librpc/wsp: use unsigned char for high byte comparison

../../librpc/wsp/wsp_util.c:244:28: warning: result of comparison of constant 160 with expression of type 'char' is always false [-Wtautological-constant-out-of-range-compare]
  244 |                 if (strlen(t) == 1 && *t == 0xa0) {

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s4/ldap server: avoid NULL deref if search control has no data

We switch to ldb_request_replace_control() so that the old search
control is removed in the NULL data case.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3/lib: fix matching interfaces with multiple assigned IPs

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15823

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Wed Mar 12 01:32:30 UTC 2025 on atb-devel-224

vfs_ceph_new: detect case sensitivity in CephFS

CephFS has recently added support for case insensitive access to the
file system. This modification detects whether the shared volume is case
sensitive or not and reports the FILE_CASE_SENSITIVE_SEARCH capability
accordingly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15822

Signed-off-by: Xavi Hernandez <xhernandez@redhat.com>
Reviewed-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Mar 11 20:34:26 UTC 2025 on atb-devel-224

s3:utils: Remove call of ads_startup() from net_ads_keytab_create()

Calling ads_startup() is not needed in net_ads_keytab_create.  Keytab
creation code in sync_pw2keytabs() decides if it needs to talk to DC or
not and connects to AD accordingly.

Fixing this, makes the bug below easier to reproduce using
'net ads keytab create'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Mon Mar 10 11:09:29 UTC 2025 on atb-devel-224

s3:libads: Make sure that REALM is always added to keytab principals

The code responsible for adding SPNs to keytab should always set the
REALM part.  Current code is not adding it for e.g. SPNs synced from AD.

If REALM is missing, krb5_parse_name() will succeed (and add the REALM)
only if the krb5.conf contains libdefaults section with
default_realm set and will fail otherwise. E.g.:

[libdefaults]
default_realm = SOMETESTDOMAIN1.MY.COM

When calling 'net ads join' we get the following error if SPN is missing
REALM and krb5.conf does not provide the default_realm:

pw2kt_process_add_info: Failed to parse principal:
RestrictedKrbHost/$MACHINE_NAME
Failed to join domain: failed to create kerberos keytab

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727

Pair-Programmed-With: Noel Power <noel.power@suse.com>

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Sun Mar  9 00:25:08 UTC 2025 on atb-devel-224

lib:krb5_wrap: Add smb_krb5_parse_name_flags()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

docs-xml: enable SMB3 Unix Extensions by default

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Mar  7 20:06:31 UTC 2025 on atb-devel-224

s3/param: remove widelinks check and warning for SMB3 UNIX Extensions

SMB3 POSIX clients won't be able to create real symlinks, so we can relax these
checks.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:locking: make sure brl_conflict_posix() is only called with 2 POSIX_LOCKS

Otherwise we hit the assert if the caller is a windows lock
and the conflicting one a posix lock.

Or in the non-developer build we don't enforce the windows locking
rules.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:locking: assert POSIX_LOCK in brl_[un]lock_posix()

This makes it clearer and prevents possible problems in future.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:locking: init_strict_lock_struct() already calls lp_posix_cifsu_locktype()

There is no need to do it in the caller and pass an unused argument.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: fix lock_flav initialization in smbd_smb2_lock_send()

Right above we did

        if (posix_handle) {
                locks[i].lock_flav = POSIX_LOCK;
        } else {
                locks[i].lock_flav = WINDOWS_LOCK;
        }

which came in with commit f68fffa85d1de992384a210bb0b9261cda3fb168,
apparently forgetting to remove the previously existing initialization
locks[i].lock_flav=WINDOWS_LOCK.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

smbd: fix check for POSIX opens in have_file_open_below()

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

smbd: fix checks for POSIX opens in file_find_subpath()

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

vfs_ceph_new: Do not resolve by inode number

CephFS snapshots within snap directory shares the same inode number from
its parent. Until unless we resolve by name we may incorrectly point at
an inode which is not a snapshot directory. Therefore to be functionally
correct we avoid resolving by inode number but proper name.

