Discussion:
[SCM] Samba Shared Repository - branch master updated
Garming Sam
2016-12-23 01:29:04 UTC
Permalink
The branch, master has been updated
via 77b51ba ldb_tdb: avoid erroneous error messages
via 5337791 dsdb: Parse linked attributes using their DN+Binary or DN+String syntax, if needed
via a18e115 ldbdump: Parse the -i option
from f7d249d s3:libsmb: Always use GENSEC_OID_SPNEGO in cli_smb1_setup_encryption_send()

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 77b51ba2f25e074bb57fb865d4fcf55243518568
Author: Garming Sam <***@catalyst.net.nz>
Date: Thu Dec 22 15:10:24 2016 +1300

ldb_tdb: avoid erroneous error messages

Signed-off-by: Garming Sam <***@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <***@catalyst.net.nz>

Autobuild-User(master): Garming Sam <***@samba.org>
Autobuild-Date(master): Fri Dec 23 02:28:54 CET 2016 on sn-devel-144

commit 53377917beeb18553904dc53b227ecf1745a5d1f
Author: Andrew Bartlett <***@samba.org>
Date: Wed May 20 11:06:22 2015 +0200

dsdb: Parse linked attributes using their DN+Binary or DN+String syntax, if needed

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Garming Sam <***@catalyst.net.nz>

commit a18e115ffe7f30282636824f074b77dc746d7fa6
Author: Garming Sam <***@catalyst.net.nz>
Date: Fri Dec 23 10:27:30 2016 +1300

ldbdump: Parse the -i option

Signed-off-by: Garming Sam <***@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <***@catalyst.net.nz>

-----------------------------------------------------------------------

Summary of changes:
lib/ldb/ldb_tdb/ldb_tdb.c | 2 +-
lib/ldb/tools/ldbdump.c | 2 +-
source4/dsdb/samdb/ldb_modules/linked_attributes.c | 26 ++++++++++++++++------
3 files changed, 21 insertions(+), 9 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/ldb/ldb_tdb/ldb_tdb.c b/lib/ldb/ldb_tdb/ldb_tdb.c
index 7cc0a2e..707d227 100644
--- a/lib/ldb/ldb_tdb/ldb_tdb.c
+++ b/lib/ldb/ldb_tdb/ldb_tdb.c
@@ -947,7 +947,7 @@ int ltdb_modify_internal(struct ldb_module *module,
if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE &&
control_permissive) {
ret = LDB_SUCCESS;
- } else {
+ } else if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
ldb_asprintf_errstring(ldb,
"attribute '%s': no matching attribute value while deleting attribute on '%s'",
msg->elements[i].name, dn);
diff --git a/lib/ldb/tools/ldbdump.c b/lib/ldb/tools/ldbdump.c
index 33f853d..c399b59 100644
--- a/lib/ldb/tools/ldbdump.c
+++ b/lib/ldb/tools/ldbdump.c
@@ -200,7 +200,7 @@ static void usage( void)
exit(1);
}

- while ((c = getopt( argc, argv, "hd:ec")) != -1) {
+ while ((c = getopt( argc, argv, "hd:eic")) != -1) {
switch (c) {
case 'h':
usage();
diff --git a/source4/dsdb/samdb/ldb_modules/linked_attributes.c b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
index 8063162..2016524 100644
--- a/source4/dsdb/samdb/ldb_modules/linked_attributes.c
+++ b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
@@ -172,28 +172,36 @@ static int la_guid_from_dn(struct ldb_module *module,
/* Common routine to handle reading the attributes and creating a
* series of modify requests */
static int la_store_op(struct la_context *ac,
- enum la_op op, struct ldb_val *dn,
+ enum la_op op,
+ const struct dsdb_attribute *schema_attr,
+ struct ldb_val *dn,
const char *name)
{
struct ldb_context *ldb;
struct la_op_store *os;
struct ldb_dn *op_dn;
+ struct dsdb_dn *dsdb_dn;
int ret;

ldb = ldb_module_get_ctx(ac->module);

- op_dn = ldb_dn_from_ldb_val(ac, ldb, dn);
- if (!op_dn) {
- ldb_asprintf_errstring(ldb,
- "could not parse attribute as a DN");
- return LDB_ERR_INVALID_DN_SYNTAX;
- }

os = talloc_zero(ac, struct la_op_store);
if (!os) {
return ldb_oom(ldb);
}

+ dsdb_dn = dsdb_dn_parse(os, ldb, dn, schema_attr->syntax->ldap_oid);
+
+ if (!dsdb_dn) {
+ ldb_asprintf_errstring(ldb,
+ "could not parse attribute as a DN");
+ TALLOC_FREE(os);
+ return LDB_ERR_INVALID_DN_SYNTAX;
+ }
+
+ op_dn = dsdb_dn->dn;
+
os->op = op;

ret = la_guid_from_dn(ac->module, ac->req, op_dn, &os->guid);
@@ -319,6 +327,7 @@ static int linked_attributes_add(struct ldb_module *module, struct ldb_request *

for (j = 0; j < el->num_values; j++) {
ret = la_store_op(ac, LA_OP_ADD,
+ schema_attr,
&el->values[j],
attr_name);
if (ret != LDB_SUCCESS) {
@@ -423,6 +432,7 @@ static int la_mod_search_callback(struct ldb_request *req, struct ldb_reply *are
/* Now we know what was there, we can remove it for the re-add */
for (j = 0; j < search_el->num_values; j++) {
ret = la_store_op(ac, LA_OP_DEL,
+ schema_attr,
&search_el->values[j],
attr_name);
if (ret != LDB_SUCCESS) {
@@ -570,6 +580,7 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
/* For each value being added, we need to setup the adds */
for (j = 0; j < el->num_values; j++) {
ret = la_store_op(ac, LA_OP_ADD,
+ schema_attr,
&el->values[j],
attr_name);
if (ret != LDB_SUCCESS) {
@@ -584,6 +595,7 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
/* For each value being deleted, we need to setup the delete */
for (j = 0; j < el->num_values; j++) {
ret = la_store_op(ac, LA_OP_DEL,
+ schema_attr,
&el->values[j],
attr_name);
if (ret != LDB_SUCCESS) {
--
Samba Shared Repository
Andreas Schneider
2016-12-21 21:22:02 UTC
Permalink
The branch, master has been updated
via f7d249d s3:libsmb: Always use GENSEC_OID_SPNEGO in cli_smb1_setup_encryption_send()
via f595031 s3:libsmb: pass cli_credentials to cli_check_msdfs_proxy()
via c19232b s3:client: use cli_cm_force_encryption_creds in smbspool.c (in a #if 0 section)
via 0c52239 s3:libsmb: make use of cli_cm_force_encryption_creds() where we already have creds
via ff23ee7 s3:libsmb: split out cli_cm_force_encryption_creds()
via b4340ea s3:libsmb: make use of cli_tree_connect_creds() in SMBC_server_internal()
via 5fd8db9 s3:libsmb: make use of cli_tree_connect_creds() in clidfs.c:do_connect()
via 1221236 s3:libsmb: remove now unused cli_session_setup()
via 151e37b s3:libsmb: avoid using cli_session_setup() in SMBC_server_internal()
via c478f68 s3:libsmb: make use of get_cmdline_auth_info_creds() in clidfs.c:do_connect()
via 9e79433 s3:libsmb: remove unused cli_*_encryption* functions
via b9ff137 s3:libsmb: make use of cli_smb1_setup_encryption() in cli_cm_force_encryption()
via 19bbd37 s3:client: make use of cli_smb1_setup_encryption() in cmd_posix_encrypt()
via 791847f s3:torture: make use of cli_smb1_setup_encryption() in force_cli_encryption()
via b9b0815 s3:libsmb: add cli_smb1_setup_encryption*() functions
via 9b39377 s3:printing: remove double PRINT_SPOOL_PREFIX define
via 1aa765d testprogs: Use better KRB5CCNAME in test_password_settings.sh
from 1a59014 docs-xml: Remove duplicate listing of configfile option in man pages

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit f7d249da4e79bb4f35b9b57b21f0f5e66380402d
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 8 12:25:22 2016 +0100

s3:libsmb: Always use GENSEC_OID_SPNEGO in cli_smb1_setup_encryption_send()

Also old servers should be able to handle NTLMSSP via SPNEGO.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Andreas Schneider <***@cryptomilk.org>
Autobuild-Date(master): Wed Dec 21 22:21:08 CET 2016 on sn-devel-144

commit f595031cb8203d4184b81976c22644e86a30cabe
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Nov 4 12:25:34 2016 +0100

s3:libsmb: pass cli_credentials to cli_check_msdfs_proxy()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit c19232b4bcfe80e7501c5600bbbec2b27832c1ce
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Nov 4 12:37:08 2016 +0100

s3:client: use cli_cm_force_encryption_creds in smbspool.c (in a #if 0 section)

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 0c522398684ae34d4306285cb6b30ecc5b5a0e98
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Nov 3 17:27:49 2016 +0100

s3:libsmb: make use of cli_cm_force_encryption_creds() where we already have creds

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit ff23ee7ef209b74856426df6bf4e36d9a7ed8f94
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Nov 3 17:26:41 2016 +0100

s3:libsmb: split out cli_cm_force_encryption_creds()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit b4340ea7743cdfff91a08eb4fe656ddbe0794cc7
Author: Stefan Metzmacher <***@samba.org>
Date: Mon Dec 12 06:00:32 2016 +0100

s3:libsmb: make use of cli_tree_connect_creds() in SMBC_server_internal()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 5fd8db91efe24e0da8321197b8b568fed9ea4d78
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 9 09:06:38 2016 +0100

s3:libsmb: make use of cli_tree_connect_creds() in clidfs.c:do_connect()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 12212363bf756c6ba33804f859d67395e4cf71d3
Author: Stefan Metzmacher <***@samba.org>
Date: Sun Oct 30 16:46:54 2016 +0100

s3:libsmb: remove now unused cli_session_setup()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 151e37b548bdba582bcbe7a216cd9b420d29b7b6
Author: Stefan Metzmacher <***@samba.org>
Date: Sun Oct 30 16:42:45 2016 +0100

s3:libsmb: avoid using cli_session_setup() in SMBC_server_internal()

Using cli_session_creds_init() will allow it to be passed to other sub functions
later.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit c478f688c29f0b9ff114cf2554c1c6cb273c98e4
Author: Stefan Metzmacher <***@samba.org>
Date: Sun Oct 30 16:45:39 2016 +0100

s3:libsmb: make use of get_cmdline_auth_info_creds() in clidfs.c:do_connect()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 9e794330d0399777cb6cc4c9b036ba1b4f7ea470
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Nov 3 14:50:28 2016 +0100

s3:libsmb: remove unused cli_*_encryption* functions

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit b9ff137e03ef4ba2cc42e886d6133c5ad61b7ea6
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Nov 3 14:50:28 2016 +0100

s3:libsmb: make use of cli_smb1_setup_encryption() in cli_cm_force_encryption()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 19bbd37b8df6315efc09b8e4007f4c4ddc155244
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Nov 3 14:50:28 2016 +0100

s3:client: make use of cli_smb1_setup_encryption() in cmd_posix_encrypt()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 791847f90ce0c0fc42c75ec6283906a0c5f5b926
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Nov 3 14:50:28 2016 +0100

s3:torture: make use of cli_smb1_setup_encryption() in force_cli_encryption()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit b9b0815d0f566923fe7442c35e2f321e442bb6bb
Author: Stefan Metzmacher <***@samba.org>
Date: Mon Oct 31 23:02:27 2016 +0100

s3:libsmb: add cli_smb1_setup_encryption*() functions

This will allow us to setup SMB1 encryption by just passing
cli_credentials.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 9b3937704d2b3a03590758bec7bdbe838d4e83be
Author: Stefan Metzmacher <***@samba.org>
Date: Mon Dec 19 23:04:17 2016 +0100

s3:printing: remove double PRINT_SPOOL_PREFIX define

We already have this in source3/include/printing.h
which is also included in source3/printing/printspoolss.c

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 1aa765d344e148826c75d65c502ee45bc9e8f42c
Author: Andreas Schneider <***@samba.org>
Date: Tue Sep 20 09:46:34 2016 +0200

testprogs: Use better KRB5CCNAME in test_password_settings.sh

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
source3/client/client.c | 46 ++-
source3/client/smbspool.c | 6 +-
source3/libsmb/cliconnect.c | 452 ++++++++++++++++++++++++---
source3/libsmb/clidfs.c | 96 +++---
source3/libsmb/clifsinfo.c | 245 ---------------
source3/libsmb/libsmb_server.c | 47 ++-
source3/libsmb/proto.h | 22 +-
source3/printing/printspoolss.c | 3 -
source3/torture/torture.c | 10 +-
testprogs/blackbox/test_password_settings.sh | 8 +
10 files changed, 556 insertions(+), 379 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/client/client.c b/source3/client/client.c
index cde9776..226eb27 100644
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -2535,35 +2535,53 @@ static int cmd_posix_encrypt(void)
{
TALLOC_CTX *ctx = talloc_tos();
NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+ char *domain = NULL;
+ char *user = NULL;
+ char *password = NULL;
+ struct cli_credentials *creds = NULL;
+ struct cli_credentials *lcreds = NULL;

- if (cli->use_kerberos) {
- status = cli_gss_smb_encryption_start(cli);
- } else {
- char *domain = NULL;
- char *user = NULL;
- char *password = NULL;
+ if (next_token_talloc(ctx, &cmd_ptr, &domain, NULL)) {

- if (!next_token_talloc(ctx, &cmd_ptr,&domain,NULL)) {
+ if (!next_token_talloc(ctx, &cmd_ptr, &user, NULL)) {
d_printf("posix_encrypt domain user password\n");
return 1;
}

- if (!next_token_talloc(ctx, &cmd_ptr,&user,NULL)) {
+ if (!next_token_talloc(ctx, &cmd_ptr, &password, NULL)) {
d_printf("posix_encrypt domain user password\n");
return 1;
}

- if (!next_token_talloc(ctx, &cmd_ptr,&password,NULL)) {
+ lcreds = cli_session_creds_init(ctx,
+ user,
+ domain,
+ NULL, /* realm */
+ password,
+ false, /* use_kerberos */
+ false, /* fallback_after_kerberos */
+ false, /* use_ccache */
+ false); /* password_is_nt_hash */
+ if (lcreds == NULL) {
+ d_printf("cli_session_creds_init() failed.\n");
+ return -1;
+ }
+ creds = lcreds;
+ } else {
+ bool auth_requested = false;
+
+ creds = get_cmdline_auth_info_creds(auth_info);
+
+ auth_requested = cli_credentials_authentication_requested(creds);
+ if (!auth_requested) {
d_printf("posix_encrypt domain user password\n");
return 1;
}
-
- status = cli_raw_ntlm_smb_encryption_start(cli,
- user,
- password,
- domain);
}

+ status = cli_smb1_setup_encryption(cli, creds);
+ /* gensec currently references the creds so we can't free them here */
+ talloc_unlink(ctx, lcreds);
if (!NT_STATUS_IS_OK(status)) {
d_printf("posix_encrypt failed with error %s\n", nt_errstr(status));
} else {
diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c
index a447836..10e89c7 100644
--- a/source3/client/smbspool.c
+++ b/source3/client/smbspool.c
@@ -474,11 +474,7 @@ smb_complete_connection(const char *myname,
#if 0
/* Need to work out how to specify this on the URL. */
if (smb_encrypt) {
- if (!cli_cm_force_encryption(cli,
- username,
- password,
- workgroup,
- share)) {
+ if (!cli_cm_force_encryption_creds(cli, creds, share)) {
fprintf(stderr, "ERROR: encryption setup failed\n");
cli_shutdown(cli);
return NULL;
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 02c465c..55768bf 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -37,6 +37,7 @@
#include "libsmb/nmblib.h"
#include "librpc/ndr/libndr.h"
#include "../libcli/smb/smbXcli_base.h"
+#include "../libcli/smb/smb_seal.h"
#include "lib/param/param.h"

#define STAR_SMBSERVER "*SMBSERVER"
@@ -1774,43 +1775,6 @@ NTSTATUS cli_session_setup_anon(struct cli_state *cli)
return NT_STATUS_OK;
}

-NTSTATUS cli_session_setup(struct cli_state *cli,
- const char *user,
- const char *pass,
- const char *workgroup)
-{
- NTSTATUS status = NT_STATUS_NO_MEMORY;
- const char *dest_realm = NULL;
- struct cli_credentials *creds = NULL;
-
- /*
- * dest_realm is only valid in the winbindd use case,
- * where we also have the account in that realm.
- */
- dest_realm = cli_state_remote_realm(cli);
-
- creds = cli_session_creds_init(cli,
- user,
- workgroup,
- dest_realm,
- pass,
- cli->use_kerberos,
- cli->fallback_after_kerberos,
- cli->use_ccache,
- cli->pw_nt_hash);
- if (creds == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
-
- status = cli_session_setup_creds(cli, creds);
- TALLOC_FREE(creds);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
-
- return NT_STATUS_OK;
-}
-
/****************************************************************************
Send a uloggoff.
*****************************************************************************/
@@ -2864,6 +2828,420 @@ fail:
return status;
}

+struct cli_smb1_setup_encryption_blob_state {
+ uint16_t setup[1];
+ uint8_t param[4];
+ NTSTATUS status;
+ DATA_BLOB out;
+ uint16_t enc_ctx_id;
+};
+
+static void cli_smb1_setup_encryption_blob_done(struct tevent_req *subreq);
+
+static struct tevent_req *cli_smb1_setup_encryption_blob_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct cli_state *cli,
+ const DATA_BLOB in)
+{
+ struct tevent_req *req = NULL;
+ struct cli_smb1_setup_encryption_blob_state *state = NULL;
+ struct tevent_req *subreq = NULL;
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct cli_smb1_setup_encryption_blob_state);
+ if (req == NULL) {
+ return NULL;
+ }
+
+ if (in.length > CLI_BUFFER_SIZE) {
+ tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
+ return tevent_req_post(req, ev);
+ }
+
+ SSVAL(state->setup+0, 0, TRANSACT2_SETFSINFO);
+ SSVAL(state->param, 0, 0);
+ SSVAL(state->param, 2, SMB_REQUEST_TRANSPORT_ENCRYPTION);
+
+ subreq = smb1cli_trans_send(state, ev, cli->conn,
+ SMBtrans2,
+ 0, 0, /* _flags */
+ 0, 0, /* _flags2 */
+ cli->timeout,
+ cli->smb1.pid,
+ cli->smb1.tcon,
+ cli->smb1.session,
+ NULL, /* pipe_name */
+ 0, /* fid */
+ 0, /* function */
+ 0, /* flags */
+ state->setup, 1, 0,
+ state->param, 4, 2,
+ in.data, in.length, CLI_BUFFER_SIZE);
+ if (tevent_req_nomem(subreq, req)) {
+ return tevent_req_post(req, ev);
+ }
+ tevent_req_set_callback(subreq,
+ cli_smb1_setup_encryption_blob_done,
+ req);
+
+ return req;
+}
+
+static void cli_smb1_setup_encryption_blob_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req =
+ tevent_req_callback_data(subreq,
+ struct tevent_req);
+ struct cli_smb1_setup_encryption_blob_state *state =
+ tevent_req_data(req,
+ struct cli_smb1_setup_encryption_blob_state);
+ uint8_t *rparam=NULL, *rdata=NULL;
+ uint32_t num_rparam, num_rdata;
+ NTSTATUS status;
+
+ status = smb1cli_trans_recv(subreq, state,
+ NULL, /* recv_flags */
+ NULL, 0, NULL, /* rsetup */
+ &rparam, 0, &num_rparam,
+ &rdata, 0, &num_rdata);
+ TALLOC_FREE(subreq);
+ state->status = status;
+ if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ status = NT_STATUS_OK;
+ }
+ if (tevent_req_nterror(req, status)) {
+ return;
+ }
+
+ if (num_rparam == 2) {
+ state->enc_ctx_id = SVAL(rparam, 0);
+ }
+ TALLOC_FREE(rparam);
+
+ state->out = data_blob_const(rdata, num_rdata);
+
+ tevent_req_done(req);
+}
+
+static NTSTATUS cli_smb1_setup_encryption_blob_recv(struct tevent_req *req,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *out,
+ uint16_t *enc_ctx_id)
+{
+ struct cli_smb1_setup_encryption_blob_state *state =
+ tevent_req_data(req,
+ struct cli_smb1_setup_encryption_blob_state);
+ NTSTATUS status;
+
+ if (tevent_req_is_nterror(req, &status)) {
+ tevent_req_received(req);
+ return status;
+ }
+
+ status = state->status;
+
+ *out = state->out;
+ talloc_steal(mem_ctx, out->data);
+
+ *enc_ctx_id = state->enc_ctx_id;
+
+ tevent_req_received(req);
+ return status;
+}
+
+struct cli_smb1_setup_encryption_state {
+ struct tevent_context *ev;
+ struct cli_state *cli;
+ struct smb_trans_enc_state *es;
+ DATA_BLOB blob_in;
+ DATA_BLOB blob_out;
+ bool local_ready;
+ bool remote_ready;
+};
+
+static void cli_smb1_setup_encryption_local_next(struct tevent_req *req);
+static void cli_smb1_setup_encryption_local_done(struct tevent_req *subreq);
+static void cli_smb1_setup_encryption_remote_next(struct tevent_req *req);
+static void cli_smb1_setup_encryption_remote_done(struct tevent_req *subreq);
+static void cli_smb1_setup_encryption_ready(struct tevent_req *req);
+
+static struct tevent_req *cli_smb1_setup_encryption_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct cli_state *cli,
+ struct cli_credentials *creds)
+{
+ struct tevent_req *req = NULL;
+ struct cli_smb1_setup_encryption_state *state = NULL;
+ struct auth_generic_state *ags = NULL;
+ const DATA_BLOB *b = NULL;
+ bool auth_requested = false;
+ const char *target_service = NULL;
+ const char *target_hostname = NULL;
+ NTSTATUS status;
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct cli_smb1_setup_encryption_state);
+ if (req == NULL) {
+ return NULL;
+ }
+ state->ev = ev;
+ state->cli = cli;
+
+ auth_requested = cli_credentials_authentication_requested(creds);
+ if (!auth_requested) {
+ tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
+ return tevent_req_post(req, ev);
+ }
+
+ target_service = "cifs";
+ target_hostname = smbXcli_conn_remote_name(cli->conn);
+
+ status = cli_session_creds_prepare_krb5(cli, creds);
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);
+ }
+
+ state->es = talloc_zero(state, struct smb_trans_enc_state);
+ if (tevent_req_nomem(state->es, req)) {
+ return tevent_req_post(req, ev);
+ }
+
+ status = auth_generic_client_prepare(state->es, &ags);
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);
+ }
+
+ gensec_want_feature(ags->gensec_security,
+ GENSEC_FEATURE_SIGN);
+ gensec_want_feature(ags->gensec_security,
+ GENSEC_FEATURE_SEAL);
+
+ status = auth_generic_set_creds(ags, creds);
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);
+ }
+
+ if (target_service != NULL) {
+ status = gensec_set_target_service(ags->gensec_security,
+ target_service);
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);
+ }
+ }
+
+ if (target_hostname != NULL) {
+ status = gensec_set_target_hostname(ags->gensec_security,
+ target_hostname);
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);
+ }
+ }
+
+ gensec_set_max_update_size(ags->gensec_security,
+ CLI_BUFFER_SIZE);
+
+ b = smbXcli_conn_server_gss_blob(state->cli->conn);
+ if (b != NULL) {
+ state->blob_in = *b;
+ }
+
+ status = auth_generic_client_start(ags, GENSEC_OID_SPNEGO);
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);
+ }
+
+ /*
+ * We only need the gensec_security part from here.
+ */
+ state->es->gensec_security = talloc_move(state->es,
+ &ags->gensec_security);
+ TALLOC_FREE(ags);
+
+ cli_smb1_setup_encryption_local_next(req);
+ if (!tevent_req_is_in_progress(req)) {
+ return tevent_req_post(req, ev);
+ }
+
+ return req;
+}
+
+static void cli_smb1_setup_encryption_local_next(struct tevent_req *req)
+{
+ struct cli_smb1_setup_encryption_state *state =
+ tevent_req_data(req,
+ struct cli_smb1_setup_encryption_state);
+ struct tevent_req *subreq = NULL;
+
+ if (state->local_ready) {
+ tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+ return;
+ }
+
+ subreq = gensec_update_send(state, state->ev,
+ state->es->gensec_security,
+ state->blob_in);
+ if (tevent_req_nomem(subreq, req)) {
+ return;
+ }
+ tevent_req_set_callback(subreq, cli_smb1_setup_encryption_local_done, req);
+}
+
+static void cli_smb1_setup_encryption_local_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req =
+ tevent_req_callback_data(subreq,
+ struct tevent_req);
+ struct cli_smb1_setup_encryption_state *state =
+ tevent_req_data(req,
+ struct cli_smb1_setup_encryption_state);
+ NTSTATUS status;
+
+ status = gensec_update_recv(subreq, state, &state->blob_out);
+ TALLOC_FREE(subreq);
+ state->blob_in = data_blob_null;
+ if (!NT_STATUS_IS_OK(status) &&
+ !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
+ {
+ tevent_req_nterror(req, status);
+ return;
+ }
+
+ if (NT_STATUS_IS_OK(status)) {
+ state->local_ready = true;
+ }
+
+ /*
+ * We always get NT_STATUS_OK from the server even if it is not ready.
+ * So guess the server is ready when we are ready and already sent
+ * our last blob to the server.
+ */
+ if (state->local_ready && state->blob_out.length == 0) {
+ state->remote_ready = true;
+ }
+
+ if (state->local_ready && state->remote_ready) {
+ cli_smb1_setup_encryption_ready(req);
+ return;
+ }
+
+ cli_smb1_setup_encryption_remote_next(req);
+}
+
+static void cli_smb1_setup_encryption_remote_next(struct tevent_req *req)
+{
+ struct cli_smb1_setup_encryption_state *state =
+ tevent_req_data(req,
+ struct cli_smb1_setup_encryption_state);
+ struct tevent_req *subreq = NULL;
+
+ if (state->remote_ready) {
+ tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+ return;
+ }
+
+ subreq = cli_smb1_setup_encryption_blob_send(state, state->ev,
+ state->cli, state->blob_out);
+ if (tevent_req_nomem(subreq, req)) {
+ return;
+ }
+ tevent_req_set_callback(subreq,
+ cli_smb1_setup_encryption_remote_done,
+ req);
+}
+
+static void cli_smb1_setup_encryption_remote_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req =
+ tevent_req_callback_data(subreq,
+ struct tevent_req);
+ struct cli_smb1_setup_encryption_state *state =
+ tevent_req_data(req,
+ struct cli_smb1_setup_encryption_state);
+ NTSTATUS status;
+
+ status = cli_smb1_setup_encryption_blob_recv(subreq, state,
+ &state->blob_in,
+ &state->es->enc_ctx_num);
+ TALLOC_FREE(subreq);
+ data_blob_free(&state->blob_out);
+ if (!NT_STATUS_IS_OK(status) &&
+ !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
+ {
+ tevent_req_nterror(req, status);
+ return;
+ }
+
+ /*
+ * We always get NT_STATUS_OK even if the server is not ready.
+ * So guess the server is ready when we are ready and sent
+ * our last blob to the server.
+ */
+ if (state->local_ready) {
+ state->remote_ready = true;
+ }
--
Samba Shared Repository
GÃŒnther Deschner
2016-12-21 12:14:02 UTC
Permalink
The branch, master has been updated
via 1a59014 docs-xml: Remove duplicate listing of configfile option in man pages
from 0383034 WHATSNEW: CTDB updates

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 1a5901440272158025a01a4619c1d178dfefc732
Author: Anoop C S <***@redhat.com>
Date: Thu Dec 15 16:06:35 2016 +0530

docs-xml: Remove duplicate listing of configfile option in man pages

stdarg.configfile option is hierarchically included within
common.samba.client entity. So explicit inclusion of this
term will generate man pages with configfile option listed
twice.

Signed-off-by: Anoop C S <***@redhat.com>
Reviewed-by: Guenther Deschner <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): Günther Deschner <***@samba.org>
Autobuild-Date(master): Wed Dec 21 13:13:16 CET 2016 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
docs-xml/manpages/net.8.xml | 1 -
docs-xml/manpages/smbcontrol.1.xml | 1 -
2 files changed, 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/net.8.xml b/docs-xml/manpages/net.8.xml
index 6e852fd..8ce2413 100644
--- a/docs-xml/manpages/net.8.xml
+++ b/docs-xml/manpages/net.8.xml
@@ -108,7 +108,6 @@
</varlistentry>

&stdarg.netbios.name;
- &stdarg.configfile;

<varlistentry>
<term>-S|--server server</term>
diff --git a/docs-xml/manpages/smbcontrol.1.xml b/docs-xml/manpages/smbcontrol.1.xml
index 03836aa..ebbb8dc 100644
--- a/docs-xml/manpages/smbcontrol.1.xml
+++ b/docs-xml/manpages/smbcontrol.1.xml
@@ -50,7 +50,6 @@

<variablelist>
&popt.autohelp;
- &stdarg.configfile;
&popt.common.samba.client;
<varlistentry>
<term>-t|--timeout</term>
--
Samba Shared Repository
Amitay Isaacs
2016-12-21 07:37:03 UTC
Permalink
The branch, master has been updated
via 0383034 WHATSNEW: CTDB updates
from c94f824 getncchanges: use the uptodateness_vector to filter links to replicate

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 0383034633a113aa0c54f39b17a1a3dfbb53ade7
Author: Martin Schwenke <***@meltin.net>
Date: Tue Dec 20 22:40:36 2016 +1100

WHATSNEW: CTDB updates

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

Autobuild-User(master): Amitay Isaacs <***@samba.org>
Autobuild-Date(master): Wed Dec 21 08:36:32 CET 2016 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
WHATSNEW.txt | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 51 insertions(+)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index e5ce010..f542a5b 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -81,6 +81,57 @@ A new option, "unix only", enables this feature only for the UNIX owner
of the file, not affecting the SID owner in the Windows NT ACL of the
file. This can be used to emulate something very similar to folder quotas.

+CTDB changes
+------------
+
+* "ctdb event" is a new top-level command for interacting with event scripts
+
+ "ctdb event status" replaces "ctdb scriptstatus" - the latter is
+ maintained for backward compatibility but the output format has been
+ cleaned up
+
+ "ctdb event run" replaces "ctdb eventscript"
+
+ "ctdb event script enable" replaces "ctdb enablescript"
+
+ "ctdb event script disable" replaces "ctdb disablescript"
+
+ The new command "ctdb event script list" lists event scripts.
+
+* CTDB's back-end for running event scripts has been replaced by a
+ separate, long-running daemon ctdbd_eventd.
+
+* Running ctdb interactively will log to stderr
+
+* CTDB logs now include process id for each process
+
+* CTDB tags log messages differently. Changes include:
+
+ ctdb-recoverd: Messages from CTDB's recovery daemon
+ ctdb-recovery: Messages from CTDB database recovery
+ ctdb-eventd: Messages from CTDB's event daemon
+ ctdb-takeover: Messgaes from CTDB's public IP takeover subsystem
+
+* The mapping between symbolic and numeric debug levels has changed
+
+ Configurations containing numeric debug levels should be updated.
+ Symbolic debug levels are recommended. See the DEBUG LEVEL section
+ of ctdb(7) for details.
+
+* Tunable IPAllocAlgorithm replaces LCP2PublicIPs, DeterministicIPs
+
+ See ctdb-tunables(7) for details
+
+* CTDB's configuration tunables should be consistently set across a cluster
+
+ This has always been the cases for most tunables but this fact is
+ now documented.
+
+* CTDB ships with recovery lock helper call-outs for etcd and Ceph RADOS
+
+ To build/install these, use the --enable-etcd-reclock and
+ --enable-ceph-reclock configure options.
+

REMOVED FEATURES
================
--
Samba Shared Repository
Garming Sam
2016-12-21 03:38:02 UTC
Permalink
The branch, master has been updated
via c94f824 getncchanges: use the uptodateness_vector to filter links to replicate
via 5631421 torture/drs: test link replication with hwm and utdv
via e130c46 torture/drs: move ExopBaseTest into DrsBaseTest and extend
from 8989725 s3-rpc_client: Pass NULL as no password

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit c94f82417035c8fdae9bb2631162798ba167e6b6
Author: Garming Sam <***@catalyst.net.nz>
Date: Wed Dec 14 16:05:05 2016 +1300

getncchanges: use the uptodateness_vector to filter links to replicate

This is to mirror the check in get_nc_changes_build_object.

Signed-off-by: Garming Sam <***@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Garming Sam <***@samba.org>
Autobuild-Date(master): Wed Dec 21 04:37:54 CET 2016 on sn-devel-144

commit 56314211439b281647a2f11e7a94bd874a5df337
Author: Bob Campbell <***@catalyst.net.nz>
Date: Mon Dec 19 12:27:31 2016 +1300

torture/drs: test link replication with hwm and utdv

Signed-off-by: Bob Campbell <***@catalyst.net.nz>
Reviewed-by: Garming Sam <***@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit e130c46e87a9dbda51a6ca7611f8bc4887ea6c7f
Author: Bob Campbell <***@catalyst.net.nz>
Date: Thu Dec 15 14:23:58 2016 +1300

torture/drs: move ExopBaseTest into DrsBaseTest and extend

Signed-off-by: Bob Campbell <***@catalyst.net.nz>
Reviewed-by: Garming Sam <***@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
source4/rpc_server/drsuapi/getncchanges.c | 19 +-
source4/torture/drs/python/drs_base.py | 324 ++++++++++++++++++++-
source4/torture/drs/python/getnc_exop.py | 198 ++++++++-----
.../torture/drs/python/linked_attributes_drs.py | 40 +--
source4/torture/drs/python/ridalloc_exop.py | 40 +--
5 files changed, 476 insertions(+), 145 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
index 70ec04c..705c8cf 100644
--- a/source4/rpc_server/drsuapi/getncchanges.c
+++ b/source4/rpc_server/drsuapi/getncchanges.c
@@ -605,8 +605,10 @@ static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
for (j=0; j<el->num_values; j++) {
struct dsdb_dn *dsdb_dn;
uint64_t local_usn;
- NTSTATUS status;
+ uint64_t originating_usn;
+ NTSTATUS status, status2;
WERROR werr;
+ struct GUID originating_invocation_id;

dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
if (dsdb_dn == NULL) {
@@ -635,6 +637,21 @@ static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
continue;
}

+ status = dsdb_get_extended_dn_guid(dsdb_dn->dn,
+ &originating_invocation_id,
+ "RMD_INVOCID");
+ status2 = dsdb_get_extended_dn_uint64(dsdb_dn->dn,
+ &originating_usn,
+ "RMD_ORIGINATING_USN");
+
+ if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(status2)) {
+ if (udv_filter(uptodateness_vector,
+ &originating_invocation_id,
+ originating_usn)) {
+ continue;
+ }
+ }
+
werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema,
sa, msg, dsdb_dn, la_list,
la_count, is_schema_nc);
diff --git a/source4/torture/drs/python/drs_base.py b/source4/torture/drs/python/drs_base.py
index aa0a7f6..e6f6e48 100644
--- a/source4/torture/drs/python/drs_base.py
+++ b/source4/torture/drs/python/drs_base.py
@@ -3,6 +3,8 @@
#
# Unix SMB/CIFS implementation.
# Copyright (C) Kamen Mazdrashki <***@samba.org> 2011
+# Copyright (C) Andrew Bartlett <***@samba.org> 2016
+# Copyright (C) Catalyst IT Ltd. 2016
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -18,15 +20,18 @@
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#

-
import sys
import time
import os
+import ldb

sys.path.insert(0, "bin/python")
import samba.tests
from samba.tests.samba_tool.base import SambaToolCmdTest
from samba import dsdb
+from samba.dcerpc import drsuapi, misc, drsblobs, security
+from samba.ndr import ndr_unpack, ndr_pack
+from samba.drs_utils import drs_DsBind

from ldb import (
SCOPE_BASE,
@@ -143,3 +148,320 @@ class DrsBaseTestCase(SambaToolCmdTest):
# disable replication
self.check_run("%s %s --dsa-option=+DISABLE_INBOUND_REPL" %(samba_tool_cmd, DC))
self.check_run("%s %s --dsa-option=+DISABLE_OUTBOUND_REPL" %(samba_tool_cmd, DC))
+
+ def _get_highest_hwm_utdv(self, ldb_conn):
+ res = ldb_conn.search("", scope=ldb.SCOPE_BASE, attrs=["highestCommittedUSN"])
+ hwm = drsuapi.DsReplicaHighWaterMark()
+ hwm.tmp_highest_usn = long(res[0]["highestCommittedUSN"][0])
+ hwm.reserved_usn = 0
+ hwm.highest_usn = hwm.tmp_highest_usn
+
+ utdv = drsuapi.DsReplicaCursorCtrEx()
+ cursors = []
+ c1 = drsuapi.DsReplicaCursor()
+ c1.source_dsa_invocation_id = misc.GUID(ldb_conn.get_invocation_id())
+ c1.highest_usn = hwm.highest_usn
+ cursors.append(c1)
+ utdv.count = len(cursors)
+ utdv.cursors = cursors
+ return (hwm, utdv)
+
+ def _get_indentifier(self, ldb_conn, dn):
+ res = ldb_conn.search(dn, scope=ldb.SCOPE_BASE,
+ attrs=["objectGUID", "objectSid"])
+ id = drsuapi.DsReplicaObjectIdentifier()
+ id.guid = ndr_unpack(misc.GUID, res[0]['objectGUID'][0])
+ if "objectSid" in res[0]:
+ id.sid = ndr_unpack(security.dom_sid, res[0]['objectSid'][0])
+ id.dn = str(res[0].dn)
+ return id
+
+ def _check_replication(self, expected_dns, replica_flags, expected_links=[],
+ drs_error=drsuapi.DRSUAPI_EXOP_ERR_NONE, drs=None, drs_handle=None,
+ highwatermark=None, uptodateness_vector=None,
+ more_flags=0, more_data=False,
+ dn_ordered=True, links_ordered=True,
+ max_objects=133, exop=0,
+ dest_dsa=drsuapi.DRSUAPI_DS_BIND_GUID_W2K3,
+ source_dsa=None, invocation_id=None, nc_dn_str=None,
+ nc_object_count=0, nc_linked_attributes_count=0):
+ """
+ Makes sure that replication returns the specific error given.
+ """
+ if source_dsa is None:
+ source_dsa = self.ldb_dc1.get_ntds_GUID()
+ if invocation_id is None:
+ invocation_id = self.ldb_dc1.get_invocation_id()
+ if nc_dn_str is None:
+ nc_dn_str = self.ldb_dc1.domain_dn()
+
+ if highwatermark is None:
+ if self.default_hwm is None:
+ (highwatermark, _) = self._get_highest_hwm_utdv(self.ldb_dc1)
+ else:
+ highwatermark = self.default_hwm
+
+ if drs is None:
+ drs = self.drs
+ if drs_handle is None:
+ drs_handle = self.drs_handle
+
+ req10 = self._getnc_req10(dest_dsa=dest_dsa,
+ invocation_id=invocation_id,
+ nc_dn_str=nc_dn_str,
+ exop=exop,
+ max_objects=max_objects,
+ replica_flags=replica_flags)
+ req10.highwatermark = highwatermark
+ if uptodateness_vector is not None:
+ uptodateness_vector_v1 = drsuapi.DsReplicaCursorCtrEx()
+ cursors = []
+ for i in xrange(0, uptodateness_vector.count):
+ c = uptodateness_vector.cursors[i]
+ c1 = drsuapi.DsReplicaCursor()
+ c1.source_dsa_invocation_id = c.source_dsa_invocation_id
+ c1.highest_usn = c.highest_usn
+ cursors.append(c1)
+ uptodateness_vector_v1.count = len(cursors)
+ uptodateness_vector_v1.cursors = cursors
+ req10.uptodateness_vector = uptodateness_vector_v1
+ (level, ctr) = drs.DsGetNCChanges(drs_handle, 10, req10)
+
+ self.assertEqual(level, 6, "expected level 6 response!")
+ self.assertEqual(ctr.source_dsa_guid, misc.GUID(source_dsa))
+ self.assertEqual(ctr.source_dsa_invocation_id, misc.GUID(invocation_id))
+ ctr6 = ctr
+ self.assertEqual(ctr6.extended_ret, drs_error)
+ self._check_ctr6(ctr6, expected_dns, expected_links,
+ nc_object_count=nc_object_count)
+ return (ctr6.new_highwatermark, ctr6.uptodateness_vector)
+
+ def _check_ctr6(self, ctr6, expected_dns=[], expected_links=[],
+ dn_ordered=True, links_ordered=True,
+ more_data=False, nc_object_count=0,
+ nc_linked_attributes_count=0, drs_error=0):
+ """
+ Check that a ctr6 matches the specified parameters.
+ """
+ self.assertEqual(ctr6.object_count, len(expected_dns))
+ self.assertEqual(ctr6.linked_attributes_count, len(expected_links))
+ self.assertEqual(ctr6.more_data, more_data)
+ self.assertEqual(ctr6.nc_object_count, nc_object_count)
+ self.assertEqual(ctr6.nc_linked_attributes_count, nc_linked_attributes_count)
+ self.assertEqual(ctr6.drs_error[0], drs_error)
+
+ ctr6_dns = []
+ next_object = ctr6.first_object
+ for i in range(0, ctr6.object_count):
+ ctr6_dns.append(next_object.object.identifier.dn)
+ next_object = next_object.next_object
+ self.assertEqual(next_object, None)
+
+ i = 0
+ for dn in expected_dns:
+ # Expect them back in the exact same order as specified.
+ if dn_ordered:
+ self.assertNotEqual(ctr6_dns[i], None)
+ self.assertEqual(ctr6_dns[i], dn)
+ i = i + 1
+ # Don't care what order
+ else:
+ self.assertTrue(dn in ctr6_dns, "Couldn't find DN '%s' anywhere in ctr6 response." % dn)
+
+ ctr6_links = []
+ expected_links.sort()
+ lidx = 0
+ for lidx in range(0, ctr6.linked_attributes_count):
+ l = ctr6.linked_attributes[lidx]
+ try:
+ target = ndr_unpack(drsuapi.DsReplicaObjectIdentifier3,
+ l.value.blob)
+ except:
+ target = ndr_unpack(drsuapi.DsReplicaObjectIdentifier3Binary,
+ l.value.blob)
+ al = AbstractLink(l.attid, l.flags,
+ l.identifier.guid,
+ target.guid)
+ ctr6_links.append(al)
+
+ lidx = 0
+ for el in expected_links:
+ if links_ordered:
+ self.assertEqual(el, ctr6_links[lidx])
+ lidx += 1
+ else:
+ self.assertTrue(el in ctr6_links, "Couldn't find link '%s' anywhere in ctr6 response." % el)
+
+ def _exop_req8(self, dest_dsa, invocation_id, nc_dn_str, exop,
+ replica_flags=0, max_objects=0, partial_attribute_set=None,
+ partial_attribute_set_ex=None, mapping_ctr=None):
+ req8 = drsuapi.DsGetNCChangesRequest8()
+
+ req8.destination_dsa_guid = misc.GUID(dest_dsa) if dest_dsa else misc.GUID()
+ req8.source_dsa_invocation_id = misc.GUID(invocation_id)
+ req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
+ req8.naming_context.dn = unicode(nc_dn_str)
+ req8.highwatermark = drsuapi.DsReplicaHighWaterMark()
+ req8.highwatermark.tmp_highest_usn = 0
+ req8.highwatermark.reserved_usn = 0
+ req8.highwatermark.highest_usn = 0
+ req8.uptodateness_vector = None
+ req8.replica_flags = replica_flags
+ req8.max_object_count = max_objects
+ req8.max_ndr_size = 402116
+ req8.extended_op = exop
+ req8.fsmo_info = 0
+ req8.partial_attribute_set = partial_attribute_set
+ req8.partial_attribute_set_ex = partial_attribute_set_ex
+ if mapping_ctr:
+ req8.mapping_ctr = mapping_ctr
+ else:
+ req8.mapping_ctr.num_mappings = 0
+ req8.mapping_ctr.mappings = None
+
+ return req8
+
+ def _getnc_req10(self, dest_dsa, invocation_id, nc_dn_str, exop,
+ replica_flags=0, max_objects=0, partial_attribute_set=None,
+ partial_attribute_set_ex=None, mapping_ctr=None,
+ more_flags=0):
+ req10 = drsuapi.DsGetNCChangesRequest10()
+
+ req10.destination_dsa_guid = misc.GUID(dest_dsa) if dest_dsa else misc.GUID()
+ req10.source_dsa_invocation_id = misc.GUID(invocation_id)
+ req10.naming_context = drsuapi.DsReplicaObjectIdentifier()
+ req10.naming_context.dn = unicode(nc_dn_str)
+ req10.highwatermark = drsuapi.DsReplicaHighWaterMark()
+ req10.highwatermark.tmp_highest_usn = 0
+ req10.highwatermark.reserved_usn = 0
+ req10.highwatermark.highest_usn = 0
+ req10.uptodateness_vector = None
+ req10.replica_flags = replica_flags
+ req10.max_object_count = max_objects
+ req10.max_ndr_size = 402116
+ req10.extended_op = exop
+ req10.fsmo_info = 0
+ req10.partial_attribute_set = partial_attribute_set
+ req10.partial_attribute_set_ex = partial_attribute_set_ex
+ if mapping_ctr:
+ req10.mapping_ctr = mapping_ctr
+ else:
+ req10.mapping_ctr.num_mappings = 0
+ req10.mapping_ctr.mappings = None
+ req10.more_flags = more_flags
+
+ return req10
+
+ def _ds_bind(self, server_name):
+ binding_str = "ncacn_ip_tcp:%s[seal]" % server_name
+
+ drs = drsuapi.drsuapi(binding_str, self.get_loadparm(), self.get_credentials())
+ (drs_handle, supported_extensions) = drs_DsBind(drs)
+ return (drs, drs_handle)
+
+
+class AbstractLink:
+ def __init__(self, attid, flags, identifier, targetGUID):
+ self.attid = attid
+ self.flags = flags
+ self.identifier = str(identifier)
+ self.selfGUID_blob = ndr_pack(identifier)
+ self.targetGUID = str(targetGUID)
+ self.targetGUID_blob = ndr_pack(targetGUID)
+
+ def __repr__(self):
+ return "AbstractLink(0x%08x, 0x%08x, %s, %s)" % (
+ self.attid, self.flags, self.identifier, self.targetGUID)
+
+ def __internal_cmp__(self, other, verbose=False):
+ """See CompareLinks() in MS-DRSR section 4.1.10.5.17"""
+ if not isinstance(other, AbstractLink):
+ if verbose:
+ print "AbstractLink.__internal_cmp__(%r, %r) => wrong type" % (self, other)
+ return NotImplemented
+
+ c = cmp(self.selfGUID_blob, other.selfGUID_blob)
+ if c != 0:
+ if verbose:
+ print "AbstractLink.__internal_cmp__(%r, %r) => %d different identifier" % (self, other, c)
+ return c
+
+ c = other.attid - self.attid
+ if c != 0:
+ if verbose:
+ print "AbstractLink.__internal_cmp__(%r, %r) => %d different attid" % (self, other, c)
+ return c
+
+ self_active = self.flags & drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
+ other_active = other.flags & drsuapi.DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
+
+ c = self_active - other_active
+ if c != 0:
+ if verbose:
+ print "AbstractLink.__internal_cmp__(%r, %r) => %d different FLAG_ACTIVE" % (self, other, c)
+ return c
+
+ c = cmp(self.targetGUID_blob, other.targetGUID_blob)
+ if c != 0:
+ if verbose:
+ print "AbstractLink.__internal_cmp__(%r, %r) => %d different target" % (self, other, c)
+ return c
+
+ c = self.flags - other.flags
+ if c != 0:
+ if verbose:
+ print "AbstractLink.__internal_cmp__(%r, %r) => %d different flags" % (self, other, c)
+ return c
+
+ return 0
+
+ def __lt__(self, other):
+ c = self.__internal_cmp__(other)
+ if c == NotImplemented:
+ return NotImplemented
+ if c < 0:
+ return True
+ return False
+
+ def __le__(self, other):
+ c = self.__internal_cmp__(other)
+ if c == NotImplemented:
+ return NotImplemented
+ if c <= 0:
+ return True
+ return False
+
+ def __eq__(self, other):
+ c = self.__internal_cmp__(other, verbose=True)
+ if c == NotImplemented:
+ return NotImplemented
+ if c == 0:
+ return True
+ return False
+
+ def __ne__(self, other):
+ c = self.__internal_cmp__(other)
+ if c == NotImplemented:
+ return NotImplemented
+ if c != 0:
+ return True
+ return False
+
+ def __gt__(self, other):
+ c = self.__internal_cmp__(other)
+ if c == NotImplemented:
+ return NotImplemented
+ if c > 0:
+ return True
+ return False
+
+ def __ge__(self, other):
+ c = self.__internal_cmp__(other)
+ if c == NotImplemented:
+ return NotImplemented
+ if c >= 0:
+ return True
+ return False
+
+ def __hash__(self):
+ return hash((self.attid, self.flags, self.identifier, self.targetGUID))
diff --git a/source4/torture/drs/python/getnc_exop.py b/source4/torture/drs/python/getnc_exop.py
index 246d859..d9e06f2 100644
--- a/source4/torture/drs/python/getnc_exop.py
+++ b/source4/torture/drs/python/getnc_exop.py
@@ -28,7 +28,11 @@
# PYTHONPATH="$PYTHONPATH:$samba4srcdir/torture/drs/python" $SUBUNITRUN getnc_exop -U"$DOMAIN/$DC_USERNAME"%"$DC_PASSWORD"
#

+import random
+
import drs_base
+from drs_base import AbstractLink
+
import samba.tests

import ldb
@@ -62,60 +66,8 @@ def _linked_attribute_compare(la1, la2):
# Ascending target object GUID
return cmp(ndr_pack(la1_target), ndr_pack(la2_target))

-class AbstractLink:
- def __init__(self, attid, flags, identifier, targetGUID):
- self.attid = attid
- self.flags = flags
- self.identifier = identifier
- self.targetGUID = targetGUID
-
- def __eq__(self, other):
- return isinstance(other, AbstractLink) and \
- ((self.attid, self.flags, self.identifier, self.targetGUID) ==
- (other.attid, other.flags, other.identifier, other.targetGUID))
-
- def __hash__(self):
- return hash((self.attid, self.flags, self.identifier, self.targetGUID))
-
-class ExopBaseTest:
- def _exop_req8(self, dest_dsa, invocation_id, nc_dn_str, exop,
- replica_flags=0, max_objects=0, partial_attribute_set=None,
- partial_attribute_set_ex=None, mapping_ctr=None):
- req8 = drsuapi.DsGetNCChangesRequest8()
-
- req8.destination_dsa_guid = misc.GUID(dest_dsa) if dest_dsa else misc.GUID()
- req8.source_dsa_invocation_id = misc.GUID(invocation_id)
- req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
- req8.naming_context.dn = unicode(nc_dn_str)
- req8.highwatermark = drsuapi.DsReplicaHighWaterMark()
- req8.highwatermark.tmp_highest_usn = 0
- req8.highwatermark.reserved_usn = 0
- req8.highwatermark.highest_usn = 0
- req8.uptodateness_vector = None
- req8.replica_flags = replica_flags
- req8.max_object_count = max_objects
- req8.max_ndr_size = 402116
- req8.extended_op = exop
- req8.fsmo_info = 0
- req8.partial_attribute_set = partial_attribute_set
- req8.partial_attribute_set_ex = partial_attribute_set_ex
- if mapping_ctr:
- req8.mapping_ctr = mapping_ctr
- else:
- req8.mapping_ctr.num_mappings = 0
- req8.mapping_ctr.mappings = None
-
- return req8
-
- def _ds_bind(self, server_name):
- binding_str = "ncacn_ip_tcp:%s[seal]" % server_name
-
- drs = drsuapi.drsuapi(binding_str, self.get_loadparm(), self.get_credentials())
- (drs_handle, supported_extensions) = drs_DsBind(drs)
- return (drs, drs_handle)
-

-class DrsReplicaSyncTestCase(drs_base.DrsBaseTestCase, ExopBaseTest):
+class DrsReplicaSyncTestCase(drs_base.DrsBaseTestCase):
"""Intended as a semi-black box test case for DsGetNCChanges
implementation for extended operations. It should be testing
how DsGetNCChanges handles different input params (mostly invalid).
@@ -124,8 +76,20 @@ class DrsReplicaSyncTestCase(drs_base.DrsBaseTestCase, ExopBaseTest):

def setUp(self):
super(DrsReplicaSyncTestCase, self).setUp()
+ self.base_dn = self.ldb_dc1.get_default_basedn()
+ self.ou = "OU=test_getncchanges,%s" % self.base_dn
+ self.ldb_dc1.add({
+ "dn": self.ou,
+ "objectclass": "organizationalUnit"})
+ (self.drs, self.drs_handle) = self._ds_bind(self.dnsname_dc1)
+ (self.default_hwm, self.default_utdv) = self._get_highest_hwm_utdv(self.ldb_dc1)

def tearDown(self):
+ try:
+ self.ldb_dc1.delete(self.ou, ["tree_delete:1"])
+ except ldb.LdbError as (enum, string):
+ if enum == ldb.ERR_NO_SUCH_OBJECT:
+ pass
super(DrsReplicaSyncTestCase, self).tearDown()

def _determine_fSMORoleOwner(self, fsmo_obj_dn):
@@ -170,6 +134,106 @@ class DrsReplicaSyncTestCase(drs_base.DrsBaseTestCase, ExopBaseTest):
self.assertEqual(ctr6.linked_attributes, [])
self.assertEqual(ctr6.drs_error[0], 0)

+ def test_link_utdv_hwm(self):
+ ou1 = "OU=get_anc1,%s" % self.ou
+ self.ldb_dc1.add({
+ "dn": ou1,
+ "objectclass": "organizationalUnit"
--
Samba Shared Repository
Stefan Metzmacher
2016-12-20 16:38:02 UTC
Permalink
The branch, master has been updated
via 8989725 s3-rpc_client: Pass NULL as no password
via ae5e654 auth/credentials: Add NULL check to free_dccache()
via c406bf6 auth/credentials: Add NULL check in free_mccache()
via d1ad71e auth/credentials: Move function to free ccaches to the top
via 59cc352 auth/credentials: Add talloc NULL check in cli_credentials_set_principal()
from 9b566e7 WHATSNEW: Add some information about ID mapping

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 8989725b67b4510b05a6819f86fc364293b5a814
Author: Andreas Schneider <***@samba.org>
Date: Mon Sep 19 14:40:42 2016 +0200

s3-rpc_client: Pass NULL as no password

GENSEC expects NULL as no password.

