 +0200)] 
CVE-2016-2019: libcli/smb: don't allow guest sessions if we require signing

Note real anonymous sessions (with "" as username) don't hit this
as we don't even call smb2cli_session_set_session_key() in that case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>
9 years agodcerpc.idl: remove unused DCERPC_NCACN_PAYLOAD_MAX_SIZE
Stefan Metzmacher [Wed, 22 Jun 2016 18:38:01 +0000 (20:38 +0200)] 
dcerpc.idl: remove unused DCERPC_NCACN_PAYLOAD_MAX_SIZE

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit d9e242e9035c15e49b041afc61e5a4a08877f289)

9 years agos4:rpc_server: use a variable for the max total reassembled request payload
Stefan Metzmacher [Wed, 22 Jun 2016 15:18:28 +0000 (17:18 +0200)] 
s4:rpc_server: use a variable for the max total reassembled request payload

We still use the same limit of 4 MByte (DCERPC_NCACN_REQUEST_DEFAULT_MAX_SIZE)
by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 23 04:51:16 CEST 2016 on sn-devel-144

(cherry picked from commit 3f36d31c848496bf509db573e4c12821905b448d)

9 years agos4:librpc/rpc: allow a total reassembled response payload of 240 MBytes
Stefan Metzmacher [Wed, 22 Jun 2016 15:18:28 +0000 (17:18 +0200)] 
s4:librpc/rpc: allow a total reassembled response payload of 240 MBytes

This will replace DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte),
The limit of DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte) was too
strict for some workloads, e.g. DRSUAPI replication with large objects.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 7413e73c5331b760dc84b3843059230ec5fcfc7b)

9 years agodcerpc.idl: add DCERPC_NCACN_{REQUEST,RESPONSE}_DEFAULT_MAX_SIZE
Stefan Metzmacher [Wed, 22 Jun 2016 14:58:03 +0000 (16:58 +0200)] 
dcerpc.idl: add DCERPC_NCACN_{REQUEST,RESPONSE}_DEFAULT_MAX_SIZE

This will replace DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte),
this limit is too strict for some workloads, e.g. DRSUAPI replication
with large objects.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 281e11b53f676647997fb9ce21227782529a62ad)

9 years agoVERSION: Bump version up to 4.3.11...
Karolin Seeger [Tue, 14 Jun 2016 07:34:22 +0000 (09:34 +0200)] 
VERSION: Bump version up to 4.3.11...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit 55785c95e7f74fb81fc95b435377a7879743dc37)

9 years agos3-winbind: Fix memory leak with each cached credential login
Andreas Schneider [Wed, 29 Jun 2016 11:38:19 +0000 (13:38 +0200)] 
s3-winbind: Fix memory leak with each cached credential login

When we allow offline logon and have a lot of logins, windbind will leak
4k of memory which each log in. On systems with heavy load this can grow
quickly and the OOM killer will kill Winbind.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11999

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jun 29 19:03:53 CEST 2016 on sn-devel-144

(cherry picked from commit 826f61960ec74deedc9d556a3b8fe04d9178dcd8)

9 years agobuild: Enable NTVFS file server to be omitted
Andrew Bartlett [Fri, 9 Oct 2015 20:30:17 +0000 (09:30 +1300)] 
build: Enable NTVFS file server to be omitted

We now only build it by default with --enable-sefltest, or otherwise
if requested.

The NTVFS file server still has features not present in the smbd file
server, such as a CIFS/SMB proxy, and a radically different design,
but it is also not undergoing any ongoing development so this keeps it
in a safe state for care and maintaince, with less of a security risk
if such an issue were to come up.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11991

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 71dcc76b70d8e249624f9bf057fc4fd3a44125e1)

9 years agobuild: Build less of Samba when building --without-ntvfs-fileserver
Andrew Bartlett [Tue, 10 May 2016 17:33:17 +0000 (05:33 +1200)] 
build: Build less of Samba when building --without-ntvfs-fileserver

We would build, but not use, many components of the NTVFS file server
even when we asked not to.  They would then consume disk, but not be
of any use

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11991

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit 0b4c741b9c03d147ee5f56d027bacda75c1b5282)

9 years agolibutil: Support systemd 230
Andreas Schneider [Wed, 22 Jun 2016 09:13:15 +0000 (11:13 +0200)] 
libutil: Support systemd 230

systemd 230 version finally deprecated
libsystemd-daemon/libsystemd-journal split and put everything in
libsystemd library.

Make sure HAVE_LIBSYSTEMD define is supported in the code (we already
have it defined by the waf).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11936

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Richard Sharpe <rsharpe@samba.org>
Autobuild-User(master): Richard Sharpe <sharpe@samba.org>
Autobuild-Date(master): Mon Jun 27 00:01:55 CEST 2016 on sn-devel-144

(cherry picked from commit 8813faffe3ce4b598b626afea4bf90405c8129d8)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Tue Jun 28 19:35:32 CEST 2016 on sn-devel-104

9 years agos4/torture: add a test for dosmode and hidden files
Ralph Boehme [Thu, 23 Jun 2016 17:13:05 +0000 (19:13 +0200)] 
s4/torture: add a test for dosmode and hidden files

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 2db5c10ac59d5362e81c50d9a854071477de9c12)

9 years agos3/smbd: only use stored dos attributes for open_match_attributes() check
Ralph Boehme [Thu, 23 Jun 2016 10:24:33 +0000 (12:24 +0200)] 
s3/smbd: only use stored dos attributes for open_match_attributes() check

This changes the way we check for old vs new DOS attributes on open with
overwrite: only check against the DOS attributes actually set by a
client and stored in the DOS attributes xattr.

