Ralph Boehme [Thu, 21 Apr 2016 18:55:36 +0000 (20:55 +0200)]
krb5_wrap: fix keep_old_entries logic in smb_krb5_kt_seek_and_delete_old_entries()
This fixes an regression introduced in 5c5d586d3ebd40 at a higher level
in the caller smb_krb5_kt_add_entry(): calling smb_krb5_kt_add_entry
with keep_old_entries=false resulted in only one enctype per principal
remaining in the exported keytab.
The function smb_krb5_kt_seek_and_delete_old_entries() is called from
smb_krb5_kt_add_entry() when adding keys to a keytab. When the keytab
contains keys with the same kvno as the key to be added and
keep_old_entries is false, the key is deleted without checking the
encryption type of the key. This means that when adding keys for a
principal only the last enctype will be in the exported keytab.
Fix this by checking the encryption type and only treat a key as "old"
if keytab_key_kvno <= new_key_kvno and keytab_key_enctype ==
new_key_enctype.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Martin Schwenke [Wed, 20 Apr 2016 05:19:45 +0000 (15:19 +1000)]
ctdb-scripts: Improve error messages when using NFS service_check_cmd
When external monitoring is enabled for an NFS service using
service_check_cmd then $ctdb_check_rpc_out is empty because the
internal RPC checking isn't used. This results in empty log messages
like:
60.nfs: ERROR:
or:
60.nfs: WARNING:
Improve this so it at least says:
60.nfs: ERROR: monitoring service "statd" failed
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Sun Apr 24 03:25:27 CEST 2016 on sn-devel-144
ctdb-client: Set control opcode in reply for one-way controls
Some controls are fire-and-forget (CTDB_CTRL_FLAG_NOREPLY). Since there
is no reply received, the opcode in the ctdb_reply_control structure
never gets set.
Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
ctdb-client: Remove client functions related to server_id
These functions were used in the transaction code. These controls did
not use server_id structure defined in samba, so samba would not use them.
Instead check if the process exists for conflicting g_lock entry.
Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
ctdb-daemon: Remove unused controls related to server_id
These controls have never been used and also they do not use the server_id
structure defined in samba. In future, similar controls can be added to
register/unregister using proper server_id structure.
Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
ctdb-tests: Fix flakey test complex/18_ctdb_reloadips.sh
This test sets TakeoverTimeout=90 to avoid banning during takeover.
However, the setting is done on the test node instead of the recovery
master node. During "ctdb reloadips", the recovery master will used
the default value of TakeoverTimeout.
Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
Volker Lendecke [Fri, 4 Mar 2016 09:51:33 +0000 (10:51 +0100)]
pdb_ldap: Don't use autofree if "mods" still changes
This will prevent some use-after-free's, potentially it might for example fix
bugzilla 11851. Not directly related, but it's a crash related to ldap-backed
user creation.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Garming Sam [Wed, 20 Apr 2016 03:25:45 +0000 (15:25 +1200)]
dbcheck: Avoid pathological behaviour in operational module
Because replPropertyMetadata was repeated for every object in the
database, the attrs list became very long.
This single line saves 20% of the time for make test TESTS=dbcheck.
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Wed Apr 20 09:12:47 CEST 2016 on sn-devel-144
Uri Simchoni [Mon, 18 Apr 2016 20:08:38 +0000 (23:08 +0300)]
libads: record session expiry for spnego sasl binds
With the move to gensec-based spnego, record the session expiry
in tgs_expire, so that libads users such as winbindd can use this info
to determine how long to keep the connection.
Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Tue Apr 19 16:53:57 CEST 2016 on sn-devel-144
David Disseldorp [Mon, 18 Apr 2016 16:48:43 +0000 (18:48 +0200)]
printing: handle "printcap cache time" change on HUP
Reschedule the housekeeping event on SIGHUP and conf reload.
Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Apr 19 13:14:20 CEST 2016 on sn-devel-144
David Disseldorp [Mon, 18 Apr 2016 16:48:42 +0000 (18:48 +0200)]
printing: use housekeeping period that matches cache time
The printcap housekeeping callback is scheduled to run every 60 seconds,
and invokes pcap_cache_reload() to reload of the printcap cache *if* the
"printcap cache time" period has expired.
