Swen Schillig [Wed, 5 Dec 2018 09:29:44 +0000 (10:29 +0100)]
Add MIT kerberos tracing capability
HEIMDAL kerberos offers already tracing via a logging facility
through smb_krb5_init_context().
MIT kerberos offers to register a callback via krb5_set_trace_callback
with which tracing information can be routed to a common logging facility.
This is now integrated into smb_krb5_init_context_basic() offering
the same functionality for both kerberos fragrances.
Signed-off-by: Bjoern Jacke <bj@sernet.de> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Wed Dec 19 20:58:52 CET 2018 on sn-devel-144
Samuel Cabrero [Thu, 6 Sep 2018 11:56:53 +0000 (13:56 +0200)]
tests/ntlm_auth: Port ntlm_auth_diagnostics tests to python
Port ntlm_auth_diagnostics bash script tests to python
Signed-off-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Noel Power <npower@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Wed Dec 19 16:21:32 CET 2018 on sn-devel-144
Samuel Cabrero [Fri, 31 Aug 2018 16:01:17 +0000 (18:01 +0200)]
tests/ntlm_auth: Port ntlm_auth tests to python: ntlm_auth with NTLMSSP gss-spnego-client and gss-spnego server against winbind with failed require-membership-of
Port ntlm_auth bash script tests to python
Signed-off-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Noel Power <npower@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Samuel Cabrero [Fri, 31 Aug 2018 15:46:59 +0000 (17:46 +0200)]
tests/ntlm_auth: Port ntlm_auth tests to python: ntlm_auth with NTLMSSP gss-spnego-client and gss-spnego server against winbind with require-membership-of
Port ntlm_auth bash script tests to python
Signed-off-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Noel Power <npower@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Samuel Cabrero [Fri, 31 Aug 2018 15:41:40 +0000 (17:41 +0200)]
tests/ntlm_auth: Port ntlm_auth tests to python: ntlm_auth against winbindd with require-membership-of
Port ntlm_auth bash script tests to python
Signed-off-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Noel Power <npower@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Noel Power <noel.power@suse.com>
Samuel Cabrero [Sat, 9 Dec 2017 09:44:15 +0000 (10:44 +0100)]
selftest: Add a new base class for ntlm_auth tests
The class is based on test_ntlm_auth.py script.
Signed-off-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Noel Power <npower@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-by: Andrew Bartlett <abartlet@samba.org>
Samuel Cabrero [Fri, 31 Aug 2018 10:44:09 +0000 (12:44 +0200)]
selftest: Create included files during provision
Files included from smb.conf have to exists, otherwise python fails to
load the configuration. Found while trying to run a python test before
samba3.blackbox.smbd_error creates the included file.
Signed-off-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Noel Power <npower@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
lib/krb5_wrap/enctype_convert.c:93:27: runtime error: left shift of 1 by
31 places cannot be represented in type 'int'
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Gary Lockyer <gary@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Dec 19 12:40:40 CET 2018 on sn-devel-144
Martin Schwenke [Fri, 14 Dec 2018 03:43:57 +0000 (14:43 +1100)]
lib/util: Count a trailing line that doesn't end in a newline
If the final line of a file does not contain a newline then it isn't
included in the line count.
Change i to point to the next slot in the array instead of the current
one. This means that that the current line won't be thrown away if no
newline is seen.
Without changing i to unsigned int, the -O3 --picky -developer build
fails with:
[ 745/4136] Compiling lib/util/util_file.c
==> /builds/samba-team/devel/samba/samba-o3.stderr <==
../../lib/util/util_file.c: In function ‘file_lines_parse’:
../../lib/util/util_file.c:251:8: error: assuming signed overflow does not occur when simplifying conditional to constant [-Werror=strict-overflow]
while (i > 0 && ret[i-1][0] == 0) {
^
cc1: all warnings being treated as errors
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Dec 19 08:08:28 CET 2018 on sn-devel-144
Swen Schillig [Tue, 18 Dec 2018 07:30:24 +0000 (08:30 +0100)]
s4: Remove double init of kerberos error table
The initialization of the kerberos error table
is already performed in smb_krb5_init_context_basic(),
therefore, it can be removed from of its callees.
Signed-off-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Dec 19 04:51:27 CET 2018 on sn-devel-144
Martin Schwenke [Tue, 18 Dec 2018 03:31:24 +0000 (14:31 +1100)]
ctdb-tests: Minimise chances of test interfering with itself
Checking that the database contains 0 records cause a traverse. This
may take a lock and cause vacuuming to fail (or be deferred for a
particular record/chain). Minimise the chance of this happening by
only checking for 0 records every 10 seconds.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Mon, 22 Oct 2018 10:40:22 +0000 (21:40 +1100)]
ctdb-daemon: Do not force full vacuum on first vacuuming run
When the number of fast path vacuuming runs is 0 then a full vacuuming
run is done. This means the first one is a full run, which is almost
certainly not what is intended.
Combine the 2 conditionals to only flag a full vacuuming run when the
count exceeds the configured limit. This means that the
full_vacuum_run flag is set in both parent and child, but this is
harmless... and is better than getting it wrong.