With this change "hide dot files" and "hide files" continue to work with
"store dos attributes = yes".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 36b7cff3188bbc21048c12ec971d9c2ac3666226)

9 years agos3/smbd: make get_ea_dos_attribute() public
Ralph Boehme [Mon, 27 Jun 2016 09:39:47 +0000 (11:39 +0200)] 
s3/smbd: make get_ea_dos_attribute() public

Needed in a subsequent commit to read the stored dosmode for a file.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
9 years agos3/smbd: move check for "hide files" to dos_mode_from_name()
Ralph Boehme [Thu, 23 Jun 2016 15:14:55 +0000 (17:14 +0200)] 
s3/smbd: move check for "hide files" to dos_mode_from_name()

Consolidate the "hide dot files" and "hide files" handling stuff in one
function. No change in overall behaviour.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit f2a53efb1aab0986d6a7d9621b1efff2127df4e6)

9 years agos3/smbd: call dos_mode_from_name after get_ea_dos_attribute()
Ralph Boehme [Thu, 23 Jun 2016 14:40:15 +0000 (16:40 +0200)] 
s3/smbd: call dos_mode_from_name after get_ea_dos_attribute()

This doesn't change overall behaviour in any way, it just prepares for
the next step where the IS_HIDDEN_PATH() stuff will be moved to the
function dos_mode_from_name().

It allows an optimisation by not checking "hide to files" patch if
FILE_ATTRIBUTE_HIDDEN was already set in the DOS xattr.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit 1be877038c53c88802bc19c00a49c1974f17c4eb)

9 years agos3/smbd: add helper func dos_mode_from_name()
Ralph Boehme [Thu, 23 Jun 2016 10:23:33 +0000 (12:23 +0200)] 
s3/smbd: add helper func dos_mode_from_name()

This just moves the computation of "hide dot files" files to a helper
functions without changing overall behaviour.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit c8c67c9a2a6347e36f4628e2d0260bd6c58d8c65)

9 years agodcerpc.idl: remove unused DCERPC_NCACN_PAYLOAD_MAX_SIZE
Stefan Metzmacher [Wed, 22 Jun 2016 18:38:01 +0000 (20:38 +0200)] 
dcerpc.idl: remove unused DCERPC_NCACN_PAYLOAD_MAX_SIZE

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit d9e242e9035c15e49b041afc61e5a4a08877f289)

9 years agos4:rpc_server: use a variable for the max total reassembled request payload
Stefan Metzmacher [Wed, 22 Jun 2016 15:18:28 +0000 (17:18 +0200)] 
s4:rpc_server: use a variable for the max total reassembled request payload

We still use the same limit of 4 MByte (DCERPC_NCACN_REQUEST_DEFAULT_MAX_SIZE)
by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 23 04:51:16 CEST 2016 on sn-devel-144

(cherry picked from commit 3f36d31c848496bf509db573e4c12821905b448d)

9 years agos4:librpc/rpc: allow a total reassembled response payload of 240 MBytes
Stefan Metzmacher [Wed, 22 Jun 2016 15:18:28 +0000 (17:18 +0200)] 
s4:librpc/rpc: allow a total reassembled response payload of 240 MBytes

This will replace DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte),
The limit of DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte) was too
strict for some workloads, e.g. DRSUAPI replication with large objects.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 7413e73c5331b760dc84b3843059230ec5fcfc7b)

9 years agodcerpc.idl: add DCERPC_NCACN_{REQUEST,RESPONSE}_DEFAULT_MAX_SIZE
Stefan Metzmacher [Wed, 22 Jun 2016 14:58:03 +0000 (16:58 +0200)] 
dcerpc.idl: add DCERPC_NCACN_{REQUEST,RESPONSE}_DEFAULT_MAX_SIZE

This will replace DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte),
this limit is too strict for some workloads, e.g. DRSUAPI replication
with large objects.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 281e11b53f676647997fb9ce21227782529a62ad)

9 years agopython/tests: add auth_pad test for the dcerpc raw_protocol test
Stefan Metzmacher [Thu, 23 Jun 2016 10:06:40 +0000 (12:06 +0200)] 
python/tests: add auth_pad test for the dcerpc raw_protocol test

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jun 24 18:08:44 CEST 2016 on sn-devel-144

(cherry picked from commit c49f9abb19adca999d0b1d897d00d91f0ad91bbd)

9 years agos4:rpc_server: generate the correct error when we got an invalid auth_pad_length...
Stefan Metzmacher [Thu, 23 Jun 2016 11:50:39 +0000 (13:50 +0200)] 
s4:rpc_server: generate the correct error when we got an invalid auth_pad_length on BIND,ALTER,AUTH3

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 7d8edcc24148658e92729b3d155e432994e27525)

9 years agolibrpc/rpc: ignore invalid auth_pad_length values in BIND, ALTER and AUTH3 pdus
Stefan Metzmacher [Mon, 20 Jun 2016 14:26:56 +0000 (16:26 +0200)] 
librpc/rpc: ignore invalid auth_pad_length values in BIND, ALTER and AUTH3 pdus

This is a workarround for a bug in old Samba releases.
For BIND_ACK <= 3.5.x and for ALTER_RESP <= 4.2.x (see bug #11061).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit aef032302863e5f3a888dbf4c52b21d561a0dff4)

9 years agolibrpc/rpc: let dcerpc_pull_auth_trailer() check that auth_pad_length fits within...
Stefan Metzmacher [Mon, 20 Jun 2016 14:25:12 +0000 (16:25 +0200)] 
librpc/rpc: let dcerpc_pull_auth_trailer() check that auth_pad_length fits within the whole pdu.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 3f7e3ed8a276f16aaed87c1f3cd5b9781aa7e1af)

9 years agolibrpc/rpc: let dcerpc_pull_auth_trailer() only accept auth_length!=NULL or auth_data...
Stefan Metzmacher [Mon, 20 Jun 2016 14:17:45 +0000 (16:17 +0200)] 
librpc/rpc: let dcerpc_pull_auth_trailer() only accept auth_length!=NULL or auth_data_only=true

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit f386e81b982cd551313eb9c0f7d2f70d65515d80)

9 years agos4:librpc/rpc: don't ask for auth_length if we ask for auth data only
Stefan Metzmacher [Mon, 20 Jun 2016 14:16:23 +0000 (16:16 +0200)] 
s4:librpc/rpc: don't ask for auth_length if we ask for auth data only

dcerpc_pull_auth_trailer() handles auth_length=NULL just fine.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit e05c732c6074df2524403ad7bb30eade91443525)

9 years agos4:rpc_server: parse auth data only for BIND,ALTER_REQ,AUTH3
Stefan Metzmacher [Mon, 20 Jun 2016 14:11:37 +0000 (16:11 +0200)] 
s4:rpc_server: parse auth data only for BIND,ALTER_REQ,AUTH3

We should tell dcerpc_pull_auth_trailer() that we only want
auth data.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 505a4e68d96e6fb3d8c7493632ecb4b0fc6caa9d)

9 years agos3: libsmb: Correctly trim a trailing \\ character in cli_smb2_create_fnum_send(...
Jeremy Allison [Tue, 21 Jun 2016 22:49:27 +0000 (15:49 -0700)] 
s3: libsmb: Correctly trim a trailing \\ character in cli_smb2_create_fnum_send() when passing a pathname to SMB2 create.