For example:

path (ino = 3)
  |
  --- dir (ino = 4)
  |
  --- .snap (ino = 3)
        |
        --- snap1 (ino = 3)
              |
              --- dir (ino = 4)

In this case an attempt to resolve 'snap1' by inode number 3 results in
pointing at 'path' which is not the desired outcome.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15818

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Mar  7 18:20:47 UTC 2025 on atb-devel-224

vfs_ceph_new: Handle absolute path in vfs_ceph_ll_walk

It can very well be the case that the incoming path is absolute in
nature which breaks the assumption inside vfs_ceph_ll_walk that it
is within the current working directory. Instead perform a check to
see whether the path includes current working directory path in its
components and accordingly trim it to make it relative in nature.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15818

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

vfs_ceph_new: Remove unused code in cephmount_mount_fs()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15818

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

vfs_ceph_new: Remove redundant re-intialization to NULL

TALLOC_FREE() by default re-initializes the pointer to NULL after
corresponding memory is freed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15818

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s4:auth: let auth_user_info_dc_expand_sids() add This Organization SID

We do that unless the Other Organization SID is already there.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Mar  6 17:35:50 UTC 2025 on atb-devel-224

s4:dsdb/tests: let the token_group.py test work against Windows 2025

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs: Simplify DBGs

Avoid casts: We have PRIu64, size_t is printed with %zu. Only off_t
must be cast to intmax_t, but for that we should not need a macro.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Mar  5 18:42:03 UTC 2025 on atb-devel-224

lib: Remove unused next_token()

Replaced by next_token_talloc()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

torture4: Test next_token_talloc() instead of next_token()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

nsswitch: Remove next_token() from torture4

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

nsswitch: Remove next_token() from wbinfo

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: Remove unused recursive_rmdir()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs: Rewrite vfs_streams_depot

This started when I found vfs_streams_depot() is the last user of
recursive_rmdir() and ended as a pretty complete rewrite. Why? This
new version does not call the path-based NEXT_[L]STAT routines
anymore, it only uses FSTATAT. This is one tiny step towards getting
rid of the path-based calls we still have that implicitly depend on
the current working directory. In some distant future I want to get
rid of our chdir() calls and do everything relative to a O_PATH handle
that we opened on the share root when connecting to a share.

This patch removes a few lines, and I don't see a reasonable way to do
this in micro-steps. Structurally it should be simple though:
Everything works off streams_depot_rootdir_pathref(), which gives a
pathref fsp to the ".streams" directory, stream_dir_pathref() turns
this into a pathref of the actual per-file subdirectory.

We also have to remove the special handling of absolute paths in
vfs_shadow_copy2, streams_depot does not send absolute paths anymore.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs: Slightly simplify streams_depot_fstreaminfo()

Use metadata_fsp()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: Make recursive_rmdir_fsp() public

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs: We expect sane callers of SMB_VFS_RENAMEAT

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

libsmb: Save lines with a direct variable initialization

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

libsmb: Simplify smbXcli_req_unset_pending()

We have ARRAY_DEL_ELEMENT() for this

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbclient3: Replacing Echos in the cli status check with TCP status check.

Replacing the echoes, which were being sent every 5 seconds by the client for a CLI status check, with a method that checks the status of the file descriptor instead, for a POLLHUP, POLLRDHUP, or a timeout.

Signed-off-by: Felix Bussmann <feb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Wed Mar  5 16:21:34 UTC 2025 on atb-devel-224

s3:smbd: disable "vfs mkdir use tmp name = auto" on OpenBSD

This is the simplest way to avoid a regression.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15801

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar  5 12:37:40 UTC 2025 on atb-devel-224

ctdb-utils: Fix incorrect FSF address

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15820

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Mar  5 03:40:15 UTC 2025 on atb-devel-224

ldb: remove unused test-sqlite3.sh

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>

codespellrc: remove reference to non-existent file

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>

ldb: doxygen: don't mention sqlite

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>

ldb:manpages: ldbedit: update url schemes

no sqlite://, but ldaps:// ldb://, mdb://.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>

ldb: remove obsolete copy of https://ldb.samba.org

lib/ldb/web/index.html used to be the source for
https://ldb.samba.org/, but the web page has continued to evolve in
minor ways without git keeping up.

The current difference is all http:// have been converted to https://
and a few URL domains and paths have changed.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>

ldb: remove unused nssldb

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>

ldb: remove unused sqlite backend

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Martin Schwenke <mschwenke@ddn.com>

vfs_ceph_new: use libcephfs nonblocking API for async-io ops

Use libcephfs non-blocking API (ceph_ll_nonblocking_readv_writev[1]) in
combination with smb VFS async hooks ({pread,pwrite,fsync}_send/_recv).
Fills libcephfs' struct ceph_ll_io_info with single iovec and
submit/complete the operation asynchronously on libcephfs side, with
corresponding tevent schedule-immediate upon completion on smbd side.