Given that pcap_cache_reload() invocation is the only job of the
housekeeping callback, it makes much more sense to schedule it every
"printcap cache time" seconds, rather than every 60 seconds.
Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Garming Sam [Wed, 13 Apr 2016 04:35:53 +0000 (16:35 +1200)]
tests/passwords: fix a typo
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Tue Apr 19 07:54:35 CEST 2016 on sn-devel-144
Andrew Bartlett [Fri, 12 Feb 2016 02:53:37 +0000 (15:53 +1300)]
dsdb: Only re-query dSHeuristics for userPassword support on modifies
We keep the database startup value for search behaviour, as to re-check
is too expensive. It caused every search to have an additional
search to the database.
We do not need to check as_system when setting ac->userPassword
as this is checked when all password attributes are stripped
As userPassword is not written to after fUserPwdSupport is set
we do not expose any data that was not already visible.
Garming Sam [Thu, 14 Apr 2016 22:45:05 +0000 (10:45 +1200)]
tests/rodc: Check that preload will skip broken users
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Apr 18 07:40:07 CEST 2016 on sn-devel-144
Martin Schwenke [Thu, 27 Aug 2015 03:22:49 +0000 (13:22 +1000)]
ctdb-scripts: Use ss instead of netstat for finding TCP connections
ss with a filter is much faster than post-processing output from
netstat. CTDB already has a hard dependency on iproute2 for IP
address handling, so depending on ss is no big deal.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Wed, 9 Mar 2016 22:12:33 +0000 (09:12 +1100)]
ctdb-scripts: Missing NFS thread count file should just produce warning
This currently causes monitor failure.
Log a warning instead. If there is a transient issue, such as NFS
being restarted in the background, then the thread count file should
be there the next time around so the count can be adjusted if
necessary.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Volker Lendecke [Sun, 27 Dec 2015 15:22:22 +0000 (16:22 +0100)]
winbind: Base idmap_ad on tldap
The main reason for this is to do proper connection management. I tried hard,
but I failed trying to slowly migrate the ads_struct based code to something
saner. So I polished tldap, which thanks to metze does proper sasl.
This patch is pretty much a complete rewrite, so looking at it in diff -u
format does not really make sense. Look at the final output.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Apr 15 19:13:39 CEST 2016 on sn-devel-144
Volker Lendecke [Tue, 12 Jan 2016 20:21:17 +0000 (21:21 +0100)]
winbind: handle DC_NOT_FOUND in wb_xids2sids
The idmap_ad child is designed to connect to domain controllers on
its own. Finding a DC is a nontrivial task that the child should not
do on its own, in particular it should not have to connect to "our"
DC's NETLOGON pipe separately. So when idmap_ad finds that it needs to
connect to a DC, it returns NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND. The
parent then asynchronously does the lookup and stores the DC info in
gencache. After that the parent re-does the idmap child call, during
which the child will find the DC-info in gencache.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 12 Jan 2016 20:21:17 +0000 (21:21 +0100)]
winbind: handle DC_NOT_FOUND in wb_sids2xids
The idmap_ad child is designed to connect to domain controllers on
its own. Finding a DC is a nontrivial task that the child should not
do on its own, in particular it should not have to connect to "our"
DC's NETLOGON pipe separately. So when idmap_ad finds that it needs to
connect to a DC, it returns NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND. The
parent then asynchronously does the lookup and stores the DC info in
gencache. After that the parent re-does the idmap child call, during
which the child will find the DC-info in gencache.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 29 Mar 2016 14:03:04 +0000 (16:03 +0200)]
idmap_ad: Separate out the nss functions
The nss functions technically right now are part of the idmap modules. However,
there is no intrinsic reason for this mixture of concerns. I would like to
heavily modify the idmap_ad idmapping functions without modifying the nss
functions (yet!!). So as a first step this patch moves the nss functions
textually out of the way.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Currently there is no signal handling available for notify daemon.
Signals like SIGHUP and SIGUSR1 can lead to terminate the notify
daemon. Masking these signals for notifyd as we are not handling them.