We already trim any leading \\ characters in this function, so this is the simplest place
to clean the pathname.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11986

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Wed Jun 22 10:33:29 CEST 2016 on sn-devel-144

(cherry picked from commit c0704d99ce43a5497a29bfc53331159e4f978441)

9 years agos4/dns_server: disable signing of DNS-TKEY responses
Stefan Metzmacher [Wed, 11 May 2016 15:53:36 +0000 (17:53 +0200)] 
s4/dns_server: disable signing of DNS-TKEY responses

DNS packet signing is broken in 4.3 and older. Fixes are available in
master and 4.4. Backporting the complete patchset turned out to be too
difficult, so we use this hack to get authenticated DDNS updates working
again.

By simply NOT signing out DNS-TKEY response, the client won't get a
broken DNS-TSIG record which caused the client to not start the
authenticated DDNS update.

DNS RFCs do require signing TKEY responses, but luckily real world
clients are forgiving and accept unsigned TKEY responses. This was
tested with Windows 7.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Thu Jun 23 15:35:39 CEST 2016 on sn-devel-104

9 years agos3: docs: Fix "strict rename" doc to match code.
Jeremy Allison [Tue, 24 Nov 2015 16:45:50 +0000 (08:45 -0800)] 
s3: docs: Fix "strict rename" doc to match code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11065

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Nov 24 23:47:19 CET 2015 on sn-devel-104

(cherry picked from commit 2b0df3788aaadcf907de15a6b6a518244c59aa81)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Wed Jun 22 16:34:25 CEST 2016 on sn-devel-104

9 years agos3: smbd: Change semantics of strict rename to search the file open db.
Jeremy Allison [Tue, 24 Nov 2015 16:43:14 +0000 (08:43 -0800)] 
s3: smbd: Change semantics of strict rename to search the file open db.

Without strict rename just look in local process. POSIX renames are
already dealt with above.

Documentation change to follow.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11065

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 16f202871ca850bec87e0ec243644b2c20266c44)

9 years agolibnet: ignore realm setting for domain security joins to AD domains if 'winbind...
Michael Adam [Wed, 15 Jun 2016 21:03:32 +0000 (23:03 +0200)] 
libnet: ignore realm setting for domain security joins to AD domains if 'winbind rpc only = true'

Inspired by initial patch from Matt Rogers @ RedHat.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11977

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Wed Jun 22 05:05:47 CEST 2016 on sn-devel-144

(cherry picked from commit e29d8f108cd090706dc3f54282f5c33ec30df899)

9 years agos3-libnet: Print error string even on successfuly completion of libnetjoin.
Günther Deschner [Wed, 15 Jun 2016 14:04:29 +0000 (16:04 +0200)] 
s3-libnet: Print error string even on successfuly completion of libnetjoin.

Sometimes useful information should be printed to the users.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11977

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 632faa87610b3afca3f8d3e9f3f46ee6b87f362a)

9 years agos4: torture: Added raw readX test to ensure 'reserved' fields are zero.
Jeremy Allison [Fri, 10 Jun 2016 16:32:32 +0000 (09:32 -0700)] 
s4: torture: Added raw readX test to ensure 'reserved' fields are zero.

Passes against Win2k12+, and smbd with the previous patch.

https://bugzilla.samba.org/show_bug.cgi?id=11845

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Sat Jun 18 19:32:22 CEST 2016 on sn-devel-144

(cherry picked from commit 747de99fcd70f400ec0ca6b2ca020664f7464454)

9 years agos3: smbd: In reply_read_and_X() SMB1 server is overwriting part of the 'reserved...
Jeremy Allison [Mon, 13 Jun 2016 16:30:25 +0000 (09:30 -0700)] 
s3: smbd: In reply_read_and_X() SMB1 server is overwriting part of the 'reserved' zero fields with reply data length.

This occurred due to old code that used to do:

SSVAL(smb_buf(req->outbuf),-2,nread);

to set the reply length. This code was not needed,
as srv_set_message() was already correctly setting
the bcc length and was probably left from much
earlier legacy code.

However, in commit ddaa65ef6e049a185281c4d5deca4045e3b085e2
this was converted to do:

SSVAL(req->outbuf,smb_vwv11,smb_maxcnt);

This code actually overwrites the last 'reserved'
field in the SMB_COM_READ_ANDX packet reply, but we
never noticed as no client (or server code) looks at or
checks vwv11 in a SMB_COM_READ_ANDX reply.

[MS-SMB] shows for SMB_COM_READ_ANDX reply:

SMB_Parameters
{
        UCHAR WordCount;
        Words
        {
                UCHAR AndXCommand;
                UCHAR AndXReserved;
                USHORT AndXOffset;
                USHORT Available;
                USHORT DataCompactionMode;
                USHORT Reserved1;
                USHORT DataLength;
                USHORT DataOffset;
                USHORT DataLengthHigh;
                USHORT Reserved2[4];
        }
}
SMB_Data
{
        USHORT ByteCount;
        Bytes
        {
                UCHAR Pad[] (optional);
                UCHAR Data[variable];
        }

and indeed checking wireshark from Win2012R2
we find that smbd is writing the returned
read length into smb_vwv11 and Windows leaves
it as zeros (reserved).

Also fix the same problem in the named pipes code.