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Tue Dec 20 17:37:56 CET 2016 on sn-devel-144

commit ae5e654f88539b3b7ab55ae11b048479523138aa
Author: Andreas Schneider <***@samba.org>
Date: Sat Oct 1 11:27:54 2016 +0200

auth/credentials: Add NULL check to free_dccache()

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit c406bf6cd6907b43301752169054c0d30b1f8544
Author: Andreas Schneider <***@samba.org>
Date: Sat Oct 1 11:25:44 2016 +0200

auth/credentials: Add NULL check in free_mccache()

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit d1ad71ef9f0fe9379eb396ee38909d28c7797ee9
Author: Andreas Schneider <***@samba.org>
Date: Thu Oct 6 09:22:29 2016 +0200

auth/credentials: Move function to free ccaches to the top

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 59cc352ac6c5b763ae9cbf81fe367dd8769863d2
Author: Andreas Schneider <***@samba.org>
Date: Thu Oct 6 08:16:57 2016 +0200

auth/credentials: Add talloc NULL check in cli_credentials_set_principal()

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
auth/credentials/credentials.c | 4 ++++
auth/credentials/credentials_krb5.c | 39 +++++++++++++++++++++++--------------
source3/rpc_client/cli_pipe.c | 2 +-
3 files changed, 29 insertions(+), 16 deletions(-)


Changeset truncated at 500 lines:

diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index 9a935c6..06648c7 100644
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -268,7 +268,11 @@ _PUBLIC_ bool cli_credentials_set_principal(struct cli_credentials *cred,
{
if (obtained >= cred->principal_obtained) {
cred->principal = talloc_strdup(cred, val);
+ if (cred->principal == NULL) {
+ return false;
+ }
cred->principal_obtained = obtained;
+
cli_credentials_invalidate_ccache(cred, cred->principal_obtained);
return true;
}
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index 4c903f2..ca62e30 100644
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -39,6 +39,30 @@ static void cli_credentials_invalidate_client_gss_creds(
struct cli_credentials *cred,
enum credentials_obtained obtained);

+/* Free a memory ccache */
+static int free_mccache(struct ccache_container *ccc)
+{
+ if (ccc->ccache != NULL) {
+ krb5_cc_destroy(ccc->smb_krb5_context->krb5_context,
+ ccc->ccache);
+ ccc->ccache = NULL;
+ }
+
+ return 0;
+}
+
+/* Free a disk-based ccache */
+static int free_dccache(struct ccache_container *ccc)
+{
+ if (ccc->ccache != NULL) {
+ krb5_cc_close(ccc->smb_krb5_context->krb5_context,
+ ccc->ccache);
+ ccc->ccache = NULL;
+ }
+
+ return 0;
+}
+
_PUBLIC_ int cli_credentials_get_krb5_context(struct cli_credentials *cred,
struct loadparm_context *lp_ctx,
struct smb_krb5_context **smb_krb5_context)
@@ -122,21 +146,6 @@ static int cli_credentials_set_from_ccache(struct cli_credentials *cred,
return 0;
}

-/* Free a memory ccache */
-static int free_mccache(struct ccache_container *ccc)
-{
- krb5_cc_destroy(ccc->smb_krb5_context->krb5_context, ccc->ccache);
-
- return 0;
-}
-
-/* Free a disk-based ccache */
-static int free_dccache(struct ccache_container *ccc) {
- krb5_cc_close(ccc->smb_krb5_context->krb5_context, ccc->ccache);
-
- return 0;
-}
-
_PUBLIC_ int cli_credentials_set_ccache(struct cli_credentials *cred,
struct loadparm_context *lp_ctx,
const char *name,
diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
index 5418fbe..14f7fbc 100644
--- a/source3/rpc_client/cli_pipe.c
+++ b/source3/rpc_client/cli_pipe.c
@@ -2629,7 +2629,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
"host", /* target_service */
NAME_NT_AUTHORITY, /* domain */
"SYSTEM",
- "", /* password */
+ NULL, /* password */
CRED_DONT_USE_KERBEROS,
NULL, /* netlogon_creds_CredentialState */
presult);
--
Samba Shared Repository
Stefan Metzmacher
2016-12-20 10:41:02 UTC
Permalink
The branch, master has been updated
via 9b566e7 WHATSNEW: Add some information about ID mapping
via cabd1df WHATSNEW: Add Printing changes
via c9c8010 WHATSNEW: Use capital K for Kerberos
via afd8c38 HEIMDAL:lib/krb5: Harden _krb5_derive_key()
via c15464f8 HEIMDAL:lib/krb5: Harden ARCFOUR_sub{en,de}crypt()
via fb318ab HEIMDAL:lib/krb5: use krb5_verify_checksum() in krb5_c_verify_checksum()
via 05cc099 HEIMDAL:lib/krb5: move checksum vs. enctype checks into get_checksum_key()
via ab25cdf CVE-2016-2126: auth/kerberos: only allow known checksum types in check_pac_checksum()
via 6459543 CVE-2016-2125: s4:gensec_gssapi: don't use GSS_C_DELEG_FLAG by default
via f52ca0c CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG
via ee30821 CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss
via ce9e4a3 CVE-2016-2123: Fix DNS vuln ZDI-CAN-3995
from 0bb3490 s3:user_auth_info: let struct user_auth_info use struct cli_credentials internally

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 9b566e7b3cd5d3efd510076e9fdec97730df4883
Author: Andreas Schneider <***@samba.org>
Date: Wed Dec 14 11:23:10 2016 +0100

WHATSNEW: Add some information about ID mapping

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Karolin Seeger <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Tue Dec 20 11:40:07 CET 2016 on sn-devel-144

commit cabd1df66ab6aba4c5f0017f8da0e2cac3adcd74
Author: Andreas Schneider <***@samba.org>
Date: Wed Dec 14 08:25:45 2016 +0100

WHATSNEW: Add Printing changes

Signed-off-by: Andreas Schneider <***@samba.org>

commit c9c8010cbd15bfc864a3425a51d9d1a0449d00c4
Author: Andreas Schneider <***@samba.org>
Date: Wed Dec 14 08:15:38 2016 +0100

WHATSNEW: Use capital K for Kerberos

Signed-off-by: Andreas Schneider <***@samba.org>

commit afd8c389c92e38aa59a55127b2594023561b2ddd
Author: Volker Lendecke <***@samba.org>
Date: Fri Nov 18 18:02:30 2016 +0000

HEIMDAL:lib/krb5: Harden _krb5_derive_key()

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit c15464f886f9734982123d38594073601d49f151
Author: Volker Lendecke <***@samba.org>
Date: Fri Nov 18 18:02:30 2016 +0000

HEIMDAL:lib/krb5: Harden ARCFOUR_sub{en,de}crypt()

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit fb318ab0203297019c5e47c6bef4a9abfdeea8a5
Author: Stefan Metzmacher <***@samba.org>
Date: Tue Nov 22 13:53:53 2016 +0100

HEIMDAL:lib/krb5: use krb5_verify_checksum() in krb5_c_verify_checksum()

This allows the optimized checksum->verify() function to be used.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 05cc099499ef3a07d140981ef82937c842a3ffef
Author: Stefan Metzmacher <***@samba.org>
Date: Tue Nov 22 13:42:31 2016 +0100

HEIMDAL:lib/krb5: move checksum vs. enctype checks into get_checksum_key()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit ab25cdfa9dd071652985eb9ab98255cda3c3de57
Author: Stefan Metzmacher <***@samba.org>
Date: Tue Nov 22 17:08:46 2016 +0100

CVE-2016-2126: auth/kerberos: only allow known checksum types in check_pac_checksum()

aes based checksums can only be checked with the
corresponding aes based keytype.

Otherwise we may trigger an undefined code path
deep in the kerberos libraries, which can leed to
segmentation faults.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12446

Signed-off-by: Stefan Metzmacher <***@samba.org>

commit 6459543b5a4782eeac5d78290918cced7de4790f
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Nov 23 11:44:22 2016 +0100

CVE-2016-2125: s4:gensec_gssapi: don't use GSS_C_DELEG_FLAG by default

This disabled the usage of GSS_C_DELEG_FLAG by default, as
GSS_C_DELEG_POLICY_FLAG is still used by default we let the
KDC decide if we should send delegated credentials to a remote server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Alexander Bokovoy <***@samba.org>
Reviewed-by: Simo Sorce <***@samba.org>

commit f52ca0cbb6412c1d3abc5dc9983b0493ef915a3f
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Nov 23 11:42:59 2016 +0100

CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG

We should only use GSS_C_DELEG_POLICY_FLAG in order to let
the KDC decide if we should send delegated credentials to
a remote server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Alexander Bokovoy <***@samba.org>
Reviewed-by: Simo Sorce <***@samba.org>

commit ee30821ecaff86f9f62da48c8a0d154cc118f058
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Nov 23 11:41:10 2016 +0100

CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss

This is just an example script that's not directly used by samba,
but we should avoid sending delegated credentials to dns servers.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Alexander Bokovoy <***@samba.org>
Reviewed-by: Simo Sorce <***@samba.org>

commit ce9e4a350135c985133af807dfaf8af95088b571
Author: Volker Lendecke <***@samba.org>
Date: Sat Nov 5 21:22:46 2016 +0100

CVE-2016-2123: Fix DNS vuln ZDI-CAN-3995

Thanks to Trend Micro's Zero Day Initiative and Frederic Besler for finding
this vulnerability with a PoC and a good analysis.

Signed-off-by: Volker Lendecke <***@samba.org>
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12409

-----------------------------------------------------------------------

Summary of changes:
WHATSNEW.txt | 25 +++++++++++-
auth/kerberos/kerberos_pac.c | 22 +++++++++++
librpc/ndr/ndr_dnsp.c | 9 +++++
source3/librpc/crypto/gse.c | 1 -
source4/auth/gensec/gensec_gssapi.c | 2 +-
source4/heimdal/lib/krb5/crypto-arcfour.c | 8 ++++
source4/heimdal/lib/krb5/crypto.c | 66 +++++++++++++++----------------
source4/heimdal/lib/krb5/mit_glue.c | 17 ++++----
source4/scripting/bin/nsupdate-gss | 2 +-
9 files changed, 106 insertions(+), 46 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 39445cc..e5ce010 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -30,10 +30,24 @@ next Samba version 4.7 will not accept the wrong spelling.
Users who were using the wrong spelling "ressource" with two "s" can keep the
setting, but are advised to switch to the correct spelling.

+ID Mapping
+----------
+We discovered that the majority of users have an invalid or incorrect
+ID mapping configuration. We implemented checks in the 'testparm' tool to
+validate the ID mapping configuration. You should run it and check if it prints
+any warnings or errors after upgrading! If it does you should fix them. See the
+'IDENTITY MAPPING CONSIDERATIONS' section in the smb.conf manpage.
+There are some ID mapping backends which are not allowed to be used for the
+default backend. Winbind will no longer start if an invalid backend is
+configured as the default backend.
+
+To avoid problems in future we advise all users to run 'testparm' after
+changing the smb.conf file!
+
NEW FEATURES/CHANGES
====================

-kerberos client encryption types
+Kerberos client encryption types
--------------------------------
Some parts of Samba (most notably winbindd) perform Kerberos client
operations based on a Samba-generated krb5.conf file. A new
@@ -48,6 +62,15 @@ only allows AES-based algorithms to be negotiated. Setting the parameter to
This can solves some corner cases of mixed environments with Server 2003R2 and
newer DCs.

+Printing
+--------
+Support for uploading printer drivers from newer Windows clients (Windows 10)
+has been added until our implementation of [MS-PAR] protocol is ready.
+Several issues with uploading different printing drivers have been addressed.
+
+The OS Version for the printing server has been increased to announce
+Windows Server 2003 R2 SP2. If a driver needs a newer version then you should
+check the smb.conf manpage for details.

new option for owner inheritance
--------------------------------
diff --git a/auth/kerberos/kerberos_pac.c b/auth/kerberos/kerberos_pac.c
index 32d9d7f..7b6efdc 100644
--- a/auth/kerberos/kerberos_pac.c
+++ b/auth/kerberos/kerberos_pac.c
@@ -39,6 +39,28 @@ krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
krb5_boolean checksum_valid = false;
krb5_data input;

+ switch (sig->type) {
+ case CKSUMTYPE_HMAC_MD5:
+ /* ignores the key type */
+ break;
+ case CKSUMTYPE_HMAC_SHA1_96_AES_256:
+ if (KRB5_KEY_TYPE(keyblock) != ENCTYPE_AES256_CTS_HMAC_SHA1_96) {
+ return EINVAL;
+ }
+ /* ok */
+ break;
+ case CKSUMTYPE_HMAC_SHA1_96_AES_128:
+ if (KRB5_KEY_TYPE(keyblock) != ENCTYPE_AES128_CTS_HMAC_SHA1_96) {
+ return EINVAL;
+ }
+ /* ok */
+ break;
+ default:
+ DEBUG(2,("check_pac_checksum: Checksum Type %d is not supported\n",
+ (int)sig->type));
+ return EINVAL;
+ }
+
#ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM /* Heimdal */
cksum.cksumtype = (krb5_cksumtype)sig->type;
cksum.checksum.length = sig->signature.length;
diff --git a/librpc/ndr/ndr_dnsp.c b/librpc/ndr/ndr_dnsp.c
index ff77bc7..974ff5e 100644
--- a/librpc/ndr/ndr_dnsp.c
+++ b/librpc/ndr/ndr_dnsp.c
@@ -56,7 +56,16 @@ _PUBLIC_ enum ndr_err_code ndr_pull_dnsp_name(struct ndr_pull *ndr, int ndr_flag
uint8_t sublen, newlen;
NDR_CHECK(ndr_pull_uint8(ndr, ndr_flags, &sublen));
newlen = total_len + sublen;
+ if (newlen < total_len) {
+ return ndr_pull_error(ndr, NDR_ERR_RANGE,
+ "Failed to pull dnsp_name");
+ }
if (i != count-1) {
+ if (newlen == UINT8_MAX) {
+ return ndr_pull_error(
+ ndr, NDR_ERR_RANGE,
+ "Failed to pull dnsp_name");
+ }
newlen++; /* for the '.' */
}
ret = talloc_realloc(ndr->current_mem_ctx, ret, char, newlen);
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index d0ae53c..e4ceed1 100644
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -142,7 +142,6 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));

gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
- GSS_C_DELEG_FLAG |
GSS_C_DELEG_POLICY_FLAG |
GSS_C_REPLAY_FLAG |
GSS_C_SEQUENCE_FLAG;
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index 18bb011..a37a0a9 100644
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -115,7 +115,7 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) {
gensec_gssapi_state->gss_want_flags |= GSS_C_MUTUAL_FLAG;
}
- if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) {
+ if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", false)) {
gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_FLAG;
}
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) {
diff --git a/source4/heimdal/lib/krb5/crypto-arcfour.c b/source4/heimdal/lib/krb5/crypto-arcfour.c
index e16b70c..2289e7d 100644
--- a/source4/heimdal/lib/krb5/crypto-arcfour.c
+++ b/source4/heimdal/lib/krb5/crypto-arcfour.c
@@ -139,6 +139,10 @@ ARCFOUR_subencrypt(krb5_context context,
unsigned char k1_c_data[16], k2_c_data[16], k3_c_data[16];
krb5_error_code ret;

+ if (len < 16) {
+ return KRB5KRB_AP_ERR_INAPP_CKSUM;
+ }
+
t[0] = (usage >> 0) & 0xFF;
t[1] = (usage >> 8) & 0xFF;
t[2] = (usage >> 16) & 0xFF;
@@ -207,6 +211,10 @@ ARCFOUR_subdecrypt(krb5_context context,
unsigned char cksum_data[16];
krb5_error_code ret;

+ if (len < 16) {
+ return KRB5KRB_AP_ERR_INAPP_CKSUM;
+ }
+
t[0] = (usage >> 0) & 0xFF;
t[1] = (usage >> 8) & 0xFF;
t[2] = (usage >> 16) & 0xFF;
diff --git a/source4/heimdal/lib/krb5/crypto.c b/source4/heimdal/lib/krb5/crypto.c
index 75d0a09..7dd2af5 100644
--- a/source4/heimdal/lib/krb5/crypto.c
+++ b/source4/heimdal/lib/krb5/crypto.c
@@ -305,6 +305,24 @@ get_checksum_key(krb5_context context,
struct _krb5_key_data **key)
{
krb5_error_code ret = 0;
+ struct _krb5_checksum_type *kct = NULL;
+
+ if (crypto == NULL) {
+ krb5_set_error_message(context, KRB5_BAD_ENCTYPE,
+ N_("Checksum type %s is keyed but no "
+ "crypto context (key) was passed in", ""),
+ ct->name);
+ return KRB5_BAD_ENCTYPE;
+ }
+ kct = crypto->et->keyed_checksum;
+ if (kct == NULL || kct->type != ct->type) {
+ krb5_set_error_message(context, KRB5_BAD_ENCTYPE,
+ N_("Checksum type %s is keyed, but "
+ "the key type %s passed didnt have that checksum "
+ "type as the keyed type", ""),
+ ct->name, crypto->et->name);
+ return KRB5_BAD_ENCTYPE;
+ }

if(ct->flags & F_DERIVED)
ret = _get_derived_key(context, crypto, usage, key);
@@ -340,21 +358,12 @@ create_checksum (krb5_context context,
{
krb5_error_code ret;
struct _krb5_key_data *dkey;
- int keyed_checksum;

if (ct->flags & F_DISABLED) {
krb5_clear_error_message (context);
return KRB5_PROG_SUMTYPE_NOSUPP;
}
- keyed_checksum = (ct->flags & F_KEYED) != 0;
- if(keyed_checksum && crypto == NULL) {
- krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
- N_("Checksum type %s is keyed but no "
- "crypto context (key) was passed in", ""),
- ct->name);
- return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
- }
- if(keyed_checksum) {
+ if (ct->flags & F_KEYED) {
ret = get_checksum_key(context, crypto, usage, ct, &dkey);
if (ret)
return ret;
@@ -422,7 +431,6 @@ verify_checksum(krb5_context context,
{
krb5_error_code ret;
struct _krb5_key_data *dkey;
- int keyed_checksum;
Checksum c;
struct _krb5_checksum_type *ct;

@@ -443,26 +451,7 @@ verify_checksum(krb5_context context,

return KRB5KRB_AP_ERR_BAD_INTEGRITY; /* XXX */
}
- keyed_checksum = (ct->flags & F_KEYED) != 0;
- if(keyed_checksum) {
- struct _krb5_checksum_type *kct;
- if (crypto == NULL) {
- krb5_set_error_message(context, KRB5_PROG_SUMTYPE_NOSUPP,
- N_("Checksum type %s is keyed but no "
- "crypto context (key) was passed in", ""),
- ct->name);
- return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
- }
- kct = crypto->et->keyed_checksum;
- if (kct == NULL || kct->type != ct->type) {
- krb5_set_error_message(context, KRB5_PROG_SUMTYPE_NOSUPP,
- N_("Checksum type %s is keyed, but "
- "the key type %s passed didnt have that checksum "
- "type as the keyed type", ""),
- ct->name, crypto->et->name);
- return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
- }
-
+ if (ct->flags & F_KEYED) {
ret = get_checksum_key(context, crypto, usage, ct, &dkey);
if (ret)
return ret;
@@ -1866,8 +1855,12 @@ _krb5_derive_key(krb5_context context,
memcpy(k + i * et->blocksize,
k + (i - 1) * et->blocksize,
et->blocksize);
- (*et->encrypt)(context, key, k + i * et->blocksize, et->blocksize,
- 1, 0, NULL);
+ ret = (*et->encrypt)(context, key, k + i * et->blocksize,
+ et->blocksize, 1, 0, NULL);
+ if (ret) {
+ krb5_set_error_message(context, ret, N_("encrypt failed", ""));
+ goto out;
+ }
}
} else {
/* this case is probably broken, but won't be run anyway */
@@ -1880,7 +1873,12 @@ _krb5_derive_key(krb5_context context,
goto out;
}
memcpy(c, constant, len);
- (*et->encrypt)(context, key, c, len, 1, 0, NULL);
+ ret = (*et->encrypt)(context, key, c, len, 1, 0, NULL);
+ if (ret) {
+ free(c);
+ krb5_set_error_message(context, ret, N_("encrypt failed", ""));
+ goto out;
+ }
k = malloc(res_len);
if(res_len != 0 && k == NULL) {
free(c);
diff --git a/source4/heimdal/lib/krb5/mit_glue.c b/source4/heimdal/lib/krb5/mit_glue.c
index 16c230a..53b20fd 100644
--- a/source4/heimdal/lib/krb5/mit_glue.c
+++ b/source4/heimdal/lib/krb5/mit_glue.c
@@ -67,22 +67,23 @@ krb5_c_verify_checksum(krb5_context context, const krb5_keyblock *key,
const krb5_checksum *cksum, krb5_boolean *valid)
{
krb5_error_code ret;
- krb5_checksum data_cksum;
+ krb5_crypto crypto;

*valid = 0;

- ret = krb5_c_make_checksum(context, cksum->cksumtype,
- key, usage, data, &data_cksum);
+ ret = krb5_crypto_init(context, key, 0, &crypto);
if (ret)
return ret;

- if (data_cksum.cksumtype == cksum->cksumtype
- && krb5_data_ct_cmp(&data_cksum.checksum, &cksum->checksum) == 0)
- *valid = 1;
+ ret = krb5_verify_checksum(context, crypto, usage,
+ data->data, data->length, cksum);
+ krb5_crypto_destroy(context, crypto);

- krb5_free_checksum_contents(context, &data_cksum);
+ if (ret == 0) {
+ *valid = 1;
+ }

- return 0;
+ return ret;
}

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
diff --git a/source4/scripting/bin/nsupdate-gss b/source4/scripting/bin/nsupdate-gss
index dec5916..509220d 100755
--- a/source4/scripting/bin/nsupdate-gss
+++ b/source4/scripting/bin/nsupdate-gss
@@ -178,7 +178,7 @@ sub negotiate_tkey($$$$)
my $flags =
GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG |
GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG |
- GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG;
+ GSS_C_INTEG_FLAG;


$status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE,
--
Samba Shared Repository
Andrew Bartlett
2016-12-20 06:02:50 UTC
Permalink
The branch, master has been updated
via 0bb3490 s3:user_auth_info: let struct user_auth_info use struct cli_credentials internally
via 4fb0e65 s3:popt_common: let POPT_COMMON_CREDENTIALS imply logfile and conffile loading
via d7fb3bb tests/credentials.py: demonstrate the last 'username' line of creds.parse_file() beats other lines
via 05e8bfd auth/credentials: change the parsing order of cli_credentials_parse_file()
via 250df9d tests/credentials.py: verify the new cli_credentials_parse_file() 'username' parsing
via d487591 auth/credentials: let cli_credentials_parse_file() handle 'username' with cli_credentials_parse_string()
via 6b6c07f tests/credentials.py: add tests to verify realm/principal behaviour of cli_credentials_parse_string()
via eaf3d44 auth/credentials: let cli_credentials_parse_string() always reset principal and realm
via 6b18ac6 auth/credentials: let cli_credentials_parse_string() always reset username and domain
via 86558b5 tests/credentials.py: add tests with a realm from smb.conf
via dab9456 auth/credentials: handle situations without a configured (default) realm
via 7c344fb auth/credentials: add python bindings for enum credentials_obtained
via 9fa7f59 tests/credentials.py: add very simple test for py_creds_parse_file
via df652c3 auth/credentials: add py_creds_parse_file()
via 63dabd2 tests/credentials.py: verify the difference of parse_string("someone") and parse_string("someone%")
via d29f7dc tests/credentials.py: add test for cli_credentials_set_password_will_be_nt_hash()
via 1565469 auth/credentials: add cli_credentials_set_password_will_be_nt_hash() and the related logic
via a3f03df auth/credentials: let cli_credentials_set_password() fail if talloc_strdup() fails
via 8415cca auth/credentials: make use of talloc_zero() in cli_credentials_init()
via 787cf39 s4-rpc_server: Add braces to better follow coding style
via abbd0a8 s4-netlogon: Push the netlogon server in the AD DC into multiple processes
via 86e706a selftest: Use 'rpc server port:netlogon' and 'rpc server port' smb.conf option
via b81cf02 s4-rpc_server: Do not check association groups for NETLOGON
via 6dc14b0 s4-rpc_server: Allow listener for RPC servers to use multiple processes
via ffb8b50 s4-rpc_server: Allow each interface to declare if it uses handles
via 5ea6708 s4-rpc_server: Add comments explaining the control flow around dcesrv_bind()
from b38f1ae s3:utils: Use cli_cm_force_encryption() instead of cli_force_encryption()

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 0bb3490329310e81147c56f42fa7b07350cfb384
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Oct 28 12:14:37 2016 +0200

s3:user_auth_info: let struct user_auth_info use struct cli_credentials internally

This way we can have a very simple get_cmdline_auth_info_creds() function,
which can be used pass cli_credentials down the stack instead of
constantly translating from user_auth_info to cli_credentials, while
loosing information.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

Autobuild-User(master): Andrew Bartlett <***@samba.org>
Autobuild-Date(master): Tue Dec 20 04:57:05 CET 2016 on sn-devel-144

commit 4fb0e65a857f601562da72c6d6087d86ba3196a0
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 9 16:04:38 2016 +0100

s3:popt_common: let POPT_COMMON_CREDENTIALS imply logfile and conffile loading

All users of POPT_COMMON_CREDENTIALS basically need the same logic,
while some ignore a broken smb.conf and some complain about it.

This will allow the future usage of config options in the
credential post processing.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit d7fb3bb5721f3903fd985d2121f893a42761fc07
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 15:30:28 2016 +0100

tests/credentials.py: demonstrate the last 'username' line of creds.parse_file() beats other lines

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 05e8bfdc95437c4a0ac087f1767bae7f5b930283
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 12:41:58 2016 +0100

auth/credentials: change the parsing order of cli_credentials_parse_file()

We now first just remember the domain, realm, username, password values
(the last value wins).

At the end we call cli_credentials_set_{realm,domain,password}()
followed by cli_credentials_parse_string() for 'username'.

It means the last 'username' line beats the domain, realm or password lines, e.g.:

username=USERDOMAIN\username
domain=DOMAIN

will result in cli_credentials_get_domain() returning "USERDOMAIN" instead of
DOMAIN.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 250df9d6374b690daea2839ba7eecb350a42d8e6
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 14:01:35 2016 +0100

tests/credentials.py: verify the new cli_credentials_parse_file() 'username' parsing

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit d487591f0b8e875093d77edfba66435705240161
Author: Stefan Metzmacher <***@samba.org>
Date: Sun Dec 11 22:50:53 2016 +0100

auth/credentials: let cli_credentials_parse_file() handle 'username' with cli_credentials_parse_string()

Some existing source3 tests (test_smbclient_s3.sh test_auth_file()) use a credentials file
that looks like this:

username=DOMAIN/username
password=password
domain=DOMAIN

This change allows us to parse the same.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 6b6c07f61f439c37e8b226660b23486b8fa546f2
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 14:12:31 2016 +0100

tests/credentials.py: add tests to verify realm/principal behaviour of cli_credentials_parse_string()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit eaf3d44641370514169b74f7e564122354b6cfdf
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Dec 14 16:47:57 2016 +0100

auth/credentials: let cli_credentials_parse_string() always reset principal and realm

If we reset username we need to reset principal if it was set at the same level.

If domain is reset we also need to use it as realm if realm
was set at the same level. Otherwise we'd build a principal
that belongs to a different user, which would not work
and only increment the wrong lockout counter and result
in wrong authorization tokens to be used.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 6b18ac69156de588ec44d812e74ec8391c07d633
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 9 12:20:19 2016 +0100

auth/credentials: let cli_credentials_parse_string() always reset username and domain

If cli_credentials_parse_string() is used we should no longer use
any guessed values and need to make sure username and domain
are reset if principal and realm are set.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 86558b5ce8c4df9a6e5b86536c81cd584cdeb20e
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 14:49:18 2016 +0100

tests/credentials.py: add tests with a realm from smb.conf

As we don't want to create a new smb.conf file
we just simulate it with "creds.set_realm(realm, credentials.UNINITIALISED)".

That's basically the same as the cli_credentials_set_conf() behaviour
if a realm is specified in the configuration.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit dab9456cfc4f42e4a7d95443e02460e59816ecbd
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 11:04:02 2016 +0100

auth/credentials: handle situations without a configured (default) realm

We should not have cli_credentials_get_realm() return "" without a
configured (default) realm in smb.conf.
Note that the existing tests with creds.get_realm() == lp.get("realm")
also work with "" as string.

At the same time we should never let cli_credentials_get_principal()
return "@REALM.EXAMPLE.COM" nor "username@".

If cli_credentials_parse_string() gets "OTHERDOMAIN\username"
we must not use cli_credentials_get_realm() to generate
a principal unless cli_credentials_get_domain() returns
also "OTHERDOMAIN". What we need to do is using
***@OTHERDOMAIN as principal, whild we still
use cli_credentials_get_realm to get a default kdc,
(which may route us to the correct kdc with WRONG_REALM
messages).

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 7c344fbbe0568734beb982bb6e0f3c81e6eb5843
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 11:37:33 2016 +0100

auth/credentials: add python bindings for enum credentials_obtained

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 9fa7f59f88cb0350c0616d6f0a6a06b4e7a52228
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 10:30:29 2016 +0100

tests/credentials.py: add very simple test for py_creds_parse_file

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit df652c3ede181576f63ae20ccd993203b744952d
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 10:06:25 2016 +0100

auth/credentials: add py_creds_parse_file()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 63dabd2f35224a7ee7468d435e67baa0e059358c
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 09:42:20 2016 +0100

tests/credentials.py: verify the difference of parse_string("someone") and parse_string("someone%")

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit d29f7dc13bb705a0cab6de2aeac70c42d83a7af8
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 15 09:34:45 2016 +0100

tests/credentials.py: add test for cli_credentials_set_password_will_be_nt_hash()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 1565469bf22cb8aee7467ab76ba64fb5c54b59fe
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Dec 14 10:02:10 2016 +0100

auth/credentials: add cli_credentials_set_password_will_be_nt_hash() and the related logic

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit a3f03df706f3dc8d7875226aa162154a0194f331
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Dec 14 08:52:12 2016 +0100

auth/credentials: let cli_credentials_set_password() fail if talloc_strdup() fails

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 8415cca557cc556c0524cdf5ef66820d22577fb0
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Dec 14 08:50:51 2016 +0100

auth/credentials: make use of talloc_zero() in cli_credentials_init()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

commit 787cf39ce6cb6695b7eeee88e1dee32d33853884
Author: Andrew Bartlett <***@samba.org>
Date: Wed Dec 14 11:58:48 2016 +1300

s4-rpc_server: Add braces to better follow coding style

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit abbd0a88dee8715dbddc1a2478fe18aafefa385c
Author: Andrew Bartlett <***@samba.org>
Date: Mon Nov 21 13:31:39 2016 +1300

s4-netlogon: Push the netlogon server in the AD DC into multiple processes

This allows the NETLOGON server to scale better, as it is often a bottleneck

What we are doing here is keeping the forced single process only for
other servers that declare they use DCE/RPC handles.

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 86e706a32dbd2259a428009f7097e7ea6c3f4f8d
Author: Andrew Bartlett <***@samba.org>
Date: Mon Nov 14 10:15:39 2016 +1300

selftest: Use 'rpc server port:netlogon' and 'rpc server port' smb.conf option

We need this because once we make NETLOGON run in multiple processes,
it will need its own port, and socket_wrapper can not currently allocate
and ephemeral port. It also tests the option, which others have asked be
made available to firewall drsuapi.

Likewise the 'rpc server port' option is used to confirm it
functions for the default port'.

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Garming Sam <***@samba.org>

commit b81cf02834bdd5b0925949cc9d42897aa3054746
Author: Andrew Bartlett <***@samba.org>
Date: Mon Nov 14 10:11:05 2016 +1300

s4-rpc_server: Do not check association groups for NETLOGON

If this RPC server is not going to use handles (actually a generic
flag) then do not check the assocation group provided. This in turn
allows us to easily make NETLOGON run in multiple processes.

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 6dc14b0a5d225ca8752088a1ee25edee46c1f956
Author: Andrew Bartlett <***@samba.org>
Date: Tue Oct 18 10:36:51 2016 +1300

s4-rpc_server: Allow listener for RPC servers to use multiple processes

To do this we must get the ncacn_ip_tcp listener to split out (for example)
netlogon onto a distinct port, so we change the registration code to split up each
ncacn_ip_tcp registration to create a new interface for indicated services.

The new option "rpc server port" allows control of the default port and
"rpc server port:netlogon" (also valid for any other pipe from the IDL name)
allows us to both work around limitations in socket_wrapper against
double-binding and allows specification of the port by the administrator.

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit ffb8b50e3c07c833fb7b1a583d21f9dc1166a0a6
Author: Andrew Bartlett <***@samba.org>
Date: Mon Nov 14 11:24:03 2016 +1300

s4-rpc_server: Allow each interface to declare if it uses handles

This will allow the NETLOGON server in the AD DC to declare that it does not use
handles, and so allow some more flexibility with association groups

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 5ea6708d819c392096413e53196d65108b1e9283
Author: Andrew Bartlett <***@samba.org>
Date: Wed Dec 14 09:38:28 2016 +1300

s4-rpc_server: Add comments explaining the control flow around dcesrv_bind()

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
auth/credentials/credentials.c | 348 +++++++++++++++++--------
auth/credentials/credentials.h | 2 +
auth/credentials/credentials_internal.h | 2 +
auth/credentials/credentials_ntlm.c | 19 ++
auth/credentials/pycredentials.c | 63 ++++-
docs-xml/smbdotconf/protocol/rpcserverport.xml | 14 +
pidl/lib/Parse/Pidl/Samba4/NDR/Server.pm | 21 +-
python/samba/tests/credentials.py | 243 ++++++++++++++++-
selftest/target/Samba4.pm | 4 +
source3/client/client.c | 11 +-
source3/include/auth_info.h | 6 +
source3/include/popt_common.h | 1 +
source3/lib/popt_common.c | 197 ++------------
source3/lib/util_cmdline.c | 346 ++++++++++++++++--------
source3/rpcclient/rpcclient.c | 15 --
source3/utils/regedit.c | 5 -
source3/utils/smbcacls.c | 5 +-
source3/utils/smbcquotas.c | 12 -
source3/utils/smbtree.c | 5 +-
source4/rpc_server/dcerpc_server.c | 198 ++++++++++++--
source4/rpc_server/dcerpc_server.h | 10 +
source4/rpc_server/dcesrv_mgmt.c | 10 +
source4/rpc_server/handles.c | 10 +
source4/rpc_server/netlogon/dcerpc_netlogon.c | 9 +
source4/rpc_server/remote/dcesrv_remote.c | 1 +
source4/rpc_server/service_rpc.c | 46 +++-
26 files changed, 1102 insertions(+), 501 deletions(-)
create mode 100644 docs-xml/smbdotconf/protocol/rpcserverport.xml


Changeset truncated at 500 lines:

diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index c8f86ba..9a935c6 100644
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -36,85 +36,11 @@
*/
_PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
{
- struct cli_credentials *cred = talloc(mem_ctx, struct cli_credentials);
+ struct cli_credentials *cred = talloc_zero(mem_ctx, struct cli_credentials);
if (cred == NULL) {
return cred;
}

- cred->workstation_obtained = CRED_UNINITIALISED;
- cred->username_obtained = CRED_UNINITIALISED;
- cred->password_obtained = CRED_UNINITIALISED;
- cred->domain_obtained = CRED_UNINITIALISED;
- cred->realm_obtained = CRED_UNINITIALISED;
- cred->ccache_obtained = CRED_UNINITIALISED;
- cred->client_gss_creds_obtained = CRED_UNINITIALISED;
- cred->principal_obtained = CRED_UNINITIALISED;
- cred->keytab_obtained = CRED_UNINITIALISED;
- cred->server_gss_creds_obtained = CRED_UNINITIALISED;
-
- cred->ccache_threshold = CRED_UNINITIALISED;
- cred->client_gss_creds_threshold = CRED_UNINITIALISED;
-
- cred->workstation = NULL;
- cred->username = NULL;
- cred->password = NULL;
- cred->old_password = NULL;
- cred->domain = NULL;
- cred->realm = NULL;
- cred->principal = NULL;
- cred->salt_principal = NULL;
- cred->impersonate_principal = NULL;
- cred->self_service = NULL;
- cred->target_service = NULL;
-
- cred->bind_dn = NULL;
-
- cred->nt_hash = NULL;
- cred->old_nt_hash = NULL;
-
- cred->lm_response.data = NULL;
- cred->lm_response.length = 0;
- cred->nt_response.data = NULL;
- cred->nt_response.length = 0;
-
- cred->ccache = NULL;
- cred->client_gss_creds = NULL;
- cred->keytab = NULL;
- cred->server_gss_creds = NULL;
-
- cred->workstation_cb = NULL;
- cred->password_cb = NULL;
- cred->username_cb = NULL;
- cred->domain_cb = NULL;
- cred->realm_cb = NULL;
- cred->principal_cb = NULL;
-
- cred->priv_data = NULL;
-
- cred->netlogon_creds = NULL;
- cred->secure_channel_type = SEC_CHAN_NULL;
-
- cred->kvno = 0;
-
- cred->password_last_changed_time = 0;
-
- cred->smb_krb5_context = NULL;
-
- cred->machine_account_pending = false;
- cred->machine_account_pending_lp_ctx = NULL;
-
- cred->machine_account = false;
-
- cred->password_tries = 0;
-
- cred->callback_running = false;
-
- cli_credentials_set_kerberos_state(cred, CRED_AUTO_USE_KERBEROS);
- cli_credentials_set_gensec_features(cred, 0);
- cli_credentials_set_krb_forwardable(cred, CRED_AUTO_KRB_FORWARDABLE);
-
- cred->forced_sasl_mech = NULL;
-
cred->winbind_separator = '\\';

return cred;
@@ -287,16 +213,37 @@ _PUBLIC_ const char *cli_credentials_get_principal_and_obtained(struct cli_crede

if (cred->principal_obtained < cred->username_obtained
|| cred->principal_obtained < MAX(cred->domain_obtained, cred->realm_obtained)) {
+ const char *effective_username = NULL;
+ const char *effective_realm = NULL;
+ enum credentials_obtained effective_obtained;
+
+ effective_username = cli_credentials_get_username(cred);
+ if (effective_username == NULL || strlen(effective_username) == 0) {
+ *obtained = cred->username_obtained;
+ return NULL;
+ }
+
if (cred->domain_obtained > cred->realm_obtained) {
- *obtained = MIN(cred->domain_obtained, cred->username_obtained);
- return talloc_asprintf(mem_ctx, "%s@%s",
- cli_credentials_get_username(cred),
- cli_credentials_get_domain(cred));
+ effective_realm = cli_credentials_get_domain(cred);
+ effective_obtained = MIN(cred->domain_obtained,
+ cred->username_obtained);
} else {
- *obtained = MIN(cred->realm_obtained, cred->username_obtained);
+ effective_realm = cli_credentials_get_realm(cred);
+ effective_obtained = MIN(cred->realm_obtained,
+ cred->username_obtained);
+ }
+
+ if (effective_realm == NULL || strlen(effective_realm) == 0) {
+ effective_realm = cli_credentials_get_domain(cred);
+ effective_obtained = MIN(cred->domain_obtained,
+ cred->username_obtained);
+ }
+
+ if (effective_realm != NULL && strlen(effective_realm) != 0) {
+ *obtained = effective_obtained;
return talloc_asprintf(mem_ctx, "%s@%s",
- cli_credentials_get_username(cred),
- cli_credentials_get_realm(cred));
+ effective_username,
+ effective_realm);
}
}
*obtained = cred->principal_obtained;
@@ -392,7 +339,8 @@ _PUBLIC_ const char *cli_credentials_get_password(struct cli_credentials *cred)
}

if (cred->password_obtained == CRED_CALLBACK &&
- !cred->callback_running) {
+ !cred->callback_running &&
+ !cred->password_will_be_nt_hash) {
cred->callback_running = true;
cred->password = cred->password_cb(cred);
cred->callback_running = false;
@@ -413,18 +361,54 @@ _PUBLIC_ bool cli_credentials_set_password(struct cli_credentials *cred,
enum credentials_obtained obtained)
{
if (obtained >= cred->password_obtained) {
+
+ cred->lm_response = data_blob_null;
+ cred->nt_response = data_blob_null;
+ cred->nt_hash = NULL;
+ cred->password = NULL;
+
+ cli_credentials_invalidate_ccache(cred, obtained);
+
cred->password_tries = 0;
+
+ if (val == NULL) {
+ cred->password_obtained = obtained;
+ return true;
+ }
+
+ if (cred->password_will_be_nt_hash) {
+ struct samr_Password *nt_hash = NULL;
+ size_t val_len = strlen(val);
+ size_t converted;
+
+ nt_hash = talloc(cred, struct samr_Password);
+ if (nt_hash == NULL) {
+ return false;
+ }
+
+ converted = strhex_to_str((char *)nt_hash->hash,
+ sizeof(nt_hash->hash),
+ val, val_len);
+ if (converted != sizeof(nt_hash->hash)) {
+ TALLOC_FREE(nt_hash);
+ return false;
+ }
+
+ cred->nt_hash = nt_hash;
+ cred->password_obtained = obtained;
+ return true;
+ }
+
cred->password = talloc_strdup(cred, val);
- if (cred->password) {
- /* Don't print the actual password in talloc memory dumps */
- talloc_set_name_const(cred->password, "password set via cli_credentials_set_password");
+ if (cred->password == NULL) {
+ return false;
}
+
+ /* Don't print the actual password in talloc memory dumps */
+ talloc_set_name_const(cred->password,
+ "password set via cli_credentials_set_password");
cred->password_obtained = obtained;
- cli_credentials_invalidate_ccache(cred, cred->password_obtained);

- cred->nt_hash = NULL;
- cred->lm_response = data_blob(NULL, 0);
- cred->nt_response = data_blob(NULL, 0);
return true;
}

@@ -485,32 +469,85 @@ _PUBLIC_ bool cli_credentials_set_old_password(struct cli_credentials *cred,
_PUBLIC_ struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred,
TALLOC_CTX *mem_ctx)
{
+ enum credentials_obtained password_obtained;
+ enum credentials_obtained ccache_threshold;
+ enum credentials_obtained client_gss_creds_threshold;
+ bool password_is_nt_hash;
const char *password = NULL;
+ struct samr_Password *nt_hash = NULL;

if (cred->nt_hash != NULL) {
- struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
- if (!nt_hash) {
- return NULL;
- }
+ /*
+ * If we already have a hash it's easy.
+ */
+ goto return_hash;
+ }

- *nt_hash = *cred->nt_hash;
+ /*
+ * This is a bit tricky, with password_will_be_nt_hash
+ * we still need to get the value via the password_callback
+ * but if we did that we should not remember it's state
+ * in the long run so we need to undo it.
+ */

- return nt_hash;
- }
+ password_obtained = cred->password_obtained;
+ ccache_threshold = cred->ccache_threshold;
+ client_gss_creds_threshold = cred->client_gss_creds_threshold;
+ password_is_nt_hash = cred->password_will_be_nt_hash;

+ cred->password_will_be_nt_hash = false;
password = cli_credentials_get_password(cred);
- if (password) {
- struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
- if (!nt_hash) {
- return NULL;
- }

+ cred->password_will_be_nt_hash = password_is_nt_hash;
+ if (password_is_nt_hash && password_obtained == CRED_CALLBACK) {
+ /*
+ * We got the nt_hash as string via the callback,
+ * so we need to undo the state change.
+ *
+ * And also don't remember it as plaintext password.
+ */
+ cred->client_gss_creds_threshold = client_gss_creds_threshold;
+ cred->ccache_threshold = ccache_threshold;
+ cred->password_obtained = password_obtained;
+ cred->password = NULL;
+ }
+
+ if (password == NULL) {
+ return NULL;
+ }
+
+ nt_hash = talloc(cred, struct samr_Password);
+ if (nt_hash == NULL) {
+ return NULL;
+ }
+
+ if (password_is_nt_hash) {
+ size_t password_len = strlen(password);
+ size_t converted;
+
+ converted = strhex_to_str((char *)nt_hash->hash,
+ sizeof(nt_hash->hash),
+ password, password_len);
+ if (converted != sizeof(nt_hash->hash)) {
+ TALLOC_FREE(nt_hash);
+ return false;
+ }
+ } else {
E_md4hash(password, nt_hash->hash);
+ }

