]> git.ipfire.org Git - thirdparty/samba.git/log
thirdparty/samba.git
8 months agosmbd: Factor out can_delete_directory_hnd()
Volker Lendecke [Thu, 5 Dec 2024 16:17:59 +0000 (17:17 +0100)] 
smbd: Factor out can_delete_directory_hnd()

To be used in close.c next

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Make can_delete_directory_fsp() look cleaner in strace
Volker Lendecke [Thu, 5 Dec 2024 15:50:12 +0000 (16:50 +0100)] 
smbd: Make can_delete_directory_fsp() look cleaner in strace

I'm not sure, but it might be that we don't have a full fd coming into
can_delete_directory_fsp() without O_PATH. We open a real fd for
readdir() in all cases, which we can use for sure in openat &
friends. Use that as dirfsp for openat.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Fix can_delete_directory_fsp()
Volker Lendecke [Fri, 6 Dec 2024 10:31:56 +0000 (11:31 +0100)] 
smbd: Fix can_delete_directory_fsp()

We should only ignore veto files if they are about to deleted anyway

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: simplify can_delete_directory_fsp()
Volker Lendecke [Thu, 5 Dec 2024 12:08:32 +0000 (13:08 +0100)] 
smbd: simplify can_delete_directory_fsp()

openat_pathref_fsp_lcomp does all of what we do here manually
anyway. Use it.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Remove a pointless and partially wrong comment
Volker Lendecke [Thu, 5 Dec 2024 19:07:03 +0000 (20:07 +0100)] 
smbd: Remove a pointless and partially wrong comment

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Fix typos
Volker Lendecke [Thu, 5 Dec 2024 10:38:51 +0000 (11:38 +0100)] 
smbd: Fix typos

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Simplify ReadDirName()
Volker Lendecke [Thu, 5 Dec 2024 10:37:15 +0000 (11:37 +0100)] 
smbd: Simplify ReadDirName()

"fp" is only used for DBG messages where I don't think we need the
full accuracy of full_path_from_dirfsp_at_basename(). Save a talloc.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolib: Simplify ad_get_internal()
Volker Lendecke [Wed, 4 Dec 2024 18:37:20 +0000 (19:37 +0100)] 
lib: Simplify ad_get_internal()

We have metadata_fsp() for this

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Pass "dirfsp" through open_streams_for_delete()
Volker Lendecke [Wed, 4 Dec 2024 18:29:03 +0000 (19:29 +0100)] 
smbd: Pass "dirfsp" through open_streams_for_delete()

One SMB_VFS_CREATE_FILE call less with "NULL" as dirfsp

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Fix a %d/%u format string hickup
Volker Lendecke [Wed, 4 Dec 2024 18:19:57 +0000 (19:19 +0100)] 
smbd: Fix a %d/%u format string hickup

num_streams is an unsigned int

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agorpcclient: Fix Coverity ID 1508978 Use of 32-bit time_t
Volker Lendecke [Wed, 4 Dec 2024 16:03:46 +0000 (17:03 +0100)] 
rpcclient: Fix Coverity ID 1508978 Use of 32-bit time_t

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agonet: Fix Coverity ID 1508974 Use of 32-bit time_t
Volker Lendecke [Wed, 4 Dec 2024 16:00:50 +0000 (17:00 +0100)] 
net: Fix Coverity ID 1508974 Use of 32-bit time_t

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agoeventlog: Fix Coverity ID 1508977 Use of 32-bit time_t
Volker Lendecke [Wed, 4 Dec 2024 15:59:01 +0000 (16:59 +0100)] 
eventlog: Fix Coverity ID 1508977 Use of 32-bit time_t

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agowinbind: Fix Coverity ID 1509002 Use of 32-bit time_t
Volker Lendecke [Wed, 4 Dec 2024 15:38:47 +0000 (16:38 +0100)] 
winbind: Fix Coverity ID 1509002 Use of 32-bit time_t

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agoprinting: Remove a few obsolete openat_pathref_fsp() calls
Volker Lendecke [Wed, 4 Dec 2024 15:30:03 +0000 (16:30 +0100)] 
printing: Remove a few obsolete openat_pathref_fsp() calls

driver_convert_unix calls filename_convert_dirfsp, which these days
fills smb_fname->fsp. So openat_pathref_fsp() will immediately return
success as it finds smb_fname->fsp != NULL.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Remove an obsolete comment
Volker Lendecke [Wed, 4 Dec 2024 15:11:44 +0000 (16:11 +0100)] 
smbd: Remove an obsolete comment

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Simplify smb_set_file_end_of_file_info()
Volker Lendecke [Wed, 4 Dec 2024 15:06:10 +0000 (16:06 +0100)] 
smbd: Simplify smb_set_file_end_of_file_info()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Simplify call_trans2setfileinfo()
Volker Lendecke [Wed, 4 Dec 2024 14:53:41 +0000 (15:53 +0100)] 
smbd: Simplify call_trans2setfileinfo()