Also tweak the comparison to be less-than-or-equal, since the zeroth
run needs to be counted.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Tue, 18 Dec 2018 00:33:30 +0000 (11:33 +1100)]
ctdb-tool: Avoid data uninitialized warnings
../../tools/ctdb.c: In function 'str_to_data':
../../tools/ctdb.c:624: warning: 'data.dsize' may be used uninitialized in this function
../../tools/ctdb.c:624: warning: 'data.dptr' may be used uninitialized in this function
Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
Martin Schwenke [Thu, 8 Nov 2018 04:49:30 +0000 (15:49 +1100)]
ctdb-recoverd: Call an election when the recovery lock is lost
The lock may have been lost due to a failure in the underlying locking
mechanism. This could be due to quorum loss or similar. It is best
to call an election to confirm that this node should still be master.
At worst, the node will reelect itself, fail to take the lock and then
ban itself. This is a suitable outcome for a node that has been
partitioned from others in the cluster.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Thu, 15 Nov 2018 02:58:53 +0000 (13:58 +1100)]
ctdb-daemon: Divide by 2 when calculating hop count bucket
This provides finer resolution while still maintaining a reasonable
maximum. In this case the top bucket contains any hop counts
>= 16384, compared to the current situation where the top bucket contains
hop counts >= 268435456.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
for clients requesting leases we don't even try to acquire kernel
oplocks, because the kernel API is not compatible. Kernel oplocks are
per fd, leases are roughly "per inode".
We don't however special-case the LEASE_OPLOCK case in
release_file_oplock, leading to nasty error messages like "bad file
descriptor" on the fcntl(fd,F_SETLEASE,F_UNLCK) call. They are
harmless, but they raise eyebrows.
To simplify the if-condition, I factored out the kernel call and
applied early returns.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec 18 02:00:44 CET 2018 on sn-devel-144
Andrew Bartlett [Fri, 14 Dec 2018 01:49:03 +0000 (14:49 +1300)]
dsdb: sort DSDB_EXTENDED defines by OID
This helps avoid duplicate values and clearly indicates what value to select next.
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Dec 17 04:30:39 CET 2018 on sn-devel-144
Will [Wed, 8 Nov 2017 03:52:34 +0000 (21:52 -0600)]
Conditionally disable macOS incompatible tests
Symbols _getgrent_r and _getpwent_r in
source4/torture/local/nss_tests.c are undefined in macOS. It seems
that checking HAVE_GETGRENT_R and HAVE_GETPWENT_R and conditionally
disabling those tests as suggested by hirochachacha in the referenced
bug allows samba on both `master` and `samba-4.7.1` to build properly
on macOS/darwin.
Signed-off-by: Will Haley <willhy@gmail.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Rearrange sd_notify() call in become_daemon() to only send status to systemd
in this mode (Type=notify is not designed to monitor forking). Drop READY=0
(it does nothing) and MAINPID= (unnecessary because the process spawned by
systemd is already the main PID).
Also remove STATUS= prefix from debug messages.
Signed-off-by: Marcos Mello <marcosfrm@gmail.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Mon Dec 17 00:10:10 CET 2018 on sn-devel-144
Andrew Bartlett [Thu, 13 Dec 2018 08:02:24 +0000 (21:02 +1300)]
travis-ci: Remove hooks for Travis CI (typically used with GitHub)
These will get out of date pretty quickly, so better to remove them now
that GitLab CI is the documented and supported solution.
This was our first public CI system, used because it is cost-free
to Open Source projects and integrated with GitHub.
It has served it's purpose now.
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Dec 14 22:04:20 CET 2018 on sn-devel-144
Gary Lockyer [Thu, 13 Dec 2018 22:09:20 +0000 (11:09 +1300)]
dsdb audit_log: Add windows event codes to password changes
Add a new "eventId" element to the PasswordChange JSON log messages.
This contains a Windows Event Code Id either:
4723 Password changed
4724 Password reset
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Thu, 13 Dec 2018 01:46:31 +0000 (14:46 +1300)]
auth log: Add windows logon type codes
Add a new "logonType" element to the Authorisation JSON log messages.
This contains a Windows Logon Type, the supported logon types are:
2 Interactive
3 Network
8 NetworkCleartext
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Wed, 12 Dec 2018 21:20:28 +0000 (10:20 +1300)]
auth log: Add windows event codes
Add a new "eventId" element to the Authorisation JSON log messages.
This contains a Windows Event Code Id either:
4624 Successful logon
4625 Unsuccessful logon
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
The intention is to add Windows Event Codes to the JSON log messages, to
provide a common event identifier in mixed Windows and Samba networks.
And to assist security personnel with a windows background.
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Joe Guo [Wed, 12 Dec 2018 00:43:21 +0000 (13:43 +1300)]
PY3: change shebang to python3 in misc dirs
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Fri Dec 14 18:00:40 CET 2018 on sn-devel-144
Andrew Bartlett [Tue, 11 Dec 2018 18:10:30 +0000 (07:10 +1300)]
build: Move python detection back into waf (instead of in configure and Makefile)
This avoids creating a mini-configure in the configure script.
Users wishing to use python2 to build need to specify PYTHON=
to both ./configure and make
After we merged the python3 change, it became clear that relying on systems prefixing
the correct python just causes trouble and make debugging harder, so only use $PYTHON
for the override, not the default case
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Dec 14 14:32:25 CET 2018 on sn-devel-144
projects / thirdparty / samba.git / log