- return nt_hash;
+ cred->nt_hash = nt_hash;
+ nt_hash = NULL;
+
+return_hash:
+ nt_hash = talloc(mem_ctx, struct samr_Password);
+ if (nt_hash == NULL) {
+ return NULL;
}

- return NULL;
+ *nt_hash = *cred->nt_hash;
+
+ return nt_hash;
}

/**
@@ -744,6 +781,14 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials,
}

if ((p = strchr_m(uname,'@'))) {
+ /*
+ * We also need to set username and domain
+ * in order to undo the effect of
+ * cli_credentials_guess().
+ */
+ cli_credentials_set_username(credentials, uname, obtained);
+ cli_credentials_set_domain(credentials, "", obtained);
+
cli_credentials_set_principal(credentials, uname, obtained);
*p = 0;
cli_credentials_set_realm(credentials, p+1, obtained);
@@ -752,9 +797,40 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials,
|| (p = strchr_m(uname, '/'))
|| (p = strchr_m(uname, credentials->winbind_separator)))
{
+ const char *domain = NULL;
+
+ domain = uname;
*p = 0;
- cli_credentials_set_domain(credentials, uname, obtained);
uname = p+1;
+
+ if (obtained == credentials->realm_obtained &&
+ !strequal_m(credentials->domain, domain))
+ {
+ /*
+ * We need to undo a former set with the same level
+ * in order to get the expected result from
+ * cli_credentials_get_principal().
+ *
+ * But we only need to do that if the domain
+ * actually changes.
+ */
+ cli_credentials_set_realm(credentials, domain, obtained);
+ }
+ cli_credentials_set_domain(credentials, domain, obtained);
+ }
+ if (obtained == credentials->principal_obtained &&
+ !strequal_m(credentials->username, uname))
+ {
+ /*
+ * We need to undo a former set with the same level
+ * in order to get the expected result from
+ * cli_credentials_get_principal().
+ *
+ * But we only need to do that if the username
+ * actually changes.
+ */
+ credentials->principal_obtained = CRED_UNINITIALISED;
+ credentials->principal = NULL;
}
cli_credentials_set_username(credentials, uname, obtained);
}
@@ -800,6 +876,7 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
struct loadparm_context *lp_ctx)
{
const char *sep = NULL;
+ const char *realm = lpcfg_realm(lp_ctx);

cli_credentials_set_username(cred, "", CRED_UNINITIALISED);
if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) {
@@ -812,10 +889,13 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
} else {
cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED);
}
+ if (realm != NULL && strlen(realm) == 0) {
+ realm = NULL;
+ }
if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) {
- cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_SPECIFIED);
+ cli_credentials_set_realm(cred, realm, CRED_SPECIFIED);
} else {
- cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_UNINITIALISED);
+ cli_credentials_set_realm(cred, realm, CRED_UNINITIALISED);
}

sep = lpcfg_winbind_separator(lp_ctx);
@@ -1037,6 +1117,10 @@ _PUBLIC_ bool cli_credentials_parse_file(struct cli_credentials *cred, const cha
char *ptr, *val, *param;
char **lines;
int i, numlines;
+ const char *realm = NULL;
+ const char *domain = NULL;
+ const char *password = NULL;
+ const char *username = NULL;

lines = file_lines_load(file, &numlines, 0, NULL);

@@ -1067,17 +1151,57 @@ _PUBLIC_ bool cli_credentials_parse_file(struct cli_credentials *cred, const cha
val++;

if (strwicmp("password", param) == 0) {
- cli_credentials_set_password(cred, val, obtained);
+ password = val;
} else if (strwicmp("username", param) == 0) {
- cli_credentials_set_username(cred, val, obtained);
+ username = val;
} else if (strwicmp("domain", param) == 0) {
- cli_credentials_set_domain(cred, val, obtained);
+ domain = val;
} else if (strwicmp("realm", param) == 0) {
- cli_credentials_set_realm(cred, val, obtained);
+ realm = val;
}
- memset(lines[i], 0, len);
+
+ /*
+ * We need to readd '=' in order to let
+ * the strlen() work in the last loop
+ * that clears the memory.
+ */
+ *ptr = '=';
+ }
+
+ if (realm != NULL && strlen(realm) != 0) {
+ /*
+ * only overwrite with a valid string
+ */
+ cli_credentials_set_realm(cred, realm, obtained);
}

+ if (domain != NULL && strlen(domain) != 0) {
+ /*
+ * only overwrite with a valid string
+ */
+ cli_credentials_set_domain(cred, domain, obtained);
+ }
+
+ if (password != NULL) {
+ /*
+ * Here we allow "".
+ */
+ cli_credentials_set_password(cred, password, obtained);
+ }
+
+ if (username != NULL) {
+ /*
+ * The last "username" line takes preference
+ * if the string also contains domain, realm or
+ * password.
+ */
+ cli_credentials_parse_string(cred, username, obtained);
+ }
+
+ for (i = 0; i < numlines; i++) {
+ len = strlen(lines[i]);
+ memset(lines[i], 0, len);
+ }
talloc_free(lines);

return true;
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
index 523793f..6b0d83b 100644
--- a/auth/credentials/credentials.h
+++ b/auth/credentials/credentials.h
@@ -201,6 +201,8 @@ bool cli_credentials_set_utf16_password(struct cli_credentials *cred,
enum credentials_obtained obtained);
bool cli_credentials_set_old_utf16_password(struct cli_credentials *cred,
const DATA_BLOB *password_utf16);
+void cli_credentials_set_password_will_be_nt_hash(struct cli_credentials *cred,
+ bool val);
bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
const struct samr_Password *nt_hash,
enum credentials_obtained obtained);
diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h
index f88ae70..68f1f25 100644
--- a/auth/credentials/credentials_internal.h
+++ b/auth/credentials/credentials_internal.h
@@ -115,6 +115,8 @@ struct cli_credentials {
bool callback_running;

char winbind_separator;
+
+ bool password_will_be_nt_hash;
};

#endif /* __CREDENTIALS_INTERNAL_H__ */
diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c
index 2a4c141..e6859bf 100644
--- a/auth/credentials/credentials_ntlm.c
+++ b/auth/credentials/credentials_ntlm.c
@@ -301,6 +301,8 @@ _PUBLIC_ bool cli_credentials_set_utf16_password(struct cli_credentials *cred,
const DATA_BLOB *password_utf16,
enum credentials_obtained obtained)
{
+ cred->password_will_be_nt_hash = false;
+
if (password_utf16 == NULL) {
--
Samba Shared Repository
Andreas Schneider
2016-12-19 12:42:03 UTC
Permalink
The branch, master has been updated
via b38f1ae s3:utils: Use cli_cm_force_encryption() instead of cli_force_encryption()
via 6e122ee s3:libsmb: Use cli_cm_force_encryption() instead of cli_force_encryption()
via cb83be2 s3:libsmb: don't let cli_session_creds_init() overwrite the default domain with ""
via a579151 s3:libsmb: split out a cli_session_creds_prepare_krb5() function
via b17543a s3:torture/masktest: masktest only works with SMB1 currently
via 6a5943c s3:torture/masktest: Use cli_tree_connect_creds()
via 65be3af s3:torture: Use cli_tree_connect_creds() where we may use share level auth
via af97833 s3:lib/netapi: Use lp_client_ipc_max_protocol() in libnetapi_open_ipc_connection()
from 59dc07e ctdb-tests: Remove the python LCP2 simulation

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit b38f1aee4092cd621081614dce34a86d0d70afff
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Nov 3 15:11:29 2016 +0100

s3:utils: Use cli_cm_force_encryption() instead of cli_force_encryption()

This allows SMB3 encryption instead of returning NT_STATUS_NOT_SUPPORTED.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Andreas Schneider <***@cryptomilk.org>
Autobuild-Date(master): Mon Dec 19 13:41:15 CET 2016 on sn-devel-144

commit 6e122eef71c05c76d26ffce0ce7c4c4750f428f8
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Nov 3 15:11:29 2016 +0100

s3:libsmb: Use cli_cm_force_encryption() instead of cli_force_encryption()

This allows SMB3 encryption instead of returning NT_STATUS_NOT_SUPPORTED.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit cb83be2f01585cad35e6dba7b60cff301ce08058
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 16 01:26:29 2016 +0100

s3:libsmb: don't let cli_session_creds_init() overwrite the default domain with ""

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit a579151ee7a613b11d66a56938e7d894bd4e89a6
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 8 12:11:45 2016 +0100

s3:libsmb: split out a cli_session_creds_prepare_krb5() function

This can be used temporarily to do the required kinit if we use kerberos
and the password has been specified.

In future this should be done in the gensec layer on demand, but there's
more work attached to doing it in the gensec_gse module.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit b17543a584f0919b7491bcfc3cd20cf47a9beed1
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 9 09:49:17 2016 +0100

s3:torture/masktest: masktest only works with SMB1 currently

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 6a5943cfd010ce54787fd404fffb4003f4ed6363
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 9 09:49:17 2016 +0100

s3:torture/masktest: Use cli_tree_connect_creds()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 65be3af952791de16a683a1fefc6d5721822245a
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 9 09:06:21 2016 +0100

s3:torture: Use cli_tree_connect_creds() where we may use share level auth

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit af9783300c8f2c8c56e958139750e4df7a868a44
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 9 09:48:06 2016 +0100

s3:lib/netapi: Use lp_client_ipc_max_protocol() in libnetapi_open_ipc_connection()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
source3/lib/netapi/cm.c | 2 +-
source3/libsmb/cliconnect.c | 300 ++++++++++++++++++++++-------------------
source3/libsmb/libsmb_server.c | 24 ++--
source3/libsmb/proto.h | 2 +
source3/torture/masktest.c | 4 +-
source3/torture/torture.c | 4 +-
source3/utils/net_util.c | 28 +---
7 files changed, 188 insertions(+), 176 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c
index 2649422..57e44ac 100644
--- a/source3/lib/netapi/cm.c
+++ b/source3/lib/netapi/cm.c
@@ -111,7 +111,7 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx,
server_name, "IPC$",
auth_info,
false, false,
- lp_client_max_protocol(),
+ lp_client_ipc_max_protocol(),
0, 0x20, &cli_ipc);
if (!NT_STATUS_IS_OK(status)) {
cli_ipc = NULL;
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 559712e..02c465c 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -72,10 +72,6 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx,
}
cli_credentials_set_conf(creds, lp_ctx);

- if (domain == NULL) {
- domain = "";
- }
-
if (username == NULL) {
username = "";
}
@@ -159,11 +155,13 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx,
goto fail;
}

- ok = cli_credentials_set_domain(creds,
- domain,
- CRED_SPECIFIED);
- if (!ok) {
- goto fail;
+ if (domain != NULL) {
+ ok = cli_credentials_set_domain(creds,
+ domain,
+ CRED_SPECIFIED);
+ if (!ok) {
+ goto fail;
+ }
}

if (principal != NULL) {
@@ -219,6 +217,154 @@ fail:
return NULL;
}

+NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
+ struct cli_credentials *creds)
+{
+ TALLOC_CTX *frame = talloc_stackframe();
+ const char *user_principal = NULL;
+ const char *user_account = NULL;
+ const char *user_domain = NULL;
+ const char *pass = NULL;
+ const char *target_hostname = NULL;
+ const DATA_BLOB *server_blob = NULL;
+ enum credentials_use_kerberos krb5_state;
+ bool try_kerberos = false;
+ bool need_kinit = false;
+ bool auth_requested = true;
+ int ret;
+
+ target_hostname = smbXcli_conn_remote_name(cli->conn);
+ if (!cli->got_kerberos_mechanism) {
+ server_blob = smbXcli_conn_server_gss_blob(cli->conn);
+ }
+
+ /* the server might not even do spnego */
+ if (server_blob != NULL && server_blob->length != 0) {
+ char *OIDs[ASN1_MAX_OIDS] = { NULL, };
+ size_t i;
+ bool ok;
+
+ /*
+ * The server sent us the first part of the SPNEGO exchange in the
+ * negprot reply. It is WRONG to depend on the principal sent in the
+ * negprot reply, but right now we do it. If we don't receive one,
+ * we try to best guess, then fall back to NTLM.
+ */
+ ok = spnego_parse_negTokenInit(frame,
+ *server_blob,
+ OIDs,
+ NULL,
+ NULL);
+ if (!ok) {
+ TALLOC_FREE(frame);
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ if (OIDs[0] == NULL) {
+ TALLOC_FREE(frame);
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /* make sure the server understands kerberos */
+ for (i = 0; OIDs[i] != NULL; i++) {
+ if (i == 0) {
+ DEBUG(3,("got OID=%s\n", OIDs[i]));
+ } else {
+ DEBUGADD(3,("got OID=%s\n", OIDs[i]));
+ }
+
+ if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
+ strcmp(OIDs[i], OID_KERBEROS5) == 0) {
+ cli->got_kerberos_mechanism = true;
+ break;
+ }
+ }
+ }
+
+ auth_requested = cli_credentials_authentication_requested(creds);
+ if (auth_requested) {
+ user_principal = cli_credentials_get_principal(creds, frame);
+ if (user_principal == NULL) {
+ TALLOC_FREE(frame);
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
+ user_account = cli_credentials_get_username(creds);
+ user_domain = cli_credentials_get_domain(creds);
+ pass = cli_credentials_get_password(creds);
+
+ krb5_state = cli_credentials_get_kerberos_state(creds);
+
+ if (krb5_state != CRED_DONT_USE_KERBEROS) {
+ try_kerberos = true;
+ }
+
+ if (target_hostname == NULL) {
+ try_kerberos = false;
+ } else if (is_ipaddress(target_hostname)) {
+ try_kerberos = false;
+ } else if (strequal(target_hostname, "localhost")) {
+ try_kerberos = false;
+ } else if (strequal(target_hostname, STAR_SMBSERVER)) {
+ try_kerberos = false;
+ } else if (!auth_requested) {
+ try_kerberos = false;
+ }
+
+ if (krb5_state == CRED_MUST_USE_KERBEROS && !try_kerberos) {
+ DEBUG(0, ("Kerberos auth with '%s' (%s\\%s) to access "
+ "'%s' not possible\n",
+ user_principal, user_domain, user_account,
+ target_hostname));
+ TALLOC_FREE(frame);
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ if (pass == NULL || strlen(pass) == 0) {
+ need_kinit = false;
+ } else if (krb5_state == CRED_MUST_USE_KERBEROS) {
+ need_kinit = try_kerberos;
+ } else if (!cli->got_kerberos_mechanism) {
+ /*
+ * Most likely the server doesn't support
+ * Kerberos, don't waste time doing a kinit
+ */
+ need_kinit = false;
+ } else {
+ need_kinit = try_kerberos;
+ }
+
+ if (!need_kinit) {
+ TALLOC_FREE(frame);
+ return NT_STATUS_OK;
+ }
+
+
+ /*
+ * TODO: This should be done within the gensec layer
+ * only if required!
+ */
+ setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
+ ret = kerberos_kinit_password(user_principal, pass,
+ 0 /* no time correction for now */,
+ NULL);
+ if (ret != 0) {
+ DEBUG(0, ("Kinit for %s to access %s failed: %s\n",
+ user_principal, target_hostname,
+ error_message(ret)));
+ if (krb5_state == CRED_MUST_USE_KERBEROS) {
+ TALLOC_FREE(frame);
+ return krb5_to_nt_status(ret);
+ }
+
+ /*
+ * Ignore the error and hope that NTLM will work
+ */
+ }
+
+ TALLOC_FREE(frame);
+ return NT_STATUS_OK;
+}
+
/********************************************************
Utility function to ensure we always return at least
a valid char * pointer to an empty string for the
@@ -689,14 +835,6 @@ static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
}

/****************************************************************************
- Use in-memory credentials cache
-****************************************************************************/
-
-static void use_in_memory_ccache(void) {
- setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
-}
-
-/****************************************************************************
Do a spnego/NTLMSSP encrypted session setup.
****************************************************************************/

@@ -1089,16 +1227,9 @@ static struct tevent_req *cli_session_setup_spnego_send(
{
struct tevent_req *req, *subreq;
struct cli_session_setup_spnego_state *state;
- const char *user_principal = NULL;
- const char *user_account = NULL;
- const char *user_domain = NULL;
- const char *pass = NULL;
+ const char *target_service = NULL;
const char *target_hostname = NULL;
- const DATA_BLOB *server_blob = NULL;
- enum credentials_use_kerberos krb5_state;
- bool try_kerberos = false;
- bool need_kinit = false;
- bool auth_requested = true;
+ NTSTATUS status;

req = tevent_req_create(mem_ctx, &state,
struct cli_session_setup_spnego_state);
@@ -1106,123 +1237,16 @@ static struct tevent_req *cli_session_setup_spnego_send(
return NULL;
}

+ target_service = "cifs";
target_hostname = smbXcli_conn_remote_name(cli->conn);
- server_blob = smbXcli_conn_server_gss_blob(cli->conn);
-
- /* the server might not even do spnego */
- if (server_blob != NULL && server_blob->length != 0) {
- char *principal = NULL;
- char *OIDs[ASN1_MAX_OIDS];
- int i;
-
- /* The server sent us the first part of the SPNEGO exchange in the
- * negprot reply. It is WRONG to depend on the principal sent in the
- * negprot reply, but right now we do it. If we don't receive one,
- * we try to best guess, then fall back to NTLM. */
- if (!spnego_parse_negTokenInit(state, *server_blob, OIDs,
- &principal, NULL) ||
- OIDs[0] == NULL) {
- state->result = ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
- tevent_req_done(req);
- return tevent_req_post(req, ev);
- }
- TALLOC_FREE(principal);

- /* make sure the server understands kerberos */
- for (i = 0; OIDs[i] != NULL; i++) {
- if (i == 0) {
- DEBUG(3,("got OID=%s\n", OIDs[i]));
- } else {
- DEBUGADD(3,("got OID=%s\n", OIDs[i]));
- }
-
- if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
- strcmp(OIDs[i], OID_KERBEROS5) == 0) {
- cli->got_kerberos_mechanism = True;
- }
- talloc_free(OIDs[i]);
- }
- }
-
- auth_requested = cli_credentials_authentication_requested(creds);
- if (auth_requested) {
- user_principal = cli_credentials_get_principal(creds, state);
- if (tevent_req_nomem(user_principal, req)) {
- return tevent_req_post(req, ev);
- }
- }
- user_account = cli_credentials_get_username(creds);
- user_domain = cli_credentials_get_domain(creds);
- pass = cli_credentials_get_password(creds);
-
- krb5_state = cli_credentials_get_kerberos_state(creds);
-
- if (krb5_state != CRED_DONT_USE_KERBEROS) {
- try_kerberos = true;
- }
-
- if (target_hostname == NULL) {
- try_kerberos = false;
- } else if (is_ipaddress(target_hostname)) {
- try_kerberos = false;
- } else if (strequal(target_hostname, "localhost")) {
- try_kerberos = false;
- } else if (strequal(target_hostname, STAR_SMBSERVER)) {
- try_kerberos = false;
- } else if (!auth_requested) {
- try_kerberos = false;
- }
-
- if (krb5_state == CRED_MUST_USE_KERBEROS && !try_kerberos) {
- DEBUG(0, ("Kerberos auth with '%s' (%s\\%s) to access "
- "'%s' not possible\n",
- user_principal, user_domain, user_account,
- target_hostname));
- tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
- return tevent_req_post(req, ev);
- }
-
- if (pass == NULL || strlen(pass) == 0) {
- need_kinit = false;
- } else if (krb5_state == CRED_MUST_USE_KERBEROS) {
- need_kinit = try_kerberos;
- } else if (!cli->got_kerberos_mechanism) {
- /*
- * Most likely the server doesn't support
- * Kerberos, don't waste time doing a kinit
- */
- need_kinit = false;
- } else {
- need_kinit = try_kerberos;
- }
-
- if (need_kinit) {
- int ret;
-
- use_in_memory_ccache();
- ret = kerberos_kinit_password(user_principal, pass,
- 0 /* no time correction for now */,
- NULL);
-
- if (ret != 0) {
- DEBUG(0, ("Kinit for %s to access %s failed: %s\n",
- user_principal, target_hostname,
- error_message(ret)));
- if (krb5_state == CRED_MUST_USE_KERBEROS) {
- state->result = ADS_ERROR_KRB5(ret);
- tevent_req_done(req);
- return tevent_req_post(req, ev);
- }
-
- /*
- * Ignore the error and hope that NTLM will work
- */
- ret = 0;
- }
+ status = cli_session_creds_prepare_krb5(cli, creds);
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);;
}

subreq = cli_session_setup_gensec_send(state, ev, cli, creds,
- "cifs", target_hostname);
+ target_service, target_hostname);
if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);
}
diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
index 438b7e6..e0cdc97 100644
--- a/source3/libsmb/libsmb_server.c
+++ b/source3/libsmb/libsmb_server.c
@@ -587,11 +587,13 @@ SMBC_server_internal(TALLOC_CTX *ctx,
}

if (context->internal->smb_encryption_level) {
- /* Attempt UNIX smb encryption. */
- if (!NT_STATUS_IS_OK(cli_force_encryption(c,
- username_used,
- password_used,
- *pp_workgroup))) {
+ /* Attempt encryption. */
+ status = cli_cm_force_encryption(c,
+ username_used,
+ password_used,
+ *pp_workgroup,
+ share);
+ if (!NT_STATUS_IS_OK(status)) {

/*
* context->smb_encryption_level == 1
@@ -787,11 +789,13 @@ SMBC_attr_server(TALLOC_CTX *ctx,
}

if (context->internal->smb_encryption_level) {
- /* Attempt UNIX smb encryption. */
- if (!NT_STATUS_IS_OK(cli_force_encryption(ipc_cli,
- *pp_username,
- *pp_password,
- *pp_workgroup))) {
+ /* Attempt encryption. */
+ nt_status = cli_cm_force_encryption(ipc_cli,
+ *pp_username,
+ *pp_password,
+ *pp_workgroup,
+ "IPC$");
+ if (!NT_STATUS_IS_OK(nt_status)) {

/*
* context->smb_encryption_level ==
diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h
index e1cd185..290183c 100644
--- a/source3/libsmb/proto.h
+++ b/source3/libsmb/proto.h
@@ -43,6 +43,8 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx,
bool fallback_after_kerberos,
bool use_ccache,
bool password_is_nt_hash);
+NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
+ struct cli_credentials *creds);
struct tevent_req *cli_session_setup_creds_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct cli_state *cli,
diff --git a/source3/torture/masktest.c b/source3/torture/masktest.c
index 537cfb0..95e0b04 100644
--- a/source3/torture/masktest.c
+++ b/source3/torture/masktest.c
@@ -218,8 +218,7 @@ static struct cli_state *connect_one(char *share)

DEBUG(4,(" session setup ok\n"));

- status = cli_tree_connect(c, share, "?????", password,
- strlen(password)+1);
+ status = cli_tree_connect_creds(c, share, "?????", test_creds);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(0,("tree connect failed: %s\n", nt_errstr(status)));
cli_shutdown(c);
@@ -537,6 +536,7 @@ static void usage(void)
argv += optind;

max_protocol = lp_client_max_protocol();
+ max_protocol = MIN(max_protocol, PROTOCOL_NT1);

if (!got_pass) {
char pwd[256] = {0};
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 8f0f136..7072f3c 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -1341,7 +1341,7 @@ static bool run_tcon_test(int dummy)
return False;
}

- status = cli_tree_connect(cli, share, "?????", password);
+ status = cli_tree_connect_creds(cli, share, "?????", torture_creds);
if (!NT_STATUS_IS_OK(status)) {
printf("%s refused 2nd tree connect (%s)\n", host,
nt_errstr(status));
@@ -1466,7 +1466,7 @@ static bool tcon_devtest(struct cli_state *cli,
NTSTATUS status;
bool ret;

- status = cli_tree_connect(cli, myshare, devtype, password);
+ status = cli_tree_connect_creds(cli, myshare, devtype, torture_creds);

if (NT_STATUS_IS_OK(expected_error)) {
if (NT_STATUS_IS_OK(status)) {
diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c
index cc65457..86a4667 100644
--- a/source3/utils/net_util.c
+++ b/source3/utils/net_util.c
@@ -155,29 +155,11 @@ NTSTATUS connect_to_service(struct net_context *c,
}

if (c->smb_encrypt) {
- nt_status = cli_force_encryption(*cli_ctx,
- c->opt_user_name,
- c->opt_password,
- c->opt_workgroup);
-
- if (NT_STATUS_EQUAL(nt_status,NT_STATUS_NOT_SUPPORTED)) {
- d_printf(_("Encryption required and "
- "server that doesn't support "
- "UNIX extensions - failing connect\n"));
- } else if (NT_STATUS_EQUAL(nt_status,NT_STATUS_UNKNOWN_REVISION)) {
- d_printf(_("Encryption required and "
- "can't get UNIX CIFS extensions "
- "version from server.\n"));
- } else if (NT_STATUS_EQUAL(nt_status,NT_STATUS_UNSUPPORTED_COMPRESSION)) {
- d_printf(_("Encryption required and "
- "share %s doesn't support "
- "encryption.\n"), service_name);
- } else if (!NT_STATUS_IS_OK(nt_status)) {
- d_printf(_("Encryption required and "
- "setup failed with error %s.\n"),
- nt_errstr(nt_status));
- }
-
+ nt_status = cli_cm_force_encryption(*cli_ctx,
+ c->opt_user_name,
+ c->opt_password,
+ c->opt_workgroup,
+ service_name);
--
Samba Shared Repository
Stefan Metzmacher
2016-12-24 20:05:03 UTC
Permalink
The branch, master has been updated
via 1e52bb9 krb5_wrap: fix smb_krb5_cc_copy_creds() for MIT krb5
via 6308671 auth/credentials: Add missing error code check for MIT Kerberos
via fd98174 auth/gensec: Fix typo in log message
via 99d8788 auth/gensec: Remove unneeded cli_credentials_set_conf() call
via 5aa00d9 WHATSNEW: Add text for AD DC changes
from 77b51ba ldb_tdb: avoid erroneous error messages

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 1e52bb9c34a77c8c79f0bfc81317aded183ada59
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 23 07:22:27 2016 +0100

krb5_wrap: fix smb_krb5_cc_copy_creds() for MIT krb5

krb5_cc_copy_creds() expects an already initialized output cache.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Sat Dec 24 21:04:23 CET 2016 on sn-devel-144

commit 630867196b9e9d1096443f979b32957c5a0d2be2
Author: Andreas Schneider <***@samba.org>
Date: Thu Dec 22 17:01:35 2016 +0100

auth/credentials: Add missing error code check for MIT Kerberos

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit fd98174443543ee3a150a10b056b45c4663bd7f7
Author: Andreas Schneider <***@samba.org>
Date: Tue Dec 13 11:33:06 2016 +0100

auth/gensec: Fix typo in log message

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 99d87880282dad4f9a5a6d9f1018329bb00e5112
Author: David Mulder <***@suse.com>
Date: Wed Dec 21 21:49:36 2016 +0100

auth/gensec: Remove unneeded cli_credentials_set_conf() call

The cli_credentials_set_client_gss_creds() will set the correct realm
from the gss creds.

Pair-Programmed-With: Andreas Schneider <***@samba.org>
Pair-Programmed-With: Stefan Metzmacher <***@samba.org>

Signed-off-by: David Mulder <***@suse.com>
Signed-off-by: Andreas Schneider <***@samba.org>
Signed-off-by: Stefan Metzmacher <***@samba.org>

commit 5aa00d92ad31a241376263029318182165ee6707
Author: Andrew Bartlett <***@samba.org>
Date: Fri Dec 23 13:55:30 2016 +1300

WHATSNEW: Add text for AD DC changes

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
WHATSNEW.txt | 44 +++++++++++++++++++++++++++++++++++++
auth/credentials/credentials_krb5.c | 6 ++++-
lib/krb5_wrap/krb5_samba.c | 12 ++++++++++
source4/auth/gensec/gensec_gssapi.c | 16 ++++++++------
4 files changed, 70 insertions(+), 8 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index f542a5b..b512796 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -81,6 +81,48 @@ A new option, "unix only", enables this feature only for the UNIX owner
of the file, not affecting the SID owner in the Windows NT ACL of the
file. This can be used to emulate something very similar to folder quotas.

+Multi-process Netlogon support
+------------------------------
+
+The Netlogon server in the Samba AD DC can now run as multiple
+processes. The Netlogon server is a part of the AD DC that handles
+NTLM authentication on behalf of domain members, including file
+servers, NTLM-authenticated web servers and 802.1x gateways. The
+previous restriction to running as a single process has been removed,
+and it will now run in the same process model as the rest of the
+'samba' binary.
+
+As part of this change, the NETLOGON service will now run on a distinct
+TCP port, rather than being shared with all other RPC services (LSA,
+SAMR, DRSUAPI etc).
+
+new options for controlling TCP ports used for RPC services
+-----------------------------------------------------------
+
+The new 'rpc server port' option controls the default port used for
+RPC services other than Netlogon. The Netlogon server honours instead
+the 'rpc server port:netlogon' option. The default value for both
+these options is the first available port including or after 1024.
+
+Improve AD performance and replication improvements
+---------------------------------------------------
+
+Samba's LDB and replication code continues to improve, particularly in
+respect to the handling of large numbers of linked attributes. We now
+respect an 'uptodateness vector' which will dramatically reduce the
+over-replication of links from new DCs. We have also made the parsing
+of on-disk linked attributes much more efficient.
+
+DNS improvements
+---------------------------
+
+The samba-tool dns subcommand is now much more robust and can delete
+records in a number of situations where it was not possible to do so
+in the past.
+
+On the server side, DNS names are now more strictly validated.
+
+
CTDB changes
------------

@@ -145,6 +187,8 @@ smb.conf changes
kerberos encryption types New all
inherit owner New option
fruit:resource Spelling correction
+ lsa over netlogon New (deprecated) no
+ rpc server port New 0


KNOWN ISSUES
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index ca62e30..e974df9 100644
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -581,7 +581,11 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,

maj_stat = gss_krb5_import_cred(&min_stat, ccache->ccache, NULL, NULL,
&gcc->creds);
- if ((maj_stat == GSS_S_FAILURE) && (min_stat == (OM_uint32)KRB5_CC_END || min_stat == (OM_uint32) KRB5_CC_NOTFOUND)) {
+ if ((maj_stat == GSS_S_FAILURE) &&
+ (min_stat == (OM_uint32)KRB5_CC_END ||
+ min_stat == (OM_uint32)KRB5_CC_NOTFOUND ||
+ min_stat == (OM_uint32)KRB5_FCC_NOFILE))
+ {
/* This CCACHE is no good. Ensure we don't use it again */
cli_credentials_unconditionally_invalidate_ccache(cred);

diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index a8eafcd..307be93 100644
--- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c
@@ -2899,6 +2899,18 @@ krb5_error_code smb_krb5_cc_copy_creds(krb5_context context,
#ifdef HAVE_KRB5_CC_COPY_CACHE /* Heimdal */
return krb5_cc_copy_cache(context, incc, outcc);
#elif defined(HAVE_KRB5_CC_COPY_CREDS)
+ krb5_error_code ret;
+ krb5_principal princ = NULL;
+
+ ret = krb5_cc_get_principal(context, incc, &princ);
+ if (ret != 0) {
+ return ret;
+ }
+ ret = krb5_cc_initialize(context, outcc, princ);
+ krb5_free_principal(context, princ);
+ if (ret != 0) {
+ return ret;
+ }
return krb5_cc_copy_creds(context, incc, outcc);
#else
#error UNKNOWN_KRB5_CC_COPY_CACHE_OR_CREDS_FUNCTION
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index a37a0a9..a6c4019 100644
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -221,7 +221,7 @@ static NTSTATUS gensec_gssapi_server_start(struct gensec_security *gensec_securi
ret = cli_credentials_get_server_gss_creds(machine_account,
gensec_security->settings->lp_ctx, &gcc);
if (ret) {
- DEBUG(1, ("Aquiring acceptor credentials failed: %s\n",
+ DEBUG(1, ("Acquiring acceptor credentials failed: %s\n",
error_message(ret)));
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
}
@@ -1311,16 +1311,18 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi
const char *error_string;

DEBUG(10, ("gensec_gssapi: delegated credentials supplied by client\n"));
- session_info->credentials = cli_credentials_init(session_info);
- if (!session_info->credentials) {
+
+ /*
+ * Create anonymous credentials for now.
+ *
+ * We will update them with the provided client gss creds.
+ */
+ session_info->credentials = cli_credentials_init_anon(session_info);
+ if (session_info->credentials == NULL) {
talloc_free(tmp_ctx);
return NT_STATUS_NO_MEMORY;
}

- cli_credentials_set_conf(session_info->credentials, gensec_security->settings->lp_ctx);
- /* Just so we don't segfault trying to get at a username */
- cli_credentials_set_anonymous(session_info->credentials);
-
ret = cli_credentials_set_client_gss_creds(session_info->credentials,
gensec_security->settings->lp_ctx,
gensec_gssapi_state->delegated_cred_handle,
--
Samba Shared Repository
David Disseldorp
2016-12-27 17:06:03 UTC
Permalink
The branch, master has been updated
via a25fb5c idmap_rid: Add the error string in a debug
via 3d875e7 idmap_autorid: Add the error string in a debug
via 462e8ce ctdb: Fix CID 1398175 Dereference after null check
via 96924f7 ctdb: Fix CID 1398178 Argument cannot be negative
via 93e8876 ctdb: Fix CID 1398179 Argument cannot be negative
via 055650e lib: Fix a comment in idmap_cache.c
via 92daaa9 lib: Fix whitespace in lmhosts.c
via b26d441 idl: Fix a comment typo
from 1e52bb9 krb5_wrap: fix smb_krb5_cc_copy_creds() for MIT krb5

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit a25fb5cae26a26aa3b994824b57e34624727b2a5
Author: Volker Lendecke <***@samba.org>
Date: Sun Dec 11 19:57:20 2016 +0100

idmap_rid: Add the error string in a debug

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): David Disseldorp <***@samba.org>
Autobuild-Date(master): Tue Dec 27 18:05:13 CET 2016 on sn-devel-144

commit 3d875e7e9ee1df368532b7962dd5de12faf1c87a
Author: Volker Lendecke <***@samba.org>
Date: Sun Dec 11 19:57:12 2016 +0100

idmap_autorid: Add the error string in a debug

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

commit 462e8cea04856eb5c82260a817f7d70770724d2e
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 10:50:29 2016 +0000

ctdb: Fix CID 1398175 Dereference after null check

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

commit 96924f75535f12ad4eb971a2b713b3ba3590ee1e
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 10:48:21 2016 +0000

ctdb: Fix CID 1398178 Argument cannot be negative

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

commit 93e8876635f56da419ae050223503cec524bfd9e
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 10:47:10 2016 +0000

ctdb: Fix CID 1398179 Argument cannot be negative

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

commit 055650ecb65f1d1d98ca97f9b938d33fe84bd28e
Author: Volker Lendecke <***@samba.org>
Date: Wed Dec 21 09:48:15 2016 +0000

lib: Fix a comment in idmap_cache.c

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

commit 92daaa97904a713236ebe3fb5cd53601fbe1c5b7
Author: Volker Lendecke <***@samba.org>
Date: Mon Dec 19 19:32:46 2016 +0100

lib: Fix whitespace in lmhosts.c

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

commit b26d441deab0fc79e0a5bae984a296ec2263b353
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 6 12:23:33 2016 +0000

idl: Fix a comment typo

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
ctdb/common/sock_daemon.c | 2 +-
ctdb/common/sock_io.c | 1 -
ctdb/server/ctdb_takeover_helper.c | 2 +-
libcli/nbt/lmhosts.c | 8 ++++----
librpc/idl/dnsserver.idl | 2 +-
source3/lib/idmap_cache.c | 8 ++++----
source3/winbindd/idmap_autorid.c | 5 +++--
source3/winbindd/idmap_rid.c | 4 +++-
8 files changed, 17 insertions(+), 15 deletions(-)


Changeset truncated at 500 lines:

diff --git a/ctdb/common/sock_daemon.c b/ctdb/common/sock_daemon.c
index 0a6573c..dc5dba0 100644
--- a/ctdb/common/sock_daemon.c
+++ b/ctdb/common/sock_daemon.c
@@ -282,7 +282,7 @@ static int sock_socket_init(TALLOC_CTX *mem_ctx, const char *sockpath,

static int sock_socket_destructor(struct sock_socket *sock)
{
- if (sock->fd == -1) {
+ if (sock->fd != -1) {
close(sock->fd);
sock->fd = -1;
}
diff --git a/ctdb/common/sock_io.c b/ctdb/common/sock_io.c
index 7245d4e..b3581fc 100644
--- a/ctdb/common/sock_io.c
+++ b/ctdb/common/sock_io.c
@@ -53,7 +53,6 @@ int sock_connect(const char *sockpath)
fd = socket(AF_UNIX, SOCK_STREAM, 0);
if (fd == -1) {
D_ERR("socket() failed, errno=%d\n", errno);
- close(fd);
return -1;
}

diff --git a/ctdb/server/ctdb_takeover_helper.c b/ctdb/server/ctdb_takeover_helper.c
index 847a49d..3057528 100644
--- a/ctdb/server/ctdb_takeover_helper.c
+++ b/ctdb/server/ctdb_takeover_helper.c
@@ -111,7 +111,7 @@ static struct tevent_req *get_public_ips_send(

req = tevent_req_create(mem_ctx, &state, struct get_public_ips_state);
if (req == NULL) {
- return tevent_req_post(req, ev);
+ return NULL;
}

state->pnns = pnns;
diff --git a/libcli/nbt/lmhosts.c b/libcli/nbt/lmhosts.c
index 722f6ad..f47d8b9 100644
--- a/libcli/nbt/lmhosts.c
+++ b/libcli/nbt/lmhosts.c
@@ -159,9 +159,9 @@ void endlmhosts(FILE *fp)
Resolve via "lmhosts" method.
*********************************************************/

-NTSTATUS resolve_lmhosts_file_as_sockaddr(const char *lmhosts_file,
+NTSTATUS resolve_lmhosts_file_as_sockaddr(const char *lmhosts_file,
const char *name, int name_type,
- TALLOC_CTX *mem_ctx,
+ TALLOC_CTX *mem_ctx,
struct sockaddr_storage **return_iplist,
int *return_count)
{
@@ -205,8 +205,8 @@ NTSTATUS resolve_lmhosts_file_as_sockaddr(const char *lmhosts_file,
TALLOC_FREE(lmhost_name);
continue;
}
-
- *return_iplist = talloc_realloc(ctx, (*return_iplist),
+
+ *return_iplist = talloc_realloc(ctx, (*return_iplist),
struct sockaddr_storage,
(*return_count)+1);

diff --git a/librpc/idl/dnsserver.idl b/librpc/idl/dnsserver.idl
index c7742e7..50cbfbe 100644
--- a/librpc/idl/dnsserver.idl
+++ b/librpc/idl/dnsserver.idl
@@ -1,7 +1,7 @@
#include "idl_types.h"
/*
dnsserver interface definition
- for a protocol descrition see [MS-DNSP].pdf
+ for a protocol description see [MS-DNSP].pdf
*/

import "misc.idl", "dnsp.idl";
diff --git a/source3/lib/idmap_cache.c b/source3/lib/idmap_cache.c
index 11bda39..1e8a1eb 100644
--- a/source3/lib/idmap_cache.c
+++ b/source3/lib/idmap_cache.c
@@ -274,12 +274,12 @@ bool idmap_cache_find_gid2sid(gid_t gid, struct dom_sid *sid, bool *expired)
/**
* Store a mapping in the idmap cache
* @param[in] sid the sid to map
- * @param[in] gid the gid to map
+ * @param[in] unix_id the unix_id to map
*
* If both parameters are valid values, then a positive mapping in both
* directions is stored. If "is_null_sid(sid)" is true, then this will be a
- * negative mapping of gid, we want to cache that for this gid we could not
- * find anything. Likewise if "gid==-1", then we want to cache that we did not
+ * negative mapping of xid, we want to cache that for this xid we could not
+ * find anything. Likewise if "xid==-1", then we want to cache that we did not
* find a mapping for the sid passed here.
*/

@@ -315,7 +315,7 @@ void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_i
}
if (unix_id->id != -1) {
if (is_null_sid(sid)) {
- /* negative gid mapping */
+ /* negative xid mapping */
fstrcpy(value, "-");
timeout = lp_idmap_negative_cache_time();
}
diff --git a/source3/winbindd/idmap_autorid.c b/source3/winbindd/idmap_autorid.c
index c27c503..786f839 100644
--- a/source3/winbindd/idmap_autorid.c
+++ b/source3/winbindd/idmap_autorid.c
@@ -343,8 +343,9 @@ static NTSTATUS idmap_autorid_unixids_to_sids(struct idmap_domain *dom,
if ((!NT_STATUS_IS_OK(ret)) &&
(!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
/* some fatal error occurred, log it */
- DEBUG(3, ("Unexpected error resolving an ID "
- " (%d)\n", ids[i]->xid.id));
+ DBG_NOTICE("Unexpected error resolving an ID "
+ "(%d): %s\n", ids[i]->xid.id,
+ nt_errstr(ret));
goto failure;
}

diff --git a/source3/winbindd/idmap_rid.c b/source3/winbindd/idmap_rid.c
index d68dbf7..ac53705 100644
--- a/source3/winbindd/idmap_rid.c
+++ b/source3/winbindd/idmap_rid.c
@@ -143,7 +143,9 @@ static NTSTATUS idmap_rid_unixids_to_sids(struct idmap_domain *dom, struct id_ma
if (( ! NT_STATUS_IS_OK(ret)) &&
( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
/* some fatal error occurred, log it */
- DEBUG(3, ("Unexpected error resolving an ID (%d)\n", ids[i]->xid.id));
+ DBG_NOTICE("Unexpected error resolving an ID "
+ "(%d): %s\n", ids[i]->xid.id,
+ nt_errstr(ret));
}
}
--
Samba Shared Repository
Uri Simchoni
2016-12-27 23:07:04 UTC
Permalink
The branch, master has been updated
via 91d0275 winbindd: Use idmap cache in xids2sids
via f7f49a2 idmap: Prime gencache after xids2sids calls
via 9079dc4 idmap: Pass up the xid2sids unix-ids from the idmap child
from a25fb5c idmap_rid: Add the error string in a debug

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 91d027554e414f371b3237110d1c92033d929992
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 10:19:17 2016 +0000

winbindd: Use idmap cache in xids2sids

Typically smbd should have looked into the idmap cache itself before
contacting winbind. But winbind has internal users of this API (getpwuid
and getgrgid for example), and those need to use the cache too.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12484

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

Autobuild-User(master): Uri Simchoni <***@samba.org>
Autobuild-Date(master): Wed Dec 28 00:06:41 CET 2016 on sn-devel-144

commit f7f49a2354c99d95a302f070fe3aa97a949063c8
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 20 16:22:48 2016 +0100

idmap: Prime gencache after xids2sids calls

This fixes a performance regression for "hide unreadable". With an empty
gencache, we only do xid2sid calls when reading a large number of acls. We
lost caching the xid2sid calls while implmenting the multiple-id calls,
probably because at that time the bug with ID_TYPE_BOTH backends was still
pending. This patch restores the xid2sid caching hopefully correctly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12484

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 9079dc4f4501c4e868f46de41b82927b69dc78d5
Author: Volker Lendecke <***@samba.org>
Date: Wed Dec 21 11:29:08 2016 +0100

idmap: Pass up the xid2sids unix-ids from the idmap child

When asking for gid2sid with an idmap backend that does ID_TYPE_BOTH
and the sid in question is actually a user, the parent winbind needs
to know about it. The next commit will prime the gencache also after
xid2sid calls, and if we filled it with a ID_TYPE_GID entry, a later
sid2uid call would fail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12484

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
librpc/idl/winbind.idl | 2 +-
source3/winbindd/wb_xids2sids.c | 41 +++++++++++++++++++++++++++++++++++-
source3/winbindd/winbindd_dual_srv.c | 1 +
3 files changed, 42 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/librpc/idl/winbind.idl b/librpc/idl/winbind.idl
index 60c875b..ec472c5 100644
--- a/librpc/idl/winbind.idl
+++ b/librpc/idl/winbind.idl
@@ -59,7 +59,7 @@ interface winbind
NTSTATUS wbint_UnixIDs2Sids(
[in,string,charset(UTF8)] char *domain_name,
[in] uint32 num_ids,
- [in] unixid xids[num_ids],
+ [in,out] unixid xids[num_ids],
[out] dom_sid sids[num_ids]
);

diff --git a/source3/winbindd/wb_xids2sids.c b/source3/winbindd/wb_xids2sids.c
index 7fc8a72..7ac1998 100644
--- a/source3/winbindd/wb_xids2sids.c
+++ b/source3/winbindd/wb_xids2sids.c
@@ -262,7 +262,20 @@ static void wb_xids2sids_dom_done(struct tevent_req *subreq)
continue;
}

- sid_copy(&state->all_sids[i], &state->dom_sids[dom_sid_idx++]);
+ sid_copy(&state->all_sids[i], &state->dom_sids[dom_sid_idx]);
+
+ /*
+ * Prime the cache after an xid2sid call. It's
+ * important that we use state->dom_xids for the xid
+ * value, not state->all_xids: state->all_xids carries
+ * what we asked for, e.g. a
+ * ID_TYPE_UID. state->dom_xids holds something the
+ * idmap child possibly changed to ID_TYPE_BOTH.
+ */
+ idmap_cache_set_sid2unixid(
+ &state->all_sids[i], &state->dom_xids[dom_sid_idx]);
+
+ dom_sid_idx += 1;
}

tevent_req_done(req);
@@ -340,6 +353,32 @@ struct tevent_req *wb_xids2sids_send(TALLOC_CTX *mem_ctx,
return tevent_req_post(req, ev);
}

+ if (winbindd_use_idmap_cache()) {
+ uint32_t i;
+
+ for (i=0; i<num_xids; i++) {
+ struct dom_sid sid;
+ bool ok, expired;
+
+ switch (xids[i].type) {
+ case ID_TYPE_UID:
+ ok = idmap_cache_find_uid2sid(
+ xids[i].id, &sid, &expired);
+ break;
+ case ID_TYPE_GID:
+ ok = idmap_cache_find_gid2sid(
+ xids[i].id, &sid, &expired);
+ break;
+ default:
+ ok = false;
+ }
+
+ if (ok && !expired) {
+ sid_copy(&state->sids[i], &sid);
+ }
+ }
+ }
+
wb_xids2sids_init_dom_maps();
num_domains = talloc_array_length(dom_maps);

diff --git a/source3/winbindd/winbindd_dual_srv.c b/source3/winbindd/winbindd_dual_srv.c
index 4a581d33..7b80418 100644
--- a/source3/winbindd/winbindd_dual_srv.c
+++ b/source3/winbindd/winbindd_dual_srv.c
@@ -233,6 +233,7 @@ NTSTATUS _wbint_UnixIDs2Sids(struct pipes_struct *p,
}

for (i=0; i<r->in.num_ids; i++) {
+ r->out.xids[i] = maps[i]->xid;
sid_copy(&r->out.sids[i], maps[i]->sid);
}
--
Samba Shared Repository
David Disseldorp
2016-12-28 04:19:02 UTC
Permalink
The branch, master has been updated
via 3660c76 ctdb-takeover: Clean up when exiting on error
via 3b0b29b ctdb-takeover: Fix CID 1398169 Unchecked return value
via bdaa2bc ctdbd_conn: remove unused fde from struct ctdbd_connection
via dd3868a ctdbd_conn: fix a resource leak
from 91d0275 winbindd: Use idmap cache in xids2sids

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 3660c76dce8bfb8b20832cd10151f832d367d9bb
Author: Martin Schwenke <***@meltin.net>
Date: Wed Dec 28 06:18:26 2016 +1100

ctdb-takeover: Clean up when exiting on error

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): David Disseldorp <***@samba.org>
Autobuild-Date(master): Wed Dec 28 05:18:08 CET 2016 on sn-devel-144

commit 3b0b29bcb6fe5fa3555b234cb30f64e1473b2472
Author: Martin Schwenke <***@meltin.net>
Date: Wed Dec 28 06:14:56 2016 +1100

ctdb-takeover: Fix CID 1398169 Unchecked return value

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: David Disseldorp <***@samba.org>

commit bdaa2bcc1dd768d27d3696de23c1e9c6084d58d3
Author: Ralph Boehme <***@samba.org>
Date: Tue Dec 27 15:41:51 2016 +0100

ctdbd_conn: remove unused fde from struct ctdbd_connection

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12485

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

commit dd3868a5c76cc6d177c393215c6755d1b42d74a6
Author: Ralph Boehme <***@samba.org>
Date: Tue Dec 27 09:19:16 2016 +0100

ctdbd_conn: fix a resource leak

When reinitializing the ctdb messaging subsystem we must free the ctdb
connection fde.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12485