Avoid an "else"

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolib: Fix Coverity ID 1636566 Untrusted loop bound
Volker Lendecke [Wed, 4 Dec 2024 13:03:12 +0000 (14:03 +0100)] 
lib: Fix Coverity ID 1636566 Untrusted loop bound

Sanitize num_auths to [0,15] in sid_copy()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Modernize DEBUGs
Volker Lendecke [Wed, 4 Dec 2024 11:42:43 +0000 (12:42 +0100)] 
smbd: Modernize DEBUGs

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Avoid a (double) cast
Volker Lendecke [Wed, 4 Dec 2024 11:42:00 +0000 (12:42 +0100)] 
smbd: Avoid a (double) cast

We don't need floating point here, intmax_t and %jd should be
sufficient

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Pass "dirfsp" to get_posix_fsp()
Volker Lendecke [Wed, 4 Dec 2024 11:28:34 +0000 (12:28 +0100)] 
smbd: Pass "dirfsp" to get_posix_fsp()

The two places where get_posix_fsp() is called we do have the dirfsp
around. Pass this through to SMB_VFS_CREATE_FILE(), looks much cleaner
in strace.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Simplify smb_set_posix_acl()
Volker Lendecke [Wed, 4 Dec 2024 08:01:15 +0000 (09:01 +0100)] 
smbd: Simplify smb_set_posix_acl()

Call get_posix_fsp() in the caller, this removes if-conditions in
smb_set_posix_acl() itself

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Simplify smb_q_posix_acl()
Volker Lendecke [Wed, 4 Dec 2024 07:54:19 +0000 (08:54 +0100)] 
smbd: Simplify smb_q_posix_acl()

Ensure it's called with a valid fsp. In the pathinfo case, use
get_posix_fsp() in the caller, in the fileinfo case the client has
sent us the fid. A client-visible fid is always a fsa fsp.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Simplify get_posix_fsp()
Volker Lendecke [Tue, 3 Dec 2024 16:24:40 +0000 (17:24 +0100)] 
smbd: Simplify get_posix_fsp()

Remove three variables only set at initialization time

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Modernize a DEBUG
Volker Lendecke [Fri, 29 Nov 2024 14:35:50 +0000 (15:35 +0100)] 
libcli: Modernize a DEBUG

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Fix a potential 32-bit problem with PRIu32
Volker Lendecke [Thu, 28 Nov 2024 17:44:02 +0000 (18:44 +0100)] 
libcli: Fix a potential 32-bit problem with PRIu32

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Make handling implicit_owner_rights bit easier to read
Volker Lendecke [Fri, 29 Nov 2024 12:06:03 +0000 (13:06 +0100)] 
libcli: Make handling implicit_owner_rights bit easier to read

The first time I came across this I missed the "FALL_THROUGH" and had
to look closely at what happens. I had expected
IMPLICIT_OWNER_READ_CONTROL_AND_WRITE_DAC_RIGHTS to grant two rights,
which to me is now more obvious. It was correct before, but to me this
is now more obvious. YMMV.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Simplify disp_sec_ace_object()
Volker Lendecke [Thu, 28 Nov 2024 17:41:50 +0000 (18:41 +0100)] 
libcli: Simplify disp_sec_ace_object()

Directly use GUID_buf_string()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Align an integer type
Volker Lendecke [Tue, 3 Dec 2024 12:33:48 +0000 (13:33 +0100)] 
libcli: Align an integer type

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Remove the "mem_ctx" argument from pull_integer()
Volker Lendecke [Thu, 28 Nov 2024 17:01:21 +0000 (18:01 +0100)] 
libcli: Remove the "mem_ctx" argument from pull_integer()

Not needed anymore

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Simplify pull_integer()
Volker Lendecke [Thu, 28 Nov 2024 16:58:59 +0000 (17:58 +0100)] 
libcli: Simplify pull_integer()

Use ndr_pull_struct_blob_noalloc, we don't need talloc here.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agovfs: Simplify connect_acl_tdb()
Volker Lendecke [Thu, 28 Nov 2024 14:48:45 +0000 (15:48 +0100)] 
vfs: Simplify connect_acl_tdb()

We don't need talloc for printing a mask with %o

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agovfs: Simplify connect_acl_xattr()
Volker Lendecke [Thu, 28 Nov 2024 14:48:45 +0000 (15:48 +0100)] 
vfs: Simplify connect_acl_xattr()

We don't need talloc for printing a mask with %o

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agosmbd: Pass "dirfsp" through posix_mkdir()
Volker Lendecke [Sat, 23 Nov 2024 15:51:15 +0000 (16:51 +0100)] 
smbd: Pass "dirfsp" through posix_mkdir()

