Jeremy Allison [Fri, 22 Aug 2008 20:49:46 +0000 (13:49 -0700)]
Don't re-initialize a token when we already have one. This fixes the build farm failures when winbindd connects as guest.
This one took a *lot* of tracking down :-).
Jeremy.
Fix segv when talking to parent DC (joined to child domain).
The root cause was
(a) storing the parent domain in the cli_state struct caused
the NTLMSSP pipe bind to fail which made us fallover to
the schannel code path
(b) the dcinfo pointer in cm_get_schannel_dcinfo() was returning
NULL even though the function indicated success.
Jeff Layton [Fri, 22 Aug 2008 17:29:16 +0000 (13:29 -0400)]
cifs.upcall: bump SPNEGO msg version number and don't reject old versions
When we added the ability for the kernel to send sec=mskrb5 to the
upcall, we subtly broke old cifs.upcall versions that don't understand
it. Bump the spnego message version to 2 to make this clear. Also,
change cifs.upcall to not reject requests with a version that's lower
than the current one, and to send the reply with the same version that
the request sent. The idea is to try and keep cifs.upcall backward
compatible with old kernels.
Jeff Layton [Mon, 18 Aug 2008 17:49:59 +0000 (13:49 -0400)]
cifs.upcall: move default install location to EPREFIX/sbin
cifs.upcall links to libraries that live under /usr, so installing it
in /sbin doesn't seem appropriate. Move it to EPREFIX/sbin instead
(i.e. /usr/sbin).
Jeff Layton [Wed, 20 Aug 2008 01:29:41 +0000 (21:29 -0400)]
cifs.upcall: handle MSKRB5 OID properly
When the kernel sends the upcall a sec=mskrb5 parameter, that means
the the MSKRB5 OID is preferred by the server. This patch fixes the
upcall to use that OID in place of the "normal" krb5 OID when it
gets a sec=mskrb5 parameter.
Signed-off-by: Jeff Layton <jlayton@redhat.com> Acked-by: Steve French <smfrench@gmail.com>
Jeremy Allison [Wed, 20 Aug 2008 23:24:22 +0000 (16:24 -0700)]
Here is a re-working of the winbindd
reconnect code to cope with rebooting a DC. This
replaces the code I asked Volker to revert.
The logic is pretty simple. It adds a new parameter,
"winbind reconnect delay", set to 30 seconds by
default, which determines how long to wait between
connection attempts.
To avoid overwhelming the box with DC-probe
forked children, the code now keeps track of
the DC probe child per winbindd_domain struct
and only starts a new one if the existing one
has died.
I also added a little logic to make sure the
dc probe child always sends a message whatever
the reason for exit so we will always reschedule
another connect attempt.
Also added documentation.
Jeremy.
smbd: fix the handling of create_options to pass RAW-OPEN
Some of the bits generate INVALID_PARAMETER and some bits
are ignored when they come from a client, that's why we need
to use bits from the ignored range for our internal usage.
Steven Danneman [Tue, 19 Aug 2008 18:05:07 +0000 (11:05 -0700)]
Updated Doxyfile conf to doxygen version 1.5.3
* Removed deprecated configuration parameters
* Silenced all warnings due to lack of doxygen comments
* Reordered config parameters to match doxygen's canonical ordering
Jeremy Allison [Sun, 17 Aug 2008 02:23:38 +0000 (19:23 -0700)]
Fix bug 5696. The problem was when smbd
was asking for a winbindd name to SID lookup of
"Unix Group\name" where "name" was also a valid username,
the winbindd passdb lookup of that name was losing the
domain string info before calling lookup name (ie. lookup_name()
was being called with just the string "name", not the
full string "Unix Group\name").
The passdb backend of winbindd has to cope with
not only names from it's own global SAM domain,
but it does lookups for BUILTIN and "Unix User"
and "Unix Group" also, so making it guess by
losing the domain string is "A Bad Idea" (tm) :-).
Note that as winbind globally calls winbind_off()
at startup, it's safe for winbind to call sys_getgrnam()
to do the "Unix Group" lookup from inside lookup_name().
Herb Lewis [Fri, 15 Aug 2008 22:28:23 +0000 (15:28 -0700)]
I think the problem with these functions is that lookup_usergroups
should never include the user SID.
The comment for the function in winbindd/winbindd_ads.c says
/* Lookup groups a user is a member of. */
The following patch makes the wbinfo calls return the correct data
before and after a login.
wbinfo --user-domgroups and --user-sids
Michael Adam [Fri, 15 Aug 2008 12:38:41 +0000 (14:38 +0200)]
configure: use ${libdir} instead of \${LIBDIR}.
Now after removing --with-libdir, the value of ${libdir} won't change
anymore at that stage, so there is no need to have the variable expansion
deferred to "make".
Michael Adam [Thu, 14 Aug 2008 22:36:49 +0000 (00:36 +0200)]
configure: Add --with-modulesdir to accompany --with-libdir.
This starts the seplitting of libdir in to libdir and modulesdir.
Our shared libs should go into libdir, the internal shared modules,
codepages, and other stuff that was originally in libdir, should
go into modulesdir.
The idea behind this is, that in a typical installation,
the shared (and static) libraries (as libtalloc, libsmbclient,
libwbclient and others) should be put into /usr/lib, while
the e.g. the vfs modules should reside in /usr/lib/samba.
This is meant to ease the work of packagers and reduce
the needs for manual interaction and workarounds.
Jeremy Allison [Fri, 15 Aug 2008 04:52:11 +0000 (21:52 -0700)]
Fix show-stopper for 3.2. Smbd depends on group SID
position zero being the primary group sid. Authenicating
via winbindd call returned a non-sorted sid list. This
fixes is for both a winbindd call and a pac list from
an info3 struct. Without this we mess up the
primary group associated with created files. Found by
Herb.
Jeremy.
Jeremy Allison [Thu, 14 Aug 2008 17:58:50 +0000 (10:58 -0700)]
Fix bug #5692 - Core dump in full_audit.so.
There were some function mismatches in the various GET_NT_ACL modules (some places the fsp parameter has not been removed).
Jeremy.
Jeremy Allison [Wed, 13 Aug 2008 23:45:34 +0000 (16:45 -0700)]
Fix for bug #5688 from SATOH Fumiyasu <fumiyas@osstech.co.jp>. LPQ process is orphaned if socket address parameter is invalid.
If the "socket address" parameter is a null string that is an invalid value for Samba 3.2 but valid for Samba 3.0.
Jeremy.
Jeremy Allison [Wed, 13 Aug 2008 22:46:35 +0000 (15:46 -0700)]
Fix for bug #5617, reported and patched by Bartosz Antosik antosik@gmail.com.
xp/2003 explorer freezes browsing shares on samba ipv6 hosts. Caused by missing
reply packet to SMB printclose packet.
Jeremy
Jim McDonough [Wed, 13 Aug 2008 22:03:51 +0000 (18:03 -0400)]
Prevent NT_STATUS 0xF1000000 errors from appearing when
dos errors are used and there is no error. It should
be mapped directly to NT_STATUS_OK. smbclient to older
servers didn't work.
projects / thirdparty / samba.git / log