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
ctdb/server/ctdb_takeover_helper.c | 10 ++++++++--
source3/lib/ctdbd_conn.c | 2 --
source3/lib/messages_ctdbd.c | 2 ++
3 files changed, 10 insertions(+), 4 deletions(-)


Changeset truncated at 500 lines:

diff --git a/ctdb/server/ctdb_takeover_helper.c b/ctdb/server/ctdb_takeover_helper.c
index 3057528..f83b914 100644
--- a/ctdb/server/ctdb_takeover_helper.c
+++ b/ctdb/server/ctdb_takeover_helper.c
@@ -1160,11 +1160,17 @@ int main(int argc, const char *argv[])
force_rebalance_nodes = parse_node_list(mem_ctx, argv[3]);
if (force_rebalance_nodes == NULL) {
usage(argv[0]);
- exit(1);
+ ret = EINVAL;
+ goto done;
}
}

- logging_init(mem_ctx, NULL, NULL, "ctdb-takeover");
+ ret = logging_init(mem_ctx, NULL, NULL, "ctdb-takeover");
+ if (ret != 0) {
+ fprintf(stderr,
+ "ctdb-takeover: Unable to initialize logging\n");
+ goto done;
+ }

ev = tevent_context_init(mem_ctx);
if (ev == NULL) {
diff --git a/source3/lib/ctdbd_conn.c b/source3/lib/ctdbd_conn.c
index 118f3a0..d16796f 100644
--- a/source3/lib/ctdbd_conn.c
+++ b/source3/lib/ctdbd_conn.c
@@ -50,7 +50,6 @@ struct ctdbd_connection {
uint64_t rand_srvid;
struct ctdbd_srvid_cb *callbacks;
int fd;
- struct tevent_fd *fde;
int timeout;
};

@@ -394,7 +393,6 @@ static int ctdb_read_req(struct ctdbd_connection *conn, uint32_t reqid,

static int ctdbd_connection_destructor(struct ctdbd_connection *c)
{
- TALLOC_FREE(c->fde);
if (c->fd != -1) {
close(c->fd);
c->fd = -1;
diff --git a/source3/lib/messages_ctdbd.c b/source3/lib/messages_ctdbd.c
index 5964894..bee2685 100644
--- a/source3/lib/messages_ctdbd.c
+++ b/source3/lib/messages_ctdbd.c
@@ -183,6 +183,8 @@ static int messaging_ctdbd_init_internal(struct messaging_context *msg_ctx,
int ret, ctdb_fd;

if (reinit) {
+ TALLOC_FREE(ctx->fde);
+
ret = ctdbd_reinit_connection(ctx,
lp_ctdbd_socket(),
lp_ctdb_timeout(),
--
Samba Shared Repository
Uri Simchoni
2016-12-28 23:06:04 UTC
Permalink
The branch, master has been updated
via 2e1dc95 idmap4: Use sid_check_is_in_unix_groups()
via e06a342 idmap4: Use sid_check_is_in_unix_users()
via 166e23d lib: Avoid an includes.h
via c66f57d lib: Add required prerequisites for librpc/gen_ndr/security.h
via 24f0878 passdb: Move lookup_unix_[user|group]_name to lookup_sid.c
via c5b9c58 lib: Add lib/util_unixsids.h
via 6830a6a idmap4: Slightly simplify idmap_xid_to_sid
via 2146df2 idmap4: Fix error path memleaks in idmap_init
via f39ed43 idmap4: Fix idmap_ctx talloc hierarchy
from 3660c76 ctdb-takeover: Clean up when exiting on error

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 2e1dc952f0505154f649c04da4b2194f433a6cbe
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 13:08:58 2016 +0000

idmap4: Use sid_check_is_in_unix_groups()

This avoids the need for the special unix groups sid

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

Autobuild-User(master): Uri Simchoni <***@samba.org>
Autobuild-Date(master): Thu Dec 29 00:05:25 CET 2016 on sn-devel-144

commit e06a342f80bf75863d0c0f057c19aeab2bcb3c29
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 13:08:58 2016 +0000

idmap4: Use sid_check_is_in_unix_users()

This avoids the need for the special unix users sid

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 166e23d98b90a814450164eb363bbbcbad0a2163
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 13:05:49 2016 +0000

lib: Avoid an includes.h

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit c66f57d1de9bb95b61e7208c7c13900ec98ce643
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 13:04:57 2016 +0000

lib: Add required prerequisites for librpc/gen_ndr/security.h

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 24f08784a3a577699895f95d087dd5be085d032a
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 12:57:23 2016 +0000

passdb: Move lookup_unix_[user|group]_name to lookup_sid.c

This is the only user and reduces the dependencies of util_unixsids.c

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit c5b9c58032e4daba49e1119001bab9c93a0c2c77
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 12:52:00 2016 +0000

lib: Add lib/util_unixsids.h

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 6830a6a35026664a70f012dce973a9805c85b82d
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 12:32:13 2016 +0000

idmap4: Slightly simplify idmap_xid_to_sid

No need to parse "S-1-22-1", we have global_sid_Unix_Users

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 2146df24d86eff3cbe6ca713db3bee546f2c7de7
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 12:21:09 2016 +0000

idmap4: Fix error path memleaks in idmap_init

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit f39ed433dc6393e82e82ad734a79473abe01ee75
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 12:19:54 2016 +0000

idmap4: Fix idmap_ctx talloc hierarchy

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
libcli/security/security.h | 3 ++
source3/auth/auth_util.c | 1 +
source3/auth/server_info.c | 1 +
source3/auth/token_util.c | 1 +
source3/include/proto.h | 13 -------
source3/lib/util_sid_passdb.c | 1 +
source3/lib/util_unixsids.c | 40 ++--------------------
.../winbindd_async.c => lib/util_unixsids.h} | 32 +++++++++--------
...passdb-0.25.0.sigs => samba-passdb-0.26.0.sigs} | 2 --
source3/passdb/lookup_sid.c | 36 +++++++++++++++++++
source3/winbindd/wb_lookupsids.c | 1 +
source3/winbindd/winbindd_samr.c | 1 +
source3/winbindd/winbindd_util.c | 1 +
source3/wscript_build | 2 +-
source4/winbind/idmap.c | 35 +++++++------------
source4/winbind/idmap.h | 2 --
16 files changed, 79 insertions(+), 93 deletions(-)
copy source3/{winbindd/winbindd_async.c => lib/util_unixsids.h} (54%)
copy source3/passdb/ABI/{samba-passdb-0.25.0.sigs => samba-passdb-0.26.0.sigs} (99%)


Changeset truncated at 500 lines:

diff --git a/libcli/security/security.h b/libcli/security/security.h
index 6e4b172..4df18eb 100644
--- a/libcli/security/security.h
+++ b/libcli/security/security.h
@@ -20,6 +20,9 @@
#ifndef _LIBCLI_SECURITY_SECURITY_H_
#define _LIBCLI_SECURITY_SECURITY_H_

+#include "lib/util/data_blob.h"
+#include "lib/util/time.h"
+
#include "librpc/gen_ndr/security.h"

#define PRIMARY_USER_SID_INDEX 0
diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 2da2896..25f27e8 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -23,6 +23,7 @@

#include "includes.h"
#include "auth.h"
+#include "lib/util_unixsids.h"
#include "../libcli/auth/libcli_auth.h"
#include "../lib/crypto/arcfour.h"
#include "rpc_client/init_lsa.h"
diff --git a/source3/auth/server_info.c b/source3/auth/server_info.c
index d2b7823..8461d20 100644
--- a/source3/auth/server_info.c
+++ b/source3/auth/server_info.c
@@ -19,6 +19,7 @@

#include "includes.h"
#include "auth.h"
+#include "lib/util_unixsids.h"
#include "../lib/crypto/arcfour.h"
#include "../librpc/gen_ndr/netlogon.h"
#include "../libcli/security/security.h"
diff --git a/source3/auth/token_util.c b/source3/auth/token_util.c
index 375905a..77b63e4 100644
--- a/source3/auth/token_util.c
+++ b/source3/auth/token_util.c
@@ -25,6 +25,7 @@
/* functions moved from auth/auth_util.c to minimize linker deps */

#include "includes.h"
+#include "lib/util_unixsids.h"
#include "system/passwd.h"
#include "auth.h"
#include "secrets.h"
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 53a2d6a..4535a14 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1104,19 +1104,6 @@ bool lookup_wellknown_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
bool lookup_wellknown_name(TALLOC_CTX *mem_ctx, const char *name,
struct dom_sid *sid, const char **domain);

-/* The following definitions come from lib/util_unixsids.c */
-
-bool sid_check_is_unix_users(const struct dom_sid *sid);
-bool sid_check_is_in_unix_users(const struct dom_sid *sid);
-void uid_to_unix_users_sid(uid_t uid, struct dom_sid *sid);
-void gid_to_unix_groups_sid(gid_t gid, struct dom_sid *sid);
-const char *unix_users_domain_name(void);
-bool lookup_unix_user_name(const char *name, struct dom_sid *sid);
-bool sid_check_is_unix_groups(const struct dom_sid *sid);
-bool sid_check_is_in_unix_groups(const struct dom_sid *sid);
-const char *unix_groups_domain_name(void);
-bool lookup_unix_group_name(const char *name, struct dom_sid *sid);
-
/* The following definitions come from lib/util_specialsids.c */
bool sid_check_is_asserted_identity(const struct dom_sid *sid);
bool sid_check_is_in_asserted_identity(const struct dom_sid *sid);
diff --git a/source3/lib/util_sid_passdb.c b/source3/lib/util_sid_passdb.c
index 0ff64cc..e67a27d 100644
--- a/source3/lib/util_sid_passdb.c
+++ b/source3/lib/util_sid_passdb.c
@@ -20,6 +20,7 @@

#include "includes.h"
#include "lib/util_sid_passdb.h"
+#include "lib/util_unixsids.h"
#include "passdb/machine_sid.h"
#include "passdb.h"

diff --git a/source3/lib/util_unixsids.c b/source3/lib/util_unixsids.c
index 4a38c57..387232c 100644
--- a/source3/lib/util_unixsids.c
+++ b/source3/lib/util_unixsids.c
@@ -17,10 +17,9 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/

-#include "includes.h"
-#include "system/passwd.h"
+#include "replace.h"
+#include "util_unixsids.h"
#include "../libcli/security/security.h"
-#include "../lib/util/util_pw.h"

bool sid_check_is_unix_users(const struct dom_sid *sid)
{
@@ -60,25 +59,6 @@ const char *unix_users_domain_name(void)
return "Unix User";
}

-bool lookup_unix_user_name(const char *name, struct dom_sid *sid)
-{
- struct passwd *pwd;
- bool ret;
-
- pwd = Get_Pwnam_alloc(talloc_tos(), name);
- if (pwd == NULL) {
- return False;
- }
-
- /*
- * For 64-bit uid's we have enough space in the whole SID,
- * should they become necessary
- */
- ret = sid_compose(sid, &global_sid_Unix_Users, pwd->pw_uid);
- TALLOC_FREE(pwd);
- return ret;
-}
-
bool sid_check_is_unix_groups(const struct dom_sid *sid)
{
return dom_sid_equal(sid, &global_sid_Unix_Groups);
@@ -98,19 +78,3 @@ const char *unix_groups_domain_name(void)
{
return "Unix Group";
}
-
-bool lookup_unix_group_name(const char *name, struct dom_sid *sid)
-{
- struct group *grp;
-
- grp = getgrnam(name);
- if (grp == NULL) {
- return False;
- }
-
- /*
- * For 64-bit gid's we have enough space in the whole SID,
- * should they become necessary
- */
- return sid_compose(sid, &global_sid_Unix_Groups, grp->gr_gid);
-}
diff --git a/source3/winbindd/winbindd_async.c b/source3/lib/util_unixsids.h
similarity index 54%
copy from source3/winbindd/winbindd_async.c
copy to source3/lib/util_unixsids.h
index 75dfa0e..b90a746 100644
--- a/source3/winbindd/winbindd_async.c
+++ b/source3/lib/util_unixsids.h
@@ -1,10 +1,7 @@
-/*
+/*
Unix SMB/CIFS implementation.
-
- Async helpers for blocking functions
-
+ Translate unix-defined names to SIDs and vice versa
Copyright (C) Volker Lendecke 2005
- Copyright (C) Gerald Carter 2006

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -20,15 +17,20 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/

-#include "includes.h"
-#include "winbindd.h"
-#include "../libcli/security/security.h"
+#ifndef __UTIL_UNIXSIDS_H__
+#define __UTIL_UNIXSIDS_H__
+
+#include "replace.h"
+
+struct dom_sid;

-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_WINBIND
+bool sid_check_is_unix_users(const struct dom_sid *sid);
+bool sid_check_is_in_unix_users(const struct dom_sid *sid);
+void uid_to_unix_users_sid(uid_t uid, struct dom_sid *sid);
+void gid_to_unix_groups_sid(gid_t gid, struct dom_sid *sid);
+const char *unix_users_domain_name(void);
+bool sid_check_is_unix_groups(const struct dom_sid *sid);
+bool sid_check_is_in_unix_groups(const struct dom_sid *sid);
+const char *unix_groups_domain_name(void);

-enum winbindd_result winbindd_dual_ping(struct winbindd_domain *domain,
- struct winbindd_cli_state *state)
-{
- return WINBINDD_OK;
-}
+#endif
diff --git a/source3/passdb/ABI/samba-passdb-0.25.0.sigs b/source3/passdb/ABI/samba-passdb-0.26.0.sigs
similarity index 99%
copy from source3/passdb/ABI/samba-passdb-0.25.0.sigs
copy to source3/passdb/ABI/samba-passdb-0.26.0.sigs
index 546374c..f3762e5 100644
--- a/source3/passdb/ABI/samba-passdb-0.25.0.sigs
+++ b/source3/passdb/ABI/samba-passdb-0.26.0.sigs
@@ -56,8 +56,6 @@ lookup_name: bool (TALLOC_CTX *, const char *, int, const char **, const char **
lookup_name_smbconf: bool (TALLOC_CTX *, const char *, int, const char **, const char **, struct dom_sid *, enum lsa_SidType *)
lookup_sid: bool (TALLOC_CTX *, const struct dom_sid *, const char **, const char **, enum lsa_SidType *)
lookup_sids: NTSTATUS (TALLOC_CTX *, int, const struct dom_sid **, int, struct lsa_dom_info **, struct lsa_name_info **)
-lookup_unix_group_name: bool (const char *, struct dom_sid *)
-lookup_unix_user_name: bool (const char *, struct dom_sid *)
lookup_wellknown_name: bool (TALLOC_CTX *, const char *, struct dom_sid *, const char **)
lookup_wellknown_sid: bool (TALLOC_CTX *, const struct dom_sid *, const char **, const char **)
make_pdb_method: NTSTATUS (struct pdb_methods **)
diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c
index 110bdd3..b06dd1b 100644
--- a/source3/passdb/lookup_sid.c
+++ b/source3/passdb/lookup_sid.c
@@ -21,6 +21,7 @@

#include "includes.h"
#include "passdb.h"
+#include "lib/util_unixsids.h"
#include "../librpc/gen_ndr/ndr_security.h"
#include "secrets.h"
#include "../lib/util/memcache.h"
@@ -29,6 +30,41 @@
#include "lib/winbind_util.h"
#include "../librpc/gen_ndr/idmap.h"

+static bool lookup_unix_user_name(const char *name, struct dom_sid *sid)
+{
+ struct passwd *pwd;
+ bool ret;
+
+ pwd = Get_Pwnam_alloc(talloc_tos(), name);
+ if (pwd == NULL) {
+ return False;
+ }
+
+ /*
+ * For 64-bit uid's we have enough space in the whole SID,
+ * should they become necessary
+ */
+ ret = sid_compose(sid, &global_sid_Unix_Users, pwd->pw_uid);
+ TALLOC_FREE(pwd);
+ return ret;
+}
+
+static bool lookup_unix_group_name(const char *name, struct dom_sid *sid)
+{
+ struct group *grp;
+
+ grp = getgrnam(name);
+ if (grp == NULL) {
+ return False;
+ }
+
+ /*
+ * For 64-bit gid's we have enough space in the whole SID,
+ * should they become necessary
+ */
+ return sid_compose(sid, &global_sid_Unix_Groups, grp->gr_gid);
+}
+
/*****************************************************************
Dissect a user-provided name into domain, name, sid and type.

diff --git a/source3/winbindd/wb_lookupsids.c b/source3/winbindd/wb_lookupsids.c
index 2480547..a4bcbad 100644
--- a/source3/winbindd/wb_lookupsids.c
+++ b/source3/winbindd/wb_lookupsids.c
@@ -19,6 +19,7 @@

#include "includes.h"
#include "winbindd.h"
+#include "lib/util_unixsids.h"
#include "librpc/gen_ndr/ndr_winbind_c.h"
#include "../libcli/security/security.h"
#include "passdb/machine_sid.h"
diff --git a/source3/winbindd/winbindd_samr.c b/source3/winbindd/winbindd_samr.c
index 3d0914a..dce26d2 100644
--- a/source3/winbindd/winbindd_samr.c
+++ b/source3/winbindd/winbindd_samr.c
@@ -26,6 +26,7 @@
#include "includes.h"
#include "winbindd.h"
#include "winbindd_rpc.h"
+#include "lib/util_unixsids.h"
#include "rpc_client/rpc_client.h"
#include "../librpc/gen_ndr/ndr_samr_c.h"
#include "rpc_client/cli_samr.h"
diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index 38e4b8b..c98b3ef 100644
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -22,6 +22,7 @@

#include "includes.h"
#include "winbindd.h"
+#include "lib/util_unixsids.h"
#include "secrets.h"
#include "../libcli/security/security.h"
#include "../libcli/auth/pam_errors.h"
diff --git a/source3/wscript_build b/source3/wscript_build
index d45a440..815a540 100755
--- a/source3/wscript_build
+++ b/source3/wscript_build
@@ -168,7 +168,7 @@ bld.SAMBA3_LIBRARY('samba-passdb',
''',
abi_match=private_pdb_match,
abi_directory='passdb/ABI',
- vnum='0.25.0')
+ vnum='0.26.0')

bld.SAMBA3_SUBSYSTEM('pdb',
source='''
diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index 26a4664..edeb724 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -23,6 +23,7 @@
#include "includes.h"
#include "auth/auth.h"
#include "librpc/gen_ndr/ndr_security.h"
+#include "lib/util_unixsids.h"
#include <ldb.h>
#include "ldb_wrap.h"
#include "param/param.h"
@@ -166,31 +167,24 @@ struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,

idmap_ctx->lp_ctx = lp_ctx;

- idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, ev_ctx, lp_ctx,
+ idmap_ctx->ldb_ctx = ldb_wrap_connect(idmap_ctx, ev_ctx, lp_ctx,
"idmap.ldb",
system_session(lp_ctx),
NULL, 0);
if (idmap_ctx->ldb_ctx == NULL) {
- return NULL;
- }
-
- idmap_ctx->unix_groups_sid = dom_sid_parse_talloc(mem_ctx, "S-1-22-2");
- if (idmap_ctx->unix_groups_sid == NULL) {
- return NULL;
+ goto fail;
}

- idmap_ctx->unix_users_sid = dom_sid_parse_talloc(mem_ctx, "S-1-22-1");
- if (idmap_ctx->unix_users_sid == NULL) {
- return NULL;
- }
-
idmap_ctx->samdb = samdb_connect(idmap_ctx, ev_ctx, lp_ctx, system_session(lp_ctx), 0);
if (idmap_ctx->samdb == NULL) {
DEBUG(0, ("Failed to load sam.ldb in idmap_init\n"));
- return NULL;
+ goto fail;
}

return idmap_ctx;
+fail:
+ TALLOC_FREE(idmap_ctx);
+ return NULL;
}

/**
@@ -216,7 +210,8 @@ static NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx,
struct ldb_context *ldb = idmap_ctx->ldb_ctx;
struct ldb_result *res = NULL;
struct ldb_message *msg;
- struct dom_sid *unix_sid, *new_sid;
+ const struct dom_sid *unix_sid;
+ struct dom_sid *new_sid;
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
const char *id_type;

@@ -354,13 +349,9 @@ static NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx,

/* For local users/groups , we just create a rid = uid/gid */
if (unixid->type == ID_TYPE_UID) {
- unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
+ unix_sid = &global_sid_Unix_Users;
} else {
- unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
- }
- if (unix_sid == NULL) {
- status = NT_STATUS_NO_MEMORY;
- goto failed;
+ unix_sid = &global_sid_Unix_Groups;
}

new_sid = dom_sid_add_rid(mem_ctx, unix_sid, unixid->id);
@@ -410,7 +401,7 @@ static NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx,
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
const char *sam_attrs[] = {"uidNumber", "gidNumber", "samAccountType", NULL};

- if (dom_sid_in_domain(idmap_ctx->unix_users_sid, sid)) {
+ if (sid_check_is_in_unix_users(sid)) {
uint32_t rid;
DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
@@ -426,7 +417,7 @@ static NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx,
return NT_STATUS_OK;
}

- if (dom_sid_in_domain(idmap_ctx->unix_groups_sid, sid)) {
+ if (sid_check_is_in_unix_groups(sid)) {
uint32_t rid;
DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
diff --git a/source4/winbind/idmap.h b/source4/winbind/idmap.h
index 676955c..04770c3 100644
--- a/source4/winbind/idmap.h
+++ b/source4/winbind/idmap.h
@@ -27,8 +27,6 @@
struct idmap_context {
struct loadparm_context *lp_ctx;
struct ldb_context *ldb_ctx;
- struct dom_sid *unix_groups_sid;
- struct dom_sid *unix_users_sid;
struct ldb_context *samdb;
};
--
Samba Shared Repository
Stefan Metzmacher
2017-01-01 12:48:03 UTC
Permalink
The branch, master has been updated
via 2487a42 Happy New Year 2017!
from 2e1dc95 idmap4: Use sid_check_is_in_unix_groups()

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 2487a423b7b5ae153690564202a582de5d8334aa
Author: Stefan Metzmacher <***@samba.org>
Date: Sun Jan 1 10:03:49 2017 +0100

Happy New Year 2017!

Signed-off-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Sun Jan 1 13:47:26 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
source3/include/smb.h | 2 +-
source4/smbd/server.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/include/smb.h b/source3/include/smb.h
index 75fcb02..7de47c8 100644
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -30,7 +30,7 @@
#include "libds/common/roles.h"

/* logged when starting the various Samba daemons */
-#define COPYRIGHT_STARTUP_MESSAGE "Copyright Andrew Tridgell and the Samba Team 1992-2016"
+#define COPYRIGHT_STARTUP_MESSAGE "Copyright Andrew Tridgell and the Samba Team 1992-2017"

#define SAFETY_MARGIN 1024
#define LARGE_WRITEX_HDR_SIZE 65
diff --git a/source4/smbd/server.c b/source4/smbd/server.c
index 28ecaca..407f258 100644
--- a/source4/smbd/server.c
+++ b/source4/smbd/server.c
@@ -376,7 +376,7 @@ static int binary_smbd_main(const char *binary_name, int argc, const char *argv[
umask(0);

DEBUG(0,("%s version %s started.\n", binary_name, SAMBA_VERSION_STRING));
- DEBUGADD(0,("Copyright Andrew Tridgell and the Samba Team 1992-2016\n"));
+ DEBUGADD(0,("Copyright Andrew Tridgell and the Samba Team 1992-2017\n"));

if (sizeof(uint16_t) < 2 || sizeof(uint32_t) < 4 || sizeof(uint64_t) < 8) {
DEBUG(0,("ERROR: Samba is not configured correctly for the word size on your machine\n"));
--
Samba Shared Repository
Ralph Böhme
2017-01-02 17:04:02 UTC
Permalink
The branch, master has been updated
via 59abfcb WAF: Fix detection of IPv6
via be12f82 WAF: Fix detection os sysname ...
via f4c0a75 WAF: Fix detection of linker features
via b7ae41e lib replace: Fix detection of features
from 2487a42 Happy New Year 2017!

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 59abfcb7945103cd4031abac86d51cd51ce052ca
Author: Lukas Slebodnik <***@redhat.com>
Date: Tue Dec 6 18:07:50 2016 +0100

WAF: Fix detection of IPv6

Detection of IPv6 failed with strict CFLAGS due to missing
header file.

Checking for HAVE_IPV6 : not found

../test.c: In function ‘main’:
../test.c:226:34: error: implicit declaration of function
‘if_nametoindex’ [-Werror=implicit-function-declaration]
int idx = if_nametoindex("iface1");
^~~~~~~~~~~~~~

Signed-off-by: Lukas Slebodnik <***@redhat.com>
Reviewed-by: Andreas Schneider <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

Autobuild-User(master): Ralph Böhme <***@samba.org>
Autobuild-Date(master): Mon Jan 2 18:03:20 CET 2017 on sn-devel-144

commit be12f82cf1ca652b06995e84971c878621315d24
Author: Lukas Slebodnik <***@redhat.com>
Date: Tue Dec 6 18:07:43 2016 +0100

WAF: Fix detection os sysname ...

Detection of sysname failed with stricter CFLAGS
"-Werrorr=implicit-function-declaration -Werror=implicit-int"

Checking uname sysname type : not found
Checking uname machine type : not found
Checking uname release type : not found
Checking uname version type : not found

../test.c: In function ‘main’:
../test.c:8:32: error: implicit declaration of function ‘printf’
[-Werror=implicit-function-declaration]
printf("%s", n.sysname);
^~~~~~
../test.c:8:32: warning: incompatible implicit declaration
of built-in function ‘printf’
../test.c:8:32: note: include ‘<stdio.h>’ or provide a declaration of ‘printf’

Signed-off-by: Lukas Slebodnik <***@redhat.com>
Reviewed-by: Andreas Schneider <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit f4c0a750d4adebcf2342a44e85f04526c34268c8
Author: Lukas Slebodnik <***@redhat.com>
Date: Tue Dec 6 18:07:36 2016 +0100

WAF: Fix detection of linker features

Following check of linker feature failed with strict CFLAGS
"-Werrorr=implicit-function-declaration -Werror=implicit-int"

Checking for rpath library support : not found
Checking for -Wl,--version-script support : not found

../main.c: In function ‘main’:
../main.c:1:26: error: implicit declaration of function ‘lib_func’
[-Werror=implicit-function-declaration]
int main(void) {return !(lib_func() == 42);}
^~~~~~~~

Signed-off-by: Lukas Slebodnik <***@redhat.com>
Reviewed-by: Andreas Schneider <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit b7ae41e6ca133e08f1dc62bd49436f51f490f46b
Author: Lukas Slebodnik <***@redhat.com>
Date: Tue Dec 6 18:07:18 2016 +0100

lib replace: Fix detection of features

If configure script is executed with stricter cflags
"-Werrorr=implicit-function-declaration -Werror=implicit-int"
then detection of few features will fail.

Checking for C99 vsnprintf : not found
Checking for HAVE_SHARED_MMAP : not found
Checking for HAVE_MREMAP : not found

lib/replace/test/shared_mmap.c:18:1:
error: return type defaults to ‘int’ [-Werror=implicit-int]
main()
^~~~
lib/replace/test/shared_mmap.c: In function ‘main’:
lib/replace/test/shared_mmap.c:25:16:
error: implicit declaration of function ‘exit’
[-Werror=implicit-function-declaration]
if (fd == -1) exit(1);
^~~~
lib/replace/test/shared_mmap.c:25:16:
warning: incompatible implicit declaration of built-in function ‘exit’
lib/replace/test/shared_mmap.c:25:16:
note: include ‘<stdlib.h>’ or provide a declaration of ‘exit’

Signed-off-by: Lukas Slebodnik <***@redhat.com>
Reviewed-by: Andreas Schneider <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
buildtools/wafsamba/samba_conftests.py | 5 ++++-
lib/replace/test/shared_mmap.c | 5 ++++-
lib/replace/test/shared_mremap.c | 5 ++++-
lib/replace/test/snprintf.c | 2 +-
lib/replace/wscript | 2 +-
5 files changed, 14 insertions(+), 5 deletions(-)


Changeset truncated at 500 lines:

diff --git a/buildtools/wafsamba/samba_conftests.py b/buildtools/wafsamba/samba_conftests.py
index 045f858..72e4321 100644
--- a/buildtools/wafsamba/samba_conftests.py
+++ b/buildtools/wafsamba/samba_conftests.py
@@ -286,7 +286,9 @@ def CHECK_LIBRARY_SUPPORT(conf, rpath=False, version_script=False, msg=None):
os.makedirs(subdir)

Utils.writef(os.path.join(subdir, 'lib1.c'), 'int lib_func(void) { return 42; }\n')
- Utils.writef(os.path.join(dir, 'main.c'), 'int main(void) {return !(lib_func() == 42);}\n')
+ Utils.writef(os.path.join(dir, 'main.c'),
+ 'int lib_func(void);\n'
+ 'int main(void) {return !(lib_func() == 42);}\n')

bld = Build.BuildContext()
bld.log = conf.log
@@ -436,6 +438,7 @@ def CHECK_UNAME(conf):
ret = True
for v in "sysname machine release version".split():
if not conf.CHECK_CODE('''
+ int printf(const char *format, ...);
struct utsname n;
if (uname(&n) == -1) return -1;
printf("%%s", n.%s);
diff --git a/lib/replace/test/shared_mmap.c b/lib/replace/test/shared_mmap.c
index 50dad8d..9d6e3fc 100644
--- a/lib/replace/test/shared_mmap.c
+++ b/lib/replace/test/shared_mmap.c
@@ -4,6 +4,9 @@
#if defined(HAVE_UNISTD_H)
#include <unistd.h>
#endif
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
@@ -15,7 +18,7 @@
#define MAP_FILE 0
#endif

-main()
+int main(void)
{
int *buf;
int i;
diff --git a/lib/replace/test/shared_mremap.c b/lib/replace/test/shared_mremap.c
index 05032ad..08040e2 100644
--- a/lib/replace/test/shared_mremap.c
+++ b/lib/replace/test/shared_mremap.c
@@ -3,6 +3,9 @@
#if defined(HAVE_UNISTD_H)
#include <unistd.h>
#endif
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
@@ -18,7 +21,7 @@
#define MAP_FAILED (int *)-1
#endif

-main()
+int main(void)
{
int *buf;
int fd;
diff --git a/lib/replace/test/snprintf.c b/lib/replace/test/snprintf.c
index d06630b..77473f0 100644
--- a/lib/replace/test/snprintf.c
+++ b/lib/replace/test/snprintf.c
@@ -26,4 +26,4 @@ void foo(const char *format, ...)
printf("1");
exit(0);
}
-main() { foo("hello"); }
+int main(void) { foo("hello"); }
diff --git a/lib/replace/wscript b/lib/replace/wscript
index 1dfd902..ea0d5d0 100644
--- a/lib/replace/wscript
+++ b/lib/replace/wscript
@@ -189,7 +189,7 @@ def configure(conf):
''',
define='HAVE_IPV6',
lib='nsl socket',
- headers='sys/socket.h netdb.h netinet/in.h')
+ headers='sys/socket.h netdb.h netinet/in.h net/if.h')

if conf.CONFIG_SET('HAVE_SYS_UCONTEXT_H') and conf.CONFIG_SET('HAVE_SIGNAL_H'):
conf.CHECK_CODE('''
--
Samba Shared Repository
Volker Lendecke
2017-01-02 20:53:04 UTC
Permalink
The branch, master has been updated
via ec62194 winbind: Remove find_builtin_domain helper function
via 7981c6f winbind: Remove wb_fill_pwent
via c4e9ec5 winbind: Go throught wb_getpwsid for listing users
via 901d2bd winbind: Add wbint_QueryUserRidList
via a1ba988 winbind: Fix a confusing indentation
via 730b176 winbind: Simplify wb_gettoken
via 7bc161d winbind: Don't do supplementary group lookup manually
via cff1924 idmap_ad: Restore querying SFU nss info
via bce19a6 winbind: Restructure wb_getpwsid
via d0f1d76 winbind: Adapt cache to extended wbint_userinfo
via 2022ec8 winbind: Add a GetNssInfo parent/child call
via c98ad0a winbind: Make "idmap_find_domain" public
via 2702114 winbind: It's legitmate to have 0 groups in info3
via 2562d19 idmap: Simplify idmap_ad_nss_init()
via c2e1f4e winbind: Fix wb_lookupsids for AD DCs
via 22b2151 winbind4: Remove unused code
via 2481584 winbind: Initialize user list info to 0
via 7c3ea9f s3:librpc/gse: make use of gss_krb5_import_cred() instead of gss_acquire_cred()
via b61a937 s3:librpc/gse: remove unused #ifdef HAVE_GSS_KRB5_IMPORT_CRED
via 6f029d5 s3:librpc/gse: include ccache_name in DEBUG message if krb5_cc_resolve() fails
via e838347 s4:librpc/rpc: make sure we handle DCERPC_PACKET before DCERPC_CONNECT
via 94fc5c4 s4:librpc/rpc: don't do an anonymous bind over ncacn_np:server[packet]
from 59abfcb WAF: Fix detection of IPv6

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit ec621945670bc023ad4a849f2e9af4eb8c299c20
Author: Volker Lendecke <***@samba.org>
Date: Fri Dec 30 11:51:37 2016 +0000

winbind: Remove find_builtin_domain helper function

There was only one caller, and the function was pretty small anyway.

This makes a "git grep find_domain_from" more obvious :-)

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Mon Jan 2 21:52:02 CET 2017 on sn-devel-144

commit 7981c6f9b5ce7ce294bfc9932286b7da03390c01
Author: Volker Lendecke <***@samba.org>
Date: Fri Dec 30 11:47:45 2016 +0000

winbind: Remove wb_fill_pwent

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit c4e9ec55f10efb1d8eb39ed54580194973bb26ad
Author: Volker Lendecke <***@samba.org>
Date: Thu Dec 29 19:05:40 2016 +0000

winbind: Go throught wb_getpwsid for listing users

This makes sure we get the same results for getpwnam and getpwent.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 901d2bd99b208cf3a87243da2a2c7e8a8656efab
Author: Volker Lendecke <***@samba.org>
Date: Thu Dec 29 18:13:28 2016 +0000

winbind: Add wbint_QueryUserRidList

This is an equivalent of QueryUserList with simpler output. The next
commit will use it to go through wb_getpwsid for getent passwd, to
make sure we get the same results. Eventually, this might get a simpler
backend.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit a1ba988c03f45ee21d04d4b27409ebdb3db9fa4c
Author: Volker Lendecke <***@samba.org>
Date: Thu Dec 29 15:34:41 2016 +0000

winbind: Fix a confusing indentation

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 730b176ffb3ba2e1452d04e1c75a4405b90132e6
Author: Volker Lendecke <***@samba.org>
Date: Sun Dec 25 10:19:38 2016 +0000

winbind: Simplify wb_gettoken

All we need from the domain struct is it's sid. Directly use it.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 7bc161db7a5c5c3b05160a92abfd5f646c4ea8f0
Author: Volker Lendecke <***@samba.org>
Date: Sun Dec 25 10:16:31 2016 +0000

winbind: Don't do supplementary group lookup manually

This can never be done successfully without a valid samlogon_cache entry.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit cff192413031a8bafe0b2b27e1aecd162422f855
Author: Volker Lendecke <***@samba.org>
Date: Thu Dec 29 10:27:58 2016 +0000

idmap_ad: Restore querying SFU nss info

With the last commit the getpwsid call did not look at the winbind
nss info parameter anymore. This restores it for the idmap ad backend
with slightly different semantics and configuration: We now have the
unix_primary_group and unix_nss_info domain-specific parameters for
idmap config. This enables overriding the Windows primary group with
the unix one.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit bce19a6efe11980933531f0349c8f5212419366a
Author: Volker Lendecke <***@samba.org>
Date: Thu Dec 29 10:05:28 2016 +0000

winbind: Restructure wb_getpwsid

This patch moves the responsibility to create a winbind user from the
winbind backends into wb_queryuser.c. The name comes from lsa_lookupsids,
the uid from idmap. If we have a netsamlogon_cache, we get the primary
group sid from there. Without netsamlogon_cache, we default to -513, as
we do right now as default for non-reachable ADS domains anyway. Shell
and homedir default to template. This can all be done in the parent
without contacting any LDAP-related calls and is correct once we have
a netsamlogon_cache.

Once the parent has filled in the userinfo, the idmap child is queried
with the GetNssInfo call, taking the userinfo [in,out]. The child is
free to override the whole thing, something the AD backend will do in
the next patch.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit d0f1d761b5765df8525f991554ffd333d4a247d6
Author: Volker Lendecke <***@samba.org>
Date: Fri Dec 30 10:57:50 2016 +0000

winbind: Adapt cache to extended wbint_userinfo

Separate commit, UL/ was missing some fields already

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 2022ec8770ff05d91f6eaf2ae3da7a4150697d56
Author: Volker Lendecke <***@samba.org>
Date: Thu Dec 29 09:56:29 2016 +0000

winbind: Add a GetNssInfo parent/child call

This call will be done in the idmap child. It is not 100% the right place,
but there is no better one available to me. It will become a replacement
for the "winbind nss info" parameter: This global parameter is good
for just one domain. It might be possible to have idmap backend AD for
different domains, and the NSS info like primary gid, homedir and shell
might be done with different policies per domain. As we already have a
domain-specific idmap configuration, doing the NSS info configuration
there also is the closest way to do it.

The alternative, if we did not want to put this call into the idmap child
would be to establish an equivalent engine like the whole "idmap config
*" just for the nss info. But as I believe this is closely related,
I'll just keep it in the idmap child.

This also extends the wbint_userinfo structure with pretty much all user
related fields. The idea is that the GetNssInfo call can do whatever it
wants with it.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit c98ad0accae2b32526cfdc4577cc6d5adafc5f00
Author: Volker Lendecke <***@samba.org>
Date: Thu Dec 29 09:54:56 2016 +0000

winbind: Make "idmap_find_domain" public

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 2702114a94100fd07696438a6acc73c7f934ccd1
Author: Volker Lendecke <***@samba.org>
Date: Sun Dec 25 10:12:59 2016 +0000

winbind: It's legitmate to have 0 groups in info3

At least a Samba DC can send an info3 struct with base.groups.count==0. We
should not fail with that and just return 0 groups.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 2562d195802d69d9f485a6c59a1854fc9345d5f5
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 17 15:03:59 2016 +0100

idmap: Simplify idmap_ad_nss_init()

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit c2e1f4eec972ba31b225d5941c1d491fdb75ffaa
Author: Volker Lendecke <***@samba.org>
Date: Sun Dec 25 11:33:53 2016 +0000

winbind: Fix wb_lookupsids for AD DCs

Not yet a fix, but the IS_DC macro also contains the
ROLE_ACTIVE_DIRECTORY_DC, and once we start to fully do this we'll
need it.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 22b2151fb52655b06e62edcda080ea9392045237
Author: Volker Lendecke <***@samba.org>
Date: Tue Dec 27 14:01:13 2016 +0000

winbind4: Remove unused code

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 2481584b8b5c6d0b742fb9b5cc5e72223a80028b
Author: Volker Lendecke <***@samba.org>
Date: Fri Dec 30 11:08:22 2016 +0000

winbind: Initialize user list info to 0

Further down wbint_userinfo will be extended. Make sure we don't
have uninitialized memory hanging around

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 7c3ea9fe96336483752adb821f8062a883d52998
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 22 08:49:38 2016 +0100

s3:librpc/gse: make use of gss_krb5_import_cred() instead of gss_acquire_cred()

This avoids the usage of the ccselect_realm logic in MIT krb5,
which leads to unpredictable results.

The problem is the usage of gss_acquire_cred(), that just creates
a credential handle without ccache.

As result gss_init_sec_context() will trigger a code path
where it use "ccselect" plugins. And the ccselect_realm
module just chooses a random ccache from a global list
where the realm of the provides target principal matches
the realm of the ccache user principal.

In the winbindd case we're using MEMORY:cliconnect to setup
the smb connection to the DC. For ldap connections we use
MEMORY:winbind_ccache.

The typical case is that we do the smb connection first.
If we try to create a new ldap connection, while the
credentials in MEMORY:cliconnect are expired,
we'll do the required kinit into MEMORY:winbind_ccache,
but the ccselect_realm module will select MEMORY:cliconnect
and tries to get a service ticket for the ldap server
using the already expired TGT from MEMORY:cliconnect.

The solution will be to use gss_krb5_import_cred() and explicitly
pass the desired ccache, which avoids the ccselect logic.

We could also use gss_acquire_cred_from(), but that's only available
in modern MIT krb5 versions, while gss_krb5_import_cred() is available
in heimdal and all supported MIT versions (>=1.9).
As far as I can see both call the same internal function in MIT
(at least for the ccache case).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12480

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit b61a93755ca59a58775c1c8c21baee49fef42fbf
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 22 08:47:32 2016 +0100

s3:librpc/gse: remove unused #ifdef HAVE_GSS_KRB5_IMPORT_CRED

We always have gss_krb5_import_cred(), it available in heimdal
and also the oldest version (1.9) of MIT krb5 that we support.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12480

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 6f029d58703f657e46fee35fc663128157db4d9f
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 22 08:46:21 2016 +0100

s3:librpc/gse: include ccache_name in DEBUG message if krb5_cc_resolve() fails

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12480

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit e8383471056805233588e1ecc79c1d590cbc93f0
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 11:13:55 2016 +0100

s4:librpc/rpc: make sure we handle DCERPC_PACKET before DCERPC_CONNECT

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 94fc5c48b756d2938589c0b9363f29995a08ea2f
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 11:11:50 2016 +0100

s4:librpc/rpc: don't do an anonymous bind over ncacn_np:server[packet]

DCERPC_AUTH_LEVEL_PACKET is basically the same as
DCERPC_AUTH_LEVEL_INTEGRITY.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
docs-xml/manpages/idmap_ad.8.xml | 14 +
librpc/idl/winbind.idl | 11 +
source3/include/idmap.h | 4 +
source3/librpc/crypto/gse.c | 38 +--
source3/winbindd/idmap.c | 2 +-
source3/winbindd/idmap_ad.c | 110 ++++++++
source3/winbindd/idmap_ad_nss.c | 31 +--
source3/winbindd/idmap_proto.h | 1 +
source3/winbindd/wb_fill_pwent.c | 248 ------------------
source3/winbindd/wb_getpwsid.c | 117 +++------
source3/winbindd/wb_gettoken.c | 72 ++---
source3/winbindd/wb_lookupsids.c | 3 +-
source3/winbindd/wb_next_pwent.c | 36 +--
source3/winbindd/wb_queryuser.c | 286 +++++++++++++++++++-
source3/winbindd/winbindd.h | 5 +-
source3/winbindd/winbindd_cache.c | 23 +-
source3/winbindd/winbindd_dual_srv.c | 61 +++++
source3/winbindd/winbindd_proto.h | 8 -
source3/winbindd/winbindd_rpc.c | 2 +
source3/winbindd/winbindd_util.c | 17 --
source3/winbindd/wscript_build | 1 -
source4/librpc/rpc/dcerpc.c | 4 +-
source4/librpc/rpc/dcerpc_util.c | 2 +-
source4/winbind/wb_async_helpers.c | 494 -----------------------------------
source4/winbind/wb_async_helpers.h | 37 ---
source4/winbind/wb_utils.c | 1 -
source4/winbind/wscript_build | 2 +-
27 files changed, 630 insertions(+), 1000 deletions(-)
delete mode 100644 source3/winbindd/wb_fill_pwent.c
delete mode 100644 source4/winbind/wb_async_helpers.c
delete mode 100644 source4/winbind/wb_async_helpers.h


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/idmap_ad.8.xml b/docs-xml/manpages/idmap_ad.8.xml
index 5876c46..58e7f52 100644
--- a/docs-xml/manpages/idmap_ad.8.xml
+++ b/docs-xml/manpages/idmap_ad.8.xml
@@ -74,6 +74,20 @@
via the "primaryGroupID" LDAP attribute.
</para></listitem>
</varlistentry>
+ <varlistentry>
+ <term>unix_primary_group = yes/no</term>
+ <listitem><para>
+ Defines whether to retrieve the user's primary group
+ from the SFU attributes.
+ </para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>unix_nss_info = yes/no</term>
+ <listitem><para>
+ Defines whether to retrieve the login shell and
+ home directory from the SFU attributes.
+ </para></listitem>
+ </varlistentry>
</variablelist>
</refsect1>

diff --git a/librpc/idl/winbind.idl b/librpc/idl/winbind.idl
index ec472c5..d38b17a 100644
--- a/librpc/idl/winbind.idl
+++ b/librpc/idl/winbind.idl
@@ -72,11 +72,14 @@ interface winbind
);

typedef [public] struct {
+ [string,charset(UTF8)] char *domain_name;
[string,charset(UTF8)] char *acct_name;
[string,charset(UTF8)] char *full_name;
[string,charset(UTF8)] char *homedir;
[string,charset(UTF8)] char *shell;
+ hyper uid;
hyper primary_gid;
+ [string,charset(UTF8)] char *primary_group_name;
dom_sid user_sid;
dom_sid group_sid;
} wbint_userinfo;
@@ -86,6 +89,10 @@ interface winbind
[out] wbint_userinfo *info
);

+ NTSTATUS wbint_GetNssInfo(
+ [in,out] wbint_userinfo *info
+ );
+
typedef [public] struct {
uint32 num_sids;
[size_is(num_sids)] dom_sid sids[];
@@ -140,6 +147,10 @@ interface winbind
[out] wbint_Principals *groups
);

+ NTSTATUS wbint_QueryUserRidList(
+ [out] wbint_RidArray *rids
+ );
+
NTSTATUS wbint_DsGetDcName(
[in,string,charset(UTF8)] char *domain_name,
[in,unique] GUID *domain_guid,
diff --git a/source3/include/idmap.h b/source3/include/idmap.h
index 800e694..c379eba 100644
--- a/source3/include/idmap.h
+++ b/source3/include/idmap.h
@@ -32,9 +32,13 @@

#include "librpc/gen_ndr/idmap.h"

+struct wbint_userinfo;
+
struct idmap_domain {
const char *name;
struct idmap_methods *methods;
+ NTSTATUS (*query_user)(struct idmap_domain *domain,
+ struct wbint_userinfo *info);
uint32_t low_id;
uint32_t high_id;
bool read_only;
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index e4ceed1..792700e 100644
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -172,8 +172,8 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
&gse_ctx->ccache);
if (k5ret) {
- DEBUG(1, ("Failed to resolve credential cache! (%s)\n",
- error_message(k5ret)));
+ DEBUG(1, ("Failed to resolve credential cache '%s'! (%s)\n",
+ ccache_name, error_message(k5ret)));
status = NT_STATUS_INTERNAL_ERROR;
goto err_out;
}
@@ -204,7 +204,6 @@ static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
struct gse_context *gse_ctx;
OM_uint32 gss_maj, gss_min;
gss_buffer_desc name_buffer = GSS_C_EMPTY_BUFFER;
- gss_OID_set_desc mech_set;
#ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
gss_buffer_desc empty_buffer = GSS_C_EMPTY_BUFFER;
gss_OID oid = discard_const(GSS_KRB5_CRED_NO_CI_FLAGS_X);
@@ -253,20 +252,26 @@ static NTSTATUS gse_init_client(TALLOC_CTX *mem_ctx,
/* TODO: get krb5 ticket using username/password, if no valid
* one already available in ccache */

- mech_set.count = 1;
- mech_set.elements = &gse_ctx->gss_mech;
-
- gss_maj = gss_acquire_cred(&gss_min,
- GSS_C_NO_NAME,
- GSS_C_INDEFINITE,
- &mech_set,
- GSS_C_INITIATE,
- &gse_ctx->creds,
- NULL, NULL);
+ gss_maj = gss_krb5_import_cred(&gss_min,
+ gse_ctx->ccache,
+ NULL, /* keytab_principal */
+ NULL, /* keytab */
+ &gse_ctx->creds);
if (gss_maj) {
- DEBUG(5, ("gss_acquire_creds failed for GSS_C_NO_NAME with [%s] -"
+ char *ccache = NULL;
+ int kret;
+
+ kret = krb5_cc_get_full_name(gse_ctx->k5ctx,
+ gse_ctx->ccache,
+ &ccache);
+ if (kret != 0) {
+ ccache = NULL;
+ }
+
+ DEBUG(5, ("gss_krb5_import_cred ccache[%s] failed with [%s] -"
"the caller may retry after a kinit.\n",
- gse_errstr(gse_ctx, gss_maj, gss_min)));
+ ccache, gse_errstr(gse_ctx, gss_maj, gss_min)));
+ SAFE_FREE(ccache);
status = NT_STATUS_INTERNAL_ERROR;
goto err_out;
}
@@ -390,8 +395,6 @@ static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
goto done;
}

-#ifdef HAVE_GSS_KRB5_IMPORT_CRED
-
/* This creates a GSSAPI cred_id_t with the keytab set */
gss_maj = gss_krb5_import_cred(&gss_min, NULL, NULL, gse_ctx->keytab,
&gse_ctx->creds);
@@ -410,7 +413,6 @@ static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
* principal in request'. Work around the issue by
* falling back to the alternate approach below. */
} else if (gss_maj == (GSS_S_CALL_BAD_STRUCTURE|GSS_S_BAD_NAME))
-#endif
/* FIXME!!!
* This call sets the default keytab for the whole server, not
* just for this context. Need to find a way that does not alter
diff --git a/source3/winbindd/idmap.c b/source3/winbindd/idmap.c
index 84834f1..6a52633 100644
--- a/source3/winbindd/idmap.c
+++ b/source3/winbindd/idmap.c
@@ -500,7 +500,7 @@ fail:
* add_trusted_domain.
*/