Control nonblocking/normal I/O mode via config parameter. The common
parts of async I/O (with/without HAVE_CEPH_ASYNCIO) are united.
Specifically, use same struct vfs_ceph_aio_state and common code via
helper function for all async I/O hooks. When HAVE_CEPH_ASYNCIO
is True _and_ config option 'asyncio = yes' use libcephfs asynchronous
I/O API. Otherwise, fake async operation using normal blocking APIs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15810

[1] https://github.com/ceph/ceph/commit/b4e39f3eccd6734f1ed13c700c136e3aef1777f8

Signed-off-by: Shachar Sharon <ssharon@redhat.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Mar  4 16:53:21 UTC 2025 on atb-devel-224

docs-xml: Update description of dns hotsname (G)

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Mon Mar  3 10:36:29 UTC 2025 on atb-devel-224

s3-waf: Enable build of MO files for localization

waf will now generate .mo files for pam_winbind and net when gettext support is enabled and gettext tools are available

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14491

Signed-off-by: Ivan Korytov <korytovip@basealt.ru>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Fri Feb 28 13:26:45 UTC 2025 on atb-devel-224

s3:locale:pam_winbind: Update Russian translation

Unused translations are left for reference in future updates

Signed-off-by: Ivan Korytov <korytovip@basealt.ru>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

bootstrap: remove wintest-only dependency

Nobody has run Wintest in the last 10 years, and we don't need it
in our CI tests.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Thu Feb 27 01:00:10 UTC 2025 on atb-devel-224

bootstrap: python-cryptography is not just for tests

Relating to, but not fixing, these distro bugs:

https://bugs.launchpad.net/ubuntu/+source/samba/+bug/2099895
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1086768

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>

smbd: avoid work in unix token debug no-op

When the debug level is too low to print, we don't need to allocate
the strings.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15737

Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Pair-programmed-with: Volker Lendecke <vl@samba.org>

libcli: avoid work in security token debug no-op

When the debug level is too low to print, we don't need to allocate
the strings.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15737

Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

python:tdb_util: "samba-tool domain backup offline" hangs

GNU getopt(3) is by default non-POSIX compliant and accepts options after
positional arguments (unless forced with POSIXLY_CORRECT). This is not portable,
e..g., on FreeBSD. Put options first and then positional arguments.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15804

Signed-off-by: Andrea Venturoli <ml@netfence.it>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>

s3:torture: report kilobytes per second as kB/s, not kb/s

https://bugzilla.samba.org/show_bug.cgi?id=11023

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>

smbclient: report kilobytes per second as kB/s, not kb/s

https://bugzilla.samba.org/show_bug.cgi?id=11023

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>

build: --disable-warnings-as-errors avoids some warning config checks

This fixes compilation with some versions of Honggfuzz.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>

vfs: Fix vfs_streams_depot's fstatat

a24c7d566f2 does not cover subdirectories

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15816
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Feb 26 09:00:34 UTC 2025 on atb-devel-224

python:tests/krb5: let create_trust() take {ingress,egress}_claims_tf_rules

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Feb 24 10:28:02 UTC 2025 on atb-devel-224

python:tests/krb5: let create_trust() take forest_info

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: let modified_ticket() to take modify_{tkt,enc}_fn

This makes it possible modify the public ticket part well as the enc part.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: add remove_pac_buffers()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: set_pac_claims with claims=[] should be an empty blob

Review with: git show -w

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: let set_pac_sids() replace the requester_sid

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: add set_pac_names() to modify the names in a pac

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: give KerberosTicketCreds a basic __str__() function

This makes debugging easier...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: let create_ccache[_with_ticket] use the correct crealm

It can be different from the servers realm.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: allow get_service_ticket() to fail with expected_status

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python:tests/krb5: add KerberosTicketCreds.set_srealm()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3:testparm: make it clear that 'client use krb5 netlogon' is experimental

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15815

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Feb 24 08:43:55 UTC 2025 on atb-devel-224

samba-tool/testparm: make it clear that 'client use krb5 netlogon' is experimental

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15815

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

docs-xml/smbdotconf: make it clear that 'client use krb5 netlogon' is experimental

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15815

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s4:kdc: split access check preparation from the actual check in samba_kdc_update_pac()

This allows us to add more access checks later...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sat Feb 22 23:04:04 UTC 2025 on atb-devel-224

s4:kdc: let samba_kdc_get_claims_blob() check msDS-EgressClaimsTransformationPolicy

For now we only allow the implicit (default) or explicit allow all
policy, as well as a deny all policy.

For all others we return an error in order to indicate the
non-supported configuration.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_get_claims_data() check msDS-IngressClaimsTransformationPolicy

For now we only allow the implicit (default) or explicit deny all
policy.