One less caller of SMB_VFS_CREATE_FILE with dirfsp==NULL

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Avoid an unnecessary "else"
Volker Lendecke [Mon, 25 Nov 2024 11:04:53 +0000 (12:04 +0100)] 
libcli: Avoid an unnecessary "else"

We return in the if-branch

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agolibcli: Use ndr_deepcopy_struct() in security_token_duplicate()
Volker Lendecke [Thu, 28 Nov 2024 12:56:19 +0000 (13:56 +0100)] 
libcli: Use ndr_deepcopy_struct() in security_token_duplicate()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
8 months agos3:open.c: Fix a typo
Pavel Filipenský [Wed, 11 Dec 2024 21:33:17 +0000 (22:33 +0100)] 
s3:open.c: Fix a typo

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Tue Dec 17 11:23:50 UTC 2024 on atb-devel-224

8 months agoselftest: Add test for vfs crossrename module
Pavel Filipenský [Wed, 4 Dec 2024 10:02:18 +0000 (11:02 +0100)] 
selftest: Add test for vfs crossrename module

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
8 months agodocs:manpage: vfs_crossrename is not fully stackable VFS module
Pavel Filipenský [Mon, 2 Dec 2024 21:27:39 +0000 (22:27 +0100)] 
docs:manpage: vfs_crossrename is not fully stackable VFS module

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
8 months agos3:vfs_crossrename: add back checking for errno ENOENT
Jones Syue [Thu, 26 Sep 2024 09:17:14 +0000 (17:17 +0800)] 
s3:vfs_crossrename: add back checking for errno ENOENT

strace gives a clue: samba try to remove 'file.txt' in the dst folder but
actually it is not existed yet, and got an errno = ENOENT,

renameat(32, "file.txt", 31, "file.txt") = -1 EXDEV (Invalid cross-device link)
unlinkat(31, "file.txt", 0)             = -1 ENOENT (No such file or directory)

Commit 5c18f074be92 ("s3: VFS: crossrename. Use real dirfsp for
SMB_VFS_RENAMEAT()") seems unintentionally removed errno ENOENT checking,
so add it back could address 1st issue.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Jones Syue <jonessyue@qnap.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
8 months agos3:vfs_crossrename: crossrename_renameat() needs to return 0 if copy_reg() is successful
Pavel Filipenský [Thu, 28 Nov 2024 17:32:25 +0000 (18:32 +0100)] 
s3:vfs_crossrename: crossrename_renameat() needs to return 0 if copy_reg() is successful

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
8 months agos3:vfs_crossrename: avoid locking panic in copy_reg()
Pavel Filipenský [Thu, 28 Nov 2024 17:39:53 +0000 (18:39 +0100)] 
s3:vfs_crossrename: avoid locking panic in copy_reg()

Use low level backend functions that don't go through the FSA layer.
Done via calling transfer_file() as it was in version before 5c18f07

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
8 months agodocs:manpages: Update 'net ads keytab create'
Pavel Filipenský [Tue, 3 Dec 2024 15:21:26 +0000 (16:21 +0100)] 
docs:manpages:  Update 'net ads keytab create'

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Mon Dec 16 19:32:32 UTC 2024 on atb-devel-224

8 months agoctdb-scripts: Change default persistent DB for statd_callout_helper
Martin Schwenke [Tue, 25 Jun 2024 01:06:19 +0000 (11:06 +1000)] 
ctdb-scripts: Change default persistent DB for statd_callout_helper

This database isn't use throughout CTDB, so name the it more
specifically.

Note that this might cause locks to be lost during upgrade to the
first version containing this change.

For testing, a different name is chosen to exercise related
functionality.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Fri Dec 13 15:01:10 UTC 2024 on atb-devel-224

8 months agoctdb-scripts: Support CTDB_STATD_CALLOUT_SHARED_STORAGE=none
Martin Schwenke [Tue, 30 Apr 2024 02:12:32 +0000 (12:12 +1000)] 
ctdb-scripts: Support CTDB_STATD_CALLOUT_SHARED_STORAGE=none

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agoctdb-tests: Update statd-callout tests to handle both modes
Martin Schwenke [Fri, 30 Jun 2023 11:50:10 +0000 (21:50 +1000)] 
ctdb-tests: Update statd-callout tests to handle both modes

Add support for shared_dir mode.

Instead of duplicating all of the tests, update them so they can be
wrapped.  Created new tests for shared_dir mode that source the
"original" tests.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agoctdb-scripts: Support storing statd-callout state in cluster filesystem
Martin Schwenke [Wed, 28 Jun 2023 04:01:44 +0000 (14:01 +1000)] 
ctdb-scripts: Support storing statd-callout state in cluster filesystem

CTDB_STATD_CALLOUT_SHARED_STORAGE is a new configuration variable
indicating where statd-callout should store its NFS client locking
data.  See the update to ctdb-script.options(5) for details.