-static struct idmap_domain *idmap_find_domain(const char *domname)
+struct idmap_domain *idmap_find_domain(const char *domname)
{
bool ok;
int i;
diff --git a/source3/winbindd/idmap_ad.c b/source3/winbindd/idmap_ad.c
index c385cf0..f406392 100644
--- a/source3/winbindd/idmap_ad.c
+++ b/source3/winbindd/idmap_ad.c
@@ -39,8 +39,14 @@ struct idmap_ad_context {
struct tldap_context *ld;
struct idmap_ad_schema_names *schema;
const char *default_nc;
+
+ bool unix_primary_group;
+ bool unix_nss_info;
};

+static NTSTATUS idmap_ad_get_context(struct idmap_domain *dom,
+ struct idmap_ad_context **pctx);
+
static char *get_schema_path(TALLOC_CTX *mem_ctx, struct tldap_context *ld)
{
struct tldap_message *rootdse;
@@ -396,6 +402,11 @@ static NTSTATUS idmap_ad_context_create(TALLOC_CTX *mem_ctx,
return NT_STATUS_NO_MEMORY;
}

+ ctx->unix_primary_group = lp_parm_bool(
+ -1, schema_config_option, "unix_primary_group", false);
+ ctx->unix_nss_info = lp_parm_bool(
+ -1, schema_config_option, "unix_nss_info", false);
+
schema_mode = lp_parm_const_string(
-1, schema_config_option, "schema_mode", "rfc2307");
TALLOC_FREE(schema_config_option);
@@ -412,8 +423,107 @@ static NTSTATUS idmap_ad_context_create(TALLOC_CTX *mem_ctx,
return NT_STATUS_OK;
}

+static NTSTATUS idmap_ad_query_user(struct idmap_domain *domain,
+ struct wbint_userinfo *info)
+{
+ struct idmap_ad_context *ctx;
+ TLDAPRC rc;
+ NTSTATUS status;
+ char *sidstr, *filter;
+ const char *attrs[4];
+ size_t i, num_msgs;
+ struct tldap_message **msgs;
+
+ status = idmap_ad_get_context(domain, &ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ if (!(ctx->unix_primary_group || ctx->unix_nss_info)) {
+ return NT_STATUS_OK;
+ }
+
+ attrs[0] = ctx->schema->gid;
+ attrs[1] = ctx->schema->gecos;
+ attrs[2] = ctx->schema->dir;
+ attrs[3] = ctx->schema->shell;
+
+ sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), &info->user_sid);
+ if (sidstr == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ filter = talloc_asprintf(talloc_tos(), "(objectsid=%s)", sidstr);
+ TALLOC_FREE(sidstr);
+ if (filter == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ DBG_DEBUG("Filter: [%s]\n", filter);
+
+ rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
+ attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
+ 0, 0, 0, talloc_tos(), &msgs);
+ if (!TLDAP_RC_IS_SUCCESS(rc)) {
+ return NT_STATUS_LDAP(TLDAP_RC_V(rc));
+ }
+
+ TALLOC_FREE(filter);
+
+ num_msgs = talloc_array_length(msgs);
+
+ for (i=0; i<num_msgs; i++) {
+ struct tldap_message *msg = msgs[i];
+
+ if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
+ continue;
+ }
+
+ if (ctx->unix_primary_group) {
+ bool ok;
+ uint32_t gid;
+
+ ok = tldap_pull_uint32(msg, ctx->schema->gid, &gid);
+ if (ok) {
+ DBG_DEBUG("Setting primary group "
+ "to %"PRIu32" from attr %s\n",
+ gid, ctx->schema->gid);
+ info->primary_gid = gid;
+ }
+ }
+
+ if (ctx->unix_nss_info) {
+ char *attr;
+
+ attr = tldap_talloc_single_attribute(
+ msg, ctx->schema->dir, talloc_tos());
+ if (attr != NULL) {
+ info->homedir = talloc_move(info, &attr);
+ }
+ TALLOC_FREE(attr);
+
+ attr = tldap_talloc_single_attribute(
+ msg, ctx->schema->shell, talloc_tos());
+ if (attr != NULL) {
+ info->shell = talloc_move(info, &attr);
+ }
+ TALLOC_FREE(attr);
+
+ attr = tldap_talloc_single_attribute(
+ msg, ctx->schema->gecos, talloc_tos());
+ if (attr != NULL) {
+ info->full_name = talloc_move(info, &attr);
+ }
+ TALLOC_FREE(attr);
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
{
+ dom->query_user = idmap_ad_query_user;
dom->private_data = NULL;
return NT_STATUS_OK;
}
diff --git a/source3/winbindd/idmap_ad_nss.c b/source3/winbindd/idmap_ad_nss.c
index 8c5a13d..d979231 100644
--- a/source3/winbindd/idmap_ad_nss.c
+++ b/source3/winbindd/idmap_ad_nss.c
@@ -502,29 +502,24 @@ static struct nss_info_methods nss_sfu20_methods = {

NTSTATUS idmap_ad_nss_init(void)
{
- static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
- static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
- static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
+ NTSTATUS status;

- if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
- status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
- "rfc2307", &nss_rfc2307_methods );
- if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
- return status_nss_rfc2307;
+ status = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
+ "rfc2307", &nss_rfc2307_methods);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
}

- if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
- status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
- "sfu", &nss_sfu_methods );
- if ( !NT_STATUS_IS_OK(status_nss_sfu) )
- return status_nss_sfu;
+ status = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
+ "sfu", &nss_sfu_methods);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
}

- if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
- status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
- "sfu20", &nss_sfu20_methods );
- if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
- return status_nss_sfu20;
+ status = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
+ "sfu20", &nss_sfu20_methods);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
}

return NT_STATUS_OK;
diff --git a/source3/winbindd/idmap_proto.h b/source3/winbindd/idmap_proto.h
index 84cc2f0..0e25963 100644
--- a/source3/winbindd/idmap_proto.h
+++ b/source3/winbindd/idmap_proto.h
@@ -36,6 +36,7 @@ NTSTATUS idmap_allocate_uid(struct unixid *id);
NTSTATUS idmap_allocate_gid(struct unixid *id);
NTSTATUS idmap_backend_unixids_to_sids(struct id_map **maps,
const char *domain_name);
+struct idmap_domain *idmap_find_domain(const char *domname);

/* The following definitions come from winbindd/idmap_nss.c */

diff --git a/source3/winbindd/wb_fill_pwent.c b/source3/winbindd/wb_fill_pwent.c
deleted file mode 100644
index 2229b05..0000000
--- a/source3/winbindd/wb_fill_pwent.c
+++ /dev/null
@@ -1,248 +0,0 @@
-/*
- Unix SMB/CIFS implementation.
- async fill_pwent
- Copyright (C) Volker Lendecke 2009
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 3 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#include "includes.h"
-#include "winbindd.h"
-#include "librpc/gen_ndr/ndr_winbind_c.h"
-
-struct wb_fill_pwent_state {
- struct tevent_context *ev;
- const struct wbint_userinfo *info;
- struct winbindd_pw *pw;
-};
-
-static bool fillup_pw_field(const char *lp_template,
- const char *username,
- const char *grpname,
- const char *domname,
- uid_t uid,
- gid_t gid,
- const char *in,
- fstring out);
-
-static void wb_fill_pwent_sid2uid_done(struct tevent_req *subreq);
-static void wb_fill_pwent_getgrsid_done(struct tevent_req *subreq);
-
-struct tevent_req *wb_fill_pwent_send(TALLOC_CTX *mem_ctx,
- struct tevent_context *ev,
- const struct wbint_userinfo *info,
- struct winbindd_pw *pw)
-{
- struct tevent_req *req, *subreq;
- struct wb_fill_pwent_state *state;
-
- req = tevent_req_create(mem_ctx, &state, struct wb_fill_pwent_state);
- if (req == NULL) {
- return NULL;
- }
- state->ev = ev;
- state->info = info;
- state->pw = pw;
-
- subreq = wb_sids2xids_send(state, state->ev, &state->info->user_sid, 1);
- if (tevent_req_nomem(subreq, req)) {
- return tevent_req_post(req, ev);
- }
- tevent_req_set_callback(subreq, wb_fill_pwent_sid2uid_done, req);
- return req;
-}
-
-static void wb_fill_pwent_sid2uid_done(struct tevent_req *subreq)
-{
- struct tevent_req *req = tevent_req_callback_data(
- subreq, struct tevent_req);
- struct wb_fill_pwent_state *state = tevent_req_data(
- req, struct wb_fill_pwent_state);
- NTSTATUS status;
- struct unixid xids[1];
-
- status = wb_sids2xids_recv(subreq, xids, ARRAY_SIZE(xids));
- TALLOC_FREE(subreq);
- if (tevent_req_nterror(req, status)) {
- return;
- }
-
- /*
- * We are filtering further down in sids2xids, but that filtering
- * depends on the actual type of the sid handed in (as determined
- * by lookupsids). Here we need to filter for the type of object
- * actually requested, in this case uid.
- */
- if (!(xids[0].type == ID_TYPE_UID || xids[0].type == ID_TYPE_BOTH)) {
- tevent_req_nterror(req, NT_STATUS_NONE_MAPPED);
- return;
- }
-
- state->pw->pw_uid = (uid_t)xids[0].id;
-
- subreq = wb_getgrsid_send(state, state->ev, &state->info->group_sid, 0);
- if (tevent_req_nomem(subreq, req)) {
- return;
- }
- tevent_req_set_callback(subreq, wb_fill_pwent_getgrsid_done, req);
-}
-
-static void wb_fill_pwent_getgrsid_done(struct tevent_req *subreq)
-{
- struct tevent_req *req = tevent_req_callback_data(
- subreq, struct tevent_req);
- struct wb_fill_pwent_state *state = tevent_req_data(
- req, struct wb_fill_pwent_state);
- struct winbindd_domain *domain;
- const char *dom_name;
- const char *grp_name;
- fstring user_name, output_username;
- char *mapped_name = NULL;
- struct talloc_dict *members;
- TALLOC_CTX *tmp_ctx = talloc_stackframe();
- NTSTATUS status;
- bool ok;
-
- /* xid handling is done in getgrsid() */
- status = wb_getgrsid_recv(subreq,
- tmp_ctx,
- &dom_name,
--
Samba Shared Repository
Karolin Seeger
2017-01-03 15:04:02 UTC
Permalink
The branch, master has been updated
via 5bcf3f1 WHATSNEW: Some small formal fixes.
from ec62194 winbind: Remove find_builtin_domain helper function

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 5bcf3f1b74647869c8d7321b3c2b7fb07e65ca53
Author: Karolin Seeger <***@samba.org>
Date: Tue Jan 3 10:09:42 2017 +0100

WHATSNEW: Some small formal fixes.

Signed-off-by: Karolin Seeger <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

Autobuild-User(master): Karolin Seeger <***@samba.org>
Autobuild-Date(master): Tue Jan 3 16:03:12 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
WHATSNEW.txt | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index b512796..7795523 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -44,6 +44,7 @@ configured as the default backend.
To avoid problems in future we advise all users to run 'testparm' after
changing the smb.conf file!

+
NEW FEATURES/CHANGES
====================

@@ -114,7 +115,7 @@ over-replication of links from new DCs. We have also made the parsing
of on-disk linked attributes much more efficient.

DNS improvements
----------------------------
+----------------

The samba-tool dns subcommand is now much more robust and can delete
records in a number of situations where it was not possible to do so
@@ -122,7 +123,6 @@ in the past.

On the server side, DNS names are now more strictly validated.

-
CTDB changes
------------

@@ -175,10 +175,6 @@ CTDB changes
--enable-ceph-reclock configure options.


-REMOVED FEATURES
-================
-
-
smb.conf changes
================
--
Samba Shared Repository
Ralph Böhme
2017-01-03 18:57:03 UTC
Permalink
The branch, master has been updated
via 98bcdca torture-netlogon: Use "all_zero" where appropriate
via 015a41a torture-samlogon: Avoid static zeros
via b3d5fe9 torture-samlogon: Use "all_zero" where appropriate
via 6eeb3ec torture-dfs: Use "all_zero" where appropriate
via efb5f38 auth4: Use "all_zero" where appropriate
via a4bc275 kdc: Use "all_zero" where appropriate
via 80bb18d samr3: Use "all_zero" where appropriate
via c9955da libads: Use "all_zero" where appropriate
via 214abc9 lib: Use "all_zero" where appropriate
via 25465b1 librpc: Use "all_zero" where appropriate
via 20c56e2 libnet: Use "all_zero" where appropriate
via f5847b6 auth: Use "all_zero" where appropriate
via f46932a librpc: Use "all_zero" where appropriate
via 577418c libcli: Use "all_zero" where appropriate
via ac389ee passdb: Use "all_zero" where appropriate
via d3322cd auth3: Avoid some zeros footprint
via 9c72823 ntlm_auth: Use "all_zero" where appropriate
via 0eea65d libcli: Use "all_zero" where appropriate
via 38884b2 libcli: Use "all_zero" where appropriate
via f50b6e7 auth3: Use "all_zero" where appropriate
via 3d9b1bd libcli: Use "all_zero" where appropriate
via 66e4026 lib: Remove a duplicate prototype
via ebdce3c libsmb: Add name_status_lmhosts
from 5bcf3f1 WHATSNEW: Some small formal fixes.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 98bcdca632c7e508af2ecb3e8d6e005d04523c83
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

torture-netlogon: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

Autobuild-User(master): Ralph Böhme <***@samba.org>
Autobuild-Date(master): Tue Jan 3 19:56:17 CET 2017 on sn-devel-144

commit 015a41a5e358849bc5960f9bc7714f751ad0f7b7
Author: Volker Lendecke <***@samba.org>
Date: Sun Jan 1 16:28:36 2017 +0000

torture-samlogon: Avoid static zeros

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit b3d5fe9679a56ba20e9627fecda36c60a471a20c
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

torture-samlogon: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 6eeb3ec3ab19ddee11829f1d5ac2d13ef1c7b18c
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

torture-dfs: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit efb5f38f1f03d3f1326a8fa115d19101c41db95a
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

auth4: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit a4bc275d947932c0a72e4f6d395634224f903e1a
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

kdc: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 80bb18d896a5609adb526a39c8512a4bc94cb409
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

samr3: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit c9955da65ad1befe51ad21dd884956c199b4c9b5
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

libads: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 214abc98e667bfa529eec86e5f1ef7e2c1cb8f37
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

lib: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 25465b118a32d0f4dea777da5880195ed7f27ecf
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

librpc: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 20c56e21ca4a5f2abcc618deb7d23e432721c88a
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

libnet: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit f5847b6e3484f7660535e60ba2d5df2fc8dad096
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

auth: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit f46932abfcd6461f4aa61302312ba13f641fc3d7
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

librpc: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 577418c87ef7ead24bcc09149c5a54840b7bc287
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

libcli: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit ac389eedece4ed9917cbac8b759b83f2111b3b66
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

passdb: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit d3322cdd21a28968fb6442843cbf169dc1ae0737
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 13:11:10 2016 +0000

auth3: Avoid some zeros footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 9c72823a99c4355af23530db2f6e263ac2b58458
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

ntlm_auth: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 0eea65d3728aaac3a443f5b57172d7486ca1c893
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

libcli: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 38884b2b2b08d54311d3b927900c5a9b071f8a5e
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

libcli: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit f50b6e7cb4aa1891f4a6808cc7008f64aee79e49
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

auth3: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 3d9b1bdf6c8f969c5075f1e0b47714a8a534bc2a
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:45:51 2016 +0000

libcli: Use "all_zero" where appropriate

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 66e402653f9a7991d03c7d483a9186a5400ab70e
Author: Volker Lendecke <***@samba.org>
Date: Sat Dec 31 12:38:45 2016 +0000

lib: Remove a duplicate prototype

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit ebdce3c489a856f233067d806fa4e3fb35976919
Author: Volker Lendecke <***@samba.org>
Date: Mon Dec 19 20:18:41 2016 +0100

libsmb: Add name_status_lmhosts

Don't ask... Oh, you did? :-)

Try to figure out a hosts' name from lmhosts. This is for a setup I've
come across where for several reasons kerberos and ldap were unusable
(very organically grown but unchangeable Solaris 10 installation with
tons of ancient libs that ./configure incorrectly finds and where tar xf
samba-4.5.3.tar takes 5 minutes...), so I had to fall back to compile
with --without-ads. Unfortunately in that environment NetBIOS was also
turned off, but the "winbind rpc only" code relies on name_status to
get a DC's name from its IP address for the netlogon calls. This walks
the local lmhosts file to scan for the same information.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
lib/krb5_wrap/krb5_samba.c | 8 ++----
libcli/auth/credentials.c | 33 +++++++++------------
libcli/auth/ntlm_check.c | 5 ++--
libcli/samsync/decrypt.c | 15 ++++------
libcli/smb/smbXcli_base.c | 10 ++-----
librpc/ndr/ndr_sec_helper.c | 12 ++------
source3/auth/auth_util.c | 10 +++----
source3/auth/check_samsec.c | 5 ++--
source3/include/proto.h | 1 -
source3/libads/kerberos_keytab.c | 30 ++++---------------
source3/libnet/libnet_dssync_passdb.c | 7 ++---
source3/libnet/libnet_keytab.h | 1 -
source3/libnet/libnet_samsync_display.c | 6 ++--
source3/libnet/libnet_samsync_keytab.c | 2 +-
source3/libnet/libnet_samsync_ldif.c | 7 ++---
source3/libnet/libnet_samsync_passdb.c | 7 ++---
source3/librpc/crypto/gse_krb5.c | 38 +++++++-----------------
source3/libsmb/namequery.c | 43 ++++++++++++++++++++++++++++
source3/passdb/pdb_samba_dsdb.c | 4 +--
source3/rpc_server/samr/srv_samr_chgpasswd.c | 8 ++----
source3/utils/ntlm_auth.c | 22 ++++++--------
source4/auth/ntlm/auth_sam.c | 5 ++--
source4/kdc/pac-glue.c | 10 +++----
source4/torture/dfs/domaindfs.c | 7 ++---
source4/torture/rpc/netlogon.c | 7 ++---
source4/torture/rpc/samlogon.c | 16 +++--------
26 files changed, 131 insertions(+), 188 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index 307be93..f8f3b16 100644
--- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c
@@ -1229,17 +1229,13 @@ krb5_error_code smb_krb5_kt_seek_and_delete_old_entries(krb5_context context,
{
krb5_error_code ret;
krb5_kt_cursor cursor;
- krb5_kt_cursor zero_csr;
krb5_keytab_entry kt_entry;
- krb5_keytab_entry zero_kt_entry;
char *ktprinc = NULL;
krb5_kvno old_kvno = kvno - 1;
TALLOC_CTX *tmp_ctx;

ZERO_STRUCT(cursor);
- ZERO_STRUCT(zero_csr);
ZERO_STRUCT(kt_entry);
- ZERO_STRUCT(zero_kt_entry);

ret = krb5_kt_start_seq_get(context, keytab, &cursor);
if (ret == KRB5_KT_END || ret == ENOENT ) {
@@ -1374,10 +1370,10 @@ krb5_error_code smb_krb5_kt_seek_and_delete_old_entries(krb5_context context,

out:
talloc_free(tmp_ctx);
- if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
+ if (!all_zero((uint8_t *)&kt_entry, sizeof(kt_entry))) {
smb_krb5_kt_free_entry(context, &kt_entry);
}
- if (memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) {
+ if (!all_zero((uint8_t *)&cursor, sizeof(cursor))) {
krb5_kt_end_seq_get(context, keytab, &cursor);
}
return ret;
diff --git a/libcli/auth/credentials.c b/libcli/auth/credentials.c
index 91f37b7..ddff5e9 100644
--- a/libcli/auth/credentials.c
+++ b/libcli/auth/credentials.c
@@ -512,7 +512,6 @@ static void netlogon_creds_crypt_samlogon_validation(struct netlogon_creds_Crede
union netr_Validation *validation,
bool do_encrypt)
{
- static const char zeros[16];
struct netr_SamBaseInfo *base = NULL;

if (validation == NULL) {
@@ -549,8 +548,7 @@ static void netlogon_creds_crypt_samlogon_validation(struct netlogon_creds_Crede
/* they aren't encrypted! */
} else if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
/* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
- if (memcmp(base->key.key, zeros,
- sizeof(base->key.key)) != 0) {
+ if (!all_zero(base->key.key, sizeof(base->key.key))) {
if (do_encrypt) {
netlogon_creds_aes_encrypt(creds,
base->key.key,
@@ -562,8 +560,8 @@ static void netlogon_creds_crypt_samlogon_validation(struct netlogon_creds_Crede
}
}

- if (memcmp(base->LMSessKey.key, zeros,
- sizeof(base->LMSessKey.key)) != 0) {
+ if (!all_zero(base->LMSessKey.key,
+ sizeof(base->LMSessKey.key))) {
if (do_encrypt) {
netlogon_creds_aes_encrypt(creds,
base->LMSessKey.key,
@@ -577,23 +575,22 @@ static void netlogon_creds_crypt_samlogon_validation(struct netlogon_creds_Crede
}
} else if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
/* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
- if (memcmp(base->key.key, zeros,
- sizeof(base->key.key)) != 0) {
+ if (!all_zero(base->key.key, sizeof(base->key.key))) {
netlogon_creds_arcfour_crypt(creds,
base->key.key,
sizeof(base->key.key));
}

- if (memcmp(base->LMSessKey.key, zeros,
- sizeof(base->LMSessKey.key)) != 0) {
+ if (!all_zero(base->LMSessKey.key,
+ sizeof(base->LMSessKey.key))) {
netlogon_creds_arcfour_crypt(creds,
base->LMSessKey.key,
sizeof(base->LMSessKey.key));
}
} else {
/* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
- if (memcmp(base->LMSessKey.key, zeros,
- sizeof(base->LMSessKey.key)) != 0) {
+ if (!all_zero(base->LMSessKey.key,
+ sizeof(base->LMSessKey.key))) {
if (do_encrypt) {
netlogon_creds_des_encrypt_LMKey(creds,
&base->LMSessKey);
@@ -626,8 +623,6 @@ static void netlogon_creds_crypt_samlogon_logon(struct netlogon_creds_Credential
union netr_LogonLevel *logon,
bool do_encrypt)
{
- static const char zeros[16];
-
if (logon == NULL) {
return;
}
@@ -645,7 +640,7 @@ static void netlogon_creds_crypt_samlogon_logon(struct netlogon_creds_Credential
uint8_t *h;

h = logon->password->lmpassword.hash;
- if (memcmp(h, zeros, 16) != 0) {
+ if (!all_zero(h, 16)) {
if (do_encrypt) {
netlogon_creds_aes_encrypt(creds, h, 16);
} else {
@@ -654,7 +649,7 @@ static void netlogon_creds_crypt_samlogon_logon(struct netlogon_creds_Credential
}

h = logon->password->ntpassword.hash;
- if (memcmp(h, zeros, 16) != 0) {
+ if (!all_zero(h, 16)) {
if (do_encrypt) {
netlogon_creds_aes_encrypt(creds, h, 16);
} else {
@@ -665,19 +660,19 @@ static void netlogon_creds_crypt_samlogon_logon(struct netlogon_creds_Credential
uint8_t *h;

h = logon->password->lmpassword.hash;
- if (memcmp(h, zeros, 16) != 0) {
+ if (!all_zero(h, 16)) {
netlogon_creds_arcfour_crypt(creds, h, 16);
}

h = logon->password->ntpassword.hash;
- if (memcmp(h, zeros, 16) != 0) {
+ if (!all_zero(h, 16)) {
netlogon_creds_arcfour_crypt(creds, h, 16);
}
} else {
struct samr_Password *p;

p = &logon->password->lmpassword;
- if (memcmp(p->hash, zeros, 16) != 0) {
+ if (!all_zero(p->hash, 16)) {
if (do_encrypt) {
netlogon_creds_des_encrypt(creds, p);
} else {
@@ -685,7 +680,7 @@ static void netlogon_creds_crypt_samlogon_logon(struct netlogon_creds_Credential
}
}
p = &logon->password->ntpassword;
- if (memcmp(p->hash, zeros, 16) != 0) {
+ if (!all_zero(p->hash, 16)) {
if (do_encrypt) {
netlogon_creds_des_encrypt(creds, p);
} else {
diff --git a/libcli/auth/ntlm_check.c b/libcli/auth/ntlm_check.c
index 7f91b52..d7fba34 100644
--- a/libcli/auth/ntlm_check.c
+++ b/libcli/auth/ntlm_check.c
@@ -293,7 +293,6 @@ NTSTATUS ntlm_password_check(TALLOC_CTX *mem_ctx,
DATA_BLOB *user_sess_key,
DATA_BLOB *lm_sess_key)
{
- const static uint8_t zeros[8];
DATA_BLOB tmp_sess_key;
const char *upper_client_domain = NULL;

@@ -314,8 +313,8 @@ NTSTATUS ntlm_password_check(TALLOC_CTX *mem_ctx,

/* Check for cleartext netlogon. Used by Exchange 5.5. */
if ((logon_parameters & MSV1_0_CLEARTEXT_PASSWORD_ALLOWED)
- && challenge->length == sizeof(zeros)
- && (memcmp(challenge->data, zeros, challenge->length) == 0 )) {
+ && challenge->length == 8
+ && (all_zero(challenge->data, challenge->length))) {
struct samr_Password client_nt;
struct samr_Password client_lm;
char *unix_pw = NULL;
diff --git a/libcli/samsync/decrypt.c b/libcli/samsync/decrypt.c
index 117151e..66cc915 100644
--- a/libcli/samsync/decrypt.c
+++ b/libcli/samsync/decrypt.c
@@ -44,15 +44,12 @@ static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
struct netr_DELTA_USER *user = delta->delta_union.user;
struct samr_Password lm_hash;
struct samr_Password nt_hash;
- unsigned char zero_buf[16];
-
- memset(zero_buf, '\0', sizeof(zero_buf));

/* Note that win2000 may send us all zeros
* for the hashes if it doesn't
* think this channel is secure enough. */
if (user->lm_password_present) {
- if (memcmp(user->lmpassword.hash, zero_buf, 16) != 0) {
+ if (!all_zero(user->lmpassword.hash, 16)) {
sam_rid_crypt(rid, user->lmpassword.hash, lm_hash.hash, 0);
} else {
memset(lm_hash.hash, '\0', sizeof(lm_hash.hash));
@@ -61,7 +58,7 @@ static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
}

if (user->nt_password_present) {
- if (memcmp(user->ntpassword.hash, zero_buf, 16) != 0) {
+ if (!all_zero(user->ntpassword.hash, 16)) {
sam_rid_crypt(rid, user->ntpassword.hash, nt_hash.hash, 0);
} else {
memset(nt_hash.hash, '\0', sizeof(nt_hash.hash));
@@ -90,8 +87,8 @@ static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
* for the hashes if it doesn't
* think this channel is secure enough. */
if (keys.keys.keys2.lmpassword.length == 16) {
- if (memcmp(keys.keys.keys2.lmpassword.pwd.hash,
- zero_buf, 16) != 0) {
+ if (!all_zero(keys.keys.keys2.lmpassword.pwd.hash,
+ 16)) {
sam_rid_crypt(rid,
keys.keys.keys2.lmpassword.pwd.hash,
lm_hash.hash, 0);
@@ -102,8 +99,8 @@ static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
user->lm_password_present = true;
}
if (keys.keys.keys2.ntpassword.length == 16) {
- if (memcmp(keys.keys.keys2.ntpassword.pwd.hash,
- zero_buf, 16) != 0) {
+ if (!all_zero(keys.keys.keys2.ntpassword.pwd.hash,
+ 16)) {
sam_rid_crypt(rid,
keys.keys.keys2.ntpassword.pwd.hash,
nt_hash.hash, 0);
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index e24090d..a7b24f0 100644
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -3851,13 +3851,9 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
}
}
if (signing_key) {
- int cmp;
- static const uint8_t zeros[16];
-
- cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
- zeros,
- 16);
- if (cmp == 0) {
+ bool zero;
+ zero = all_zero(inhdr+SMB2_HDR_SIGNATURE, 16);
+ if (zero) {
state->smb2.signing_skipped = true;
signing_key = NULL;
}
diff --git a/librpc/ndr/ndr_sec_helper.c b/librpc/ndr/ndr_sec_helper.c
index ea082d1..ecc0511 100644
--- a/librpc/ndr/ndr_sec_helper.c
+++ b/librpc/ndr/ndr_sec_helper.c
@@ -128,13 +128,9 @@ size_t ndr_size_dom_sid(const struct dom_sid *sid, int flags)

size_t ndr_size_dom_sid28(const struct dom_sid *sid, int flags)
{
- struct dom_sid zero_sid;
-
if (!sid) return 0;

- ZERO_STRUCT(zero_sid);
-
- if (memcmp(&zero_sid, sid, sizeof(zero_sid)) == 0) {
+ if (all_zero((const uint8_t *)sid, sizeof(struct dom_sid))) {
return 0;
}

@@ -287,8 +283,6 @@ enum ndr_err_code ndr_pull_dom_sid0(struct ndr_pull *ndr, int ndr_flags, struct
*/
enum ndr_err_code ndr_push_dom_sid0(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
{
- struct dom_sid zero_sid;
-
if (!(ndr_flags & NDR_SCALARS)) {
return NDR_ERR_SUCCESS;
}
@@ -297,9 +291,7 @@ enum ndr_err_code ndr_push_dom_sid0(struct ndr_push *ndr, int ndr_flags, const s
return NDR_ERR_SUCCESS;
}

- ZERO_STRUCT(zero_sid);
-
- if (memcmp(&zero_sid, sid, sizeof(zero_sid)) == 0) {
+ if (all_zero((const uint8_t *)sid, sizeof(struct dom_sid))) {
return NDR_ERR_SUCCESS;
}

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 25f27e8..ae6bfb3 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -811,7 +811,6 @@ static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,

static NTSTATUS make_new_session_info_guest(struct auth_session_info **session_info, struct auth_serversupplied_info **server_info)
{
- static const char zeros[16] = {0};
const char *guest_account = lp_guest_account();
const char *domain = lp_netbios_name();
struct netr_SamInfo3 info3;
@@ -861,7 +860,7 @@ static NTSTATUS make_new_session_info_guest(struct auth_session_info **session_i

/* annoying, but the Guest really does have a session key, and it is
all zeros! */
- (*session_info)->session_key = data_blob(zeros, sizeof(zeros));
+ (*session_info)->session_key = data_blob_talloc_zero(NULL, 16);

status = NT_STATUS_OK;
done:
@@ -1358,8 +1357,6 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
struct auth_serversupplied_info **server_info,
const struct netr_SamInfo3 *info3)
{
- static const char zeros[16] = {0, };
-
NTSTATUS nt_status = NT_STATUS_OK;
char *found_username = NULL;
const char *nt_domain;
@@ -1460,7 +1457,7 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,

/* ensure we are never given NULL session keys */

- if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
+ if (all_zero(info3->base.key.key, sizeof(info3->base.key.key))) {
result->session_key = data_blob_null;
} else {
result->session_key = data_blob_talloc(
@@ -1468,7 +1465,8 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
sizeof(info3->base.key.key));
}

- if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
+ if (all_zero(info3->base.LMSessKey.key,
+ sizeof(info3->base.LMSessKey.key))) {
result->lm_session_key = data_blob_null;
} else {
result->lm_session_key = data_blob_talloc(
diff --git a/source3/auth/check_samsec.c b/source3/auth/check_samsec.c
index cbcde08..53b6da5 100644
--- a/source3/auth/check_samsec.c
+++ b/source3/auth/check_samsec.c
@@ -322,7 +322,6 @@ static bool need_to_increment_bad_pw_count(
username = pdb_get_username(sampass);

for (i=1; i < MIN(MIN(3, policy_pwhistory_len), pwhistory_len); i++) {
- static const uint8_t zero16[SALTED_MD5_HASH_LEN];
const uint8_t *salt;
const uint8_t *nt_pw;
NTSTATUS status;
@@ -332,12 +331,12 @@ static bool need_to_increment_bad_pw_count(
salt = &pwhistory[i*PW_HISTORY_ENTRY_LEN];
nt_pw = salt + PW_HISTORY_SALT_LEN;

- if (memcmp(zero16, nt_pw, NT_HASH_LEN) == 0) {
+ if (all_zero(nt_pw, NT_HASH_LEN)) {
/* skip zero password hash */
continue;
}

- if (memcmp(zero16, salt, PW_HISTORY_SALT_LEN) != 0) {
+ if (!all_zero(salt, PW_HISTORY_SALT_LEN)) {
/* skip nonzero salt (old format entry) */
continue;
}
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 4535a14..642900e 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -324,7 +324,6 @@ const char *my_sam_name(void);

enum protocol_types get_Protocol(void);
void set_Protocol(enum protocol_types p);
-bool all_zero(const uint8_t *ptr, size_t size);
void gfree_names(void);
void gfree_all( void );
const char *my_netbios_names(int i);
diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
index 8c7c1c3..3c73b08 100644
--- a/source3/libads/kerberos_keytab.c
+++ b/source3/libads/kerberos_keytab.c
@@ -553,18 +553,10 @@ done:
TALLOC_FREE(frame);

if (context) {
- krb5_keytab_entry zero_kt_entry;
- krb5_kt_cursor zero_csr;
-
- ZERO_STRUCT(zero_kt_entry);
- ZERO_STRUCT(zero_csr);
-
- if (memcmp(&zero_kt_entry, &kt_entry,
- sizeof(krb5_keytab_entry))) {
+ if (!all_zero((uint8_t *)&kt_entry, sizeof(kt_entry))) {
smb_krb5_kt_free_entry(context, &kt_entry);
}
- if ((memcmp(&cursor, &zero_csr,
- sizeof(krb5_kt_cursor)) != 0) && keytab) {
+ if (!all_zero((uint8_t *)&cursor, sizeof(cursor)) && keytab) {
krb5_kt_end_seq_get(context, keytab, &cursor);
}
if (keytab) {
@@ -657,21 +649,11 @@ int ads_keytab_list(const char *keytab_name)
ZERO_STRUCT(cursor);
out:

- {
- krb5_keytab_entry zero_kt_entry;
- ZERO_STRUCT(zero_kt_entry);
- if (memcmp(&zero_kt_entry, &kt_entry,
- sizeof(krb5_keytab_entry))) {
- smb_krb5_kt_free_entry(context, &kt_entry);
- }
+ if (!all_zero((uint8_t *)&kt_entry, sizeof(kt_entry))) {
+ smb_krb5_kt_free_entry(context, &kt_entry);
}
- {
- krb5_kt_cursor zero_csr;
- ZERO_STRUCT(zero_csr);
- if ((memcmp(&cursor, &zero_csr,
- sizeof(krb5_kt_cursor)) != 0) && keytab) {
- krb5_kt_end_seq_get(context, keytab, &cursor);
- }
+ if (!all_zero((uint8_t *)&cursor, sizeof(cursor)) && keytab) {
+ krb5_kt_end_seq_get(context, keytab, &cursor);
}

if (keytab) {
diff --git a/source3/libnet/libnet_dssync_passdb.c b/source3/libnet/libnet_dssync_passdb.c
index 99e65c2..8e2a459 100644
--- a/source3/libnet/libnet_dssync_passdb.c
+++ b/source3/libnet/libnet_dssync_passdb.c
@@ -1105,7 +1105,6 @@ static NTSTATUS sam_account_from_object(struct samu *account,
TALLOC_CTX *mem_ctx = account;
const char *old_string, *new_string;
time_t unix_time, stored_time;
- uchar zero_buf[16];
NTSTATUS status;

NTTIME lastLogon;
@@ -1134,8 +1133,6 @@ static NTSTATUS sam_account_from_object(struct samu *account,
uint32_t acct_flags;
uint32_t units_per_week;

- memset(zero_buf, '\0', sizeof(zero_buf));
-
objectSid = cur->object.identifier->sid;
GET_STRING_EX(sAMAccountName, true);
DEBUG(0,("sam_account_from_object(%s, %s) start\n",
@@ -1329,11 +1326,11 @@ static NTSTATUS sam_account_from_object(struct samu *account,
think this channel is secure enough - don't set the passwords at all
in that case
*/
- if (dBCSPwd.length == 16 && memcmp(dBCSPwd.data, zero_buf, 16) != 0) {
+ if (dBCSPwd.length == 16 && !all_zero(dBCSPwd.data, 16)) {
pdb_set_lanman_passwd(account, dBCSPwd.data, PDB_CHANGED);
}

- if (unicodePwd.length == 16 && memcmp(unicodePwd.data, zero_buf, 16) != 0) {
+ if (unicodePwd.length == 16 && !all_zero(unicodePwd.data, 16)) {
pdb_set_nt_passwd(account, unicodePwd.data, PDB_CHANGED);
}

diff --git a/source3/libnet/libnet_keytab.h b/source3/libnet/libnet_keytab.h
index 43071ce..df6e957 100644
--- a/source3/libnet/libnet_keytab.h
+++ b/source3/libnet/libnet_keytab.h
@@ -35,7 +35,6 @@ struct libnet_keytab_context {
const char *keytab_name;
struct ads_struct *ads;
const char *dns_domain_name;
- uint8_t zero_buf[16];
uint32_t count;
struct libnet_keytab_entry *entries;
bool clean_old_entries;
diff --git a/source3/libnet/libnet_samsync_display.c b/source3/libnet/libnet_samsync_display.c
index 034a23f..040742d 100644
--- a/source3/libnet/libnet_samsync_display.c
+++ b/source3/libnet/libnet_samsync_display.c
@@ -60,19 +60,17 @@ static void display_account_info(uint32_t rid,
struct netr_DELTA_USER *r)
{
fstring hex_nt_passwd, hex_lm_passwd;
- uchar zero_buf[16];

- memset(zero_buf, '\0', sizeof(zero_buf));

/* Decode hashes from password hash (if they are not NULL) */

- if (memcmp(r->lmpassword.hash, zero_buf, 16) != 0) {
+ if (!all_zero(r->lmpassword.hash, 16)) {
pdb_sethexpwd(hex_lm_passwd, r->lmpassword.hash, r->acct_flags);
} else {
pdb_sethexpwd(hex_lm_passwd, NULL, 0);
}

- if (memcmp(r->ntpassword.hash, zero_buf, 16) != 0) {
+ if (!all_zero(r->ntpassword.hash, 16)) {
--
Samba Shared Repository
Volker Lendecke
2017-01-04 15:11:03 UTC
Permalink
The branch, master has been updated
via eb35afa winbind: Fix a typo
via b26ea7e winbind: Avoid a few explicit ZERO_STRUCT calls
via 319d602 winbind: remove nss_get_info backend functions
via 3081efb winbind: Remove nss_get_info()
via 2b722af winbind: Remove unused nss_get_info_cached
via 480c958 winbind: Simplify query_user_list to only return rids
via 67c0696 winbind: Remove wbint_QueryUserList
via 479ce28 winbind: Make list_users use wb_query_user_list
via 81e5770 winbind: Make wb_query_user_list just return names
via 91b73b1 winbind: Remove rpc_lookup_usergroups
via b231814 winbind: Remove "lookup_usergroups" winbind method
via 3f58a8c winbind: Remove validate_ug
via 876dc28 winbind: Remove wcache_lookup_usergroups
via f83863b winbind: Remove wb_cache_lookup_usergroups
via 256632e winbind: Remove wbint_LookupUserGroups
via c0570e6 winbind: Remove wb_lookupusergroups
via 13d7d46 winbind: Use wb_gettoken in getuserdomgroups
via bb050bf winbind: Add "expand_local_aliases" to wb_gettoken
via a8ab48e winbind: Remove rpc_query_user
via 241c81b winbind: Remove "query_user" backend function
via 81f3400 winbind: Remove unused wb_cache_query_user
via 5b2d74b winbind: Remove wbint_QueryUser
via b92cac8 s3: torture: Add test for cli_ftruncate calling cli_smb2_ftruncate.
via e0f1ed9 s3: libsmb: Add cli_smb2_ftruncate(), plumb into cli_ftruncate().
from 98bcdca torture-netlogon: Use "all_zero" where appropriate

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit eb35afacc145914478bc94bba9cbab6220b4f7ff
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 12:18:25 2017 +0000

winbind: Fix a typo

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Wed Jan 4 16:10:32 CET 2017 on sn-devel-144

commit b26ea7ef5e34d8f838d41131002ff5d10dc07ac5
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 09:54:33 2017 +0000

winbind: Avoid a few explicit ZERO_STRUCT calls

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 319d60285c92bbf86bc0a3f872f9c9f9d0530129
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 12:35:15 2017 +0000

winbind: remove nss_get_info backend functions

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 3081efb74f4082a4a4b25d2ddb6a0e339183184f
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 12:32:07 2017 +0000

winbind: Remove nss_get_info()

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 2b722af4235e6cd01e53272bfe0747642bae624b
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 12:17:27 2017 +0000

winbind: Remove unused nss_get_info_cached

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 480c9581a13afc08b20e80d2ff8a45ac8d7f18d3
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 12:11:30 2017 +0000

winbind: Simplify query_user_list to only return rids

Unfortunately this is a pretty large patch, because many functions
implement this API. The alternative would have been to create a new
backend function, add the new one piece by piece and then remove the
original function.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 67c0696761dedb748b1e4dc02531acbbf5ff95ca
Author: Volker Lendecke <***@samba.org>
Date: Mon Jan 2 15:45:50 2017 +0000

winbind: Remove wbint_QueryUserList

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 479ce28fd7dd54a6ae76fbbe3cd0a870738d87c0
Author: Volker Lendecke <***@samba.org>
Date: Mon Jan 2 15:44:04 2017 +0000

winbind: Make list_users use wb_query_user_list

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 81e5770aeebccfe6c65a40a5ac0e9e3a7b4c5d60
Author: Volker Lendecke <***@samba.org>
Date: Mon Jan 2 15:19:14 2017 +0000

winbind: Make wb_query_user_list just return names

Yes, this compiles. Nobody call this right now. Hold on :-)

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 91b73b1e93bb8fb38e2f1cea6c1cbd012c952542
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 15:23:21 2017 +0000

winbind: Remove rpc_lookup_usergroups

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit b231814c6b0ad17255139bc8934f269610348b2b
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 15:21:37 2017 +0000

winbind: Remove "lookup_usergroups" winbind method

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 3f58a8cabab75a594cff9088d5dd8ea439b36178
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 15:13:50 2017 +0000

winbind: Remove validate_ug

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 876dc28b9cf13343a2962b1a1b035fe78c1858a6
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 15:12:35 2017 +0000

winbind: Remove wcache_lookup_usergroups

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit f83863b4d1510a9519d15934c960fd1675235812
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 15:07:03 2017 +0000

winbind: Remove wb_cache_lookup_usergroups

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 256632ed3cc724bab0fc22132ca6b52faf680ab2
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 15:04:29 2017 +0000

winbind: Remove wbint_LookupUserGroups

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit c0570e6ae8f8f0057ece48d764580897ff2b6f62
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 15:02:48 2017 +0000

winbind: Remove wb_lookupusergroups

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 13d7d46a80949e2f8abd77c7dfc9dc9dcc03ae97
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 15:00:46 2017 +0000

winbind: Use wb_gettoken in getuserdomgroups

This makes sure we return the same information regardless of which call into
winbind is used

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit bb050bfd88e34c9d922ac2c26ab4cefc1bd07543
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 14:54:46 2017 +0000

winbind: Add "expand_local_aliases" to wb_gettoken

I hate passing down booleans, but we have the "domain_groups_only"
parameter in wbcLookupUserSids which we need to keep for API
compatibility. To make sure we use as few code paths as possible, this
basically passes down this flag.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit a8ab48ee193f68217e7c53b71bf6c57d2d15f8d7
Author: Volker Lendecke <***@samba.org>
Date: Mon Jan 2 15:58:39 2017 +0000

winbind: Remove rpc_query_user

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 241c81b2763392439043261cf179cd2c8793faed
Author: Volker Lendecke <***@samba.org>
Date: Mon Jan 2 15:56:48 2017 +0000

winbind: Remove "query_user" backend function

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 81f340097436280a90ba252d00f37c644a6be084
Author: Volker Lendecke <***@samba.org>
Date: Mon Jan 2 10:35:02 2017 +0000

winbind: Remove unused wb_cache_query_user

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 5b2d74bd1116ef182b4a2a58cb8949ae8f10638f
Author: Volker Lendecke <***@samba.org>
Date: Mon Jan 2 10:32:19 2017 +0000

winbind: Remove wbint_QueryUser

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit b92cac857823ac2d29133fba2fde57cf58805b45
Author: Jeremy Allison <***@samba.org>
Date: Tue Jan 3 15:37:03 2017 -0800

s3: torture: Add test for cli_ftruncate calling cli_smb2_ftruncate.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12479

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit e0f1ed9f450851bf5b7fec84577b50047309db3f
Author: Jeremy Allison <***@samba.org>
Date: Wed Dec 21 13:55:50 2016 -0800

s3: libsmb: Add cli_smb2_ftruncate(), plumb into cli_ftruncate().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12479

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
librpc/idl/winbind.idl | 14 -
source3/include/nss_info.h | 10 -
source3/libsmb/cli_smb2_fnum.c | 65 +++
source3/libsmb/cli_smb2_fnum.h | 3 +
source3/libsmb/clifile.c | 8 +-
source3/selftest/tests.py | 2 +-
source3/torture/proto.h | 1 +
source3/torture/test_smb2.c | 157 +++++++
source3/torture/torture.c | 1 +
source3/winbindd/idmap_ad_nss.c | 106 -----
source3/winbindd/idmap_hash/idmap_hash.c | 41 --
source3/winbindd/nss_info.c | 26 --
source3/winbindd/nss_info_template.c | 27 --
source3/winbindd/wb_gettoken.c | 10 +-
source3/winbindd/wb_lookupusergroups.c | 97 -----
source3/winbindd/wb_query_user_list.c | 70 ++-
source3/winbindd/winbindd.h | 17 +-
source3/winbindd/winbindd_ads.c | 613 +--------------------------
source3/winbindd/winbindd_cache.c | 443 ++-----------------
source3/winbindd/winbindd_dual_srv.c | 74 +---
source3/winbindd/winbindd_getgroups.c | 2 +-
source3/winbindd/winbindd_getuserdomgroups.c | 15 +-
source3/winbindd/winbindd_getusersids.c | 2 +-
source3/winbindd/winbindd_list_users.c | 106 ++---
source3/winbindd/winbindd_msrpc.c | 172 +-------
source3/winbindd/winbindd_proto.h | 37 +-
source3/winbindd/winbindd_reconnect.c | 50 +--
source3/winbindd/winbindd_reconnect_ads.c | 50 +--
source3/winbindd/winbindd_rpc.c | 212 +--------
source3/winbindd/winbindd_rpc.h | 20 +-
source3/winbindd/winbindd_samr.c | 204 +--------
source3/winbindd/wscript_build | 1 -
32 files changed, 453 insertions(+), 2203 deletions(-)
delete mode 100644 source3/winbindd/wb_lookupusergroups.c


Changeset truncated at 500 lines:

diff --git a/librpc/idl/winbind.idl b/librpc/idl/winbind.idl
index d38b17a..6245e13 100644
--- a/librpc/idl/winbind.idl
+++ b/librpc/idl/winbind.idl
@@ -84,11 +84,6 @@ interface winbind
dom_sid group_sid;
} wbint_userinfo;

- NTSTATUS wbint_QueryUser(
- [in] dom_sid *sid,
- [out] wbint_userinfo *info
- );
-
NTSTATUS wbint_GetNssInfo(
[in,out] wbint_userinfo *info
);
@@ -108,11 +103,6 @@ interface winbind
[out] wbint_RidArray *rids
);

- NTSTATUS wbint_LookupUserGroups(
- [in] dom_sid *sid,
- [out] wbint_SidArray *sids
- );
-
NTSTATUS wbint_QuerySequenceNumber(
[out] uint32 *sequence
);
@@ -139,10 +129,6 @@ interface winbind
[size_is(num_userinfos)] wbint_userinfo userinfos[];
} wbint_userinfos;

- NTSTATUS wbint_QueryUserList(
- [out] wbint_userinfos *users
- );
-
NTSTATUS wbint_QueryGroupList(
[out] wbint_Principals *groups
);
diff --git a/source3/include/nss_info.h b/source3/include/nss_info.h
index f92937e..54b4399 100644
--- a/source3/include/nss_info.h
+++ b/source3/include/nss_info.h
@@ -61,11 +61,6 @@ struct nss_domain_entry {

struct nss_info_methods {
NTSTATUS (*init)( struct nss_domain_entry *e );
- NTSTATUS (*get_nss_info)( struct nss_domain_entry *e,
- const struct dom_sid *sid,
- TALLOC_CTX *ctx,
- const char **homedir, const char **shell,
- const char **gecos, gid_t *p_gid);
NTSTATUS (*map_to_alias)(TALLOC_CTX *mem_ctx,
struct nss_domain_entry *e,
const char *name, char **alias);
@@ -82,11 +77,6 @@ NTSTATUS smb_register_idmap_nss(int version,
const char *name,
struct nss_info_methods *methods);