Torture test to ensure Reserved2[4] replies
are zero to follow.

https://bugzilla.samba.org/show_bug.cgi?id=11845

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit e57f9e15d08ed46b2fac2562d1027c6a2ba80dac)

9 years agos3: smbd: Use common function setup_readX_header() in aio read code.
Jeremy Allison [Mon, 13 Jun 2016 16:25:02 +0000 (09:25 -0700)] 
s3: smbd: Use common function setup_readX_header() in aio read code.

https://bugzilla.samba.org/show_bug.cgi?id=11845

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 6507336d6646b7709768c19a03eac61ea30cce31)

9 years agos3: smbd: Make setup_readX_header() externally accessible
Jeremy Allison [Mon, 13 Jun 2016 16:22:56 +0000 (09:22 -0700)] 
s3: smbd: Make setup_readX_header() externally accessible

https://bugzilla.samba.org/show_bug.cgi?id=11845

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 2ff3171fba931e621581336c975bae146a2ea3a9)

9 years agos3: smbd: Remove unused 'req' argument from setup_readX_header()
Jeremy Allison [Mon, 13 Jun 2016 16:20:43 +0000 (09:20 -0700)] 
s3: smbd: Remove unused 'req' argument from setup_readX_header()

https://bugzilla.samba.org/show_bug.cgi?id=11845

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 1e29a1ce067e5f5b5159bcd20d37c6945bcc3900)

9 years agolibnet: make Kerberos domain join site-aware
Uri Simchoni [Thu, 3 Mar 2016 07:18:58 +0000 (09:18 +0200)] 
libnet: make Kerberos domain join site-aware

When joining a domain using Kerberos authentication, create a
configuration file for the Kerberos libs to prefer on-site
domain controllers, without relying on the winbindd Kerberos
locator, which many not be operational at this stage.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11769

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Mar  8 01:30:35 CET 2016 on sn-devel-144

(cherry picked from commit 0dbab0e33e9efc46f72b6a8b0dc894ea251df9aa)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Mon Jun 20 13:20:34 CEST 2016 on sn-devel-104

9 years agodsgetdcname: fix flag check
Uri Simchoni [Thu, 3 Mar 2016 07:18:57 +0000 (09:18 +0200)] 
dsgetdcname: fix flag check

Fix the check for zero requseted flags.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11769

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 6d717402e42131298ba670ee47686379854ec56d)

9 years agodsgetdcname: return an IP address on rediscovery
Uri Simchoni [Thu, 3 Mar 2016 07:18:44 +0000 (09:18 +0200)] 
dsgetdcname: return an IP address on rediscovery

When dsgetdcname return its result based on discovery
process (instead of retrieving cached value), always
return the found server's IP address in dc_address field,
rather than its netbios name.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11769

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit ef84f4c018424b1fcc232a4780dc2c0435701d86)

9 years agos3: krb5: keytab - The done label can be jumped to with context == NULL.
Jeremy Allison [Wed, 8 Jun 2016 21:50:59 +0000 (14:50 -0700)] 
s3: krb5: keytab - The done label can be jumped to with context == NULL.

Ensure we don't crash in this case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11959

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Thu Jun  9 13:18:56 CEST 2016 on sn-devel-144

(cherry picked from commit e46cb9b835eb8f2bd998def82baf6f07fda9fe5c)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Wed Jun 15 15:05:50 CEST 2016 on sn-devel-104

9 years agolib: Fix uninitialized read in msghdr_copy
Jeremy Allison [Wed, 8 Jun 2016 12:34:20 +0000 (14:34 +0200)] 
lib: Fix uninitialized read in msghdr_copy

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11955

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jun  8 18:34:27 CEST 2016 on sn-devel-144

(cherry picked from commit 0e2711b2a0adeda6873f9c8161b9b01a56ae7098)

9 years agoVERSION: Bump version up to 4.3.11...
Karolin Seeger [Tue, 14 Jun 2016 07:34:22 +0000 (09:34 +0200)] 
VERSION: Bump version up to 4.3.11...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
9 years agoVERSION: Disable git snapshots for the 4.3.10 release. samba-4.3.10
Karolin Seeger [Tue, 14 Jun 2016 07:33:27 +0000 (09:33 +0200)] 
VERSION: Disable git snapshots for the 4.3.10 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
9 years agoWHATSNEW: Add release notes for Samba 4.3.10.
Karolin Seeger [Tue, 14 Jun 2016 07:32:44 +0000 (09:32 +0200)] 
WHATSNEW: Add release notes for Samba 4.3.10.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
9 years agolib: replace: snprintf - Fix length calculation for hex/octal 64-bit values.
Lorinczy Zsigmond [Thu, 2 Jun 2016 21:54:05 +0000 (14:54 -0700)] 
lib: replace: snprintf - Fix length calculation for hex/octal 64-bit values.

Prevents truncation due to buffer size being too small.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11947

Signed-off-by: Lorinczy Zsigmond <lzsiga@freemail.c3.hu>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Jun  3 03:48:58 CEST 2016 on sn-devel-144

(cherry picked from commit 8814b2556583e1f8965e8bf5a93438d46e8d43e6)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Thu Jun  9 16:30:22 CEST 2016 on sn-devel-104

9 years agosamba-too: Allow 'samba-tool fsmo' to cope with empty or missing fsmo roles
Rowland Penny [Thu, 31 Mar 2016 11:07:00 +0000 (12:07 +0100)] 
samba-too: Allow 'samba-tool fsmo' to cope with empty or missing fsmo roles

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11613

Signed-off-by: Rowland Penny <rpenny@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 7583377473ecd3d096c4f924e61a04a84be32a96)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Thu Jun  2 15:50:53 CEST 2016 on sn-devel-104

9 years agos3:client:smbspool_krb5_wrapper: fix the non clearenv build.
Günther Deschner [Fri, 29 Apr 2016 11:28:42 +0000 (13:28 +0200)] 
s3:client:smbspool_krb5_wrapper: fix the non clearenv build.

