Simo Sorce [Thu, 26 Apr 2012 16:27:05 +0000 (12:27 -0400)]
s4-auth-krb: smb_rd_req_return_stuff is used only in gensec_krb5
Make it clearly a gensec_krb5 accessory file.
This function should never be used anywhere else.
This function was copied out from the Heimdal tree and is kept in a separate
file for clarity and to keep the original license boilerplate.
Simo Sorce [Thu, 26 Apr 2012 16:06:24 +0000 (12:06 -0400)]
Split normal kinit from s4u2 flavored kinit
This makes it simpler to slowly integrate MIT support and also amkes it
somewhat clearer what operation is really requested.
The 24u2 part is really only used by the cifs proxy code so we can temporarily
disable it in the MIT build w/o major consequences.
s4:samldb LDB module - make sure to not add identical "servicePrincipalName"s more than once
The service principal names need to be case-insensitively unique, otherwise we
end up in a LDB ERR_ATTRIBUTE_OR_VALUE_EXISTS error.
This issue has been discovered on the technical mailing list (thread:
cannot rename windows xp machine in samba4) when trying to rename a AD
client workstation.
Andrew Bartlett [Wed, 2 May 2012 06:05:25 +0000 (16:05 +1000)]
s4-s3upgrade: Force ldapsam:trusted = yes
While this setting is not the default in Samba3, any domain that is
in a suitable condition to upgrade to Samba4 should already be in the
layout that ldapsam:trusted uses. It can be turned off by setting
ldapsam:trusted=false in the smb.conf.
Many upgrades to Samba4 happen on a different host to the old Samba3 domain
and this avoids the need to configure nss_ldap only for the duration of
the upgrade.
Andrew Bartlett [Wed, 2 May 2012 03:01:29 +0000 (13:01 +1000)]
s4-s3upgrade: Try harder to get group memberships on upgrade
This fixes an issue where some group types were not upgraded, as we
did not upgrade alias memberships.
It also uses enum_group_memberships() to try and find the memberships
from the other direction, by asking which groups a user is a member
of. As Samba3 (and NT4) does not implement nested groups, this should
be safe.
Andrew Bartlett [Wed, 2 May 2012 02:57:27 +0000 (12:57 +1000)]
s3-pypassdb: add wrapper for enum_group_memberships
This will be used in samba3upgrade to try and get the group memberships by instead asking
for the groups each user is in. This reverse lookup may be more reliable, as this
is used at login time.
Michael Adam [Wed, 2 May 2012 16:09:48 +0000 (18:09 +0200)]
s4:torture:rpc: add a new test samba3.smb2-pipe-read-logoff
- open a pipe via smb2
- trigger a read which hangs since there is nothing to read
- do a logoff
- wait for the read to return and check the status
(STATUS_PIPE_BROKEN)
Autobuild-User: Michael Adam <obnox@samba.org>
Autobuild-Date: Wed May 2 19:57:45 CEST 2012 on sn-devel-104
Michael Adam [Wed, 2 May 2012 16:03:33 +0000 (18:03 +0200)]
s4:torture:rpc: add a new test samba3.smb2.pipe-read-tdis
- open a pipe via smb2
- trigger a read which hangs since there is nothing to read
- do a tree disconnect
- wait for the read to return and check the status
(STATUS_PIPE_BROKEN)
Michael Adam [Wed, 2 May 2012 12:25:58 +0000 (14:25 +0200)]
s4:torture:rpc: add a test samba3.smb2-pipe-read-close
* open a pipe via smb2
* trigger a read which hangs since there is nothing to read
* close the pipe file handle
* wait for the read to reaturn and check the status
(NT_STATUS_PIPE_BROKEN)
Andrew Bartlett [Sat, 21 Apr 2012 00:22:35 +0000 (10:22 +1000)]
s3-passdb: Add extra debug on ID mapping failures
Signed-off-by: Michael Adam <obnox@samba.org>
Autobuild-User: Michael Adam <obnox@samba.org>
Autobuild-Date: Wed May 2 15:34:13 CEST 2012 on sn-devel-104
Andrew Bartlett [Fri, 23 Mar 2012 10:01:01 +0000 (21:01 +1100)]
s3-idmap: Rework idmap_cache to store ID_TYPE_BOTH values
This required that the lower level cache store a UID/GID and a type, and that
we operate on struct unixid rather than just uid/gid.
The ID_TYPE_BOTH is then handled as being a positive mapping for both
a UID and GID value. Wrapper functions are provided so that callers are not
changed in this patch.
Andrew Bartlett [Tue, 1 May 2012 23:49:19 +0000 (09:49 +1000)]
testsuite/libsmbclient: Remove unused and expensive-to-link testsuite
This testsuite never got off the ground, and unlike the other
libsmbclient tests, it is not integrated into make test, has no driver
script we could integrate.
As it has been in this state for 10 years, and adding it to the compile
did not find any link-time issues (particularly in comparison to the
link-time cost for so many individual binaries), I am now removing them.
The libsmbclient examples are seperate to this, and remain in
examples/libsmbclient.
Andrew Bartlett [Tue, 1 May 2012 23:38:39 +0000 (09:38 +1000)]
s4-provision: set 'dcerpc endpoint servers' but not 'vfs objects'
The VFS objects are now set in the fileserver.conf, but this is only read by smbd, so
the provision-time smb.conf needs to turn off the extra Samba4 DCE/RPC services.
Andrew Bartlett [Tue, 17 Apr 2012 01:56:23 +0000 (11:56 +1000)]
selftest: Enable ACL testing against the s3dc environment
Previously, ACL tests were skipped and the correct modules for ACL
testing were not loaded.
The addition of a knownfail entry for raw.samba3* tests is due to an
inconsitancy between the behaviour with and without ACL modules loaded
- posix chown calls appear to be ignored in this mode.
Andrew Bartlett [Tue, 1 May 2012 07:13:34 +0000 (17:13 +1000)]
s3-smbd: Use security_session_user_level() rather than nt_token_check_sid()
This allows the unix.whoami test to pass when configured as part of the AD DC.
The struct auth_session_info is slightly different in the AD DC configuration
when using auth_samba4. In particular, there is a distinction between Guest
and Anonymous logins.
Jeremy Allison [Mon, 30 Apr 2012 18:05:51 +0000 (11:05 -0700)]
Fix the loop unrolling inside resolve_ads(). If we don't get
an IP list don't use interpret_string_addr(), as this only
returns one address, use interpret_string_addr_internal()
instead.
Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Mon Apr 30 23:21:16 CEST 2012 on sn-devel-104
First they do not need to be "static" any longer since we have abandoned
asynchronous result handling (where global variables have been important).
In addition add some "const" in order to protect us from unwanted writes.
Reviewed-by: Andrew Bartlett
Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Mon Apr 30 16:46:20 CEST 2012 on sn-devel-104
projects / thirdparty / samba.git / log