-NTSTATUS nss_get_info( const char *domain, const struct dom_sid *user_sid,
- TALLOC_CTX *ctx,
- const char **homedir, const char **shell,
- const char **gecos, gid_t *p_gid);
-
NTSTATUS nss_map_to_alias( TALLOC_CTX *mem_ctx, const char *domain,
const char *name, char **alias );

diff --git a/source3/libsmb/cli_smb2_fnum.c b/source3/libsmb/cli_smb2_fnum.c
index 266f2d3..848e077 100644
--- a/source3/libsmb/cli_smb2_fnum.c
+++ b/source3/libsmb/cli_smb2_fnum.c
@@ -3574,3 +3574,68 @@ NTSTATUS cli_smb2_shadow_copy_data(TALLOC_CTX *mem_ctx,
TALLOC_FREE(frame);
return status;
}
+
+/***************************************************************
+ Wrapper that allows SMB2 to truncate a file.
+ Synchronous only.
+***************************************************************/
+
+NTSTATUS cli_smb2_ftruncate(struct cli_state *cli,
+ uint16_t fnum,
+ uint64_t newsize)
+{
+ NTSTATUS status;
+ DATA_BLOB inbuf = data_blob_null;
+ struct smb2_hnd *ph = NULL;
+ TALLOC_CTX *frame = talloc_stackframe();
+
+ if (smbXcli_conn_has_async_calls(cli->conn)) {
+ /*
+ * Can't use sync call while an async call is in flight
+ */
+ status = NT_STATUS_INVALID_PARAMETER;
+ goto fail;
+ }
+
+ if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) {
+ status = NT_STATUS_INVALID_PARAMETER;
+ goto fail;
+ }
+
+ status = map_fnum_to_smb2_handle(cli,
+ fnum,
+ &ph);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto fail;
+ }
+
+ inbuf = data_blob_talloc_zero(frame, 8);
+ if (inbuf.data == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
+
+ SBVAL(inbuf.data, 0, newsize);
+
+ /* setinfo on the handle with info_type SMB2_SETINFO_FILE (1),
+ level 20 (SMB_FILE_END_OF_FILE_INFORMATION - 1000). */
+
+ status = smb2cli_set_info(cli->conn,
+ cli->timeout,
+ cli->smb2.session,
+ cli->smb2.tcon,
+ 1, /* in_info_type */
+ /* in_file_info_class */
+ SMB_FILE_END_OF_FILE_INFORMATION - 1000,
+ &inbuf, /* in_input_buffer */
+ 0, /* in_additional_info */
+ ph->fid_persistent,
+ ph->fid_volatile);
+
+ fail:
+
+ cli->raw_status = status;
+
+ TALLOC_FREE(frame);
+ return status;
+}
diff --git a/source3/libsmb/cli_smb2_fnum.h b/source3/libsmb/cli_smb2_fnum.h
index 3289f7e..12c42a2 100644
--- a/source3/libsmb/cli_smb2_fnum.h
+++ b/source3/libsmb/cli_smb2_fnum.h
@@ -208,4 +208,7 @@ NTSTATUS cli_smb2_shadow_copy_data(TALLOC_CTX *mem_ctx,
bool get_names,
char ***pnames,
int *pnum_names);
+NTSTATUS cli_smb2_ftruncate(struct cli_state *cli,
+ uint16_t fnum,
+ uint64_t newsize);
#endif /* __SMB2CLI_FNUM_H__ */
diff --git a/source3/libsmb/clifile.c b/source3/libsmb/clifile.c
index 5e667bd..03dd640 100644
--- a/source3/libsmb/clifile.c
+++ b/source3/libsmb/clifile.c
@@ -2819,11 +2819,17 @@ NTSTATUS cli_ftruncate_recv(struct tevent_req *req)

NTSTATUS cli_ftruncate(struct cli_state *cli, uint16_t fnum, uint64_t size)
{
- TALLOC_CTX *frame = talloc_stackframe();
+ TALLOC_CTX *frame = NULL;
struct tevent_context *ev = NULL;
struct tevent_req *req = NULL;
NTSTATUS status = NT_STATUS_OK;

+ if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
+ return cli_smb2_ftruncate(cli, fnum, size);
+ }
+
+ frame = talloc_stackframe();
+
if (smbXcli_conn_has_async_calls(cli->conn)) {
/*
* Can't use sync call while an async call is in flight
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index d9d32cc..3aecc9c 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -53,7 +53,7 @@ tests = ["FDPASS", "LOCK1", "LOCK2", "LOCK3", "LOCK4", "LOCK5", "LOCK6", "LOCK7"
"CHAIN3", "PIDHIGH",
"GETADDRINFO", "UID-REGRESSION-TEST", "SHORTNAME-TEST",
"CASE-INSENSITIVE-CREATE", "SMB2-BASIC", "NTTRANS-FSCTL", "SMB2-NEGPROT",
- "SMB2-SESSION-REAUTH", "SMB2-SESSION-RECONNECT",
+ "SMB2-SESSION-REAUTH", "SMB2-SESSION-RECONNECT", "SMB2-FTRUNCATE",
"CLEANUP1",
"CLEANUP2",
"CLEANUP4",
diff --git a/source3/torture/proto.h b/source3/torture/proto.h
index 7d2dedd..da0c69f 100644
--- a/source3/torture/proto.h
+++ b/source3/torture/proto.h
@@ -98,6 +98,7 @@ bool run_smb2_session_reconnect(int dummy);
bool run_smb2_tcon_dependence(int dummy);
bool run_smb2_multi_channel(int dummy);
bool run_smb2_session_reauth(int dummy);
+bool run_smb2_ftruncate(int dummy);
bool run_chain3(int dummy);
bool run_local_conv_auth_info(int dummy);
bool run_local_sprintf_append(int dummy);
diff --git a/source3/torture/test_smb2.c b/source3/torture/test_smb2.c
index 7819bc2..c0d11e6 100644
--- a/source3/torture/test_smb2.c
+++ b/source3/torture/test_smb2.c
@@ -27,6 +27,7 @@
#include "auth/gensec/gensec.h"
#include "auth_generic.h"
#include "../librpc/ndr/libndr.h"
+#include "libsmb/clirap.h"

extern fstring host, workgroup, share, password, username, myname;
extern struct cli_credentials *torture_creds;
@@ -1892,3 +1893,159 @@ bool run_smb2_session_reauth(int dummy)

return true;
}
+
+static NTSTATUS check_size(struct cli_state *cli,
+ uint16_t fnum,
+ const char *fname,
+ size_t size)
+{
+ off_t size_read = 0;
+
+ NTSTATUS status = cli_qfileinfo_basic(cli,
+ fnum,
+ NULL,
+ &size_read,
+ NULL,
+ NULL,
+ NULL,
+ NULL,
+ NULL);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("cli_smb2_qfileinfo_basic of %s failed (%s)\n",
+ fname,
+ nt_errstr(status));
+ return status;
+ }
+
+ if (size != size_read) {
+ printf("size (%u) != size_read(%u) for %s\n",
+ (unsigned int)size,
+ (unsigned int)size_read,
+ fname);
+ /* Use EOF to mean bad size. */
+ return NT_STATUS_END_OF_FILE;
+ }
+ return NT_STATUS_OK;
+}
+
+/* Ensure cli_ftruncate() works for SMB2. */
+
+bool run_smb2_ftruncate(int dummy)
+{
+ struct cli_state *cli = NULL;
+ const char *fname = "smb2_ftruncate.txt";
+ uint16_t fnum = (uint16_t)-1;
+ bool correct = false;
+ size_t buflen = 1024*1024;
+ uint8_t *buf = NULL;
+ unsigned int i;
+ NTSTATUS status;
+
+ printf("Starting SMB2-FTRUNCATE\n");
+
+ if (!torture_init_connection(&cli)) {
+ goto fail;
+ }
+
+ status = smbXcli_negprot(cli->conn, cli->timeout,
+ PROTOCOL_SMB2_02, PROTOCOL_SMB2_02);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("smbXcli_negprot returned %s\n", nt_errstr(status));
+ goto fail;
+ }
+
+ status = cli_session_setup_creds(cli, torture_creds);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("cli_session_setup returned %s\n", nt_errstr(status));
+ goto fail;
+ }
+
+ status = cli_tree_connect(cli, share, "?????", NULL);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("cli_tree_connect returned %s\n", nt_errstr(status));
+ goto fail;
+ }
+
+ cli_setatr(cli, fname, 0, 0);
+ cli_unlink(cli, fname, FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
+
+ status = cli_ntcreate(cli,
+ fname,
+ 0,
+ GENERIC_ALL_ACCESS,
+ FILE_ATTRIBUTE_NORMAL,
+ FILE_SHARE_NONE,
+ FILE_CREATE,
+ 0,
+ 0,
+ &fnum,
+ NULL);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("open of %s failed (%s)\n", fname, nt_errstr(status));
+ goto fail;
+ }
+
+ buf = talloc_zero_array(cli, uint8_t, buflen);
+ if (buf == NULL) {
+ goto fail;
+ }
+
+ /* Write 1MB. */
+ status = cli_writeall(cli,
+ fnum,
+ 0,
+ buf,
+ 0,
+ buflen,
+ NULL);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("write of %u to %s failed (%s)\n",
+ (unsigned int)buflen,
+ fname,
+ nt_errstr(status));
+ goto fail;
+ }
+
+ status = check_size(cli, fnum, fname, buflen);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto fail;
+ }
+
+ /* Now ftruncate. */
+ for ( i = 0; i < 10; i++) {
+ status = cli_ftruncate(cli, fnum, i*1024);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("cli_ftruncate %u of %s failed (%s)\n",
+ (unsigned int)i*1024,
+ fname,
+ nt_errstr(status));
+ goto fail;
+ }
+ status = check_size(cli, fnum, fname, i*1024);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto fail;
+ }
+ }
+
+ correct = true;
+
+ fail:
+
+ if (cli == NULL) {
+ return false;
+ }
+
+ if (fnum != (uint16_t)-1) {
+ cli_close(cli, fnum);
+ }
+ cli_setatr(cli, fname, 0, 0);
+ cli_unlink(cli, fname, FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
+
+ if (!torture_close_connection(cli)) {
+ correct = false;
+ }
+ return correct;
+}
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 1a57f41..ff3d68e 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -11070,6 +11070,7 @@ static struct {
{ "SMB2-TCON-DEPENDENCE", run_smb2_tcon_dependence },
{ "SMB2-MULTI-CHANNEL", run_smb2_multi_channel },
{ "SMB2-SESSION-REAUTH", run_smb2_session_reauth },
+ { "SMB2-FTRUNCATE", run_smb2_ftruncate },
{ "CLEANUP1", run_cleanup1 },
{ "CLEANUP2", run_cleanup2 },
{ "CLEANUP3", run_cleanup3 },
diff --git a/source3/winbindd/idmap_ad_nss.c b/source3/winbindd/idmap_ad_nss.c
index d979231..8b27b36 100644
--- a/source3/winbindd/idmap_ad_nss.c
+++ b/source3/winbindd/idmap_ad_nss.c
@@ -197,109 +197,6 @@ static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
}

-
-/************************************************************************
- ***********************************************************************/
-
-static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
- const struct dom_sid *sid,
- TALLOC_CTX *mem_ctx,
- const char **homedir,
- const char **shell,
- const char **gecos,
- gid_t *p_gid )
-{
- const char *attrs[] = {NULL, /* attr_homedir */
- NULL, /* attr_shell */
- NULL, /* attr_gecos */
- NULL, /* attr_gidnumber */
- NULL };
- char *filter = NULL;
- LDAPMessage *msg_internal = NULL;
- ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
- NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
- char *sidstr = NULL;
- struct idmap_domain *dom;
- struct idmap_ad_context *ctx;
-
- DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
- sid_string_dbg(sid), e->domain?e->domain:"NULL"));
-
- /* Only do query if we are online */
- if (idmap_is_offline()) {
- return NT_STATUS_FILE_IS_OFFLINE;
- }
-
- dom = talloc_get_type(e->state, struct idmap_domain);
- ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
-
- ads_status = ad_idmap_cached_connection(dom);
- if (!ADS_ERR_OK(ads_status)) {
- return NT_STATUS_OBJECT_NAME_NOT_FOUND;
- }
-
- if (!ctx->ad_schema) {
- DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
- return NT_STATUS_OBJECT_NAME_NOT_FOUND;
- }
-
- if (!sid || !homedir || !shell || !gecos) {
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- /* Have to do our own query */
-
- DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
- "own query\n"));
-
- attrs[0] = ctx->ad_schema->posix_homedir_attr;
- attrs[1] = ctx->ad_schema->posix_shell_attr;
- attrs[2] = ctx->ad_schema->posix_gecos_attr;
- attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
-
- sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
- filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
- TALLOC_FREE(sidstr);
-
- if (!filter) {
- nt_status = NT_STATUS_NO_MEMORY;
- goto done;
- }
-
- ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
- if (!ADS_ERR_OK(ads_status)) {
- nt_status = ads_ntstatus(ads_status);
- goto done;
- }
-
- *homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
- *shell = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
- *gecos = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
-
- if (p_gid != NULL) {
- uint32_t gid = UINT32_MAX;
- bool ok;
-
- ok = ads_pull_uint32(ctx->ads, msg_internal,
- ctx->ad_schema->posix_gidnumber_attr,
- &gid);
- if (ok) {
- *p_gid = gid;
- } else {
- *p_gid = (gid_t)-1;
- }
- }
-
- nt_status = NT_STATUS_OK;
-
-done:
- if (msg_internal) {
- ads_msgfree(ctx->ads, msg_internal);
- }
-
- return nt_status;
-}
-
/**********************************************************************
*********************************************************************/

@@ -475,21 +372,18 @@ done:
--
Samba Shared Repository
Karolin Seeger
2017-01-05 08:18:02 UTC
Permalink
The branch, master has been updated
via 03373f6 VERSION: Bump version up to 4.7.0pre1...
via b88d95e VERSION: Diable git snapshots for the 4.6.0rc1 release.
via 3817fd5 VERSION: Bump version up to 4.6.0rc1.
from eb35afa winbind: Fix a typo

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 03373f6ef0742930ef9ac88a27b06e79b6914643
Author: Karolin Seeger <***@samba.org>
Date: Thu Jan 5 08:45:25 2017 +0100

VERSION: Bump version up to 4.7.0pre1...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <***@samba.org>

commit b88d95e6b05a06c02043b9bf260ced7a247f2a60
Author: Karolin Seeger <***@samba.org>
Date: Thu Jan 5 08:44:22 2017 +0100

VERSION: Diable git snapshots for the 4.6.0rc1 release.

commit 3817fd5386b48fe9091653a2e91be227d73bb970
Author: Karolin Seeger <***@samba.org>
Date: Thu Jan 5 08:43:57 2017 +0100

VERSION: Bump version up to 4.6.0rc1.

Signed-off-by: Karolin Seeger <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
VERSION | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/VERSION b/VERSION
index 7252373..74fa2cf 100644
--- a/VERSION
+++ b/VERSION
@@ -24,7 +24,7 @@
# -> "3.0.0" #
########################################################
SAMBA_VERSION_MAJOR=4
-SAMBA_VERSION_MINOR=6
+SAMBA_VERSION_MINOR=7
SAMBA_VERSION_RELEASE=0

########################################################
--
Samba Shared Repository
Martin Schwenke
2017-01-06 11:28:03 UTC
Permalink
The branch, master has been updated
via 4635c22 ctdb-tests: Do not attempt to unregister the join handler multiple times
via 1dc1689 ctdb-tests: Add tests for generic socket I/O
via e3440d2 ctdb-common: Fix a bug in packet reading code for generic socket I/O
via ebc60b2 ctdb-tests: Add another test for sock_daemon
via d937055 ctdb-common: Simplify async computation for sock_socket_write_send/recv
from 03373f6 VERSION: Bump version up to 4.7.0pre1...

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 4635c22411a7864dd70703f854ec9844816e0294
Author: Amitay Isaacs <***@gmail.com>
Date: Thu Jan 5 15:05:56 2017 +1100

ctdb-tests: Do not attempt to unregister the join handler multiple times

MSG_ID_SYNC is broadcast to each node when a MSG_ID_JOIN has been
received from all nodes. After MSG_ID_SYNC is successfully broadcast,
the join handler is unregistered. However, if another MSG_ID_JOIN is
received before the join handler is unregistered then MSG_ID_SYNC is
re-broadcast. This results in multiple attempts to unregister the
join handler.

Once all MSG_ID_JOIN messages are received, unregister the join handler
to ignore any extra MSG_ID_JOIN messages. Also, make sure that while
join handler is being unregistered, MSG_ID_JOIN messages are ignored.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12500

Identified-by: Martin Schwenke <***@meltin.net>
Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

Autobuild-User(master): Martin Schwenke <***@samba.org>
Autobuild-Date(master): Fri Jan 6 12:27:23 CET 2017 on sn-devel-144

commit 1dc1689e7402f6f90af3ddd4c7d33d140892ff2a
Author: Amitay Isaacs <***@gmail.com>
Date: Thu Jan 5 00:48:32 2017 +1100

ctdb-tests: Add tests for generic socket I/O

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12500

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

commit e3440d2bbc0e8f2cb09c94a1d77a60524017cfa0
Author: Amitay Isaacs <***@gmail.com>
Date: Wed Jan 4 17:46:54 2017 +1100

ctdb-common: Fix a bug in packet reading code for generic socket I/O

queue->offset currently points to the end of available data. However,
after processing one packet the beginning of the next packet is not
marked explicitly and caused the same packet to be processed again.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12500

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

commit ebc60b2accbbb1586351d246d0bcc6a2dd528911
Author: Amitay Isaacs <***@gmail.com>
Date: Thu Jan 5 00:47:11 2017 +1100

ctdb-tests: Add another test for sock_daemon

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12500

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

commit d9370550a7f72ff02c296ef61bd7f86645167378
Author: Amitay Isaacs <***@gmail.com>
Date: Wed Jan 4 16:20:17 2017 +1100

ctdb-common: Simplify async computation for sock_socket_write_send/recv

This is now just a wrapper around comm_write_send/recv. This avoids the
extra tevent_req and fixes a bug in the termination of sock_socket_write
computation.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12500

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

-----------------------------------------------------------------------

Summary of changes:
ctdb/common/sock_daemon.c | 56 +-----
ctdb/common/sock_io.c | 28 +--
ctdb/tests/cunit/sock_daemon_test_001.sh | 23 ++-
ctdb/tests/cunit/sock_io_test_001.sh | 9 +
ctdb/tests/src/cluster_wait.c | 40 +++--
ctdb/tests/src/sock_daemon_test.c | 275 +++++++++++++++++++++++++++++-
ctdb/tests/src/sock_io_test.c | 283 +++++++++++++++++++++++++++++++
ctdb/wscript | 1 +
8 files changed, 628 insertions(+), 87 deletions(-)
create mode 100755 ctdb/tests/cunit/sock_io_test_001.sh
create mode 100644 ctdb/tests/src/sock_io_test.c


Changeset truncated at 500 lines:

diff --git a/ctdb/common/sock_daemon.c b/ctdb/common/sock_daemon.c
index dc5dba0..ca4086d 100644
--- a/ctdb/common/sock_daemon.c
+++ b/ctdb/common/sock_daemon.c
@@ -420,77 +420,33 @@ static bool sock_socket_start_recv(struct tevent_req *req, int *perr)
* Send message to a client
*/

-struct sock_socket_write_state {
- int status;
-};
-
-static void sock_socket_write_done(struct tevent_req *subreq);
-
struct tevent_req *sock_socket_write_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct sock_client_context *client_ctx,
uint8_t *buf, size_t buflen)
{
- struct tevent_req *req, *subreq;
- struct sock_socket_write_state *state;
-
- req = tevent_req_create(mem_ctx, &state,
- struct sock_socket_write_state);
- if (req == NULL) {
- return NULL;
- }
+ struct tevent_req *req;

- subreq = comm_write_send(state, ev, client_ctx->comm, buf, buflen);
- if (tevent_req_nomem(subreq, req)) {
- return tevent_req_post(req, ev);
- }
- tevent_req_set_callback(subreq, sock_socket_write_done, req);
+ req = comm_write_send(mem_ctx, ev, client_ctx->comm, buf, buflen);

return req;
}

-static void sock_socket_write_done(struct tevent_req *subreq)
+bool sock_socket_write_recv(struct tevent_req *req, int *perr)
{
- struct tevent_req *req = tevent_req_callback_data(
- subreq, struct tevent_req);
- struct sock_socket_write_state *state = tevent_req_data(
- req, struct sock_socket_write_state);
int ret;
bool status;

- status = comm_write_recv(subreq, &ret);
- TALLOC_FREE(subreq);
+ status = comm_write_recv(req, &ret);
if (! status) {
- state->status = ret;
- return;
- }
-}
-
-bool sock_socket_write_recv(struct tevent_req *req, int *perr)
-{
- struct sock_socket_write_state *state = tevent_req_data(
- req, struct sock_socket_write_state);
- int ret;
-
- if (tevent_req_is_unix_error(req, &ret)) {
if (perr != NULL) {
*perr = ret;
}
- return false;
}

- if (state->status != 0) {
- if (perr != NULL) {
- *perr = state->status;
- }
- return false;
- }
-
- if (perr != NULL) {
- *perr = 0;
- }
- return true;
+ return status;
}
+
/*
* Socket daemon
*/
diff --git a/ctdb/common/sock_io.c b/ctdb/common/sock_io.c
index b3581fc..7431eec 100644
--- a/ctdb/common/sock_io.c
+++ b/ctdb/common/sock_io.c
@@ -76,7 +76,7 @@ struct sock_queue {
struct tevent_queue *queue;
struct tevent_fd *fde;
uint8_t *buf;
- size_t buflen, offset;
+ size_t buflen, begin, end;
};

static bool sock_queue_set_fd(struct sock_queue *queue, int fd);
@@ -181,20 +181,20 @@ static void sock_queue_handler(struct tevent_context *ev,
goto fail;
}

- if (num_ready > queue->buflen - queue->offset) {
+ if (num_ready > queue->buflen - queue->end) {
queue->buf = talloc_realloc_size(queue, queue->buf,
- queue->offset + num_ready);
+ queue->end + num_ready);
if (queue->buf == NULL) {
goto fail;
}
- queue->buflen = queue->offset + num_ready;
+ queue->buflen = queue->end + num_ready;
}

- nread = sys_read(queue->fd, queue->buf + queue->offset, num_ready);
+ nread = sys_read(queue->fd, queue->buf + queue->end, num_ready);
if (nread < 0) {
goto fail;
}
- queue->offset += nread;
+ queue->end += nread;

sock_queue_process(queue);
return;
@@ -207,33 +207,35 @@ static void sock_queue_process(struct sock_queue *queue)
{
uint32_t pkt_size;

- if (queue->offset < sizeof(uint32_t)) {
+ if ((queue->end - queue->begin) < sizeof(uint32_t)) {
/* not enough data */
return;
}

- pkt_size = *(uint32_t *)queue->buf;
+ pkt_size = *(uint32_t *)(queue->buf + queue->begin);
if (pkt_size == 0) {
D_ERR("Invalid packet of length 0\n");
queue->callback(NULL, 0, queue->private_data);
}

- if (queue->offset < pkt_size) {
+ if ((queue->end - queue->begin) < pkt_size) {
/* not enough data */
return;
}

- queue->callback(queue->buf, pkt_size, queue->private_data);
- queue->offset += pkt_size;
+ queue->callback(queue->buf + queue->begin, pkt_size,
+ queue->private_data);
+ queue->begin += pkt_size;

- if (queue->offset < queue->buflen) {
+ if (queue->begin < queue->end) {
/* more data to be processed */
tevent_schedule_immediate(queue->im, queue->ev,
sock_queue_process_event, queue);
} else {
TALLOC_FREE(queue->buf);
queue->buflen = 0;
- queue->offset = 0;
+ queue->begin = 0;
+ queue->end = 0;
}
}

diff --git a/ctdb/tests/cunit/sock_daemon_test_001.sh b/ctdb/tests/cunit/sock_daemon_test_001.sh
index 9555cdd..036b6ac 100755
--- a/ctdb/tests/cunit/sock_daemon_test_001.sh
+++ b/ctdb/tests/cunit/sock_daemon_test_001.sh
@@ -24,21 +24,42 @@ result_filter ()

ok <<EOF
test1[PID]: listening on $sockpath
+EOF
+unit_test sock_daemon_test "$pidfile" "$sockpath" 1
+
+ok <<EOF
test2[PID]: listening on $sockpath
test2[PID]: daemon started, pid=PID
test2[PID]: Received signal 1
test2[PID]: Received signal 10
test2[PID]: Received signal 15
test2[PID]: Shutting down
+EOF
+unit_test sock_daemon_test "$pidfile" "$sockpath" 2
+
+ok <<EOF
test3[PID]: listening on $sockpath
test3[PID]: daemon started, pid=PID
test3[PID]: PID PID gone away, exiting
test3[PID]: Shutting down
+EOF
+unit_test sock_daemon_test "$pidfile" "$sockpath" 3
+
+ok <<EOF
test4[PID]: daemon started, pid=PID
+EOF
+unit_test sock_daemon_test "$pidfile" "$sockpath" 4
+
+ok <<EOF
test5[PID]: listening on $sockpath
test5[PID]: daemon started, pid=PID
test5[PID]: Received signal 15
test5[PID]: Shutting down
EOF
+unit_test sock_daemon_test "$pidfile" "$sockpath" 5

-unit_test sock_daemon_test "$pidfile" "$sockpath"
+ok <<EOF
+test6[PID]: listening on $sockpath
+test6[PID]: daemon started, pid=PID
+EOF
+unit_test sock_daemon_test "$pidfile" "$sockpath" 6
diff --git a/ctdb/tests/cunit/sock_io_test_001.sh b/ctdb/tests/cunit/sock_io_test_001.sh
new file mode 100755
index 0000000..1ead2f3
--- /dev/null
+++ b/ctdb/tests/cunit/sock_io_test_001.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+. "${TEST_SCRIPTS_DIR}/unit.sh"
+
+sockpath="${TEST_VAR_DIR}/sock_daemon_test.sock.$$"
+
+ok_null
+
+unit_test sock_io_test "$sockpath"
diff --git a/ctdb/tests/src/cluster_wait.c b/ctdb/tests/src/cluster_wait.c
index ddc3e02..1405738 100644
--- a/ctdb/tests/src/cluster_wait.c
+++ b/ctdb/tests/src/cluster_wait.c
@@ -36,6 +36,7 @@ struct cluster_wait_state {
struct ctdb_client_context *client;
int num_nodes;
bool *ready;
+ bool join_done;
};

static void cluster_wait_join_registered(struct tevent_req *subreq);
@@ -44,8 +45,8 @@ static void cluster_wait_join(struct tevent_req *subreq);
static void cluster_wait_join_sent(struct tevent_req *subreq);
static void cluster_wait_join_handler(uint64_t srvid, TDB_DATA data,
void *private_data);
-static void cluster_wait_sync_sent(struct tevent_req *subreq);
static void cluster_wait_join_unregistered(struct tevent_req *subreq);
+static void cluster_wait_sync_sent(struct tevent_req *subreq);
static void cluster_wait_sync_handler(uint64_t srvid, TDB_DATA data,
void *private_data);
static void cluster_wait_sync_unregistered(struct tevent_req *subreq);
@@ -67,6 +68,8 @@ struct tevent_req *cluster_wait_send(TALLOC_CTX *mem_ctx,
state->client = client;
state->num_nodes = num_nodes;

+ state->join_done = false;
+
if (ctdb_client_pnn(client) == 0) {
state->ready = talloc_zero_array(state, bool, num_nodes);
if (tevent_req_nomem(state->ready, req)) {
@@ -201,7 +204,6 @@ static void cluster_wait_join_handler(uint64_t srvid, TDB_DATA data,
private_data, struct tevent_req);
struct cluster_wait_state *state = tevent_req_data(
req, struct cluster_wait_state);
- struct ctdb_req_message msg;
struct tevent_req *subreq;
uint32_t pnn;
int i;
@@ -228,50 +230,56 @@ static void cluster_wait_join_handler(uint64_t srvid, TDB_DATA data,
}
}

- msg.srvid = MSG_ID_SYNC;
- msg.data.data = tdb_null;
+ if (state->join_done) {
+ return;
+ }

- subreq = ctdb_client_message_send(state, state->ev, state->client,
- CTDB_BROADCAST_ALL, &msg);
+ state->join_done = true;
+ subreq = ctdb_client_remove_message_handler_send(
+ state, state->ev, state->client,
+ MSG_ID_JOIN, req);
if (tevent_req_nomem(subreq, req)) {
return;
}
- tevent_req_set_callback(subreq, cluster_wait_sync_sent, req);
+ tevent_req_set_callback(subreq, cluster_wait_join_unregistered, req);
}

-static void cluster_wait_sync_sent(struct tevent_req *subreq)
+static void cluster_wait_join_unregistered(struct tevent_req *subreq)
{
struct tevent_req *req = tevent_req_callback_data(
subreq, struct tevent_req);
struct cluster_wait_state *state = tevent_req_data(
req, struct cluster_wait_state);
+ struct ctdb_req_message msg;
bool status;
int ret;

- status = ctdb_client_message_recv(subreq, &ret);
- TALLOC_FREE(subreq);
+ status = ctdb_client_remove_message_handler_recv(subreq, &ret);
if (! status) {
tevent_req_error(req, ret);
return;
}

- subreq = ctdb_client_remove_message_handler_send(
- state, state->ev, state->client,
- MSG_ID_JOIN, req);
+ msg.srvid = MSG_ID_SYNC;
+ msg.data.data = tdb_null;
+
+ subreq = ctdb_client_message_send(state, state->ev, state->client,
+ CTDB_BROADCAST_ALL, &msg);
if (tevent_req_nomem(subreq, req)) {
return;
}
- tevent_req_set_callback(subreq, cluster_wait_join_unregistered, req);
+ tevent_req_set_callback(subreq, cluster_wait_sync_sent, req);
}

-static void cluster_wait_join_unregistered(struct tevent_req *subreq)
+static void cluster_wait_sync_sent(struct tevent_req *subreq)
{
struct tevent_req *req = tevent_req_callback_data(
subreq, struct tevent_req);
bool status;
int ret;

- status = ctdb_client_remove_message_handler_recv(subreq, &ret);
+ status = ctdb_client_message_recv(subreq, &ret);
+ TALLOC_FREE(subreq);
if (! status) {
tevent_req_error(req, ret);
return;
diff --git a/ctdb/tests/src/sock_daemon_test.c b/ctdb/tests/src/sock_daemon_test.c
index 14ddefd..4a085c0 100644
--- a/ctdb/tests/src/sock_daemon_test.c
+++ b/ctdb/tests/src/sock_daemon_test.c
@@ -606,27 +606,288 @@ static void test5(TALLOC_CTX *mem_ctx, const char *pidfile,
assert(ret == 0);
}

+struct test6_pkt {
+ uint32_t len;
+ uint32_t data;
+};
+
+struct test6_client_state {
+ bool done;
+};
+
+static void test6_client_callback(uint8_t *buf, size_t buflen,
+ void *private_data)
+{
+ struct test6_client_state *state =
+ (struct test6_client_state *)private_data;
+ struct test6_pkt *pkt;
+
+ assert(buflen == sizeof(struct test6_pkt));
+ pkt = (struct test6_pkt *)buf;
+ assert(pkt->len == sizeof(struct test6_pkt));
+ assert(pkt->data == 0xffeeddcc);
+
+ state->done = true;
+}
+
+static void test6_client(const char *sockpath)
+{
+ struct tevent_context *ev;
+ struct test6_client_state state;
+ struct sock_queue *queue;
+ struct test6_pkt pkt;
+ int conn, ret;
+
+ ev = tevent_context_init(NULL);
+ assert(ev != NULL);
+
+ conn = sock_connect(sockpath);
+ assert(conn != -1);
+
+ state.done = false;
+
+ queue = sock_queue_setup(ev, ev, conn,
+ test6_client_callback, &state);
+ assert(queue != NULL);
+
+ pkt.len = 8;
+ pkt.data = 0xaabbccdd;
+
+ ret = sock_queue_write(queue, (uint8_t *)&pkt,
+ sizeof(struct test6_pkt));
+ assert(ret == 0);
+
+ while (! state.done) {
+ tevent_loop_once(ev);
+ }
+
+ talloc_free(ev);
+}
+
+struct test6_server_state {
+ struct sock_daemon_context *sockd;
+ int done;
+};
+
+struct test6_read_state {
+ struct test6_server_state *server_state;
+ struct test6_pkt reply;
+};
+
+static void test6_read_done(struct tevent_req *subreq);
+
+static struct tevent_req *test6_read_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct sock_client_context *client,
+ uint8_t *buf, size_t buflen,
+ void *private_data)
+{
+ struct test6_server_state *server_state =
+ (struct test6_server_state *)private_data;
+ struct tevent_req *req, *subreq;
+ struct test6_read_state *state;
+ struct test6_pkt *pkt;
+
+ req = tevent_req_create(mem_ctx, &state, struct test6_read_state);
+ assert(req != NULL);
+
+ state->server_state = server_state;
+
+ assert(buflen == sizeof(struct test6_pkt));
+
+ pkt = (struct test6_pkt *)buf;
+ assert(pkt->data == 0xaabbccdd);
+
+ state->reply.len = sizeof(struct test6_pkt);
+ state->reply.data = 0xffeeddcc;
+
+ subreq = sock_socket_write_send(state, ev, client,
+ (uint8_t *)&state->reply,
+ state->reply.len);
+ assert(subreq != NULL);
+
+ tevent_req_set_callback(subreq, test6_read_done, req);
+
+ return req;
+}
+
+static void test6_read_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(
+ subreq, struct tevent_req);
+ struct test6_read_state *state = tevent_req_data(
+ req, struct test6_read_state);
+ int ret;
+ bool status;
+
+ status = sock_socket_write_recv(subreq, &ret);
+ TALLOC_FREE(subreq);
+ if (! status) {
+ tevent_req_error(req, ret);
+ return;
+ }
+
+ state->server_state->done = 1;
+ tevent_req_done(req);
+}
+
+static bool test6_read_recv(struct tevent_req *req, int *perr)
+{
+ int ret;
+
+ if (tevent_req_is_unix_error(req, &ret)) {
+ if (perr != NULL) {
+ *perr = ret;
+ }
+ return false;
+ }
+
+ return true;
+}
+
+static struct sock_socket_funcs test6_client_funcs = {
+ .read_send = test6_read_send,
+ .read_recv = test6_read_recv,
+};
+
+static void test6_startup(void *private_data)
+{
+ int fd = *(int *)private_data;
+ int ret = 1;
+ ssize_t nwritten;
--
Samba Shared Repository
Andreas Schneider
2017-01-06 15:17:02 UTC
Permalink
The branch, master has been updated
via c586c3d libgpo: allow empty values in gp inifile parsing code.
via 7eeb2ed lib/util: add pm_process_with_flags to allow parsing ini files with empty values
via 235aa67 libgpo: default to empty values if none are there
via 06978c6 libgpo: deal with non utf16-le ini files.
via dcb2680 libgpo: apply some const.
via 8e5251c libgpo: add gp_inifile_enum_section()
via 5c16dfe libgpo: add gp_inifile_init_context_direct()
via 90deb9f s3-spoolss: Create a sperate header file for 'struct printer_handle'
via bb24649 s3-spoolss: remove unused type field in printer handle
via a250184 s3-iremotewinspool: update api struct map so we only end up implementing 8 calls
via 7dd880f s3-iremotewinspool: add generated server stubs and no longer compile autogenerated ones
via 29266c0 s3-iremotewinspool: add generated srv_iremotewinspool_nt.c file
via 5674655 s3-rpc_server: setup secondary address for tcp transport in bind_ack packet.
via 3e084ea s3-rpc_server: enforce packet level authentication for iremotewinspool server
via 1ec825b s3-rpc_server: allow to set minimal auth level for a DCE/RPC service
from 4635c22 ctdb-tests: Do not attempt to unregister the join handler multiple times

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit c586c3d962e8ee57e90f76147b458e1bea0ed988
Author: Günther Deschner <***@samba.org>
Date: Wed Sep 14 18:13:39 2016 +0200

libgpo: allow empty values in gp inifile parsing code.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Andreas Schneider <***@cryptomilk.org>
Autobuild-Date(master): Fri Jan 6 16:16:02 CET 2017 on sn-devel-144

commit 7eeb2edc5060b03efa7166017e5b2a36af5b7f75
Author: Günther Deschner <***@samba.org>
Date: Wed Sep 14 18:13:00 2016 +0200

lib/util: add pm_process_with_flags to allow parsing ini files with empty values

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 235aa6754471122bd5791614953eeea6d86e2a5e
Author: Günther Deschner <***@samba.org>
Date: Mon Sep 19 17:11:19 2016 +0200

libgpo: default to empty values if none are there

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 06978c65414a3afb25e22d40379208ca3857bcbc
Author: Günther Deschner <***@samba.org>
Date: Thu Nov 10 15:15:05 2016 +0100

libgpo: deal with non utf16-le ini files.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit dcb26801632d354e4037f146f89d55448fbbb622
Author: Günther Deschner <***@samba.org>
Date: Tue Sep 27 18:18:51 2016 +0200

libgpo: apply some const.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 8e5251c1f30a86ef88c7c145c71deccf19d4189f
Author: Günther Deschner <***@samba.org>
Date: Tue Sep 13 08:36:59 2016 +0200

libgpo: add gp_inifile_enum_section()

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 5c16dfe32532e06c7fe9fad6524ebef7d7378b76
Author: Günther Deschner <***@samba.org>
Date: Sun Sep 11 12:48:14 2016 +0200

libgpo: add gp_inifile_init_context_direct()

This varient ignores the group policy flags and does not try to find the right
unix path.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 90deb9f04c5ac1b2ef3ced35d927abb139d3e789
Author: Günther Deschner <***@samba.org>
Date: Fri Aug 26 18:33:19 2016 +0200

s3-spoolss: Create a sperate header file for 'struct printer_handle'

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit bb24649051d95ee8d3e968496d77e43b4c433563
Author: Günther Deschner <***@samba.org>
Date: Fri Dec 2 09:09:49 2016 +0100

s3-spoolss: remove unused type field in printer handle

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit a2501843b6a93c09918825e2f04726ab843c2107
Author: Günther Deschner <***@samba.org>
Date: Wed Sep 14 11:46:20 2016 +0200

s3-iremotewinspool: update api struct map so we only end up implementing 8 calls

In the end, these calls are the only ones we need to implement:

3.1.4.2. Printer Driver Management Methods

* AsyncInstallPrinterDriverFromPackage
* AsyncUploadPrinterDriverPackage
* AsyncCorePrinterDriverInstalled
* AsyncDeletePrinterDriverPackage

3.1.4.9. Printing Related Notification Methods

* SyncRegisterForRemoteNotifications
* SyncUnRegisterForRemoteNotifications
* SyncRefreshRemoteNotifications
* AsyncGetRemoteNotifications

All other calls are 1:1 mapped to spoolss calls.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 7dd880f4b91dd55f800fe3b7097684acdd3297ca
Author: Günther Deschner <***@samba.org>
Date: Tue Sep 20 18:43:57 2016 +0200

s3-iremotewinspool: add generated server stubs and no longer compile autogenerated ones

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 29266c0a9075d466a2e580206e9018b278bce972
Author: Günther Deschner <***@samba.org>
Date: Tue Sep 20 20:21:50 2016 +0200

s3-iremotewinspool: add generated srv_iremotewinspool_nt.c file

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 567465546f112fda90f59bbeeba0bff3d4985bcd
Author: Günther Deschner <***@samba.org>
Date: Mon Sep 26 20:22:04 2016 +0200

s3-rpc_server: setup secondary address for tcp transport in bind_ack packet.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 3e084ea6ceb82b61c24ce7260404027a4428b9d6
Author: Günther Deschner <***@samba.org>
Date: Mon Sep 26 19:21:05 2016 +0200

s3-rpc_server: enforce packet level authentication for iremotewinspool server

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 1ec825b28a296d7df11fd9ac83a6c123c7b177ea
Author: Günther Deschner <***@samba.org>
Date: Mon Sep 26 19:20:24 2016 +0200

s3-rpc_server: allow to set minimal auth level for a DCE/RPC service

Guenther

Pair-Programmed-With: Stefan Metzmacher <***@samba.org>

Signed-off-by: Guenther Deschner <***@samba.org>
Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
lib/util/params.c | 25 +-
lib/util/samba_util.h | 6 +
lib/util/tini.c | 25 +-
lib/util/tini.h | 1 +
lib/util/tiniparser.c | 1 +
libgpo/gpo_ini.c | 168 +++-
libgpo/gpo_ini.h | 15 +-
source3/include/nt_printing.h | 5 -
source3/libgpo/gpext/scripts.c | 4 +-
source3/libgpo/gpext/security.c | 2 +-
source3/rpc_server/rpc_pipes.h | 5 +
source3/rpc_server/spoolss/srv_iremotewinspool.c | 723 ++++++++++++++++
.../rpc_server/spoolss/srv_iremotewinspool_nt.c | 923 +++++++++++++++++++++
source3/rpc_server/spoolss/srv_spoolss_handle.h | 77 ++
source3/rpc_server/spoolss/srv_spoolss_nt.c | 43 +-
source3/rpc_server/srv_pipe.c | 41 +-
source3/rpc_server/wscript_build | 9 +-
17 files changed, 1988 insertions(+), 85 deletions(-)
create mode 100644 source3/rpc_server/spoolss/srv_iremotewinspool.c
create mode 100644 source3/rpc_server/spoolss/srv_iremotewinspool_nt.c
create mode 100644 source3/rpc_server/spoolss/srv_spoolss_handle.h


Changeset truncated at 500 lines:

diff --git a/lib/util/params.c b/lib/util/params.c
index 5ec4fd2..c5c2526 100644
--- a/lib/util/params.c
+++ b/lib/util/params.c
@@ -96,7 +96,30 @@ bool pm_process(const char *filename,
return false;
}

- ret = tini_parse(f, sfunc, pfunc, private_data);
+ ret = tini_parse(f, false, sfunc, pfunc, private_data);
+
+ fclose(f);
+
+ return ret;
+}
+
+
+bool pm_process_with_flags(const char *filename,
+ bool allow_empty_values,
+ bool (*sfunc)(const char *section, void *private_data),
+ bool (*pfunc)(const char *name, const char *value,
+ void *private_data),
+ void *private_data)
+{
+ FILE *f;
+ bool ret;
+
+ f = fopen(filename, "r");
+ if (f == NULL) {
+ return false;
+ }
+
+ ret = tini_parse(f, allow_empty_values, sfunc, pfunc, private_data);

fclose(f);

diff --git a/lib/util/samba_util.h b/lib/util/samba_util.h
index 897e0f5..c19e246 100644
--- a/lib/util/samba_util.h
+++ b/lib/util/samba_util.h
@@ -609,6 +609,12 @@ bool pm_process( const char *fileName,
bool (*sfunc)(const char *, void *),
bool (*pfunc)(const char *, const char *, void *),
void *userdata);
+bool pm_process_with_flags(const char *filename,
+ bool allow_empty_values,
+ bool (*sfunc)(const char *section, void *private_data),
+ bool (*pfunc)(const char *name, const char *value,
+ void *private_data),
+ void *private_data);

void print_asc(int level, const uint8_t *buf,int len);
void print_asc_cb(const uint8_t *buf, int len,
diff --git a/lib/util/tini.c b/lib/util/tini.c
index 3bfc2d6..36d7a45 100644
--- a/lib/util/tini.c
+++ b/lib/util/tini.c
@@ -227,19 +227,27 @@ static char *trim_one_space(char *buf)
}

static bool parse_param(char *buf,
+ bool allow_empty_value,
bool (*pfunc)(const char *name, const char *value,
void *private_data),
void *private_data)
{
char *equals;
- char *name, *value;
+ char *name;
+ const char *value;
size_t len;
+ bool no_value = false;

equals = strchr(buf, '=');
- if (equals == NULL) {
- return true;
+ if (equals != NULL) {
+ *equals = '\0';
+ } else {
+ if (allow_empty_value) {
+ no_value = true;
+ } else {
+ return true;
+ }
}
- *equals = '\0';

name = trim_one_space(buf);
len = strlen(buf);
@@ -247,12 +255,17 @@ static bool parse_param(char *buf,
return false;
}

- value = trim_one_space(equals+1);
+ if (no_value) {
+ value = "";
+ } else {
+ value = trim_one_space(equals+1);
+ }

return pfunc(name, value, private_data);
}

bool tini_parse(FILE *f,
+ bool allow_empty_value,
bool (*sfunc)(const char *section, void *private_data),
bool (*pfunc)(const char *name, const char *value,
void *private_data),
@@ -293,7 +306,7 @@ bool tini_parse(FILE *f,
ok = parse_section(buf, sfunc, private_data);
break;
default:
- ok = parse_param(buf, pfunc, private_data);
+ ok = parse_param(buf, allow_empty_value, pfunc, private_data);
break;
}

diff --git a/lib/util/tini.h b/lib/util/tini.h
index 02cc1ac..36fc080 100644
--- a/lib/util/tini.h
+++ b/lib/util/tini.h
@@ -38,6 +38,7 @@
#include <stdio.h>

bool tini_parse(FILE *f,
+ bool allow_empty_value,
bool (*sfunc)(const char *section, void *private_data),
bool (*pfunc)(const char *name, const char *value,
void *private_data),
diff --git a/lib/util/tiniparser.c b/lib/util/tiniparser.c
index 7c10616..c3ab4e7 100644
--- a/lib/util/tiniparser.c
+++ b/lib/util/tiniparser.c
@@ -339,6 +339,7 @@ struct tiniparser_dictionary *tiniparser_load(const char *filename)
d->section_list = NULL;

ret = tini_parse(fp,
+ false,
section_parser,
value_parser,
d);
diff --git a/libgpo/gpo_ini.c b/libgpo/gpo_ini.c
index c027612..198e8af 100644
--- a/libgpo/gpo_ini.c
+++ b/libgpo/gpo_ini.c
@@ -56,7 +56,7 @@ static bool store_keyval_pair(const char *key, const char *value, void *ctx_ptr)
}

ctx->data[ctx->keyval_count]->key = talloc_asprintf(ctx, "%s:%s", ctx->current_section, key);
- ctx->data[ctx->keyval_count]->val = talloc_strdup(ctx, value);
+ ctx->data[ctx->keyval_count]->val = talloc_strdup(ctx, value ? value : "");

if (!ctx->data[ctx->keyval_count]->key ||
!ctx->data[ctx->keyval_count]->val) {
@@ -87,12 +87,22 @@ static NTSTATUS convert_file_from_ucs2(TALLOC_CTX *mem_ctx,
return NT_STATUS_INVALID_PARAMETER;
}

- data_in = (uint8_t *)file_load(filename_in, &n, 0, NULL);
+ data_in = (uint8_t *)file_load(filename_in, &n, 0, mem_ctx);
if (!data_in) {
status = NT_STATUS_NO_SUCH_FILE;
goto out;
}

+ DEBUG(11,("convert_file_from_ucs2: "
+ "data_in[0]: 0x%x, data_in[1]: 0x%x, data_in[2]: 0x%x\n",
+ data_in[0], data_in[1], data_in[2]));
+
+ if ((data_in[0] != 0xff) || (data_in[1] != 0xfe) || (data_in[2] != 0x0d)) {
+ *filename_out = NULL;
+ status = NT_STATUS_OK;
+ goto out;
+ }
+
tmp_name = talloc_asprintf(mem_ctx, "%s/convert_file_from_ucs2.XXXXXX",
tmpdir());
if (!tmp_name) {
@@ -115,20 +125,12 @@ static NTSTATUS convert_file_from_ucs2(TALLOC_CTX *mem_ctx,
goto out;
}

- /* skip utf8 BOM */
DEBUG(11,("convert_file_from_ucs2: "
- "data_out[0]: 0x%x, data_out[1]: 0x%x, data_out[2]: 0x%x\n",
- data_out[0], data_out[1], data_out[2]));
+ "%s skipping utf16-le BOM\n", tmp_name));

- if ((data_out[0] == 0xef) && (data_out[1] == 0xbb) &&
- (data_out[2] == 0xbf)) {
- DEBUG(11,("convert_file_from_ucs2: "
- "%s skipping utf8 BOM\n", tmp_name));
- data_out += 3;
- converted_size -= 3;
- }
+ converted_size -= 3;

- if (write(tmp_fd, data_out, converted_size) != converted_size) {
+ if (write(tmp_fd, data_out + 3, converted_size) != converted_size) {
status = map_nt_error_from_unix_common(errno);
goto out;
}
@@ -143,6 +145,7 @@ static NTSTATUS convert_file_from_ucs2(TALLOC_CTX *mem_ctx,
}

talloc_free(data_in);
+ talloc_free(data_out);

return status;
}
@@ -150,7 +153,7 @@ static NTSTATUS convert_file_from_ucs2(TALLOC_CTX *mem_ctx,
/****************************************************************
****************************************************************/

-NTSTATUS gp_inifile_getstring(struct gp_inifile_context *ctx, const char *key, char **ret)
+NTSTATUS gp_inifile_getstring(struct gp_inifile_context *ctx, const char *key, const char **ret)
{
int i;

@@ -170,7 +173,7 @@ NTSTATUS gp_inifile_getstring(struct gp_inifile_context *ctx, const char *key, c

NTSTATUS gp_inifile_getint(struct gp_inifile_context *ctx, const char *key, int *ret)
{
- char *value;
+ const char *value;
NTSTATUS result;

result = gp_inifile_getstring(ctx,key, &value);
@@ -189,7 +192,7 @@ NTSTATUS gp_inifile_getint(struct gp_inifile_context *ctx, const char *key, int