This adds back functionality that was removed in commit
12cc82623150ca4a83482f1b7165401cbdecd3de.  The commit message doesn't
say why this was changed but it was most likely due to a cluster
filesystem hanging at inopportune times.  Hence, this is re-added as a
non-default option.  There are 2 justifications for re-adding it:

* The existing method (persistent_db) relies on dequeuing data during
  the monitor event, which loses any queued data on node crash.

* NFS-Ganesha writes NFSv4 client locking data to a cluster
  filesystem, by default.  Something similar might as well exist for
  NFSv3.

Note that this could create the files for sm-notify in add-client.
However, this would require an alternate implementation of
send_notifies() (or a change to the implementation for persistent_db
too).  It seems better to leave add-client lightweight and do the work
in notify, since add-client is a more frequent operation.

Unconditionally create the state directory on startup.  This is
currently implicitly created for persistent_db when the queue
directory is created.  However, it isn't created anywhere else for
shared_dir, so do it in a common place.

In test mode, the shared storage location has a prefix added so files
are created within the test environment.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agoctdb-scripts: Fix impending SM_NOTIFY versus record deletion race
Martin Schwenke [Tue, 4 Jun 2024 23:32:21 +0000 (09:32 +1000)] 
ctdb-scripts: Fix impending SM_NOTIFY versus record deletion race

SM_NOTIFYs are sent before client records are deleted.  Theoretically,
this means new records resulting from lock reclaim can be deleted.

This doesn't actually happen at the moment because any new "records"
resulting from lock reclaim are entered into the queue directory and
only dequeued to the database during a later monitor event.  Since a
monitor event can't collide with an ipreallocated event, no records
can be dequeeued into the database during the ipreallocated event, so
they can't be deleted by delete_records().

However, a subsequent commit will add direct writing of records into a
shared cluster filesystem directory.  This means that add-client
events will cause records to be added directly to that directory so,
without a fix, the race will be able to occur.

So, delete records before sending SM_NOTIFYs.  In theory, the script
could be killed before all SM_NOTIFYs are successfully sent, resulting
in loss of locks.  However, given the overall lack of error checking,
there are other, more likely problems.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agoctdb-scripts: Factor out some statd-callout functions
Martin Schwenke [Tue, 27 Jun 2023 03:37:56 +0000 (13:37 +1000)] 
ctdb-scripts: Factor out some statd-callout functions

This captures all of the persistent database (currently ctdb.tdb)
implementation-specific details in functions.  Alternate
implementations can now be easily added.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agoctdb-scripts: Improve update and listing code
Martin Schwenke [Wed, 2 Aug 2023 03:23:58 +0000 (13:23 +1000)] 
ctdb-scripts: Improve update and listing code

Drop the complexity associated with using awk to escape dots in IPv4
addresses to protect them from sed, and generate a grep -F filter
instead.

For listing, the pipeline is now longer, but the steps are now
clearer:

1. List DB records
2. Extract keys
3. Keep only keys machine hosted public IPs
4. Parse out server IP and client IP
5. Sort

Performance here isn't critical, so having clearer code is preferable.

Use temporary files to avoid command-line length limits.

Also, drop the cd to the queue directory during update.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agoctdb-scripts: Drop TCP tuning comments from statd_callout_helper
Martin Schwenke [Wed, 16 Oct 2024 01:23:42 +0000 (12:23 +1100)] 
ctdb-scripts: Drop TCP tuning comments from statd_callout_helper

Commits caad5dc38d790d76f6720b312c1557ec3151a084 and
f022df1d40c9c1e3e528f178204f404ee395d5c2 commented out these lines
back in 2007.

2 things are clear from the commit messages:

* These setting should not be required in the real world - they are:

    mainly useful for avoiding ack-storms when doing very rapid
    failover/failback during testing

* If they are needed, they are not specific to
  statd_callout/statd_callout_helper

Let's remove these comments to avoid confusing people.

Reported-by: Ulrich Sibiller <ulrich.sibiller@eviden.com>
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agoctdb-scripts: Fix some bit-rotted comments and whitespace
Martin Schwenke [Tue, 26 Nov 2024 00:25:09 +0000 (11:25 +1100)] 
ctdb-scripts: Fix some bit-rotted comments and whitespace

The top comment in the file is no longer true.

The comment about notifications doesn't really apply anymore since
upstream sm-notify is used and it does "the right thing".

shfmt wants to remove a space before a semicolon, so do that too.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agoctdb-scripts: Use CTDB_NFS_SHARED_STATE_DIR in nfs-ganesha-callout
Martin Schwenke [Wed, 5 Jul 2023 22:20:37 +0000 (08:20 +1000)] 
ctdb-scripts: Use CTDB_NFS_SHARED_STATE_DIR in nfs-ganesha-callout

Rename CTDB_NFS_STATE_MNT to CTDB_NFS_SHARED_STATE_DIR.  It doesn't
have to be a mount but can be any directory in a cluster filesystem.
CTDB_NFS_SHARED_STATE_DIR will soon be used in statd_callout_helper,
so the variable name might as well be better.