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Apr 29 19:52:23 CEST 2016 on sn-devel-144

(cherry picked from commit e0d8c6b6b428819206fb6e96c47e952845af0874)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Wed Jun  1 15:01:03 CEST 2016 on sn-devel-104

9 years agoProvide fallback code for non-portable clearenv(3)
Jérémie Courrèges-Anglas [Wed, 27 Apr 2016 16:01:51 +0000 (18:01 +0200)] 
Provide fallback code for non-portable clearenv(3)

clearenv(3) is a GNU extension that was rejected twice by POSIX,
without an easy, portable alternative.

As the dovecot project notes,
"""
environ = NULL crashes on OSX - and OpenBSD < 6.0
*environ = NULL doesn't work on FreeBSD 7.0
environ = emptyenv doesn't work on Haiku OS
environ = calloc should work everywhere
"""
(source: http://hg.dovecot.org/dovecot-2.0/file/48f90e7e92dc/src/lib/env-util.c)

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11864
Signed-off-by: Jérémie Courrèges-Anglas <jca@wxcvbn.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Apr 29 00:12:02 CEST 2016 on sn-devel-144

(cherry picked from commit f198abcbb3f6e8b26c697d3ded2caa1076ae018b)

9 years agos3:selftest add a test for rpcclient --pw-nt-hash option
Christian Ambach [Wed, 11 May 2016 17:21:20 +0000 (19:21 +0200)] 
s3:selftest add a test for rpcclient --pw-nt-hash option

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit d0cdf02dc9733dae960021ff1ca07587d8155e58)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Tue May 31 16:34:38 CEST 2016 on sn-devel-104

9 years agos3:rpcclient make --pw-nt-hash option work
Christian Ambach [Wed, 11 May 2016 15:41:24 +0000 (17:41 +0200)] 
s3:rpcclient make --pw-nt-hash option work

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10796

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 4fe59879cc2a608194578e33e27e0dc1e2f0fc58)

9 years agos3-smbd: Support systemd 230
Alexander Bokovoy [Wed, 25 May 2016 12:41:52 +0000 (15:41 +0300)] 
s3-smbd: Support systemd 230

systemd 230 version finally deprecated libsystemd-daemon/libsystemd-journal split
and put everything in libsystemd library.

Make sure HAVE_LIBSYSTEMD define is supported in the code (we already
have it defined by the waf).

Patch is based on the code proposed by Zbigniew Jędrzejewski-Szmek
from systemd project.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11936

Signed-off-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed May 25 20:25:44 CEST 2016 on sn-devel-144

(cherry picked from commit 92b4b6b3c58e6c8bc39e5693ad30ba6f8442ca99)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Tue May 31 12:21:40 CEST 2016 on sn-devel-104

9 years agos3-smbspool: Log to stderr
Andreas Schneider [Wed, 25 May 2016 11:39:29 +0000 (13:39 +0200)] 
s3-smbspool: Log to stderr

This way we will be able to see the log in the cups logs and are able to
debug issues.

https://bugzilla.samba.org/show_bug.cgi?id=11935

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
(cherry picked from commit e59e0a5481196b1ddda0393306c514b8c32d6ea0)

9 years agoFix memory leak in share mode locking.
Hemanth Thummala [Wed, 25 May 2016 06:15:04 +0000 (23:15 -0700)] 
Fix memory leak in share mode locking.

Not freeing up(and reparenting to NULL context) ndr buffer
used for TDB updates resulting in huge memory leak when there
in high volume of opens and closes happening on same object.

Free the buffer before reparenting its parent to NULL context.

https://bugzilla.samba.org/show_bug.cgi?id=11934

Signed-off-by: Hemanth Thummala <hemanth.thummala@nutanix.com>
Signed-off-by: Saji VR <saji.vr@nutanix.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri May 27 18:43:31 CEST 2016 on sn-devel-144

(cherry picked from commit 7a725eea25f905fc5f611e8f3d7cfe414d5cf913)

9 years agos3-quotas: fix sysquotas_4B quota fetching for BSD
Uri Simchoni [Sat, 21 May 2016 19:25:32 +0000 (22:25 +0300)] 
s3-quotas: fix sysquotas_4B quota fetching for BSD

Correctly copy block hard/soft limits from the OS-specific structure
to samba structure.

BUG:https://bugzilla.samba.org/show_bug.cgi?id=11931

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 59133295bbfd3b51953d9c86e3b533ff1d4861e3)

9 years agos3-net: Convert the key_name to UTF8 during migration
Andreas Schneider [Wed, 18 May 2016 14:51:45 +0000 (16:51 +0200)] 
s3-net: Convert the key_name to UTF8 during migration

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11922

Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 858e1eaa64858790888b42d97ae4d6962a09756b)

9 years agopackaging: Set default limit for core file size in service files
Anoop C S [Tue, 10 May 2016 09:38:07 +0000 (15:08 +0530)] 
packaging: Set default limit for core file size in service files

This change adds the missing LimitCORE variable setting in nmb and
winbind service files to have no limit for coredumps by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11907

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed May 18 19:26:49 CEST 2016 on sn-devel-144

(cherry picked from commit f15b23f8358d7b2f60b1df0f81bb93a2c8789af4)

9 years agopackaging: Set default limit for core file size in init scripts
Anoop C S [Tue, 10 May 2016 15:37:01 +0000 (21:07 +0530)] 
packaging: Set default limit for core file size in init scripts

SysV init scripts used for initiating smb and winbind services
determines the value for default limit of coredump from variable
named DAEMON_COREFILE_LIMIT within a bash env. Therefore this
patch explicitly sets this variable to 'unlimited' so as to have
no limit for core file size by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11907

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit ba9ccc6be48e8541748afbf31d5e5dba7d1baf8e)

9 years agopackaging: Remove ulimit usage for setting core file size limit
Anoop C S [Tue, 10 May 2016 09:20:14 +0000 (14:50 +0530)] 
packaging: Remove ulimit usage for setting core file size limit

Recent commit ebd139c4db7e51a2d7843a773991f15cadf504dd modified smb.init
to set core file size to 'unlimited' by default using the ulimit command.
But when smb and winbind services are initiated via sysv init scripts,
another variable named DAEMON_COREFILE_LIMIT takes higher priority in
deciding the core file size. Therefore setting default value using ulimit
command is useless.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11907

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 46524b4543acc9d104d85136c0a4a9e006fc099c)

9 years agos3: auth: Move the declaration of struct dom_sid tmp_sid to function level scope.
Jeremy Allison [Thu, 26 May 2016 23:31:55 +0000 (16:31 -0700)] 
s3: auth: Move the declaration of struct dom_sid tmp_sid to function level scope.