NTSTATUS gp_inifile_getbool(struct gp_inifile_context *ctx, const char *key, bool *ret)
{
- char *value;
+ const char *value;
NTSTATUS result;

result = gp_inifile_getstring(ctx,key, &value);
@@ -217,6 +220,80 @@ NTSTATUS gp_inifile_getbool(struct gp_inifile_context *ctx, const char *key, boo
/****************************************************************
****************************************************************/

+NTSTATUS gp_inifile_enum_section(struct gp_inifile_context *ctx,
+ const char *section,
+ size_t *num_ini_keys,
+ const char ***ini_keys,
+ const char ***ini_values)
+{
+ NTSTATUS status;
+ int i;
+ size_t num_keys = 0, num_vals = 0;
+ const char **keys = NULL;
+ const char **values = NULL;
+
+ if (section == NULL || num_ini_keys == NULL ||
+ ini_keys == NULL || ini_values == NULL) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ for (i = 0; i < ctx->keyval_count; i++) {
+
+ bool ok;
+
+ /*
+ * section: KEYNAME
+ * KEYNAME:value matches
+ * KEYNAME_OEM:value not
+ */
+
+ if (strlen(section)+1 > strlen(ctx->data[i]->key)) {
+ continue;
+ }
+
+ if (!strnequal(section, ctx->data[i]->key, strlen(section))) {
+ continue;
+ }
+
+ if (ctx->data[i]->key[strlen(section)] != ':') {
+ continue;
+ }
+
+ ok = add_string_to_array(ctx, ctx->data[i]->key, &keys, &num_keys);
+ if (!ok) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ok = add_string_to_array(ctx, ctx->data[i]->val, &values, &num_vals);
+ if (!ok) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ if (num_keys != num_vals) {
+ status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+ goto failed;
+ }
+ }
+
+ *num_ini_keys = num_keys;
+ *ini_keys = keys;
+ *ini_values = values;
+
+ return NT_STATUS_OK;
+
+ failed:
+ talloc_free(keys);
+ talloc_free(values);
+
+ return status;
+}
+
+
+/****************************************************************
+****************************************************************/
+
NTSTATUS gp_inifile_init_context(TALLOC_CTX *mem_ctx,
uint32_t flags,
const char *unix_path,
@@ -249,7 +326,8 @@ NTSTATUS gp_inifile_init_context(TALLOC_CTX *mem_ctx,
goto failed;
}

- rv = pm_process(tmp_filename, change_section, store_keyval_pair, ctx);
+ rv = pm_process(tmp_filename != NULL ? tmp_filename : ini_filename,
+ change_section, store_keyval_pair, ctx);
if (!rv) {
return NT_STATUS_NO_SUCH_FILE;
}
@@ -273,6 +351,60 @@ NTSTATUS gp_inifile_init_context(TALLOC_CTX *mem_ctx,
}

/****************************************************************
+****************************************************************/
+
+NTSTATUS gp_inifile_init_context_direct(TALLOC_CTX *mem_ctx,
+ const char *unix_path,
+ struct gp_inifile_context **pgp_ctx)
+{
+ struct gp_inifile_context *gp_ctx = NULL;
+ NTSTATUS status;
+ int rv;
+ char *tmp_filename = NULL;
+
+ if (unix_path == NULL || pgp_ctx == NULL) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ gp_ctx = talloc_zero(mem_ctx, struct gp_inifile_context);
+ if (gp_ctx == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ status = convert_file_from_ucs2(mem_ctx, unix_path,
+ &tmp_filename);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto failed;
+ }
+
+ rv = pm_process_with_flags(tmp_filename != NULL ? tmp_filename : unix_path,
+ true,
+ change_section,
+ store_keyval_pair,
+ gp_ctx);
+ if (rv != 0) {
+ return NT_STATUS_NO_SUCH_FILE;
+ }
+
+ gp_ctx->generated_filename = tmp_filename;
+ gp_ctx->mem_ctx = mem_ctx;
+
+ *pgp_ctx = gp_ctx;
+
+ return NT_STATUS_OK;
+
+ failed:
+
+ DEBUG(1,("gp_inifile_init_context_direct failed: %s\n",
+ nt_errstr(status)));
+
+ talloc_free(gp_ctx);
+
+ return status;
+}
+
+
+/****************************************************************
parse the local gpt.ini file
****************************************************************/

@@ -288,7 +420,7 @@ NTSTATUS parse_gpt_ini(TALLOC_CTX *mem_ctx,
NTSTATUS result;
int rv;
int v = 0;
- char *name = NULL;
+ const char *name = NULL;
struct gp_inifile_context *ctx;

if (!filename) {
diff --git a/libgpo/gpo_ini.h b/libgpo/gpo_ini.h
index c9afec0..0bfe5b1 100644
--- a/libgpo/gpo_ini.h
+++ b/libgpo/gpo_ini.h
@@ -18,8 +18,8 @@
*/

struct keyval_pair {
- char *key;
- char *val;
+ const char *key;
+ const char *val;
};

struct gp_inifile_context {
@@ -35,12 +35,19 @@ struct gp_inifile_context {
NTSTATUS gp_inifile_init_context(TALLOC_CTX *mem_ctx, uint32_t flags,
const char *unix_path, const char *suffix,
struct gp_inifile_context **ctx_ret);
-
+NTSTATUS gp_inifile_init_context_direct(TALLOC_CTX *mem_ctx,
+ const char *unix_path,
+ struct gp_inifile_context **ctx_ret);
NTSTATUS parse_gpt_ini(TALLOC_CTX *ctx,
const char *filename,
uint32_t *version,
char **display_name);
-NTSTATUS gp_inifile_getstring(struct gp_inifile_context *ctx, const char *key, char **ret);
+NTSTATUS gp_inifile_getstring(struct gp_inifile_context *ctx, const char *key, const char **ret);
NTSTATUS gp_inifile_getint(struct gp_inifile_context *ctx, const char *key, int *ret);
NTSTATUS gp_inifile_getbool(struct gp_inifile_context *ctx, const char *key, bool *ret);

+NTSTATUS gp_inifile_enum_section(struct gp_inifile_context *ctx,
+ const char *section,
+ size_t *num_ini_keys,
+ const char ***ini_keys,
+ const char ***ini_values);
diff --git a/source3/include/nt_printing.h b/source3/include/nt_printing.h
index e0003f9..688c6b9 100644
--- a/source3/include/nt_printing.h
+++ b/source3/include/nt_printing.h
@@ -97,11 +97,6 @@ typedef struct {
SPOOLSS_NOTIFY_MSG_GROUP *msg_groups;
} SPOOLSS_NOTIFY_MSG_CTR;

-#define SPLHND_PRINTER 1
-#define SPLHND_SERVER 2
-#define SPLHND_PORTMON_TCP 3
-#define SPLHND_PORTMON_LOCAL 4
-
/*
* The printer attributes.
* I #defined all of them (grabbed form MSDN)
diff --git a/source3/libgpo/gpext/scripts.c b/source3/libgpo/gpext/scripts.c
index 12e17b1e..7471fb8 100644
--- a/source3/libgpo/gpext/scripts.c
+++ b/source3/libgpo/gpext/scripts.c
@@ -138,9 +138,9 @@ static NTSTATUS scripts_parse_ini_section(struct gp_inifile_context *ini_ctx,
while (1) {

const char *key = NULL;
- char *script = NULL;
+ const char *script = NULL;
const char *count = NULL;
- char *parameters = NULL;
+ const char *parameters = NULL;

count = talloc_asprintf(ini_ctx->mem_ctx, "%d", i);
NT_STATUS_HAVE_NO_MEMORY(count);
diff --git a/source3/libgpo/gpext/security.c b/source3/libgpo/gpext/security.c
index 2f46184..dda58d3 100644
--- a/source3/libgpo/gpext/security.c
+++ b/source3/libgpo/gpext/security.c
@@ -62,7 +62,7 @@ struct gpttmpl_table {
static NTSTATUS gpttmpl_parse_header(struct gp_inifile_context *ini_ctx,
uint32_t *version_out)
{
- char *signature = NULL;
+ const char *signature = NULL;
NTSTATUS result;
int version;
bool is_unicode = false;
diff --git a/source3/rpc_server/rpc_pipes.h b/source3/rpc_server/rpc_pipes.h
index d44ee92..8a8f8e5 100644
--- a/source3/rpc_server/rpc_pipes.h
+++ b/source3/rpc_server/rpc_pipes.h
@@ -98,6 +98,11 @@ struct pipe_rpc_fns {
* shall we allow "connect" auth level for this interface ?
*/
bool allow_connect;
+
+ /*
+ * minimal required auth level
+ */
+ enum dcerpc_AuthLevel min_auth_level;
};

/*
diff --git a/source3/rpc_server/spoolss/srv_iremotewinspool.c b/source3/rpc_server/spoolss/srv_iremotewinspool.c
new file mode 100644
index 0000000..ea52348
--- /dev/null
--
Samba Shared Repository
Björn Jacke
2017-01-07 02:20:02 UTC
Permalink
The branch, master has been updated
via 3d1cdb7 WHATSNEW: fix typo
from c586c3d libgpo: allow empty values in gp inifile parsing code.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 3d1cdb70fd45b36c0fa39ec7527fbb44855ed8dd
Author: Björn Jacke <***@sernet.de>
Date: Fri Jan 6 23:26:13 2017 +0100

WHATSNEW: fix typo

Autobuild-User(master): Björn Jacke <***@sernet.de>
Autobuild-Date(master): Sat Jan 7 03:19:03 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
WHATSNEW.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 7795523..a521813 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -101,7 +101,7 @@ new options for controlling TCP ports used for RPC services
-----------------------------------------------------------

The new 'rpc server port' option controls the default port used for
-RPC services other than Netlogon. The Netlogon server honours instead
+RPC services other than Netlogon. The Netlogon server honors instead
the 'rpc server port:netlogon' option. The default value for both
these options is the first available port including or after 1024.
--
Samba Shared Repository
Volker Lendecke
2017-01-08 21:31:02 UTC
Permalink
The branch, master has been updated
via 0127bdd replace: Include sysmacros.h
from 3d1cdb7 WHATSNEW: fix typo

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 0127bdd33b251a52c6ffc44b6cb3b82b16a80741
Author: Andreas Schneider <***@samba.org>
Date: Thu Jan 5 09:34:36 2017 +0100

replace: Include sysmacros.h

In the GNU C Library, "makedev" is defined by <sys/sysmacros.h>. For
historical compatibility, it is currently defined by <sys/types.h> as
well, but it is planned to remove this soon.

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Sun Jan 8 22:30:03 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
lib/replace/replace.h | 4 ++++
1 file changed, 4 insertions(+)


Changeset truncated at 500 lines:

diff --git a/lib/replace/replace.h b/lib/replace/replace.h
index c69a069..1dbeacf 100644
--- a/lib/replace/replace.h
+++ b/lib/replace/replace.h
@@ -171,6 +171,10 @@
#include <sys/types.h>
#endif

+#ifdef HAVE_SYS_SYSMACROS_H
+#include <sys/sysmacros.h>
+#endif
+
#ifdef HAVE_SETPROCTITLE_H
#include <setproctitle.h>
#endif
--
Samba Shared Repository
Volker Lendecke
2017-01-09 17:16:03 UTC
Permalink
The branch, master has been updated
via b9e76cc passdb: Remove pdb_wbc_sam
via ccadd26 auth: Remove auth_wbc
via e3c3ef3 selftest: Don't test auth_wbc anymore
from 0127bdd replace: Include sysmacros.h

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit b9e76cc8e1690e2a5b9608e9ead8aa45a5349485
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 07:04:59 2017 +0000

passdb: Remove pdb_wbc_sam

It seems that this was only used in OneFS. The filesystem parts were
removed in 2012 with 70be41c772d.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Mon Jan 9 18:15:20 CET 2017 on sn-devel-144

commit ccadd26ac7fa62520db5975278381b801824f8da
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 3 07:04:59 2017 +0000

auth: Remove auth_wbc

It seems that this was only used in OneFS. The filesystem parts were
removed in 2012 with 70be41c772d.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit e3c3ef331aabe63a9b22876b6f6720553f6dff6b
Author: Volker Lendecke <***@samba.org>
Date: Wed Jan 4 10:36:04 2017 +0000

selftest: Don't test auth_wbc anymore

It will go in the next commit

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Michael Adam <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
source3/auth/auth_wbc.c | 199 -------------------
source3/auth/wscript_build | 8 -
source3/passdb/pdb_wbc_sam.c | 452 -------------------------------------------
source3/passdb/pdb_wbc_sam.h | 33 ----
source3/passdb/wscript_build | 8 -
source3/wscript | 4 +-
source4/selftest/tests.py | 1 -
7 files changed, 2 insertions(+), 703 deletions(-)
delete mode 100644 source3/auth/auth_wbc.c
delete mode 100644 source3/passdb/pdb_wbc_sam.c
delete mode 100644 source3/passdb/pdb_wbc_sam.h


Changeset truncated at 500 lines:

diff --git a/source3/auth/auth_wbc.c b/source3/auth/auth_wbc.c
deleted file mode 100644
index 1b70042..0000000
--- a/source3/auth/auth_wbc.c
+++ /dev/null
@@ -1,199 +0,0 @@
-/*
- Unix SMB/CIFS implementation.
-
- Winbind client authentication mechanism designed to defer all
- authentication to the winbind daemon.
-
- Copyright (C) Tim Potter 2000
- Copyright (C) Andrew Bartlett 2001 - 2002
- Copyright (C) Dan Sledz 2009
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 3 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <http://www.gnu.org/licenses/>.
-*/
-
-/* This auth module is very similar to auth_winbind with 3 distinct
- * differences.
- *
- * 1) Does not fallback to another auth module if winbindd is unavailable
- * 2) Does not validate the domain of the user
- * 3) Handles unencrypted passwords
- *
- * The purpose of this module is to defer all authentication decisions (ie:
- * local user vs NIS vs LDAP vs AD; encrypted vs plaintext) to the wbc
- * compatible daemon. This centeralizes all authentication decisions to a
- * single provider.
- *
- * This auth backend is most useful when used in conjunction with pdb_wbc_sam.
- */
-
-#include "includes.h"
-#include "auth.h"
-#include "nsswitch/libwbclient/wbclient.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_AUTH
-
-/* Authenticate a user with a challenge/response */
-
-static NTSTATUS check_wbc_security(const struct auth_context *auth_context,
- void *my_private_data,
- TALLOC_CTX *mem_ctx,
- const struct auth_usersupplied_info *user_info,
- struct auth_serversupplied_info **server_info)
-{
- NTSTATUS nt_status;
- wbcErr wbc_status;
- struct wbcAuthUserParams params;
- struct wbcAuthUserInfo *info = NULL;
- struct wbcAuthErrorInfo *err = NULL;
-
- if (!user_info || !auth_context || !server_info) {
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- ZERO_STRUCT(params);
-
- /* Send off request */
-
- DEBUG(10, ("Check auth for: [%s]", user_info->mapped.account_name));
-
- params.account_name = user_info->client.account_name;
- params.domain_name = user_info->mapped.domain_name;
- params.workstation_name = user_info->workstation_name;
-
- params.flags = 0;
- params.parameter_control= user_info->logon_parameters;
-
- /* Handle plaintext */
- switch (user_info->password_state) {
- case AUTH_PASSWORD_PLAIN:
- {
- DEBUG(3,("Checking plaintext password for %s.\n",
- user_info->mapped.account_name));
- params.level = WBC_AUTH_USER_LEVEL_PLAIN;
-
- params.password.plaintext = user_info->password.plaintext;
- break;
- }
- case AUTH_PASSWORD_RESPONSE:
- case AUTH_PASSWORD_HASH:
- {
- DEBUG(3,("Checking encrypted password for %s.\n",
- user_info->mapped.account_name));
- params.level = WBC_AUTH_USER_LEVEL_RESPONSE;
-
- memcpy(params.password.response.challenge,
- auth_context->challenge.data,
- sizeof(params.password.response.challenge));
-
- if (user_info->password.response.nt.length != 0) {
- params.password.response.nt_length =
- user_info->password.response.nt.length;
- params.password.response.nt_data =
- user_info->password.response.nt.data;
- }
- if (user_info->password.response.lanman.length != 0) {
- params.password.response.lm_length =
- user_info->password.response.lanman.length;
- params.password.response.lm_data =
- user_info->password.response.lanman.data;
- }
- break;
- }
- default:
- DEBUG(0,("user_info constructed for user '%s' was invalid - password_state=%u invalid.\n",user_info->mapped.account_name, user_info->password_state));
- return NT_STATUS_INTERNAL_ERROR;
-#if 0 /* If ever implemented in libwbclient */
- case AUTH_PASSWORD_HASH:
- {
- DEBUG(3,("Checking logon (hash) password for %s.\n",
- user_info->mapped.account_name));
- params.level = WBC_AUTH_USER_LEVEL_HASH;
-
- if (user_info->password.hash.nt) {
- memcpy(params.password.hash.nt_hash, user_info->password.hash.nt, sizeof(* user_info->password.hash.nt));
- } else {
- memset(params.password.hash.nt_hash, '\0', sizeof(params.password.hash.nt_hash));
- }
-
- if (user_info->password.hash.lanman) {
- memcpy(params.password.hash.lm_hash, user_info->password.hash.lanman, sizeof(* user_info->password.hash.lanman));
- } else {
- memset(params.password.hash.lm_hash, '\0', sizeof(params.password.hash.lm_hash));
- }
-
- }
-#endif
- }
-
- /* we are contacting the privileged pipe */
- become_root();
- wbc_status = wbcAuthenticateUserEx(&params, &info, &err);
- unbecome_root();
-
- if (!WBC_ERROR_IS_OK(wbc_status)) {
- DEBUG(10,("wbcAuthenticateUserEx failed (%d): %s\n",
- wbc_status, wbcErrorString(wbc_status)));
- }
-
- if (wbc_status == WBC_ERR_NO_MEMORY) {
- return NT_STATUS_NO_MEMORY;
- }
-
- if (wbc_status == WBC_ERR_AUTH_ERROR) {
- nt_status = NT_STATUS(err->nt_status);
- wbcFreeMemory(err);
- return nt_status;
- }
-
- if (!WBC_ERROR_IS_OK(wbc_status)) {
- return NT_STATUS_LOGON_FAILURE;
- }
-
- DEBUG(10,("wbcAuthenticateUserEx succeeded\n"));
-
- nt_status = make_server_info_wbcAuthUserInfo(mem_ctx,
- user_info->client.account_name,
- user_info->mapped.domain_name,
- info, server_info);
- wbcFreeMemory(info);
- if (!NT_STATUS_IS_OK(nt_status)) {
- return nt_status;
- }
-
- (*server_info)->nss_token |= user_info->was_mapped;
-
- return nt_status;
-}
-
-/* module initialisation */
-static NTSTATUS auth_init_wbc(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
-{
- struct auth_methods *result;
-
- result = talloc_zero(auth_context, struct auth_methods);
- if (result == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- result->name = "wbc";
- result->auth = check_wbc_security;
-
- *auth_method = result;
- return NT_STATUS_OK;
-}
-
-NTSTATUS auth_wbc_init(void)
-{
- return smb_register_auth(AUTH_INTERFACE_VERSION, "wbc", auth_init_wbc);
-}
diff --git a/source3/auth/wscript_build b/source3/auth/wscript_build
index e7a6051..b95fb98 100644
--- a/source3/auth/wscript_build
+++ b/source3/auth/wscript_build
@@ -46,14 +46,6 @@ bld.SAMBA3_MODULE('auth_winbind',
init_function='',
internal_module=True)

-bld.SAMBA3_MODULE('auth_wbc',
- subsystem='auth',
- source='auth_wbc.c',
- deps='samba-util',
- init_function='',
- internal_module=bld.SAMBA3_IS_STATIC_MODULE('auth_wbc'),
- enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_wbc'))
-
bld.SAMBA3_MODULE('auth_domain',
subsystem='auth',
source='auth_domain.c',
diff --git a/source3/passdb/pdb_wbc_sam.c b/source3/passdb/pdb_wbc_sam.c
deleted file mode 100644
index b73fcc4..0000000
--- a/source3/passdb/pdb_wbc_sam.c
+++ /dev/null
@@ -1,452 +0,0 @@
-/*
- Unix SMB/CIFS implementation.
-
- Password and authentication handling by wbclient
-
- Copyright (C) Andrew Bartlett 2002
- Copyright (C) Jelmer Vernooij 2002
- Copyright (C) Simo Sorce 2003
- Copyright (C) Volker Lendecke 2006
- Copyright (C) Dan Sledz 2009
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 3 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program. If not, see <http://www.gnu.org/licenses/>.
-*/
-
-/* This passdb module retrieves full passdb information for local users and
- * groups from a wbclient compatible daemon.
- *
- * The purpose of this module is to defer all SAM authorization information
- * storage and retrieval to a wbc compatible daemon.
- *
- * This passdb backend is most useful when used in conjunction with auth_wbc.
- *
- * A few current limitations of this module are:
- * - read only interface
- * - no privileges
- */
-
-#include "includes.h"
-#include "passdb.h"
-#include "lib/winbind_util.h"
-#include "passdb/pdb_wbc_sam.h"
-#include "idmap.h"
-
-/***************************************************************************
- Default implementations of some functions.
- ****************************************************************************/
-static NTSTATUS _pdb_wbc_sam_getsampw(struct pdb_methods *methods,
- struct samu *user,
- const struct passwd *pwd)
-{
- NTSTATUS result = NT_STATUS_OK;
-
- if (pwd == NULL)
- return NT_STATUS_NO_SUCH_USER;
-
- ZERO_STRUCTP(user);
-
- /* Can we really get away with this little of information */
- user->methods = methods;
- result = samu_set_unix(user, pwd);
-
- return result;
-}
-
-static NTSTATUS pdb_wbc_sam_getsampwnam(struct pdb_methods *methods, struct samu *user, const char *sname)
-{
- return _pdb_wbc_sam_getsampw(methods, user, winbind_getpwnam(sname));
-}
-
-static NTSTATUS pdb_wbc_sam_getsampwsid(struct pdb_methods *methods, struct samu *user, const struct dom_sid *sid)
-{
- return _pdb_wbc_sam_getsampw(methods, user, winbind_getpwsid(sid));
-}
-
-static bool pdb_wbc_sam_id_to_sid(struct pdb_methods *methods, struct unixid *id,
- struct dom_sid *sid)
-{
- switch (id->type) {
- case ID_TYPE_UID:
- return winbind_uid_to_sid(sid, id->id);
-
- case ID_TYPE_GID:
- return winbind_gid_to_sid(sid, id->id);
-
- default:
- return false;
- }
-}
-
-static NTSTATUS pdb_wbc_sam_enum_group_members(struct pdb_methods *methods,
- TALLOC_CTX *mem_ctx,
- const struct dom_sid *group,
- uint32_t **pp_member_rids,
- size_t *p_num_members)
-{
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static NTSTATUS pdb_wbc_sam_enum_group_memberships(struct pdb_methods *methods,
- TALLOC_CTX *mem_ctx,
- struct samu *user,
- struct dom_sid **pp_sids,
- gid_t **pp_gids,
- uint32_t *p_num_groups)
-{
- size_t i;
- const char *username = pdb_get_username(user);
- uint32_t num_groups;
-
- if (!winbind_get_groups(mem_ctx, username, &num_groups, pp_gids)) {
- return NT_STATUS_NO_SUCH_USER;
- }
- *p_num_groups = num_groups;
-
- if (*p_num_groups == 0) {
- smb_panic("primary group missing");
- }
-
- *pp_sids = talloc_array(mem_ctx, struct dom_sid, *p_num_groups);
-
- if (*pp_sids == NULL) {
- TALLOC_FREE(*pp_gids);
- return NT_STATUS_NO_MEMORY;
- }
-
- for (i=0; i < *p_num_groups; i++) {
- gid_to_sid(&(*pp_sids)[i], (*pp_gids)[i]);
- }
-
- return NT_STATUS_OK;
-}
-
-static NTSTATUS pdb_wbc_sam_lookup_rids(struct pdb_methods *methods,
- const struct dom_sid *domain_sid,
- int num_rids,
- uint32_t *rids,
- const char **names,
- enum lsa_SidType *attrs)
-{
- NTSTATUS result = NT_STATUS_OK;
- const char *p = NULL;
- const char **pp = NULL;
- char *domain = NULL;
- char **account_names = NULL;
- enum lsa_SidType *attr_list = NULL;
- int i;
-
- if (!winbind_lookup_rids(talloc_tos(), domain_sid, num_rids, rids,
- &p, &pp, &attr_list))
- {
- result = NT_STATUS_NONE_MAPPED;
- goto done;
- }
- domain = discard_const_p(char, p);
- account_names = discard_const_p(char *, pp);
-
- memcpy(attrs, attr_list, num_rids * sizeof(enum lsa_SidType));
-
- for (i=0; i<num_rids; i++) {
- if (attrs[i] == SID_NAME_UNKNOWN) {
- names[i] = NULL;
- } else {
- names[i] = talloc_strdup(names, account_names[i]);
- if (names[i] == NULL) {
- result = NT_STATUS_NO_MEMORY;
- goto done;
- }
-
- }
- }
-
-done:
- TALLOC_FREE(account_names);
- TALLOC_FREE(domain);
- TALLOC_FREE(attr_list);
- return result;
-}
-
-static NTSTATUS pdb_wbc_sam_get_account_policy(struct pdb_methods *methods, enum pdb_policy_type type, uint32_t *value)
-{
- return NT_STATUS_UNSUCCESSFUL;
-}
-
-static NTSTATUS pdb_wbc_sam_set_account_policy(struct pdb_methods *methods, enum pdb_policy_type type, uint32_t value)
-{
- return NT_STATUS_UNSUCCESSFUL;
-}
-
-static bool pdb_wbc_sam_search_groups(struct pdb_methods *methods,
- struct pdb_search *search)
-{
- return false;
-}
-
-static bool pdb_wbc_sam_search_aliases(struct pdb_methods *methods,
- struct pdb_search *search,
- const struct dom_sid *sid)
-{
-
- return false;
-}
-
-static bool pdb_wbc_sam_get_trusteddom_pw(struct pdb_methods *methods,
- const char *domain,
- char **pwd,
- struct dom_sid *sid,
- time_t *pass_last_set_time)
-{
- return false;
-
-}
-
-static bool pdb_wbc_sam_set_trusteddom_pw(struct pdb_methods *methods,
- const char *domain,
- const char *pwd,
- const struct dom_sid *sid)
-{
- return false;
-}
-
-static bool pdb_wbc_sam_del_trusteddom_pw(struct pdb_methods *methods,
- const char *domain)
-{
- return false;
-}
-
-static NTSTATUS pdb_wbc_sam_enum_trusteddoms(struct pdb_methods *methods,
- TALLOC_CTX *mem_ctx,
- uint32_t *num_domains,
- struct trustdom_info ***domains)
-{
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static bool _make_group_map(struct pdb_methods *methods, const char *domain, const char *name, enum lsa_SidType name_type, gid_t gid, struct dom_sid *sid, GROUP_MAP *map)
-{
- map->nt_name = talloc_asprintf(map, "%s%c%s",
- domain, *lp_winbind_separator(), name);
- if (!map->nt_name) {
- return false;
- }
- map->sid_name_use = name_type;
- map->sid = *sid;
- map->gid = gid;
- return true;
-}
-
-static NTSTATUS pdb_wbc_sam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
- struct dom_sid sid)
-{
- NTSTATUS result = NT_STATUS_OK;
- const char *p1 = NULL, *p2 = NULL;
- char *name = NULL;
- char *domain = NULL;
- enum lsa_SidType name_type;
- gid_t gid;
-
- if (!winbind_lookup_sid(talloc_tos(), &sid, &p1, &p2, &name_type)) {
- result = NT_STATUS_NO_SUCH_GROUP;
- goto done;
- }
- domain = discard_const_p(char, p1);
- name = discard_const_p(char, p2);
-
- if ((name_type != SID_NAME_DOM_GRP) &&
- (name_type != SID_NAME_DOMAIN) &&
- (name_type != SID_NAME_ALIAS) &&
- (name_type != SID_NAME_WKN_GRP)) {
- result = NT_STATUS_NO_SUCH_GROUP;
--
Samba Shared Repository
Jeremy Allison
2017-01-09 22:15:03 UTC
Permalink
The branch, master has been updated
via 28cc347 smbd/ioctl: match WS2016 ReFS set compression behaviour
via 6fde123 torture/ioctl: test set_compression(format_none)
via 5737624 s3/torture: add a test for "mangled names = invalid"
via 18591ed s3/smbd: new "mangled names" setting "illegal"
via 19eae53 s3/smbd: convert "mangled names" option to an enum
via e2f3411 s3: vfs: dirsort doesn't handle opendir of "." correctly.
from b9e76cc passdb: Remove pdb_wbc_sam

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 28cc347876b97b7409d6efd377f031fc6df0c5f3
Author: David Disseldorp <***@samba.org>
Date: Thu Jan 5 17:36:02 2017 +0100

smbd/ioctl: match WS2016 ReFS set compression behaviour

ReFS doesn't support compression, but responds to set-compression FSCTLs
with NT_STATUS_OK if (and only if) the requested compression format is
COMPRESSION_FORMAT_NONE.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12144

Reported-by: Nick Barrett <***@barrett.org.nz>
Signed-off-by: David Disseldorp <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Mon Jan 9 23:14:28 CET 2017 on sn-devel-144

commit 6fde123176409e261d955e24b3d28e5124f33bed
Author: David Disseldorp <***@samba.org>
Date: Thu Jan 5 17:10:42 2017 +0100

torture/ioctl: test set_compression(format_none)

This test case was overlooked in the previous bso#12144 update -
set compression requests with format=COMPRESSION_FORMAT_NONE should
succeed if the server / backing storage doesn't offer compression
support.
Confirm that Samba matches Windows Server 2016 ReFS behaviour here.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12144

Reported-by: Nick Barrett <***@barrett.org.nz>
Signed-off-by: David Disseldorp <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 573762436ae4fe2663b12be3f5f9c4314348e312
Author: Ralph Boehme <***@samba.org>
Date: Thu Dec 15 13:05:50 2016 +0100

s3/torture: add a test for "mangled names = invalid"

This checks both that illegal NTFS names are still mangled and that long
names have no shortname.

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 18591edafad17172502cc9b831d58d27f9076bbc
Author: Ralph Boehme <***@samba.org>
Date: Thu Nov 17 14:24:07 2016 +0100

s3/smbd: new "mangled names" setting "illegal"

This does mangling for names with illegal NTFS characters, but not for
names longer then 8.3:

Name mangling with mangled named = yes
======================================

Mangled | Short | Name
----------------------------
| | foo
| yes | 123456789
yes | | foo:bar

Name mangling with mangled named = illegal
==========================================

Mangled | Short | Name
----------------------------
| | foo
| | 123456789
yes | | foo:bar

Setting "mangled names = illegal" is the most sensible setting for
modern clients that don't use the shortname anymore.

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 19eae537739daf95d10b67d9888769e7bf895d76
Author: Ralph Boehme <***@samba.org>
Date: Thu Nov 17 14:22:41 2016 +0100

s3/smbd: convert "mangled names" option to an enum

This is in preparation of adding an additional setting for this
option. No change in behaviour by this commit, that comes in the next
one.

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit e2f34116ab6328e2b872999dc7c4bcda69c03ab2
Author: Jeremy Allison <***@samba.org>
Date: Thu Jan 5 12:38:07 2017 -0800

s3: vfs: dirsort doesn't handle opendir of "." correctly.

Needs to store $cwd path for correct sorting.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12499

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
docs-xml/smbdotconf/filename/manglednames.xml | 20 +++-
lib/param/loadparm.h | 3 +
lib/param/param_table.c | 11 ++
selftest/target/Samba3.pm | 4 +
source3/modules/vfs_dirsort.c | 4 +
source3/param/loadparm.c | 2 +-
source3/selftest/tests.py | 5 +
source3/smbd/mangle.c | 4 +-
source3/smbd/smb2_ioctl_filesys.c | 26 ++---
source3/smbd/trans2.c | 12 ++-
source3/torture/torture.c | 147 ++++++++++++++++++++++++++
source4/torture/smb2/ioctl.c | 11 +-
12 files changed, 230 insertions(+), 19 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/smbdotconf/filename/manglednames.xml b/docs-xml/smbdotconf/filename/manglednames.xml
index bd5d97f..972834e 100644
--- a/docs-xml/smbdotconf/filename/manglednames.xml
+++ b/docs-xml/smbdotconf/filename/manglednames.xml
@@ -1,5 +1,6 @@
<samba:parameter name="mangled names"
- type="boolean"
+ type="enum"
+ enumlist="enum_mangled_names"
context="S"
parm="1"
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
@@ -11,6 +12,22 @@
<para>See the section on <smbconfoption name="name mangling"/> for
details on how to control the mangling process.</para>

+ <para>Possible option settings are</para>
+
+ <itemizedlist>
+ <listitem><para><emphasis>yes (default)</emphasis> -
+ enables name mangling for all not DOS 8.3 conforming
+ names.</para></listitem>
+
+ <listitem><para><emphasis>no</emphasis> - disables any
+ name mangling.</para></listitem>
+
+ <listitem><para><emphasis>illegal</emphasis> - does
+ mangling for names with illegal NTFS characters. This
+ is the most sensible setting for modern clients that
+ don't use the shortname anymore.</para></listitem>
+ </itemizedlist>
+
<para>If mangling is used then the mangling method is as follows:</para>

<itemizedlist>
@@ -56,4 +73,5 @@
do not change between sessions.</para>
</description>
<value type="default">yes</value>
+<value type="example">illegal</value>
</samba:parameter>
diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h
index f9fb7d8..6d01b37 100644
--- a/lib/param/loadparm.h
+++ b/lib/param/loadparm.h
@@ -236,6 +236,9 @@ enum inheritowner_options {
INHERIT_OWNER_UNIX_ONLY
};

+/* mangled names options */
+enum mangled_names_options {MANGLED_NAMES_NO, MANGLED_NAMES_YES, MANGLED_NAMES_ILLEGAL};
+
/*
* Default passwd chat script.
*/
diff --git a/lib/param/param_table.c b/lib/param/param_table.c
index 4b5234a..95c3b8c 100644
--- a/lib/param/param_table.c
+++ b/lib/param/param_table.c
@@ -315,6 +315,17 @@ static const struct enum_list enum_inherit_owner_vals[] = {
{INHERIT_OWNER_UNIX_ONLY, "unix only"},
{-1, NULL}};

+static const struct enum_list enum_mangled_names[] = {
+ {MANGLED_NAMES_NO, "no"},
+ {MANGLED_NAMES_NO, "false"},
+ {MANGLED_NAMES_NO, "0"},
+ {MANGLED_NAMES_ILLEGAL, "illegal"},
+ {MANGLED_NAMES_YES, "yes"},
+ {MANGLED_NAMES_YES, "true"},
+ {MANGLED_NAMES_YES, "1"},
+ {-1, NULL}
+};
+
/* Note: We do not initialise the defaults union - it is not allowed in ANSI C
*
* NOTE: Handling of duplicated (synonym) parameters:
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 9013652..1d77c97 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1830,6 +1830,10 @@ sub provision($$$$$$$$)
copy = tmp
acl_xattr:ignore system acls = yes
acl_xattr:default acl style = windows
+
+[mangle_illegal]
+ copy = tmp
+ mangled names = illegal
";
close(CONF);

diff --git a/source3/modules/vfs_dirsort.c b/source3/modules/vfs_dirsort.c
index f856835..4a3e152 100644
--- a/source3/modules/vfs_dirsort.c
+++ b/source3/modules/vfs_dirsort.c
@@ -138,6 +138,10 @@ static DIR *dirsort_opendir(vfs_handle_struct *handle,
return NULL;
}

+ if (ISDOT(data->smb_fname->base_name)) {
+ data->smb_fname->base_name = vfs_GetWd(data, handle->conn);
+ }
+
/* Open the underlying directory and count the number of entries */
data->source_directory = SMB_VFS_NEXT_OPENDIR(handle, smb_fname, mask,
attr);
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index d8da749..ac9ba49 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -201,7 +201,7 @@ static struct loadparm_service sDefault =
.oplocks = true,
.kernel_oplocks = false,
.level2_oplocks = true,
- .mangled_names = true,
+ .mangled_names = MANGLED_NAMES_YES,
.wide_links = false,
.follow_symlinks = true,
.sync_always = false,
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 3aecc9c..37cf1a4 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -79,6 +79,11 @@ tests = ["OPLOCK-CANCEL"]
for t in tests:
plantestsuite("samba3.smbtorture_s3.plain(nt4_dc).%s" % t, "nt4_dc", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmp', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])

+env = "nt4_dc"
+tests = ["MANGLE-ILLEGAL"]
+for t in tests:
+ plantestsuite("samba3.smbtorture_s3.plain(%s).%s" % (env, t), env, [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/mangle_illegal', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
+
tests = ["RW1", "RW2", "RW3"]
for t in tests:
plantestsuite("samba3.smbtorture_s3.vfs_aio_fork(simpleserver).%s" % t, "simpleserver", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/vfs_aio_fork', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
diff --git a/source3/smbd/mangle.c b/source3/smbd/mangle.c
index a8988f0..3649bf7 100644
--- a/source3/smbd/mangle.c
+++ b/source3/smbd/mangle.c
@@ -104,7 +104,7 @@ bool mangle_is_8_3_wildcards(const char *fname, bool check_case,
bool mangle_must_mangle(const char *fname,
const struct share_params *p)
{
- if (!lp_mangled_names(p)) {
+ if (lp_mangled_names(p) == MANGLED_NAMES_NO) {
return False;
}
return mangle_fns->must_mangle(fname, p);
@@ -140,7 +140,7 @@ bool name_to_8_3(const char *in,

/* name mangling can be disabled for speed, in which case
we just truncate the string */
- if (!lp_mangled_names(p)) {
+ if (lp_mangled_names(p) == MANGLED_NAMES_NO) {
strlcpy(out, in, 13);
return True;
}
diff --git a/source3/smbd/smb2_ioctl_filesys.c b/source3/smbd/smb2_ioctl_filesys.c
index f2a0554..64b5454 100644
--- a/source3/smbd/smb2_ioctl_filesys.c
+++ b/source3/smbd/smb2_ioctl_filesys.c
@@ -104,11 +104,6 @@ static NTSTATUS fsctl_set_cmprn(TALLOC_CTX *mem_ctx,
return status;
}

- if ((fsp->conn->fs_capabilities & FILE_FILE_COMPRESSION) == 0) {
- DEBUG(4, ("FS does not advertise compression support\n"));
- return NT_STATUS_NOT_SUPPORTED;
- }
-
ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cmpr_state,
(ndr_pull_flags_fn_t)ndr_pull_compression_state);
if (ndr_ret != NDR_ERR_SUCCESS) {
@@ -116,15 +111,22 @@ static NTSTATUS fsctl_set_cmprn(TALLOC_CTX *mem_ctx,
return NT_STATUS_INVALID_PARAMETER;
}

- status = SMB_VFS_SET_COMPRESSION(fsp->conn,
- mem_ctx,
- fsp,
- cmpr_state.format);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
+ status = NT_STATUS_NOT_SUPPORTED;
+ if (fsp->conn->fs_capabilities & FILE_FILE_COMPRESSION) {
+ status = SMB_VFS_SET_COMPRESSION(fsp->conn,
+ mem_ctx,
+ fsp,
+ cmpr_state.format);
+ } else if (cmpr_state.format == COMPRESSION_FORMAT_NONE) {
+ /*
+ * bso#12144: The underlying filesystem doesn't support
+ * compression. We should still accept set(FORMAT_NONE) requests
+ * (like WS2016 ReFS).
+ */
+ status = NT_STATUS_OK;
}

- return NT_STATUS_OK;
+ return status;
}

static NTSTATUS fsctl_zero_data(TALLOC_CTX *mem_ctx,
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 6999b2d..6fe3f92 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -2440,11 +2440,17 @@ NTSTATUS smbd_dirptr_lanman2_entry(TALLOC_CTX *ctx,
bool ok;
uint64_t last_entry_off = 0;
NTSTATUS status;
+ enum mangled_names_options mangled_names;
+ bool marshall_with_83_names;
+
+ mangled_names = lp_mangled_names(conn->params);

ZERO_STRUCT(state);
state.conn = conn;
state.info_level = info_level;
- state.check_mangled_names = lp_mangled_names(conn->params);
+ if (mangled_names != MANGLED_NAMES_NO) {
+ state.check_mangled_names = true;
+ }
state.has_wild = dptr_has_wild(dirptr);
state.got_exact_match = false;

@@ -2480,12 +2486,14 @@ NTSTATUS smbd_dirptr_lanman2_entry(TALLOC_CTX *ctx,

*got_exact_match = state.got_exact_match;

+ marshall_with_83_names = (mangled_names == MANGLED_NAMES_YES);
+
status = smbd_marshall_dir_entry(ctx,
conn,
flags2,
info_level,
name_list,
- state.check_mangled_names,
+ marshall_with_83_names,
requires_resume_key,
mode,
fname,
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index ff3d68e..073931e 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -8440,6 +8440,152 @@ static bool run_mangle1(int dummy)
return true;
}

+static NTSTATUS mangle_illegal_list_shortname_fn(const char *mntpoint,
+ struct file_info *f,
+ const char *mask,
+ void *state)
+{
+ if (f->short_name == NULL) {
+ return NT_STATUS_OK;
+ }
+
+ if (strlen(f->short_name) == 0) {
+ return NT_STATUS_OK;
+ }
+
+ printf("unexpected shortname: %s\n", f->short_name);
+
+ return NT_STATUS_OBJECT_NAME_INVALID;
+}
+
+static NTSTATUS mangle_illegal_list_name_fn(const char *mntpoint,
+ struct file_info *f,
+ const char *mask,
+ void *state)
+{
+ char *name = state;
+
+ printf("name: %s\n", f->name);
+ fstrcpy(name, f->name);
+ return NT_STATUS_OK;
+}
+
+static bool run_mangle_illegal(int dummy)
+{
+ struct cli_state *cli = NULL;
+ struct cli_state *cli_posix = NULL;
+ const char *fname = "\\MANGLE_ILLEGAL\\this_is_a_long_fname_to_be_mangled.txt";
+ const char *illegal_fname = "MANGLE_ILLEGAL/foo:bar";
+ char *mangled_path = NULL;
+ uint16_t fnum;
+ fstring name;
+ fstring alt_name;
+ NTSTATUS status;
+
+ printf("starting mangle-illegal test\n");
+
+ if (!torture_open_connection(&cli, 0)) {
+ return False;
+ }
+
+ smbXcli_conn_set_sockopt(cli->conn, sockops);
+
+ if (!torture_open_connection(&cli_posix, 0)) {
+ return false;
+ }
+
+ smbXcli_conn_set_sockopt(cli_posix->conn, sockops);
+
+ status = torture_setup_unix_extensions(cli_posix);
+ if (!NT_STATUS_IS_OK(status)) {
+ return false;
+ }
+
+ cli_rmdir(cli, "\\MANGLE_ILLEGAL");
+ status = cli_mkdir(cli, "\\MANGLE_ILLEGAL");
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("mkdir1 failed : %s\n", nt_errstr(status));
+ return False;
+ }
+
+ /*
+ * Create a file with illegal NTFS characters and test that we
+ * get a usable mangled name
+ */
+
+ cli_setatr(cli_posix, illegal_fname, 0, 0);
+ cli_posix_unlink(cli_posix, illegal_fname);
+
+ status = cli_posix_open(cli_posix, illegal_fname, O_RDWR|O_CREAT|O_EXCL,
+ 0600, &fnum);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("POSIX create of %s failed (%s)\n",
+ illegal_fname, nt_errstr(status));
+ return false;
+ }
+
+ status = cli_close(cli_posix, fnum);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("close failed (%s)\n", nt_errstr(status));
+ return false;
+ }
+
+ status = cli_list(cli, "\\MANGLE_ILLEGAL\\*", 0, mangle_illegal_list_name_fn, &name);
+ if (!NT_STATUS_IS_OK(status)) {
+ d_printf("cli_list failed: %s\n", nt_errstr(status));
+ return false;
+ }
+
+ mangled_path = talloc_asprintf(talloc_tos(), "\\MANGLE_ILLEGAL\\%s", name);
+ if (mangled_path == NULL) {
+ return false;
+ }
+
+ status = cli_openx(cli, mangled_path, O_RDONLY, DENY_NONE, &fnum);
+ if (!NT_STATUS_IS_OK(status)) {
+ d_printf("cli_openx(%s) failed: %s\n", mangled_path, nt_errstr(status));
+ TALLOC_FREE(mangled_path);
+ return false;
+ }
+ TALLOC_FREE(mangled_path);
+ cli_close(cli, fnum);
+
+ cli_setatr(cli_posix, illegal_fname, 0, 0);
+ cli_posix_unlink(cli_posix, illegal_fname);
+
+ /*
+ * Create a file with a long name and check that we got *no* short name.
+ */
+
+ status = cli_ntcreate(cli, fname, 0, GENERIC_ALL_ACCESS|DELETE_ACCESS,
+ FILE_ATTRIBUTE_NORMAL, 0, FILE_OVERWRITE_IF,
+ 0, 0, &fnum, NULL);
+ if (!NT_STATUS_IS_OK(status)) {
+ d_printf("open %s failed: %s\n", fname, nt_errstr(status));
+ return false;
+ }
+ cli_close(cli, fnum);
+
+ status = cli_list(cli, fname, 0, mangle_illegal_list_shortname_fn, &alt_name);
+ if (!NT_STATUS_IS_OK(status)) {
+ d_printf("cli_list failed\n");
+ return false;
+ }
+
+ cli_unlink(cli, fname, 0);
+ cli_rmdir(cli, "\\MANGLE_ILLEGAL");
+
+ if (!torture_close_connection(cli_posix)) {
+ return false;
+ }
+
+ if (!torture_close_connection(cli)) {
+ return false;
+ }
+
+ return true;
+}
+
static size_t null_source(uint8_t *buf, size_t n, void *priv)
{
size_t *to_pull = (size_t *)priv;
@@ -11034,6 +11180,7 @@ static struct {
{"PROPERTIES", run_properties, 0},
{"MANGLE", torture_mangle, 0},
{"MANGLE1", run_mangle1, 0},
+ {"MANGLE-ILLEGAL", run_mangle_illegal, 0},
{"W2K", run_w2ktest, 0},
{"TRANS2SCAN", torture_trans2_scan, 0},
{"NTTRANSSCAN", torture_nttrans_scan, 0},
diff --git a/source4/torture/smb2/ioctl.c b/source4/torture/smb2/ioctl.c
index 01cc150..54a36a8 100644
--- a/source4/torture/smb2/ioctl.c
+++ b/source4/torture/smb2/ioctl.c
@@ -2608,7 +2608,16 @@ static bool test_ioctl_compress_notsup_set(struct torture_context *torture,
COMPRESSION_FORMAT_DEFAULT);
torture_assert_ntstatus_equal(torture, status,
NT_STATUS_NOT_SUPPORTED,
- "FSCTL_GET_COMPRESSION");
+ "FSCTL_SET_COMPRESSION default");
+
+ /*
+ * Despite not supporting compression, we should get a successful
+ * response for set(COMPRESSION_FORMAT_NONE) - like WS2016 ReFS.
+ */
+ status = test_ioctl_compress_set(torture, tmp_ctx, tree, fh,
+ COMPRESSION_FORMAT_NONE);
+ torture_assert_ntstatus_ok(torture, status,
+ "FSCTL_SET_COMPRESSION none");

smb2_util_close(tree, fh);
talloc_free(tmp_ctx);
--
Samba Shared Repository
Stefan Metzmacher
2017-01-10 12:45:03 UTC
Permalink
The branch, master has been updated
via 207fa23 python/schema: fix tests flapping due to oid collision
via dde30ab s3:winbindd: talloc_steal the extra_data in winbindd_list_users_recv()
from 28cc347 smbd/ioctl: match WS2016 ReFS set compression behaviour

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 207fa2331831f570eb4855e98b676782d2008f34
Author: Andrew Bartlett <***@samba.org>
Date: Tue Jan 10 10:00:43 2017 +1300

python/schema: fix tests flapping due to oid collision

These tests would sometimes fail because the randomly generated OIDs
would collide. This fixes that by giving a unique OID to each attribute
and class.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12507

Pair-Programmed-With: Bob Campbell <***@catalyst.net.nz>

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Tue Jan 10 13:44:02 CET 2017 on sn-devel-144

commit dde30ab89c276474d19b584c6def6f25ed5cc678
Author: Stefan Metzmacher <***@samba.org>
Date: Tue Jan 10 09:48:33 2017 +0100

s3:winbindd: talloc_steal the extra_data in winbindd_list_users_recv()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12501

Pair-Programmed-With: Andreas Schneider <***@samba.org>

Signed-off-by: Stefan Metzmacher <***@samba.org>
Signed-off-by: Andreas Schneider <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
source3/winbindd/winbindd_list_users.c | 2 +-
source4/dsdb/tests/python/dsdb_schema_info.py | 12 +++---
source4/dsdb/tests/python/ldap_schema.py | 54 +++++++++++++--------------
source4/setup/schema_samba4.ldif | 4 ++
4 files changed, 38 insertions(+), 34 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/winbindd/winbindd_list_users.c b/source3/winbindd/winbindd_list_users.c
index 4a4343e..9a751a7 100644
--- a/source3/winbindd/winbindd_list_users.c
+++ b/source3/winbindd/winbindd_list_users.c
@@ -174,7 +174,7 @@ NTSTATUS winbindd_list_users_recv(struct tevent_req *req,

len = talloc_get_size(result);