With this change, it will still only be used by nfs-ganesha-callout,
which isn't yet supported (i.e. it still lives in doc/examples).  The
rest of the comments below refer to behaviour changes in that script.

CTDB_NFS_SHARED_STATE_DIR is now mandatory when GPFS is used.  This is
much saner that choosing the first GPFS filesystem - if the state
directory changes then connection metadata can be lost.

Drop CTDB_NFS_STATE_FS_TYPE.  The filesystem type is now determined
from CTDB_NFS_SHARED_STATE_DIR and it is now checked against supported
filesystems.  This will catch the case when the filesystem for the
specified directory has not been mounted and the filesystem for the
mountpoint (e.g. ext4) is not a supported filesystem for shared state.

A side-effect is that the filesystem containing
CTDB_NFS_SHARED_STATE_DIR must be mounted when nfs-ganesha-callout is
first run.

While touching this file, my shfmt pre-commit hook wants to insert a
trailing ;; into a case statement.  Let's sneak that in here too.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
8 months agos4:rpc_server/netlogon: fix dcesrv_netr_LogonSamLogon_base_call() for ServerAuthentic...
Stefan Metzmacher [Tue, 26 Nov 2024 10:13:32 +0000 (11:13 +0100)] 
s4:rpc_server/netlogon: fix dcesrv_netr_LogonSamLogon_base_call() for ServerAuthenticateKerberos()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Dec 12 15:00:10 UTC 2024 on atb-devel-224

8 months agos4:rpc_server/netlogon: fix dcesrv_netr_ServerPasswordSet[2] for ServerAuthenticateKe...
Stefan Metzmacher [Tue, 26 Nov 2024 10:10:16 +0000 (11:10 +0100)] 
s4:rpc_server/netlogon: fix dcesrv_netr_ServerPasswordSet[2] for ServerAuthenticateKerberos

Review with: git show --patience

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agolibrpc/server: call dcesrv_netr_check_schannel() as schannel_check_creds_state()...
Stefan Metzmacher [Tue, 26 Nov 2024 11:55:12 +0000 (12:55 +0100)] 
librpc/server: call dcesrv_netr_check_schannel() as schannel_check_creds_state() callback

If schannel is not used we need to return ACCESS_DENIED and discard
the effect of netlogon_creds_server_step_check().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agolibcli/auth: let schannel_check_creds_state() take an access_check callback
Stefan Metzmacher [Tue, 26 Nov 2024 11:54:02 +0000 (12:54 +0100)] 
libcli/auth: let schannel_check_creds_state() take an access_check callback

This allows the callback to decide if the updated creds should be stored
or not.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agoselftest: add 'server support krb5 netlogon = yes' for ad_dc
Stefan Metzmacher [Tue, 26 Nov 2024 10:01:16 +0000 (11:01 +0100)] 
selftest: add 'server support krb5 netlogon = yes' for ad_dc

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agoselftest add 'server reject aes schannel:COMPUTER$' rules
Stefan Metzmacher [Tue, 26 Nov 2024 18:43:44 +0000 (19:43 +0100)] 
selftest add 'server reject aes schannel:COMPUTER$' rules

These avoid a lot of messages during the tests...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos4:rpc_server/netlogon: implement dcesrv_netr_ServerAuthenticateKerberos
Stefan Metzmacher [Tue, 29 Oct 2024 17:30:22 +0000 (18:30 +0100)] 
s4:rpc_server/netlogon: implement dcesrv_netr_ServerAuthenticateKerberos

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agolibrpc/server: prepare schannel_util.c for netr_ServerAuthenticateKerberos
Stefan Metzmacher [Tue, 29 Oct 2024 17:30:22 +0000 (18:30 +0100)] 
librpc/server: prepare schannel_util.c for netr_ServerAuthenticateKerberos

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agodocs-xml/smbdotconf: add "server support krb5 netlogon" options
Stefan Metzmacher [Thu, 7 Nov 2024 14:37:57 +0000 (15:37 +0100)] 
docs-xml/smbdotconf: add "server support krb5 netlogon" options

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agodocs-xml/smbdotconf: add "server reject aes schannel[:COMPUTERACCOUNT]" options
Stefan Metzmacher [Thu, 7 Nov 2024 14:16:18 +0000 (15:16 +0100)] 
docs-xml/smbdotconf: add "server reject aes schannel[:COMPUTERACCOUNT]" options

This will be useful in order to require netr_ServerAuthenticateKerberos()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos4:rpc_server/lsa: allow krb5+privacy instead of schannel
Stefan Metzmacher [Tue, 30 Apr 2024 23:09:40 +0000 (01:09 +0200)] 
s4:rpc_server/lsa: allow krb5+privacy instead of schannel