It's referred to outside of the {} brace scope it was defined in by
the following code:

                uid_to_unix_users_sid(*uid, &tmp_sid);
                user_sid = &tmp_sid;

As tmp_sid was going out of scope, user_sid was
being incorrectly set in the token sid list.

I think this *may* be the root cause of:

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10618

But even if not this is an obvious error that must
be fixed.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri May 27 11:28:18 CEST 2016 on sn-devel-144

(cherry picked from commit 1b3b89345480d16222da00753f973e36e2e0f92d)

9 years agos3:rpcclient: make use of SMB_SIGNING_IPC_DEFAULT
Stefan Metzmacher [Thu, 19 May 2016 09:47:18 +0000 (11:47 +0200)] 
s3:rpcclient: make use of SMB_SIGNING_IPC_DEFAULT

This means we'll use the "client ipc min protocol", "client ipc max protocol"
and "client ipc signing" options. But "--signing=no" or "--signing=required"
still overwrite "client ipc signing".

The following can be used to alter the max protocol

rpcclient --option="client ipc max protocol=SMB2_10" 172.31.9.163 -Uadministrator%A1b2C3d4 -c "getusername"
Account Name: Administrator, Authority Name: W4EDOM-L4

rpcclient --option="client ipc max protocol=NT1" 172.31.9.163 -Uadministrator%A1b2C3d4 -c "getusername"
Account Name: Administrator, Authority Name: W4EDOM-L4

rpcclient 172.31.9.163 -Uadministrator%A1b2C3d4 -c "getusername"
Account Name: Administrator, Authority Name: W4EDOM-L4

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11927

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat May 21 05:01:15 CEST 2016 on sn-devel-144

(cherry picked from commit 2eb824fbaf61dfc5e9c735589c80c41379dabe86)

9 years agosmbd: Fix an assert
Volker Lendecke [Wed, 20 Apr 2016 11:13:38 +0000 (13:13 +0200)] 
smbd: Fix an assert

This might stumble over stale entries

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11844
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a5d49b7ce1cfbf8491bc3d29c1ae5b0960b5fe01)

9 years agos3:ntlm_auth: make ntlm_auth_generate_session_info() more complete
Stefan Metzmacher [Wed, 11 May 2016 15:59:32 +0000 (17:59 +0200)] 
s3:ntlm_auth: make ntlm_auth_generate_session_info() more complete

The generate_session_info() function maybe called more than once
per session.

Some may try to look/dereference session_info->security_token,
so we provide simplified token.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11914

Signed-off-by: Stefan Metzmacher <metze@samba.org>
9 years agos3:smbd: fix anonymous authentication if signing is mandatory
Stefan Metzmacher [Wed, 18 May 2016 07:56:02 +0000 (09:56 +0200)] 
s3:smbd: fix anonymous authentication if signing is mandatory

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11910

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
9 years agolibcli/auth: let msrpc_parse() return talloc'ed empty strings
Stefan Metzmacher [Mon, 9 May 2016 14:14:31 +0000 (16:14 +0200)] 
libcli/auth: let msrpc_parse() return talloc'ed empty strings

This make it more predictable for the callers.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11912
BUG: https://bugzilla.redhat.com/show_bug.cgi?id=1334356
BUG: https://launchpad.net/bugs/1578576

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon May  9 22:27:21 CEST 2016 on sn-devel-144

(cherry picked from commit 58a83236294117d32d9883ac3024f81fa1730a87)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Tue May 17 14:29:44 CEST 2016 on sn-devel-104

9 years agos3:libsmb/clifile use correct value for MaxParameterCount for setting EAs
Christian Ambach [Tue, 10 May 2016 17:47:02 +0000 (19:47 +0200)] 
s3:libsmb/clifile use correct value for MaxParameterCount for setting EAs

Windows servers will refuse trans2 requests which use excessive
request parameters. From [MS-CIFS|:
<239> Section 3.3.5.2.5: Windows NT servers fail a transaction request with
STATUS_INSUFF_SERVER_RESOURCES, if (SetupCount + MaxSetupCount +
TotalParameterCount + MaxParameterCount + TotalDataCount + MaxDataCount)
is greater than 65*1024.

When attempting to set a large list of EAs for a file, this limit can be
hit when using CLI_BUFFER_SIZE as MaxDataCount
while the TRANS2_SET_PATH_INFORMATION response has no data reply,
only parameters (section 2.2.6.7.2).

Be as minimal as possible here to allow a maximum number of EAs to
be written.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11354
Reviewed-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Christian Ambach <ambi@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed May 11 18:35:59 CEST 2016 on sn-devel-144

(cherry picked from commit 7efbe1139796bb708176cd8dddb206a0f271ec1b)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Thu May 12 17:38:44 CEST 2016 on sn-devel-104

9 years agopdb: Fix segfault in pdb_ldap for missing gecos
Luca Olivetti [Fri, 5 Feb 2016 11:02:51 +0000 (12:02 +0100)] 
pdb: Fix segfault in pdb_ldap for missing gecos

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11530
Signed-off-by: Luca Olivetti <luca@wetron.es>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Feb  5 16:47:00 CET 2016 on sn-devel-144

(cherry picked from commit 5d759bd0d4bf7cae8b54b69af5ecacb7987c2a0f)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Thu May 12 11:40:33 CEST 2016 on sn-devel-104

9 years agos3:libnet:libnet_join: add netbios aliases as SPNs
Ralph Boehme [Tue, 26 Apr 2016 15:21:46 +0000 (17:21 +0200)] 
s3:libnet:libnet_join: add netbios aliases as SPNs

Add all listed smb.conf netbios aliases as SPNs to the machine account:

  HOST/NETBIOS_ALIAS@REALM

and

  HOST/netbios_alias.dnsdomain.name@REALM

Bug: https://bugzilla.samba.org/show_bug.cgi?id=1703

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed May  4 17:58:05 CEST 2016 on sn-devel-144

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Mon May  9 14:04:05 CEST 2016 on sn-devel-104

9 years agoinit: set core file size to unlimited by default
Raghavendra Talur [Mon, 2 May 2016 10:44:06 +0000 (16:14 +0530)] 
init: set core file size to unlimited by default

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11907

Signed-off-by: Raghavendra Talur <rtalur@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri May  6 19:15:17 CEST 2016 on sn-devel-144

(cherry picked from commit ebd139c4db7e51a2d7843a773991f15cadf504dd)

9 years agosource3: Honor the core soft limit of the OS.
Ira Cooper [Thu, 3 Mar 2016 18:47:32 +0000 (13:47 -0500)] 
source3: Honor the core soft limit of the OS.

We should honor the soft limits set by the operating system.

In any case, 16M doesn't make a useful coredump for modern
Samba.

Signed-off-by: Ira Cooper <ira@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Mar  5 00:39:48 CET 2016 on sn-devel-144

(cherry picked from commit 58d3462bc58290d8eb5e554c6c59cf6b73ccf58a)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11907

9 years agoheimdal: encode/decode kvno as signed integer
Uri Simchoni [Thu, 5 May 2016 20:40:22 +0000 (23:40 +0300)] 
heimdal: encode/decode kvno as signed integer

This patch changes the encoding/decoding of kvno (key version number)
in blobs and packets to signed integer, for compatibility with Windows.
Reportedly, MIT Kerberos does the same.

This patch effectively reverts commit 1124c4872dfb81bec9c4b527b8927ca35e39a599
in the heimdal tree.

According to the Kerberos spec (RFC 4120 5.2.9), the kvno field
in encrypted data object is an unsigned integer that fits in
32 bits. The Heimdal Kerberos component bundled with Samba
conforms to this. However, Windows deviates from the standard
and encodes kvno as a signed integer, and this creates
interoperability issues.

ASN.1 DER has no special encoding for unsigned integer. A 32-bit
unsigned integer is encoded as a signed integer, so while a signed
32-bit integer (covering the range of -0x80000000..0x7fffffff) is
encoded using up to 4 bytes, an unsigned integer (covering
0..0xffffffff) could require 5 bytes.

Normally, kvno for a given account starts at 1 and increments on
password changes. Kerberos defined this as unsigned because there's
no meaning for negative version numbers, so the standard writers figured
4 billion versions is better than 2 billion. It was not
expected for a kvno to really go past 0x7fffffff and the disctinction
usually does not matter. However, RODCs use kvnos which
have the most-significant bit set.

In Active Directory, RODCs have a private secret for the krbtgt,
because the assumption is that the RODC is less secure, and
recovering the domain krbtgt secret from the RODC would compromise
the security of the entire domain. The kvno field is being used
to identify the private krbtgt account that owns the key - the
upper 16 bits are the RODC id, and the lower 16 bits identify
the key version number for this specific RODC. It's common to
have an RODC id greater than 0x8000, and therefore to have a
kvno larger than 0x7fffffff, which would be DER-encoded using
5 bytes.

Windows encodes kvno as signed integer - basically taking the
32 bits and treating them as a signed integer rather than an
unsigned integer. This means that in Windows a kvno can
always be encoded using 4 bytes, and Windows DCs reject a kvno
encoded using more than 4 bytes without even generating an error
response (the DC assumes it's an attack).

Heimdal re-encodes the TGT when it creates a TGS request. Obviously
it cannot decode and encode the encrypted parts but it does re-encode
the plain parts, which include the kvno. That leads to a 5-byte
kvno in the TGS request, which is rejected without an error
response.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11900

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sat May  7 21:14:21 CEST 2016 on sn-devel-144

(cherry picked from commit 6379737b7ddc6ccb752238c5820cc62e76a8da17)

9 years agovfs_fruit: add an option that allows disabling POSIX rename behaviour
Ralph Boehme [Mon, 11 Apr 2016 10:17:22 +0000 (12:17 +0200)] 
vfs_fruit: add an option that allows disabling POSIX rename behaviour

https://bugzilla.samba.org/show_bug.cgi?id=11721

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu May  5 00:04:50 CEST 2016 on sn-devel-144

(cherry picked from commit 625dcef765adc75c34ee5955a08c6cb77b87f41b)

9 years agos3:smbd/filename remove smelly code
Christian Ambach [Tue, 5 Apr 2016 00:58:48 +0000 (02:58 +0200)] 
s3:smbd/filename remove smelly code

not sure how this chunk ended up there, but I agree with
the statement in the comment that behavior should not depend
on developer mode

make test does not seem to depend on it anymore.

This piece had some bad influence on the tests I wrote
for case insensitivite behavior of SMB2/3, so let us
remove this technical debt.

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
The last 3 patches address
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11438

9 years agos3:smbd/service apply some code formatting
Christian Ambach [Sun, 3 Apr 2016 03:16:45 +0000 (05:16 +0200)] 
s3:smbd/service apply some code formatting

reduce indentation in switch statement, obey 80 char line limit, use C99 bool

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
9 years agos3:smbd/service disable case-sensitivity for SMB2/3 connections
Christian Ambach [Sun, 3 Apr 2016 03:06:05 +0000 (05:06 +0200)] 
s3:smbd/service disable case-sensitivity for SMB2/3 connections

in SMB2, there is no flag to let us know if the client wants to have case-sensitive behavior,
so in Auto mode, disable case-sensitivity

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11438
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
9 years agoCorrectly set cli->raw_status for libsmbclient in SMB2 code
Robin McCorkell [Mon, 2 May 2016 20:48:14 +0000 (21:48 +0100)] 
Correctly set cli->raw_status for libsmbclient in SMB2 code

The SMB2 file handling code wasn't correctly setting raw_status, which
is used by libsmbclient to report file open errors etc.