For all others we return an error in order to indicate the
non-supported configuration.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: also fetch msDS-[In|E]gressClaimsTransformationPolicy

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:dsdb/common: add dsdb_trust_get_claims_tf_policy()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_update_pac() always call samba_kdc_get_upn_info_blob()

There's no reason not to regenerate it, it makes the code more
consistent.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_update_pac() always call samba_kdc_get_logon_info_blob()

The logic in samba_kdc_get_logon_info_blob() also does
talloc_zero(tmp_ctx, DATA_BLOB) followed by calling
samba_get_logon_info_pac_blob().

So we can always just call samba_kdc_get_logon_info_blob().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: also pass override_resource_groups to samba_kdc_get_logon_info_blob()

This will make the following changes easier...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: move device_{info,claims}_blob generation in samba_kdc_update_pac()

We should generate the device blobs after generating the client blobs
and also after all access checking.

We also use the samba_kdc_get_claims_blob() helper,
which is currently only a wrapper around
claims_data_encoded_claims_set(), but that will change in future...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: regenerate the client claims blob in samba_kdc_update_pac() if needed

Note that samba_kdc_get_claims_data() already handles the
samba_kdc_entry_pac_issued_by_trust() case to clear the
claims received from a trusted domain.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_get_claims_data() indicate if regeneration is needed

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: rewrite the logic in samba_kdc_get_claims_data()

We should also go via samba_kdc_get_claims_data_from_pac()
if the pack was issued by a trust. But for now we still
clear the claims, which is the default if
msDS-IngressClaimsTransformationPolicy is missing
on the trustedDomain object.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_get_claims_data_from_pac() return if a buffer was found

This will simplify further changes.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_get_pac() use samba_kdc_get_claims_blob()

We should avoid calling claims_data_encoded_claims_set() directly,
we'll have to do more than claims_data_encoded_claims_set() in future,
so make sure we always go via the common samba_kdc_get_claims_blob()
helper.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_get_claims_blob() take struct claims_data as input.

It means samba_kdc_update_pac() does not call
samba_kdc_get_claims_data_from_db() twice,
as it's already called by samba_kdc_get_claims_data().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_update_pac() always fetch the user claims

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let samba_kdc_update_pac() use samba_kdc_entry_pac_valid_principal() to check delegated_proxy

This might not be needed, but it's more consistent.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: remove useless samba_kdc_get_user_info_dc() from samba_kdc_get_device_info_blob()

There's no need to call it again if the caller already did.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: move user_info_dc_shallow_copy variable in samba_kdc_update_pac()

This is only needed as tmp variable in the if block...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: move samba_kdc_get_user_info_dc() for the device in samba_kdc_update_pac()

We should can already call this in the 'need_device' branch, then
it can be reused later.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: move samba_kdc_get_user_info_dc() up in samba_kdc_update_pac()

This will make further changes easier.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: introduce need_device helper variable in samba_kdc_update_pac()

Also use samba_kdc_entry_pac_valid_principal() in order to catch
all conditions for a valid device. For principals issued by
trusted domains there's no device.entry pointer!

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: make samba_kdc_get_{user_info_dc,claims_data} static

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: pass samba_kdc_entry_pac to samba_kdc_check_s4u2proxy_rbcd()

This simplifies and unifies the callers.

For the MIT kdc we avoid using via kerberos_pac_to_user_info_dc()
directly.

Now both go via samba_kdc_get_user_info_dc() and MIT also
handles the samba_kdc_get_claims_data() path.

For the MIT kdc it means kerberos_pac_to_user_info_dc() is now
called via samba_kdc_get_user_info_dc() ->
samba_kdc_get_user_info_from_pac() and it is followed by
authsam_update_user_info_dc() consistently.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: move samba_kdc_check_s4u2proxy_rbcd() from db-glue to pac-glue

This will allow us to make more functions static in the next steps.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: make a lot of pac-glue.c functions static

This makes the code base less confusing (at least for me).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: let mit_samba_get_pac() use samba_kdc_get_pac()

It means we port commit b42fbc78395870c3caa33aa1c9636a59fde9e867 also to the
MIT kdc and enforce authentication policy service restrictions when getting a PAC

We should have this logic only once in order to avoid getting out of
sync between heimdal and MIT regarding the core logic.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: split out samba_kdc_get_pac() from samba_wdc_get_pac()

samba_kdc_get_pac() will be re-used by mit_samba_get_pac() in
the next step.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: don't return ENOENT from samba_kdc_get_claims_data[_from_pac]

This will matter in the next commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4:kdc: use better variable names in samba_wdc_check_client_access()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>