With netr_ServerAuthenticateKerberos() clients also use
krb5 for lsa_LookupSids3 and lsa_LookupNames4.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agoauth_log: prepare for netr_ServerAuthenticateKerberos
Stefan Metzmacher [Tue, 29 Oct 2024 17:30:22 +0000 (18:30 +0100)] 
auth_log: prepare for netr_ServerAuthenticateKerberos

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopython:tests/krb5: add ServerAuthenticateKerberos related tests to netlogon.py
Stefan Metzmacher [Fri, 22 Nov 2024 18:51:17 +0000 (19:51 +0100)] 
python:tests/krb5: add ServerAuthenticateKerberos related tests to netlogon.py

Works against Windows 2025 preview:

SMB_CONF_PATH=/dev/null \
SERVER=172.31.9.115 DC_SERVER=w2025p-115.w2025p-l8.base \
DOMAIN="W2025P-L8" REALM="W2025P-L8.BASE" \
ADMIN_USERNAME="Administrator" ADMIN_PASSWORD="A1b2C3d4" \
NETLOGON_STRONG_KEY_SUPPORT=1 NETLOGON_AUTH_KRB5_SUPPORT=1 \
STRICT_CHECKING=0 python/samba/tests/krb5/netlogon.py

The code still works against Windows 2022 with the
following options:

SMB_CONF_PATH=/dev/null \
SERVER=172.31.9.118 DC_SERVER=w2022-118.w2022-l7.base \
DOMAIN="W2022-L7" REALM="W2022-L7.BASE" \
ADMIN_USERNAME="Administrator" ADMIN_PASSWORD="A1b2C3d4" \
NETLOGON_STRONG_KEY_SUPPORT=1 NETLOGON_AUTH_KRB5_SUPPORT=0 \
STRICT_CHECKING=0 python/samba/tests/krb5/netlogon.py

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopycredentials: add py_netlogon_creds_kerberos_init
Stefan Metzmacher [Fri, 22 Nov 2024 14:31:15 +0000 (15:31 +0100)] 
pycredentials: add py_netlogon_creds_kerberos_init

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopython:tests/krb5: let netlogon.py test strong key without arcfour
Stefan Metzmacher [Tue, 26 Nov 2024 17:51:07 +0000 (18:51 +0100)] 
python:tests/krb5: let netlogon.py test strong key without arcfour

It shows that there's no encryption on buffers...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agolibcli/auth: add infrastructure for netr_ServerAuthenticateKerberos()
Stefan Metzmacher [Tue, 29 Oct 2024 17:02:19 +0000 (18:02 +0100)] 
libcli/auth: add infrastructure for netr_ServerAuthenticateKerberos()

This shows that STRONG_KEY without ARCFOUR means no encryption
for ServerPasswordSet2.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agolibcli/auth: add let netlogon_creds_alloc() use _talloc_keep_secret()
Stefan Metzmacher [Wed, 11 Dec 2024 09:14:44 +0000 (10:14 +0100)] 
libcli/auth: add let netlogon_creds_alloc() use _talloc_keep_secret()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agoldb: Add LGPLv3 LICENSE file
Andreas Schneider [Wed, 11 Dec 2024 08:47:46 +0000 (09:47 +0100)] 
ldb: Add LGPLv3 LICENSE file

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15729

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
8 months agotdb: Add LGPLv3 LICENSE file
Andreas Schneider [Wed, 11 Dec 2024 08:47:24 +0000 (09:47 +0100)] 
tdb: Add LGPLv3 LICENSE file

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15729

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
8 months agotevent: Add LGPLv3 LICENSE file
Andreas Schneider [Wed, 11 Dec 2024 08:45:33 +0000 (09:45 +0100)] 
tevent: Add LGPLv3 LICENSE file

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15729

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
8 months agotalloc: Add LGPLv3 LICENSE file
Andreas Schneider [Wed, 11 Dec 2024 08:44:48 +0000 (09:44 +0100)] 
talloc: Add LGPLv3 LICENSE file

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15729

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
8 months agos4:rpc_server: make use of dcesrv_assoc_group_common_destructor()
Stefan Metzmacher [Wed, 11 Dec 2024 16:24:19 +0000 (17:24 +0100)] 
s4:rpc_server: make use of dcesrv_assoc_group_common_destructor()

Currently this should not be needed, but it's better to
call dcesrv_assoc_group_common_destructor() in all assoc_group
destructors.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Dec 12 07:22:29 UTC 2024 on atb-devel-224

8 months agos3:rpc_server: make use of dcesrv_assoc_group_common_destructor()
Stefan Metzmacher [Wed, 11 Dec 2024 16:24:19 +0000 (17:24 +0100)] 
s3:rpc_server: make use of dcesrv_assoc_group_common_destructor()

We need to detach dcesrv_iface_state from dcesrv_assoc_group,
if dcesrv_assoc_group is free'ed first.

