Michael Adam [Wed, 26 Nov 2008 22:09:49 +0000 (23:09 +0100)]
s3:winbindd/idmap_ad: add support for trusted domains to idmap_ad (bug #3661)
This initial fix does at least work for explicitly configured domains.
The patch has a few disadvantages:
1. It does work only for explicitly configured domains, not with
the default backend (idmap backend = ad), since it relies on the
domain name being passed in via the idmap_domain. One workaround
for this would be to create clones of the default idmap_domain
for domains not explicitly configured.
2. It calls find_domain_from_name_noinit() from idmap_ad_cached_connection.
The problem here is that only the NetBIOS domain name (workgroup
name) is passed in via the idmap_domain struct, and the module
has to establish a connection to the domain based on that information.
find_domain_from_name_noinit() has the disadvantage that it uses the state
of the domain list at fork time (unless used from the main winbindd).
But this should be ok as long as the primary domain was reachable at
start time.
For nss_info, the situation is similar - This will only work for domains
explicitly configured in smb.conf as follows:
"winbind nss info = rfc2307:dom1 sfu:dom2 rfc2307:dom3 template:dom4"
Setting the default nss info to one of the ad backends (rfc2307, sfu, sfu20)
will fail since the domain name is not passed in with the nss_domain_entry.
Volker Lendecke [Sat, 8 Nov 2008 16:08:57 +0000 (17:08 +0100)]
Consolidate the buffer checks for the reply_trans style functions
This is the one where I found the problem that led to 3.2.5. So if there is one
checkin in the last year that I would like others to review and *understand*,
it is this one :-)
Volker Lendecke [Sat, 8 Nov 2008 15:14:12 +0000 (16:14 +0100)]
Remove the variable "size" from reply_nttrans
This converts the range checks for the setup[] array to rely on req->wct being
set correctly in init_smb_request. As that already verifies the vwv array to be
in the range of the smb_request inbuf, we don't have to do overflow checks here
anymore.
Volker Lendecke [Sat, 8 Nov 2008 15:14:12 +0000 (16:14 +0100)]
Remove the variable "size" from reply_trans
This converts the range checks for the setup[] array to rely on req->wct being
set correctly in init_smb_request. As that already verifies the vwv array to be
in the range of the smb_request inbuf, we don't have to do overflow checks here
anymore.
Mathias Dietz [Wed, 12 Nov 2008 13:32:45 +0000 (14:32 +0100)]
Search for gpfs functions in both libgpfs_gpl.so an libgpfs.so
As of GPFS 3.2.1 PTF8 libgpfs will be available as GPL, so we don't need the
special libgpfs_gpl lib anymore. For backwards compatibility with pre-PTF8 GPFS
installations, still look there.
If no DACL/SACL is present in the packet, the SEC_INFO field should still be
passed down as is to the VFS layer to signal the creation of a NULL DACL/SACL.
As seen in metze RAW-ACL test_nttrans_create_null_dacl(), a NULL DACL is set
regardless of the SEC_DESC_DACL_PRESENT bit being set.
Michael Adam [Sun, 23 Nov 2008 00:59:30 +0000 (01:59 +0100)]
s3 build: when detecting to use internal zlib, put "-I../lib/zlib" first in CFLAGS
This should fix a build error on our Tru64 build farm box where a zlib.h is
found in an include path handed in via external CFLAGS, but that zlib.h belongs
to an old zlib. So in ndr_compression.c, "#include <zlib.h>" includes the wrong
header for the internal zlib.
Michael Adam [Sat, 22 Nov 2008 22:25:14 +0000 (23:25 +0100)]
s3 build: don't specify ZLIB_LIBS (i.e. "-lz") in object collections.
This causes make to fail on at least HP-UX and MacOS X with message
"no rule to make target -lz" or similar, when these object collections
are specified in dependencies.
Jeremy Allison [Sat, 22 Nov 2008 06:48:37 +0000 (22:48 -0800)]
Rever 83ff6979f504d50caf725ee62549604630b69be7 - "Fix the logic bug that caused us to
run into kernel oplocks on an open for a stream inside a file with stream_xattr module. On
opening the base_fsp we must break existing oplocks." as it broke make test.
Jeremy.
Jeremy Allison [Sat, 22 Nov 2008 02:20:38 +0000 (18:20 -0800)]
Fix the logic bug that caused us to run into kernel oplocks on an open for a stream inside a file with stream_xattr module. On opening the base_fsp we must break existing oplocks.
Jeremy.
Michael Adam [Fri, 21 Nov 2008 01:26:50 +0000 (02:26 +0100)]
s3-winbindd_ads: use the reconnect methods instead of the rpc methods directly
Some of the ads methods just point to the rpc methods.
This makes winbindd_ads use the reconnect methods instead of
calling the rpc methods directly in order to prevent
negative cache entries for e.g. name_to_sid, when the dc
has closed the connection without sending a reset.
Michael Adam [Thu, 20 Nov 2008 15:57:44 +0000 (16:57 +0100)]
s3-winbindd_ads: prevent negative GM/ cache entries due to broken connections
The ads lookup_groupmem() function calls lda_lookupsids to resolve sids
to names. This is tried only once. So in case the connection was broken,
e.g. closed by the server (without a reset packet), there will be an empty
GM/ cache entry for the requested group which will prevent proper working
of access checks among other checks for the expiry period.
This patch works around this problem by retrying once if the lsa_lookupsids
call fails, re-establishing the dc-connection, as we already do in many other
places (e.g. the winbindd retry methods for the rpc layer).
projects / thirdparty / samba.git / log