Martin Schwenke [Fri, 8 Apr 2016 06:21:08 +0000 (16:21 +1000)]
ctdb-scripts: Call out to ctdb_lvs helper from 91.lvs
To keep this commit comprehensible, 91.lvs and the CTDB CLI tool are
temporarily inconsistent. The tool will be made consistent in a
subsequent commit.
LVS now uses a configuration file specified by CTDB_LVS_NODES and
supports the same slave-only syntax as CTDB_NATGW_NODES. LVS also
uses new variable CTDB_LVS_PUBLIC_IFACE instead of
CTDB_PUBLIC_INTERFACE.
Update unit tests and documentation.
Note that the --lvs and --single-public-ip daemon options are no
longer used. These will be removed and relevant documentation
updated in a subsequent commit.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Basic error redirection improvements before writing tests.
Deleting the service during "startup" will usually fail because the
service has never been setup, so redirect output to avoid logging an
error.
Similarly, deleting the service in "ipreallocated" will always fail
the first time, which would cause an error to be logged. Given the
simplicity of the script, there's no sane way to avoid the error
sometimes and log it if it actually matters. This could potentially
be tidied up in the future by making 91.lvs stateful, in a similar way
to 11.natgw.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Noel Power [Wed, 13 Apr 2016 16:57:31 +0000 (17:57 +0100)]
s3:libsmb: Fix illegal memory access after memory has been deleted.
smbtorture with the libsmbclient test suite produces the following valgrind
trace
==31432== Invalid read of size 8
==31432== at 0x99B8858: smbc_free_context (libsmb_context.c:260)
==31432== by 0x5E6401: torture_libsmbclient_opendir (libsmbclient.c:136)
==31432== by 0x9553F42: wrap_simple_test (torture.c:632)
==31432== by 0x955366F: internal_torture_run_test (torture.c:442)
==31432== by 0x95538C3: torture_run_tcase_restricted (torture.c:506)
==31432== by 0x9553278: torture_run_suite_restricted (torture.c:357)
==31432== by 0x95531D7: torture_run_suite (torture.c:339)
==31432== by 0x25FEFF: run_matching (smbtorture.c:93)
==31432== by 0x260195: torture_run_named_tests (smbtorture.c:143)
==31432== by 0x261E14: main (smbtorture.c:665)
==31432== Address 0x18864a70 is 80 bytes inside a block of size 96 free'd
==31432== at 0x4C2A37C: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==31432== by 0x99BCC46: SMBC_closedir_ctx (libsmb_dir.c:922)
==31432== by 0x99C06CA: SMBC_close_ctx (libsmb_file.c:370)
==31432== by 0x99B8853: smbc_free_context (libsmb_context.c:259)
==31432== by 0x5E6401: torture_libsmbclient_opendir (libsmbclient.c:136)
==31432== by 0x9553F42: wrap_simple_test (torture.c:632)
==31432== by 0x955366F: internal_torture_run_test (torture.c:442)
==31432== by 0x95538C3: torture_run_tcase_restricted (torture.c:506)
==31432== by 0x9553278: torture_run_suite_restricted (torture.c:357)
==31432== by 0x95531D7: torture_run_suite (torture.c:339)
==31432== by 0x25FEFF: run_matching (smbtorture.c:93)
==31432== by 0x260195: torture_run_named_tests (smbtorture.c:143)
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Apr 14 13:24:10 CEST 2016 on sn-devel-144
s3:libads: sasl wrapped LDAP connections against with kerberos and arcfour-hmac-md5
This fixes a regression in commit 2cb07ba50decdfd6d08271cd2b3d893ff95f5af9
(s3:libads: make use of ads_sasl_spnego_gensec_bind() for GSS-SPNEGO with Kerberos)
that prevents things like 'net ads join' from working against a Windows 2003 domain.
CVE-2015-5370: s3:rpc_client: make use of pipe_auth_data->auth_context_id
This is better than using hardcoded values.
We need to use auth_context_id = 1 for authenticated
connections, as old Samba server (before this patchset)
will use a hardcoded value of 1.
projects / thirdparty / samba.git / log