Typically this doesn't happen, but it does when
rpc_worker_connection_terminated explicitly calls
talloc_unlink(conn, conn->assoc_group)
and dcesrv_iface_state_store_conn() is used.

But we better do it in all assoc_group destructors.

==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778
READ of size 8 at 0x50d000004f80 thread T0
    #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166
    #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080
    #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764
    #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360
    #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115

0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98)
freed by thread T0 here:
    #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222
    #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473
    #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143
    #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175
    #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234

previously allocated by thread T0 here:
    #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783
    #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825
    #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982
    #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421
    #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681
    #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730
    #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158
    #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324
    #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222
    #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489
    #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558
    #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343
    #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371
    #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431
    #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144
    #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426
    #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316
    #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agodcesrv_core: add dcesrv_assoc_group_common_destructor()
Stefan Metzmacher [Wed, 11 Dec 2024 16:21:06 +0000 (17:21 +0100)] 
dcesrv_core: add dcesrv_assoc_group_common_destructor()

We need to detach dcesrv_iface_state from dcesrv_assoc_group,
if dcesrv_assoc_group is free'ed first.

==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778
READ of size 8 at 0x50d000004f80 thread T0
    #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166
    #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080
    #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764
    #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360
    #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115

0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98)
freed by thread T0 here:
    #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222
    #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473
    #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143
    #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175
    #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234

previously allocated by thread T0 here:
    #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783
    #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825
    #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982
    #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421
    #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681
    #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730
    #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158
    #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324
    #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222
    #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489
    #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558
    #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343
    #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371
    #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431
    #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144
    #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426
    #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316
    #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agosamba-tool/backup: set the right permissions on our root dir
Björn Jacke [Tue, 15 Oct 2024 09:43:58 +0000 (11:43 +0200)] 
samba-tool/backup: set the right permissions on our root dir

Since processes can run under the UID of the logged in user, it's required
to make sure that the users have the permissions here.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Björn Baumbach <bbaumbach@samba.org>
Autobuild-User(master): Björn Baumbach <bb@sernet.de>
Autobuild-Date(master): Tue Dec 10 11:40:27 UTC 2024 on atb-devel-224

8 months agodocs-xml: Change 'DEBUGLEVEL' -> 'level' to match the option description
Pavel Filipenský [Thu, 5 Dec 2024 16:54:07 +0000 (17:54 +0100)] 
docs-xml: Change 'DEBUGLEVEL' -> 'level' to match the option description

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Fri Dec  6 13:33:38 UTC 2024 on atb-devel-224

8 months agodocs-xml: Fix manpage section generated by cmdline.common.debug.server
Pavel Filipenský [Thu, 5 Dec 2024 16:36:49 +0000 (17:36 +0100)] 
docs-xml: Fix manpage section generated by cmdline.common.debug.server

man winbinbdd.8 is wrongly mixing two options:

before fix:
       -d|--debuglevel=DEBUGLEVEL, --debug-stdout
...

after fix:
       -d|--debuglevel=DEBUGLEVEL
...
       --debug-stdout

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
8 months agos4:rpc_server/netlogon: fix error codes in dcesrv_netr_NetrLogonSendToSam
Stefan Metzmacher [Mon, 25 Nov 2024 17:25:52 +0000 (18:25 +0100)] 
s4:rpc_server/netlogon: fix error codes in dcesrv_netr_NetrLogonSendToSam

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Dec  5 17:46:49 UTC 2024 on atb-devel-224

8 months agos4:rpc_server/netlogon: implement dcesrv_netr_ServerPasswordGet()
Stefan Metzmacher [Mon, 25 Nov 2024 17:12:22 +0000 (18:12 +0100)] 
s4:rpc_server/netlogon: implement dcesrv_netr_ServerPasswordGet()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos4:selftest: run samba.tests.krb5.netlogon
Stefan Metzmacher [Fri, 22 Nov 2024 23:24:34 +0000 (00:24 +0100)] 
s4:selftest: run samba.tests.krb5.netlogon

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopython:tests/krb5: add netlogon.py
Stefan Metzmacher [Fri, 8 Nov 2024 16:08:26 +0000 (17:08 +0100)] 
python:tests/krb5: add netlogon.py

This adds tests for the application layer encryption used
based on the secure channel session key.

This will get tests for netr_ServerAuthenticateKerberos()
in order to explore its details.