https://bugzilla.samba.org/show_bug.cgi?id=11276

Signed-off-by: Robin McCorkell <robin@mccorkell.me.uk>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 2a872e2b66f373b3c96b315b13c9f06a15522e13)

9 years agoVERSION: Bump version up to 4.3.10...
Karolin Seeger [Mon, 2 May 2016 07:43:11 +0000 (09:43 +0200)] 
VERSION: Bump version up to 4.3.10...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
9 years agoVERSION: Disable git snapshots for the 4.3.9 release. samba-4.3.9
Karolin Seeger [Mon, 2 May 2016 07:42:22 +0000 (09:42 +0200)] 
VERSION: Disable git snapshots for the 4.3.9 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
9 years agoWHATSNEW: Add release date.
Karolin Seeger [Mon, 2 May 2016 07:41:27 +0000 (09:41 +0200)] 
WHATSNEW: Add release date.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
9 years agoWHATSNEW: Update release notes.
Karolin Seeger [Fri, 29 Apr 2016 09:16:16 +0000 (11:16 +0200)] 
WHATSNEW: Update release notes.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Fri Apr 29 16:26:53 CEST 2016 on sn-devel-104

9 years agos3:selftest: add smbclient_ntlm tests
Stefan Metzmacher [Mon, 25 Apr 2016 14:12:47 +0000 (16:12 +0200)] 
s3:selftest: add smbclient_ntlm tests

We test all combinations of NT1 with and without spnego and SMB3
for user, anonymous and guest authentication.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11849

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Apr 28 20:16:45 CEST 2016 on sn-devel-144

(cherry picked from commit eee88e07b3e68efb467b390536eea4155b5ced7e)

Autobuild-User(v4-3-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-3-test): Fri Apr 29 13:02:37 CEST 2016 on sn-devel-104

9 years agoselftest:Samba4: let fl2000dc use Windows2000 style SPNEGO/NTLMSSP
Stefan Metzmacher [Mon, 25 Apr 2016 14:02:22 +0000 (16:02 +0200)] 
selftest:Samba4: let fl2000dc use Windows2000 style SPNEGO/NTLMSSP

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11849

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 4de43387235cb17a185fdd1afd658972e8c174ef)

9 years agoselftest:Samba4: let fl2000dc use Windows2000 supported_enctypes
Stefan Metzmacher [Tue, 26 Apr 2016 23:00:14 +0000 (01:00 +0200)] 
selftest:Samba4: let fl2000dc use Windows2000 supported_enctypes

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11849

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 587b5db7979c1ca1055f5bfd81ab79606cd3c2dd)

9 years agos3:test_smbclient_auth.sh: this script reqiures 5 arguments
Stefan Metzmacher [Tue, 26 Apr 2016 09:33:52 +0000 (11:33 +0200)] 
s3:test_smbclient_auth.sh: this script reqiures 5 arguments

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11849

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 70910334caa176bf98fece7d638ed599979dc173)

9 years agoselftest:Samba4: provide DC_* variables for fl2000dc and fl2008r2dc
Stefan Metzmacher [Tue, 26 Apr 2016 06:50:00 +0000 (08:50 +0200)] 
selftest:Samba4: provide DC_* variables for fl2000dc and fl2008r2dc

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11849

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit b8055cb42cadf48367867213a35635f3391c9b8d)

9 years agoauth/ntlmssp: add ntlmssp_{client,server}:force_old_spnego option for testing
Stefan Metzmacher [Mon, 25 Apr 2016 13:58:27 +0000 (15:58 +0200)] 
auth/ntlmssp: add ntlmssp_{client,server}:force_old_spnego option for testing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11849

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 7a2cb2c97611171613fc677a534277839348c56f)

9 years agoauth/spnego: add spnego:simulate_w2k option for testing
Stefan Metzmacher [Mon, 25 Apr 2016 12:45:55 +0000 (14:45 +0200)] 
auth/spnego: add spnego:simulate_w2k option for testing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11849

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit db9c01a51975a0a3ec2564357617958c2f466091)

9 years agoauth/ntlmssp: do map to guest checking after the authentication
Stefan Metzmacher [Wed, 20 Apr 2016 16:27:34 +0000 (18:27 +0200)] 
auth/ntlmssp: do map to guest checking after the authentication

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11847

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit d667520568996471b55007a42b503edbabb1eee0)

9 years agos3:smbd: only mark real guest sessions with the GUEST flag
Stefan Metzmacher [Wed, 20 Apr 2016 14:34:28 +0000 (16:34 +0200)] 
s3:smbd: only mark real guest sessions with the GUEST flag

Real anonymous sessions don't get it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11847

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(similar to commit 79a71545bfc87525c6ba6c8fe9fa7d8a9da33441)

9 years agos3:smbd: make use SMB_SETUP_GUEST constant
Stefan Metzmacher [Mon, 18 Apr 2016 15:36:56 +0000 (17:36 +0200)] 
s3:smbd: make use SMB_SETUP_GUEST constant

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11847

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 25ce97892ad3ce5028e4dbbbdd844ef6619ac396)

9 years agolibcli/security: implement SECURITY_GUEST
Stefan Metzmacher [Wed, 20 Apr 2016 14:29:42 +0000 (16:29 +0200)] 
libcli/security: implement SECURITY_GUEST

SECURITY_GUEST is not exactly the same as SECURITY_ANONYMOUS.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11847

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 837e6176329330893d5a1e4ce4ac67dbac758e56)

9 years agos3:auth_builtin: anonymous authentication doesn't allow a password
Stefan Metzmacher [Tue, 26 Apr 2016 23:48:32 +0000 (01:48 +0200)] 
s3:auth_builtin: anonymous authentication doesn't allow a password

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11847

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit ead483b0c0ec746c0869162024c97f2e08df7f4b)

9 years agos4:auth_anonymous: anonymous authentication doesn't allow a password
Stefan Metzmacher [Tue, 26 Apr 2016 23:44:56 +0000 (01:44 +0200)] 
s4:auth_anonymous: anonymous authentication doesn't allow a password

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11847

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
(cherry picked from commit d247dceaaab24b568425f2360e40f5e91be452cc)