This runs against Windows 2022 as well as Windows 2025 (preview)
using something like this:

SMB_CONF_PATH=/dev/null \
SERVER=172.31.9.118 DC_SERVER=w2022-118.w2022-l7.base \
DOMAIN="W2022-L7" REALM="W2022-L7.BASE" \
ADMIN_USERNAME="Administrator" ADMIN_PASSWORD="A1b2C3d4" \
STRICT_CHECKING=0 \python/samba/tests/krb5/netlogon.py

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopython:tests/krb5: avoid some problems when running against w2025 (preview) with...
Stefan Metzmacher [Thu, 21 Nov 2024 14:57:41 +0000 (15:57 +0100)] 
python:tests/krb5: avoid some problems when running against w2025 (preview) with STRICT_CHECKING=0

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopython:tests/krb5: remember the objectGUID of created accounts
Stefan Metzmacher [Thu, 21 Nov 2024 17:10:18 +0000 (18:10 +0100)] 
python:tests/krb5: remember the objectGUID of created accounts

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopycredentials: add credentials.netlogon_creds_*() functions via py_module_methods
Stefan Metzmacher [Mon, 18 Nov 2024 18:26:30 +0000 (19:26 +0100)] 
pycredentials: add credentials.netlogon_creds_*() functions via py_module_methods

This makes it possible to explore the functions arround
netlogon_creds_CredentialState via python.

This allows us to write tests in order to explore
the details of netr_ServerAuthenticateKerberos().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopycredentials: add creds.[g|s]et_netlogon_creds()
Stefan Metzmacher [Mon, 18 Nov 2024 17:49:40 +0000 (18:49 +0100)] 
pycredentials: add creds.[g|s]et_netlogon_creds()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopycredentials: remove unused module methods
Stefan Metzmacher [Mon, 18 Nov 2024 17:03:24 +0000 (18:03 +0100)] 
pycredentials: remove unused module methods

It's not useful to use the PyCredentials methods
also as module methods...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agopyrpc_util: fix error Exception message in py_check_dcerpc_type()
Stefan Metzmacher [Tue, 19 Nov 2024 14:55:30 +0000 (15:55 +0100)] 
pyrpc_util: fix error Exception message in py_check_dcerpc_type()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos4:rpc_server/netlogon: let dcesrv_netr_LogonSamLogon_base_reply handle encryption...
Stefan Metzmacher [Fri, 15 Nov 2024 16:12:52 +0000 (17:12 +0100)] 
s4:rpc_server/netlogon: let dcesrv_netr_LogonSamLogon_base_reply handle encryption errors

This might be the better option when we implement
netr_ServerAuthenticateKerberos().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agolibcli/auth: let netlogon_creds_crypt_samlogon_validation handle generic info
Stefan Metzmacher [Mon, 18 Nov 2024 18:50:22 +0000 (19:50 +0100)] 
libcli/auth: let netlogon_creds_crypt_samlogon_validation handle generic info

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agotests/krb5: make use of conn.auth_info() in _test_samlogon()
Stefan Metzmacher [Mon, 11 Nov 2024 22:27:05 +0000 (23:27 +0100)] 
tests/krb5: make use of conn.auth_info() in _test_samlogon()

In future we'll have KRB5 instead of SCHANNEL...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos4:pyrpc: add conn.auth_info()
Stefan Metzmacher [Mon, 11 Nov 2024 22:20:52 +0000 (23:20 +0100)] 
s4:pyrpc: add conn.auth_info()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agogensec: add GENSEC_FEATURE_NO_DELEGATION flag to avoid GSS_C_DELEG[_POLICY]_FLAG
Stefan Metzmacher [Wed, 6 Nov 2024 13:29:10 +0000 (14:29 +0100)] 
gensec: add GENSEC_FEATURE_NO_DELEGATION flag to avoid GSS_C_DELEG[_POLICY]_FLAG

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos3:cli_pipe: pass target_service to cli_rpc_pipe_open_with_creds()
Stefan Metzmacher [Wed, 6 Nov 2024 13:16:27 +0000 (14:16 +0100)] 
s3:cli_pipe: pass target_service to cli_rpc_pipe_open_with_creds()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos3:libads: add kerberos_kinit_passwords_ext() helper
Stefan Metzmacher [Wed, 25 Sep 2024 14:02:02 +0000 (16:02 +0200)] 
s3:libads: add kerberos_kinit_passwords_ext() helper

This can check more than one password and is designed to
support getting a TGT for our machine account also falling
back to older passwords...

If we don't have a plaintext password it falls back to an nt_hash.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos3:libads: split out kerberos_kinit_generic_once()
Stefan Metzmacher [Thu, 12 Sep 2024 18:53:14 +0000 (20:53 +0200)] 
s3:libads: split out kerberos_kinit_generic_once()

This can be used to kinit with a keyblock later
and also a loop over multiple password generations will
be possible.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
8 months agos3:libads: remove unused time_offset from kerberos_kinit_password()
Stefan Metzmacher [Thu, 12 Sep 2024 17:56:05 +0000 (19:56 +0200)] 
s3:libads: remove unused time_offset from kerberos_kinit_password()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>