- response->extra_data.data = result;
+ response->extra_data.data = talloc_steal(response, result);
response->length += len;
response->data.num_entries = 0;

diff --git a/source4/dsdb/tests/python/dsdb_schema_info.py b/source4/dsdb/tests/python/dsdb_schema_info.py
index e7933f4..0ae95b3 100755
--- a/source4/dsdb/tests/python/dsdb_schema_info.py
+++ b/source4/dsdb/tests/python/dsdb_schema_info.py
@@ -104,7 +104,7 @@ schemaUpdateNow: 1
obj_dn = "CN=%s,%s" % (obj_name, self.schema_dn)
return (obj_name, obj_ldap_name, obj_dn)

- def _make_attr_ldif(self, attr_name, attr_dn):
+ def _make_attr_ldif(self, attr_name, attr_dn, sub_oid):
ldif = """
dn: """ + attr_dn + """
objectClass: top
@@ -112,7 +112,7 @@ objectClass: attributeSchema
adminDescription: """ + attr_name + """
adminDisplayName: """ + attr_name + """
cn: """ + attr_name + """
-attributeId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9940
+attributeId: 1.3.6.1.4.1.7165.4.6.1.7.%d.""" % sub_oid + str(random.randint(1,100000)) + """
attributeSyntax: 2.5.5.12
omSyntax: 64
instanceType: 4
@@ -127,7 +127,7 @@ systemOnly: FALSE

# create names for an attribute to add
(attr_name, attr_ldap_name, attr_dn) = self._make_obj_names("schemaInfo-Attr-")
- ldif = self._make_attr_ldif(attr_name, attr_dn)
+ ldif = self._make_attr_ldif(attr_name, attr_dn, 1)

# add the new attribute
self.sam_db.add_ldif(ldif)
@@ -149,7 +149,7 @@ systemOnly: FALSE
pass


- def _make_class_ldif(self, class_name, class_dn):
+ def _make_class_ldif(self, class_name, class_dn, sub_oid):
ldif = """
dn: """ + class_dn + """
objectClass: top
@@ -157,7 +157,7 @@ objectClass: classSchema
adminDescription: """ + class_name + """
adminDisplayName: """ + class_name + """
cn: """ + class_name + """
-governsId: 1.3.6.1.4.1.7165.4.6.2.""" + str(random.randint(1,100000)) + """
+governsId: 1.3.6.1.4.1.7165.4.6.2.7.%d.""" % sub_oid + str(random.randint(1,100000)) + """
instanceType: 4
objectClassCategory: 1
subClassOf: organizationalPerson
@@ -173,7 +173,7 @@ systemOnly: FALSE

# create names for a Class to add
(class_name, class_ldap_name, class_dn) = self._make_obj_names("schemaInfo-Class-")
- ldif = self._make_class_ldif(class_name, class_dn)
+ ldif = self._make_class_ldif(class_name, class_dn, 1)

# add the new Class
self.sam_db.add_ldif(ldif)
diff --git a/source4/dsdb/tests/python/ldap_schema.py b/source4/dsdb/tests/python/ldap_schema.py
index 1c5aeeb..c920296 100755
--- a/source4/dsdb/tests/python/ldap_schema.py
+++ b/source4/dsdb/tests/python/ldap_schema.py
@@ -108,7 +108,7 @@ objectClass: attributeSchema
adminDescription: """ + attr_name + """
adminDisplayName: """ + attr_name + """
cn: """ + attr_name + """
-attributeId: 1.3.6.1.4.1.7165.4.6.1.""" + rand + """
+attributeId: 1.3.6.1.4.1.7165.4.6.1.6.1.""" + rand + """
attributeSyntax: 2.5.5.12
omSyntax: 64
instanceType: 4
@@ -152,7 +152,7 @@ defaultObjectCategory: CN=_
adminDescription: """ + class_name + """
adminDisplayName: """ + class_name + """
cn: """ + class_name + """
-governsId: 1.3.6.1.4.1.7165.4.6.2.""" + str(random.randint(1,100000)) + """
+governsId: 1.3.6.1.4.1.7165.4.6.2.6.1.""" + str(random.randint(1,100000)) + """
instanceType: 4
objectClassCategory: 1
subClassOf: organizationalPerson
@@ -175,7 +175,7 @@ objectClass: classSchema
adminDescription: """ + class_name + """
adminDisplayName: """ + class_name + """
cn: """ + class_name + """
-governsId: 1.3.6.1.4.1.7165.4.6.2.""" + str(random.randint(1,100000)) + """
+governsId: 1.3.6.1.4.1.7165.4.6.2.6.2.""" + str(random.randint(1,100000)) + """
instanceType: 4
objectClassCategory: 1
subClassOf: organizationalPerson
@@ -257,7 +257,7 @@ objectClass: classSchema
adminDescription: """ + class_name + """
adminDisplayName: """ + class_name + """
cn: """ + class_name + """
-governsId: 1.3.6.1.4.1.7165.4.6.2.""" + str(random.randint(1,100000)) + """
+governsId: 1.3.6.1.4.1.7165.4.6.2.6.3.""" + str(random.randint(1,100000)) + """
instanceType: 4
objectClassCategory: 1
subClassOf: organizationalUnit
@@ -307,7 +307,7 @@ instanceType: 4
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.2." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -350,7 +350,7 @@ systemOnly: FALSE
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.3." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -394,7 +394,7 @@ systemOnly: FALSE
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.4." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -436,7 +436,7 @@ systemOnly: FALSE
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.5." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -480,7 +480,7 @@ systemOnly: FALSE
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.6." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -526,8 +526,8 @@ systemOnly: FALSE
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
- governsID = "1.3.6.1.4.1.7165.4.6.2." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.7." + rand
+ governsID = "1.3.6.1.4.1.7165.4.6.2.6.4." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -573,7 +573,7 @@ systemOnly: FALSE
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.8." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -627,7 +627,7 @@ ldapDisplayName: """ + attr_ldap_display_name + """
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.9." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -680,7 +680,7 @@ attributeId: """ + attributeID + """
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.10." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -715,7 +715,7 @@ replace: ldapDisplayName
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.11." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -748,7 +748,7 @@ ldapDisplayName: """ + attr_ldap_display_name + """2
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.12." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -785,7 +785,7 @@ attributeId: """ + attributeID + """.1
rand = str(random.randint(1,100000))
attr_name = "test-Attr" + time.strftime("%s", time.gmtime()) + "-" + rand
attr_ldap_display_name = attr_name.replace("-", "")
- attributeID = "1.3.6.1.4.1.7165.4.6.1." + rand
+ attributeID = "1.3.6.1.4.1.7165.4.6.1.6.13." + rand
ldif = """
dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
objectClass: top
@@ -822,7 +822,7 @@ attributeId: """ + attributeID + """
rand = str(random.randint(1,100000))
class_name = "test-Class" + time.strftime("%s", time.gmtime()) + "-" + rand
class_ldap_display_name = class_name.replace("-", "")
- governsID = "1.3.6.1.4.1.7165.4.6.2." + rand
+ governsID = "1.3.6.1.4.1.7165.4.6.2.6.5." + rand
ldif = """
dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
objectClass: top
@@ -860,7 +860,7 @@ governsId: """ + governsID + """.1
rand = str(random.randint(1,100000))
class_name = "test-Class" + time.strftime("%s", time.gmtime()) + "-" + rand
class_ldap_display_name = class_name.replace("-", "")
- governsID = "1.3.6.1.4.1.7165.4.6.2." + rand
+ governsID = "1.3.6.1.4.1.7165.4.6.2.6.6." + rand
ldif = """
dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
objectClass: top
@@ -907,7 +907,7 @@ objectClass: classSchema
adminDescription: """ + class_name + """
adminDisplayName: """ + class_name + """
cn: """ + class_name + """
-governsId: 1.3.6.1.4.1.7165.4.6.2.""" + str(random.randint(1,100000)) + """
+governsId: 1.3.6.1.4.1.7165.4.6.2.6.7.""" + str(random.randint(1,100000)) + """
instanceType: 4
objectClassCategory: 1
subClassOf: organizationalUnit
@@ -996,7 +996,7 @@ objectClass: attributeSchema
adminDescription: """ + attr_name + """
adminDisplayName: """ + attr_name + """
cn: """ + attr_name + """
-attributeId: 1.3.6.1.4.1.7165.4.6.1.""" + str(random.randint(1,100000)) + """
+attributeId: 1.3.6.1.4.1.7165.4.6.1.6.14.""" + str(random.randint(1,100000)) + """
attributeSyntax: 2.5.5.12
omSyntax: 64
instanceType: 4
@@ -1104,7 +1104,7 @@ systemOnly: FALSE
self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)


- def _make_class_ldif(self, class_dn, class_name):
+ def _make_class_ldif(self, class_dn, class_name, sub_oid):
ldif = """
dn: """ + class_dn + """
objectClass: top
@@ -1112,7 +1112,7 @@ objectClass: classSchema
adminDescription: """ + class_name + """
adminDisplayName: """ + class_name + """
cn: """ + class_name + """
-governsId: 1.3.6.1.4.1.7165.4.6.2.""" + str(random.randint(1,100000)) + """
+governsId: 1.3.6.1.4.1.7165.4.6.2.6.%d.""" % sub_oid + str(random.randint(1,100000)) + """
instanceType: 4
objectClassCategory: 1
subClassOf: organizationalPerson
@@ -1131,7 +1131,7 @@ systemOnly: FALSE
# level is >= DS_DOMAIN_FUNCTION_2003
# and missing otherwise
(class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-1-")
- ldif = self._make_class_ldif(class_dn, class_name)
+ ldif = self._make_class_ldif(class_dn, class_name, 8)

# try to add msDS-IntId during Class creation
ldif_add = ldif + "msDS-IntId: -1993108831\n"
@@ -1144,7 +1144,7 @@ systemOnly: FALSE

# add a new Class and update schema
(class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-2-")
- ldif = self._make_class_ldif(class_dn, class_name)
+ ldif = self._make_class_ldif(class_dn, class_name, 9)

self.ldb.add_ldif(ldif)
self._ldap_schemaUpdateNow()
@@ -1168,7 +1168,7 @@ systemOnly: FALSE
# level is >= DS_DOMAIN_FUNCTION_2003
# and missing otherwise
(class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-3-")
- ldif = self._make_class_ldif(class_dn, class_name)
+ ldif = self._make_class_ldif(class_dn, class_name, 10)
ldif += "systemFlags: 16\n"

# try to add msDS-IntId during Class creation
@@ -1181,7 +1181,7 @@ systemOnly: FALSE

# add the new Class and update schema
(class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-4-")
- ldif = self._make_class_ldif(class_dn, class_name)
+ ldif = self._make_class_ldif(class_dn, class_name, 11)
ldif += "systemFlags: 16\n"

self.ldb.add_ldif(ldif)
diff --git a/source4/setup/schema_samba4.ldif b/source4/setup/schema_samba4.ldif
index b63bd30..0189fb5 100644
--- a/source4/setup/schema_samba4.ldif
+++ b/source4/setup/schema_samba4.ldif
@@ -19,6 +19,8 @@
## 1.3.6.1.4.1.7165.4.6.1.2.x - ldap_syntaxes.py
## 1.3.6.1.4.1.7165.4.6.1.4.x - urgent_replication.py
## 1.3.6.1.4.1.7165.4.6.1.5.x - repl_schema.py
+## 1.3.6.1.4.1.7165.4.6.1.6.x - ldap_schema.py
+## 1.3.6.1.4.1.7165.4.6.1.7.x - dsdb_schema_info.py

## 1.3.6.1.4.1.7165.4.6.2.x - SELFTEST random classes
## 1.3.6.1.4.1.7165.4.6.2.1.x - ldap_syntaxes.py
@@ -26,6 +28,8 @@
## 1.3.6.1.4.1.7165.4.6.2.3.x - sec_descriptor.py
## 1.3.6.1.4.1.7165.4.6.2.4.x - urgent_replication.py
## 1.3.6.1.4.1.7165.4.6.2.5.x - repl_schema.py
+## 1.3.6.1.4.1.7165.4.6.2.6.x - ldap_schema.py
+## 1.3.6.1.4.1.7165.4.6.2.7.x - dsdb_schema_info.py

## 1.3.6.1.4.1.7165.4.255.x - mapped OIDs due to conflicts between AD and standards-track
#
--
Samba Shared Repository
Stefan Metzmacher
2017-01-10 16:41:02 UTC
Permalink
The branch, master has been updated
via e84e44c messaging: Fix dead but not cleaned-up-yet destination sockets
via e6a5e6a script/autobuild.py: try make test TESTS=samba3.*ktest for samba-systemkrb5
via 1204b44 selftest/selftest.pl: print out '[expanded] command: ' in all error cases
via 133416a selftest/selftest.pl: we don't need to call Subunit::progress_pop() twice on error
via a5db045 selftest/selftesthelpers.py: let plantestsuite() use the env name in the test name
via 3a870ba s4:gensec_gssapi: require a realm in gensec_gssapi_client_start()
via 48bcca5 s4:gensec_gssapi: the value gensec_get_target_principal() should overwrite gensec_get_target_hostname()
via 30c0706 auth/credentials: Always set the the realm if we set the principal from the ccache
via 2a2c03c auth/credentials: remove const where we always return a talloc string
via 3be1203 krb5_wrap: let smb_krb5_kinit_s4u2_ccache() work if store_creds.client and server have different realms
via ea0c35f s4:auth/gensec: remove unused dependencies to gensec_util
from 207fa23 python/schema: fix tests flapping due to oid collision

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit e84e44ce923e5dc7529bb813e10a2890528a4ab0
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 10 12:30:54 2017 +0000

messaging: Fix dead but not cleaned-up-yet destination sockets

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12509

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Tue Jan 10 17:40:58 CET 2017 on sn-devel-144

commit e6a5e6a01a3ada62a8490ae612e926738aa78a28
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 23 14:07:51 2016 +0100

script/autobuild.py: try make test TESTS=samba3.*ktest for samba-systemkrb5

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 1204b4432d23556bc8af32b0388141ae555cacb2
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 12:35:48 2016 +0100

selftest/selftest.pl: print out '[expanded] command: ' in all error cases

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 133416a8b9eaa7b84ce6b7144a737647183ff1e0
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 21:45:32 2016 +0100

selftest/selftest.pl: we don't need to call Subunit::progress_pop() twice on error

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit a5db045f98233ff6fda212000e23343a4ed0ab89
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 15:57:03 2016 +0100

selftest/selftesthelpers.py: let plantestsuite() use the env name in the test name

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 3a870baee8d9dbe5359f04a108814afc27e57d46
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 15:20:00 2016 +0100

s4:gensec_gssapi: require a realm in gensec_gssapi_client_start()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 48bcca566ebb3a5385b15b0525d7fbdd06361e04
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 14:00:36 2016 +0100

s4:gensec_gssapi: the value gensec_get_target_principal() should overwrite gensec_get_target_hostname()

If gensec_get_target_principal() has a value, we no longer have to verify
the gensec_get_target_hostname() value, it can be just an ipadress.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 30c07065300281e3a67197fe39ed928346480ff7
Author: Andreas Schneider <***@samba.org>
Date: Wed Dec 21 22:17:22 2016 +0100

auth/credentials: Always set the the realm if we set the principal from the ccache

This fixes a bug in gensec_gssapi_client_start() where an invalid realm
is used to get a Kerberos ticket.

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 2a2c03c655e51ff83483bbde1ded36c2e679faa3
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 15:26:00 2016 +0100

auth/credentials: remove const where we always return a talloc string

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 3be1203987de8cf1ae6f30b6e3a6904e3d46990e
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 14:42:49 2016 +0100

krb5_wrap: let smb_krb5_kinit_s4u2_ccache() work if store_creds.client and server have different realms

As the principal in the resulting ccache may not match the realm of the
target principal, we need to store the credentials twice.

The caller uses the ccache principal's realm to construct the
search key for the target principal.

If we get ***@SAMBADOMAIN via the NTLMSSP authentication
and want to do s4u2selfproxy, we'll get ticket for

client realm: SAMBADOMAIN
client name: administrator
server realm: SAMBA.EXAMPLE.COM
server name: cifs/localdc

This is stored in credential cache, but
the caller will use cifs/***@SAMBADOMAIN as
target_principal name when it tries to use the
cache.

So also store the ticket as:

client realm: SAMBADOMAIN
client name: administrator
server realm: SAMBADOMAIN
server name: cifs/localdc

Note that it can always happen that the target is not in the clients
realm, so we always deal with changing realm names, so this is not
a s4u2self/proxy specific thing.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit ea0c35fbd1e1799fc0162377ffc116cffa8659ab
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Dec 29 17:16:22 2016 +0100

s4:auth/gensec: remove unused dependencies to gensec_util

gensec_util only contains gensec_tstream and is already a public_dep
of 'gensec' itself.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
auth/credentials/credentials.c | 12 +++++-----
auth/credentials/credentials.h | 6 ++---
auth/credentials/credentials_krb5.c | 20 +++++++++++++---
lib/krb5_wrap/krb5_samba.c | 24 ++++++++++++++++++++
script/autobuild.py | 2 +-
selftest/selftest.pl | 5 +++-
selftest/selftesthelpers.py | 6 ++++-
selftest/skip.no-GSS_KRB5_CRED_NO_CI_FLAGS_X | 6 +++++
selftest/wscript | 4 ++++
source3/lib/messages.c | 11 +++++++++
source4/auth/gensec/gensec_gssapi.c | 34 +++++++++++++++++++++++-----
source4/auth/gensec/wscript_build | 4 ++--
12 files changed, 111 insertions(+), 23 deletions(-)
create mode 100644 selftest/skip.no-GSS_KRB5_CRED_NO_CI_FLAGS_X


Changeset truncated at 500 lines:

diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index 06648c7..ff444e3 100644
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -193,7 +193,7 @@ _PUBLIC_ const char *cli_credentials_get_bind_dn(struct cli_credentials *cred)
* @retval The username set on this context.
* @note Return value will never be NULL except by programmer error.
*/
-_PUBLIC_ const char *cli_credentials_get_principal_and_obtained(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, enum credentials_obtained *obtained)
+_PUBLIC_ char *cli_credentials_get_principal_and_obtained(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, enum credentials_obtained *obtained)
{
if (cred->machine_account_pending) {
cli_credentials_set_machine_account(cred,
@@ -256,7 +256,7 @@ _PUBLIC_ const char *cli_credentials_get_principal_and_obtained(struct cli_crede
* @retval The username set on this context.
* @note Return value will never be NULL except by programmer error.
*/
-_PUBLIC_ const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
+_PUBLIC_ char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
{
enum credentials_obtained obtained;
return cli_credentials_get_principal_and_obtained(cred, mem_ctx, &obtained);
@@ -848,12 +848,12 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials,
* @param mem_ctx The memory context to place the result on
*/

-_PUBLIC_ const char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx)
+_PUBLIC_ char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx)
{
const char *bind_dn = cli_credentials_get_bind_dn(credentials);
- const char *domain;
- const char *username;
- const char *name;
+ const char *domain = NULL;
+ const char *username = NULL;
+ char *name = NULL;

if (bind_dn) {
name = talloc_strdup(mem_ctx, bind_dn);
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
index 6b0d83b..50f6994 100644
--- a/auth/credentials/credentials.h
+++ b/auth/credentials/credentials.h
@@ -113,7 +113,7 @@ void cli_credentials_set_machine_account_pending(struct cli_credentials *cred,
struct loadparm_context *lp_ctx);
void cli_credentials_set_conf(struct cli_credentials *cred,
struct loadparm_context *lp_ctx);
-const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx);
+char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx);
int cli_credentials_get_server_gss_creds(struct cli_credentials *cred,
struct loadparm_context *lp_ctx,
struct gssapi_creds_container **_gcc);
@@ -189,7 +189,7 @@ bool cli_credentials_set_bind_dn(struct cli_credentials *cred,
const char *bind_dn);
const char *cli_credentials_get_bind_dn(struct cli_credentials *cred);
bool cli_credentials_parse_file(struct cli_credentials *cred, const char *file, enum credentials_obtained obtained);
-const char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx);
+char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx);
bool cli_credentials_set_password_callback(struct cli_credentials *cred,
const char *(*password_cb) (struct cli_credentials *));
enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred);
@@ -257,7 +257,7 @@ bool cli_credentials_set_username_callback(struct cli_credentials *cred,
* @retval The username set on this context.
* @note Return value will never be NULL except by programmer error.
*/
-const char *cli_credentials_get_principal_and_obtained(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, enum credentials_obtained *obtained);
+char *cli_credentials_get_principal_and_obtained(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, enum credentials_obtained *obtained);
bool cli_credentials_set_principal(struct cli_credentials *cred,
const char *val,
enum credentials_obtained obtained);
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index e974df9..a0346a2 100644
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -107,7 +107,8 @@ static int cli_credentials_set_from_ccache(struct cli_credentials *cred,
enum credentials_obtained obtained,
const char **error_string)
{
-
+ bool ok;
+ char *realm;
krb5_principal princ;
krb5_error_code ret;
char *name;
@@ -134,11 +135,24 @@ static int cli_credentials_set_from_ccache(struct cli_credentials *cred,
return ret;
}

- cli_credentials_set_principal(cred, name, obtained);
-
+ ok = cli_credentials_set_principal(cred, name, obtained);
+ if (!ok) {
+ krb5_free_principal(ccache->smb_krb5_context->krb5_context, princ);
+ return ENOMEM;
+ }
free(name);

+ realm = smb_krb5_principal_get_realm(ccache->smb_krb5_context->krb5_context,
+ princ);
krb5_free_principal(ccache->smb_krb5_context->krb5_context, princ);
+ if (realm == NULL) {
+ return ENOMEM;
+ }
+ ok = cli_credentials_set_realm(cred, realm, obtained);
+ SAFE_FREE(realm);
+ if (!ok) {
+ return ENOMEM;
+ }

/* set the ccache_obtained here, as it just got set to UNINITIALISED by the calls above */
cred->ccache_obtained = obtained;
diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index f8f3b16..bb0b5df 100644
--- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c
@@ -1942,6 +1942,7 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
krb5_principal target_princ;
krb5_ccache tmp_cc;
const char *self_realm;
+ const char *client_realm = NULL;
krb5_principal blacklist_principal = NULL;
krb5_principal whitelist_principal = NULL;

@@ -2273,6 +2274,29 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
return code;
}

+ client_realm = krb5_principal_get_realm(ctx, store_creds.client);
+ if (client_realm != NULL) {
+ /*
+ * Because the CANON flag doesn't have any impact
+ * on the impersonate_principal => store_creds.client
+ * realm mapping. We need to store the credentials twice,
+ * once with the returned realm and once with the
+ * realm of impersonate_principal.
+ */
+ code = krb5_principal_set_realm(ctx, store_creds.server,
+ client_realm);
+ if (code != 0) {
+ krb5_free_cred_contents(ctx, &store_creds);
+ return code;
+ }
+
+ code = krb5_cc_store_cred(ctx, store_cc, &store_creds);
+ if (code != 0) {
+ krb5_free_cred_contents(ctx, &store_creds);
+ return code;
+ }
+ }
+
if (expire_time) {
*expire_time = (time_t) store_creds.times.endtime;
}
diff --git a/script/autobuild.py b/script/autobuild.py
index 3d76130..45f449b 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -169,7 +169,7 @@ tasks = {
("make", "make -j", "text/plain"),
# we currently cannot run a full make test, a limited list of tests could be run
# via "make test TESTS=sometests"
- # ("test", "make test FAIL_IMMEDIATELY=1", "text/plain"),
+ ("test", "make test FAIL_IMMEDIATELY=1 TESTS='samba3.*ktest'", "text/plain"),
("install", "make install", "text/plain"),
("check-clean-tree", "script/clean-source-tree.sh", "text/plain"),
("clean", "make clean", "text/plain")
diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index c54ea68..e1c3429 100755
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -142,10 +142,13 @@ sub run_testsuite($$$$$)
Subunit::progress_pop();

if ($? == -1) {
- Subunit::progress_pop();
+ print "command: $cmd\n";
+ printf "expanded command: %s\n", expand_environment_strings($cmd);
Subunit::end_testsuite($name, "error", "Unable to run $cmd: $!");
exit(1);
} elsif ($? & 127) {
+ print "command: $cmd\n";
+ printf "expanded command: %s\n", expand_environment_strings($cmd);
Subunit::end_testsuite($name, "error",
sprintf("%s died with signal %d, %s coredump\n", $cmd, ($? & 127), ($? & 128) ? 'with' : 'without'));
exit(1);
diff --git a/selftest/selftesthelpers.py b/selftest/selftesthelpers.py
index 1a1e080..b0ece36 100644
--- a/selftest/selftesthelpers.py
+++ b/selftest/selftesthelpers.py
@@ -67,7 +67,11 @@ def plantestsuite(name, env, cmdline):
:param cmdline: Command line to run
"""
print "-- TEST --"
- print name
+ if env == "none":
+ fullname = name
+ else:
+ fullname = "%s(%s)" % (name, env)
+ print fullname
print env
if isinstance(cmdline, list):
cmdline = " ".join(cmdline)
diff --git a/selftest/skip.no-GSS_KRB5_CRED_NO_CI_FLAGS_X b/selftest/skip.no-GSS_KRB5_CRED_NO_CI_FLAGS_X
new file mode 100644
index 0000000..9ec679d
--- /dev/null
+++ b/selftest/skip.no-GSS_KRB5_CRED_NO_CI_FLAGS_X
@@ -0,0 +1,6 @@
+# GSS_KRB5_CRED_NO_CI_FLAGS_X is not available in older MIT releases (< 1.14)
+^samba3.rpc.lsa.lookupsids.krb5.*ncacn.*packet.*ktest
+^samba3.rpc.lsa.lookupsids.krb5.*ncacn.*sign.*ktest
+^samba3.blackbox.rpcclient.krb5.*ncacn.*krb5\].*ktest
+^samba3.blackbox.rpcclient.krb5.*ncacn.*packet\].*ktest
+^samba3.blackbox.rpcclient.krb5.*ncacn.*sign\].*ktest
diff --git a/selftest/wscript b/selftest/wscript
index 4a3fb4e..86deac5 100644
--- a/selftest/wscript
+++ b/selftest/wscript
@@ -231,6 +231,10 @@ def cmd_testonly(opt):
# FIXME REMOVE ME!
env.OPTIONS += " --use-dns-faking"

+ if not CONFIG_GET(opt, 'HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X'):
+ # older MIT krb5 libraries (< 1.14) don't have
+ # GSS_KRB5_CRED_NO_CI_FLAGS_X
+ env.OPTIONS += " --exclude=${srcdir}/selftest/skip.no-GSS_KRB5_CRED_NO_CI_FLAGS_X"

subunit_cache = None
# We use the full path rather than relative path to avoid problems on some platforms (ie. solaris 8).
diff --git a/source3/lib/messages.c b/source3/lib/messages.c
index 505eb66..533e869 100644
--- a/source3/lib/messages.c
+++ b/source3/lib/messages.c
@@ -626,6 +626,17 @@ int messaging_send_iov_from(struct messaging_context *msg_ctx,
unbecome_root();
}

+ if (ret == ECONNREFUSED) {
+ /*
+ * Linux returns this when a socket exists in the file
+ * system without a listening process. This is not
+ * documented in susv4 or the linux manpages, but it's
+ * easily testable. For the higher levels this is the
+ * same as "destination does not exist"
+ */
+ ret = ENOENT;
+ }
+
return ret;
}

diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index a6c4019..2ae2e23 100644
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -307,7 +307,15 @@ static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_securi
gss_buffer_desc name_token;
gss_OID name_type;
OM_uint32 maj_stat, min_stat;
+ const char *target_principal = NULL;
const char *hostname = gensec_get_target_hostname(gensec_security);
+ const char *service = gensec_get_target_service(gensec_security);
+ const char *realm = cli_credentials_get_realm(creds);
+
+ target_principal = gensec_get_target_principal(gensec_security);
+ if (target_principal != NULL) {
+ goto do_start;
+ }

if (!hostname) {
DEBUG(3, ("No hostname for target computer passed in, cannot use kerberos for this connection\n"));
@@ -322,6 +330,18 @@ static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_securi
return NT_STATUS_INVALID_PARAMETER;
}

+ if (realm == NULL) {
+ char *cred_name = cli_credentials_get_unparsed_name(creds,
+ gensec_security);
+ DEBUG(3, ("cli_credentials(%s) without realm, "
+ "cannot use kerberos for this connection %s/%s\n",
+ cred_name, service, hostname));
+ TALLOC_FREE(cred_name);
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+do_start:
+
nt_status = gensec_gssapi_start(gensec_security);
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
@@ -333,16 +353,18 @@ static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_securi
gensec_gssapi_state->gss_want_flags &= ~(GSS_C_DELEG_FLAG|GSS_C_DELEG_POLICY_FLAG);
}

- gensec_gssapi_state->target_principal = gensec_get_target_principal(gensec_security);
- if (gensec_gssapi_state->target_principal) {
+ if (target_principal != NULL) {
name_type = GSS_C_NULL_OID;
} else {
- gensec_gssapi_state->target_principal = talloc_asprintf(gensec_gssapi_state, "%s/%s@%s",
- gensec_get_target_service(gensec_security),
- hostname, cli_credentials_get_realm(creds));
-
+ target_principal = talloc_asprintf(gensec_gssapi_state,
+ "%s/%s@%s", service, hostname, realm);
+ if (target_principal == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
name_type = GSS_C_NT_USER_NAME;
}
+ gensec_gssapi_state->target_principal = target_principal;
+
name_token.value = discard_const_p(uint8_t, gensec_gssapi_state->target_principal);
name_token.length = strlen(gensec_gssapi_state->target_principal);

diff --git a/source4/auth/gensec/wscript_build b/source4/auth/gensec/wscript_build
index a1d30a9..098826a 100755
--- a/source4/auth/gensec/wscript_build
+++ b/source4/auth/gensec/wscript_build
@@ -13,7 +13,7 @@ bld.SAMBA_MODULE('gensec_krb5',
source='gensec_krb5.c ' + gensec_krb5_sources,
subsystem='gensec',
init_function='gensec_krb5_init',
- deps='samba-credentials authkrb5 com_err gensec_util',
+ deps='samba-credentials authkrb5 com_err',
internal_module=False,
enabled=bld.AD_DC_BUILD_IS_ENABLED()
)
@@ -23,7 +23,7 @@ bld.SAMBA_MODULE('gensec_gssapi',
source='gensec_gssapi.c',
subsystem='gensec',
init_function='gensec_gssapi_init',
- deps='gssapi samba-credentials authkrb5 com_err gensec_util'
+ deps='gssapi samba-credentials authkrb5 com_err'
)

bld.SAMBA_PYTHON('pygensec',
--
Samba Shared Repository
Jeremy Allison
2017-01-11 03:39:03 UTC
Permalink
The branch, master has been updated
via f16908c winbind: Fix CID 1398530 Resource leak
via e8008fb winbind: Fix CID 1398530 Resource leak
via 24a8193 winbind: Fix CID 1398531 Resource leak
via 5f024a0 winbind: Fix CID 1398533 Resource leak
via 4495535 winbind: Fix CID 1398533 Resource leak
via 3a864fc s3/smb2_read: Better fallback for incorrectly configured sendfile setups
from e84e44c messaging: Fix dead but not cleaned-up-yet destination sockets

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit f16908c454e4350d9b3a321ea78d345f7c7bfd55
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 10 13:29:38 2017 +0000

winbind: Fix CID 1398530 Resource leak

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Wed Jan 11 04:38:25 CET 2017 on sn-devel-144

commit e8008fb36d7821eafffc5f0ff2ee6f080f84c4ae
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 10 13:28:41 2017 +0000

winbind: Fix CID 1398530 Resource leak

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 24a81937d009a3079d75e3bab6e46eae35fc797f
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 10 13:24:22 2017 +0000

winbind: Fix CID 1398531 Resource leak

Not really a leak due to talloc, but this way it's clear

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 5f024a0079cf5b762eafe68264fa2599f33666b7
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 10 13:26:13 2017 +0000

winbind: Fix CID 1398533 Resource leak

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 4495535cb55afe254a6bd15df1121e14ad7ad054
Author: Volker Lendecke <***@samba.org>
Date: Tue Jan 10 13:24:22 2017 +0000

winbind: Fix CID 1398533 Resource leak

Not really a leak due to talloc, but this way it's clear

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 3a864fc952edaa96d2ee20254a3e9c90d29fe28c
Author: Anoop C S <***@redhat.com>
Date: Tue Jan 10 13:30:30 2017 +0000

s3/smb2_read: Better fallback for incorrectly configured sendfile setups

When "use sendfile" is enabled but not supported by the underlying VFS
module then fallback to normal copy and print out a warning for the
admin.

Pair-Programmed-With: Guenther Deschner <***@samba.org>
Pair-Programmed-With: Michael Adam <***@samba.org>
Signed-off-by: Anoop C S <***@redhat.com>
Reviewed-by: Jeremy Allison <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
source3/smbd/smb2_read.c | 7 +++++++
source3/winbindd/winbindd_ads.c | 5 +++--
source3/winbindd/winbindd_cache.c | 1 +
source3/winbindd/winbindd_msrpc.c | 1 +
source3/winbindd/winbindd_rpc.c | 1 +
source3/winbindd/winbindd_samr.c | 1 +
6 files changed, 14 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/smb2_read.c b/source3/smbd/smb2_read.c
index 89527f3..1c85840 100644
--- a/source3/smbd/smb2_read.c
+++ b/source3/smbd/smb2_read.c
@@ -221,6 +221,13 @@ static int smb2_sendfile_send_data(struct smbd_smb2_read_state *state)
goto normal_read;
}

+ if (errno == ENOTSUP) {
+ set_use_sendfile(SNUM(fsp->conn), false);
+ DBG_WARNING("Disabling sendfile use as sendfile is "
+ "not supported by the system\n");
+ goto normal_read;
+ }
+
if (errno == EINTR) {
/*
* Special hack for broken Linux with no working sendfile. If we
diff --git a/source3/winbindd/winbindd_ads.c b/source3/winbindd/winbindd_ads.c
index 8357968..b14f21e 100644
--- a/source3/winbindd/winbindd_ads.c
+++ b/source3/winbindd/winbindd_ads.c
@@ -356,8 +356,9 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain,
}

if (!ads_pull_sid(ads, msg, "objectSid", &user_sid)) {
- DBG_INFO("No sid for %s !?\n",
- ads_get_dn(ads, talloc_tos(), msg));
+ char *dn = ads_get_dn(ads, talloc_tos(), msg);
+ DBG_INFO("No sid for %s !?\n", dn);
+ TALLOC_FREE(dn);
continue;
}

diff --git a/source3/winbindd/winbindd_cache.c b/source3/winbindd/winbindd_cache.c
index d92c050..4431cb5 100644
--- a/source3/winbindd/winbindd_cache.c
+++ b/source3/winbindd/winbindd_cache.c
@@ -1457,6 +1457,7 @@ do_fetch_cache:

rids = talloc_array(mem_ctx, uint32_t, num_rids);
if (rids == NULL) {
+ centry_free(centry);
return NT_STATUS_NO_MEMORY;
}

diff --git a/source3/winbindd/winbindd_msrpc.c b/source3/winbindd/winbindd_msrpc.c
index 4b742c4..0d0e4ca 100644
--- a/source3/winbindd/winbindd_msrpc.c
+++ b/source3/winbindd/winbindd_msrpc.c
@@ -90,6 +90,7 @@ static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
}

done:
+ TALLOC_FREE(rids);
TALLOC_FREE(tmp_ctx);
return status;
}
diff --git a/source3/winbindd/winbindd_rpc.c b/source3/winbindd/winbindd_rpc.c
index bb8af45..fcc6366 100644
--- a/source3/winbindd/winbindd_rpc.c
+++ b/source3/winbindd/winbindd_rpc.c
@@ -77,6 +77,7 @@ NTSTATUS rpc_query_user_list(TALLOC_CTX *mem_ctx,
}
if (!NT_STATUS_IS_OK(result)) {
if (!NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
+ TALLOC_FREE(rids);
return result;
}
}
diff --git a/source3/winbindd/winbindd_samr.c b/source3/winbindd/winbindd_samr.c
index dd67496..224f105 100644
--- a/source3/winbindd/winbindd_samr.c
+++ b/source3/winbindd/winbindd_samr.c
@@ -208,6 +208,7 @@ done:
dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
}

+ TALLOC_FREE(rids);
TALLOC_FREE(tmp_ctx);
return status;
}
--
Samba Shared Repository
Volker Lendecke
2017-01-11 19:22:03 UTC
Permalink
The branch, master has been updated
via 4b295b1 wscript: remove executable bits for all wscript* files
via c736689 lib/tevent: remove unused release-script.sh
via cfaa358 nsswitch: remove unused TALLOC_* defines in pam_winbind.h
from f16908c winbind: Fix CID 1398530 Resource leak

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 4b295b106c687284d8468eab07d353bb800ba76b
Author: Stefan Metzmacher <***@samba.org>
Date: Tue Jan 10 12:43:54 2017 +0100

wscript: remove executable bits for all wscript* files

These files should not be executable.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Wed Jan 11 20:21:01 CET 2017 on sn-devel-144

commit c7366892b06f1c4f1541a8b9c0d8682131260a66
Author: Stefan Metzmacher <***@samba.org>
Date: Tue Jan 10 13:07:33 2017 +0100

lib/tevent: remove unused release-script.sh

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

commit cfaa3582087f21a6dfc769b36f9d7245f73b25fc
Author: Stefan Metzmacher <***@samba.org>
Date: Tue Jan 10 15:08:48 2017 +0100

nsswitch: remove unused TALLOC_* defines in pam_winbind.h

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
auth/credentials/wscript_build | 0
auth/gensec/wscript_build | 0
auth/kerberos/wscript_build | 0
buildtools/wafsamba/wscript | 0
dynconfig/wscript | 0
lib/addns/wscript_build | 0
lib/krb5_wrap/wscript_build | 0
lib/ldb/wscript | 0
lib/tevent/release-script.sh | 48 ----------------------
lib/tevent/wscript | 0
lib/util/wscript_build | 0
libcli/auth/wscript_build | 0
libcli/dns/wscript_build | 0
libcli/nbt/wscript_build | 0
libcli/smb/wscript | 0
nsswitch/pam_winbind.h | 6 ---
source3/rpc_server/wscript_build | 0
source3/wscript_build | 0
source4/auth/gensec/wscript_build | 0
source4/auth/kerberos/wscript_build | 0
source4/dsdb/samdb/ldb_modules/wscript_build | 0
.../dsdb/samdb/ldb_modules/wscript_build_server | 0
source4/dsdb/wscript_build | 0
source4/heimdal_build/wscript_configure | 0
source4/kdc/wscript_build | 0
source4/libcli/wscript_build | 0
source4/librpc/wscript_build | 0
source4/rpc_server/wscript_build | 0
source4/torture/wscript_build | 0
29 files changed, 54 deletions(-)
mode change 100755 => 100644 auth/credentials/wscript_build
mode change 100755 => 100644 auth/gensec/wscript_build
mode change 100755 => 100644 auth/kerberos/wscript_build
mode change 100755 => 100644 buildtools/wafsamba/wscript
mode change 100755 => 100644 dynconfig/wscript
mode change 100755 => 100644 lib/addns/wscript_build
mode change 100755 => 100644 lib/krb5_wrap/wscript_build
mode change 100755 => 100644 lib/ldb/wscript
delete mode 100755 lib/tevent/release-script.sh
mode change 100755 => 100644 lib/tevent/wscript
mode change 100755 => 100644 lib/util/wscript_build
mode change 100755 => 100644 libcli/auth/wscript_build
mode change 100755 => 100644 libcli/dns/wscript_build
mode change 100755 => 100644 libcli/nbt/wscript_build
mode change 100755 => 100644 libcli/smb/wscript
mode change 100755 => 100644 source3/rpc_server/wscript_build
mode change 100755 => 100644 source3/wscript_build
mode change 100755 => 100644 source4/auth/gensec/wscript_build
mode change 100755 => 100644 source4/auth/kerberos/wscript_build
mode change 100755 => 100644 source4/dsdb/samdb/ldb_modules/wscript_build
mode change 100755 => 100644 source4/dsdb/samdb/ldb_modules/wscript_build_server
mode change 100755 => 100644 source4/dsdb/wscript_build
mode change 100755 => 100644 source4/heimdal_build/wscript_configure
mode change 100755 => 100644 source4/kdc/wscript_build
mode change 100755 => 100644 source4/libcli/wscript_build
mode change 100755 => 100644 source4/librpc/wscript_build
mode change 100755 => 100644 source4/rpc_server/wscript_build
mode change 100755 => 100644 source4/torture/wscript_build


Changeset truncated at 500 lines:

diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build
old mode 100755
new mode 100644
diff --git a/auth/gensec/wscript_build b/auth/gensec/wscript_build
old mode 100755
new mode 100644
diff --git a/auth/kerberos/wscript_build b/auth/kerberos/wscript_build
old mode 100755
new mode 100644
diff --git a/buildtools/wafsamba/wscript b/buildtools/wafsamba/wscript
old mode 100755
new mode 100644
diff --git a/dynconfig/wscript b/dynconfig/wscript
old mode 100755
new mode 100644
diff --git a/lib/addns/wscript_build b/lib/addns/wscript_build
old mode 100755
new mode 100644
diff --git a/lib/krb5_wrap/wscript_build b/lib/krb5_wrap/wscript_build
old mode 100755
new mode 100644
diff --git a/lib/ldb/wscript b/lib/ldb/wscript
old mode 100755
new mode 100644
diff --git a/lib/tevent/release-script.sh b/lib/tevent/release-script.sh
deleted file mode 100755
index 077f562..0000000
--- a/lib/tevent/release-script.sh
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/bin/bash
-
-if [ "$1" = "" ]; then
- echo "Please provide version string, eg: 1.2.0"
- exit 1
-fi
-
-if [ ! -d "lib/tevent" ]; then
- echo "Run this script from the samba base directory."
- exit 1
-fi
-
-git clean -f -x -d lib/tevent
-git clean -f -x -d lib/replace
-
-curbranch=`git-branch |grep "^*" | tr -d "* "`
-
-version=$1
-strver=`echo ${version} | tr "." "-"`
-
-# Checkout the release tag
-git branch -f tevent-release-script-${strver} tevent-${strver}
-if [ ! "$?" = "0" ]; then
- echo "Unable to checkout tevent-${strver} release"
- exit 1
-fi
-
-git checkout tevent-release-script-${strver}
-
-# Test configure agrees with us
-confver=`grep "^AC_INIT" lib/tevent/configure.ac | tr -d "AC_INIT(tevent, " | tr -d ")"`
-if [ ! "$confver" = "$version" ]; then
- echo "Wrong version, requested release for ${version}, found ${confver}"
- exit 1
-fi
-
-# Now build tarball
-cp -a lib/tevent tevent-${version}
-cp -a lib/replace tevent-${version}/libreplace
-pushd tevent-${version}
-./autogen.sh
-popd
-tar cvzf tevent-${version}.tar.gz tevent-${version}
-rm -fr tevent-${version}
-
-#Clean up
-git checkout $curbranch
-git branch -d tevent-release-script-${strver}
diff --git a/lib/tevent/wscript b/lib/tevent/wscript
old mode 100755
new mode 100644
diff --git a/lib/util/wscript_build b/lib/util/wscript_build
old mode 100755
new mode 100644
diff --git a/libcli/auth/wscript_build b/libcli/auth/wscript_build
old mode 100755
new mode 100644
diff --git a/libcli/dns/wscript_build b/libcli/dns/wscript_build
old mode 100755
new mode 100644
diff --git a/libcli/nbt/wscript_build b/libcli/nbt/wscript_build
old mode 100755
new mode 100644
diff --git a/libcli/smb/wscript b/libcli/smb/wscript
old mode 100755
new mode 100644
diff --git a/nsswitch/pam_winbind.h b/nsswitch/pam_winbind.h
index 6b65c46..d468efb 100644
--- a/nsswitch/pam_winbind.h
+++ b/nsswitch/pam_winbind.h
@@ -216,10 +216,4 @@ struct pwb_context {
struct wbcContext *wbc_ctx;
};

-#ifndef TALLOC_FREE
-#define TALLOC_FREE(ctx) do { talloc_free(ctx); ctx=NULL; } while(0)
-#endif
-#define TALLOC_ZERO_P(ctx, type) (type *)_talloc_zero(ctx, sizeof(type), #type)
-#define TALLOC_P(ctx, type) (type *)talloc_named_const(ctx, sizeof(type), #type)
-
#endif /* _NSSWITCH_PAM_WINBIND_H_ */
diff --git a/source3/rpc_server/wscript_build b/source3/rpc_server/wscript_build
old mode 100755
new mode 100644
diff --git a/source3/wscript_build b/source3/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/auth/gensec/wscript_build b/source4/auth/gensec/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/auth/kerberos/wscript_build b/source4/auth/kerberos/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build b/source4/dsdb/samdb/ldb_modules/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server
old mode 100755
new mode 100644
diff --git a/source4/dsdb/wscript_build b/source4/dsdb/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/heimdal_build/wscript_configure b/source4/heimdal_build/wscript_configure
old mode 100755
new mode 100644
diff --git a/source4/kdc/wscript_build b/source4/kdc/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/libcli/wscript_build b/source4/libcli/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/librpc/wscript_build b/source4/librpc/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build
old mode 100755
new mode 100644
diff --git a/source4/torture/wscript_build b/source4/torture/wscript_build
old mode 100755
new mode 100644
--
Samba Shared Repository
David Disseldorp
2017-01-12 03:03:03 UTC
Permalink
The branch, master has been updated
via b4f40e4 s4:tests/sec_descriptor: use more unique oid values
from 4b295b1 wscript: remove executable bits for all wscript* files

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit b4f40e4d6db4d5a8e889ea778ebbce8eaf6b10f5
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Jan 11 13:34:28 2017 +0100

s4:tests/sec_descriptor: use more unique oid values

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12507

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): David Disseldorp <***@samba.org>
Autobuild-Date(master): Thu Jan 12 04:02:21 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
source4/dsdb/tests/python/sec_descriptor.py | 82 +++++++++--------------------
1 file changed, 25 insertions(+), 57 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source4/dsdb/tests/python/sec_descriptor.py b/source4/dsdb/tests/python/sec_descriptor.py
index ac80469..2f02418 100755
--- a/source4/dsdb/tests/python/sec_descriptor.py
+++ b/source4/dsdb/tests/python/sec_descriptor.py
@@ -64,24 +64,23 @@ class DescriptorTests(samba.tests.TestCase):
def get_users_domain_dn(self, name):
return "CN=%s,CN=Users,%s" % (name, self.base_dn)

- def get_unique_schema_class_name(self):
+ def create_schema_class(self, _ldb, desc=None):
while True:
- class_name = "test-class%s" % random.randint(1,100000)
+ class_id = random.randint(0,65535)
+ class_name = "descriptor-test-class%s" % class_id
class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
try:
- self.ldb_admin.search(base=class_dn, attrs=["*"])
+ self.ldb_admin.search(base=class_dn, attrs=["name"])
except LdbError, (num, _):
self.assertEquals(num, ERR_NO_SUCH_OBJECT)
- return class_name
+ break

- def create_schema_class(self, _ldb, object_dn, desc=None):
ldif = """
-dn: """ + object_dn + """
+dn: """ + class_dn + """
objectClass: classSchema
objectCategory: CN=Class-Schema,""" + self.schema_dn + """
-defaultObjectCategory: """ + object_dn + """
-distinguishedName: """ + object_dn + """
-governsId: 1.3.6.1.4.1.7165.4.6.3.""" + str(random.randint(1,100000)) + """
+defaultObjectCategory: """ + class_dn + """
+governsId: 1.3.6.1.4.1.7165.4.6.2.3.""" + str(class_id) + """
instanceType: 4
objectClassCategory: 1
subClassOf: organizationalPerson
@@ -97,6 +96,7 @@ systemOnly: FALSE
elif isinstance(desc, security.descriptor):
ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
_ldb.add_ldif(ldif)
+ return class_dn

def create_configuration_container(self, _ldb, object_dn, desc=None):
ldif = """
@@ -688,9 +688,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
mod = "(A;;WDCC;;;AU)"
self.sd_utils.dacl_add_ace(self.schema_dn, mod)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn)
+ class_dn = self.create_schema_class(_ldb)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
@@ -705,9 +703,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
mod = "(A;CI;WDCC;;;AU)"
self.sd_utils.dacl_add_ace(self.schema_dn, mod)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn)
+ class_dn = self.create_schema_class(_ldb)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
@@ -722,9 +718,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
mod = "(A;CI;WDCC;;;AU)"
self.sd_utils.dacl_add_ace(self.schema_dn, mod)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn)
+ class_dn = self.create_schema_class(_ldb)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
@@ -740,9 +734,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
mod = "(A;CI;WDCC;;;AU)"
self.sd_utils.dacl_add_ace(self.schema_dn, mod)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn)
+ class_dn = self.create_schema_class(_ldb)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
@@ -757,9 +749,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
mod = "(A;CI;WDCC;;;AU)"
self.sd_utils.dacl_add_ace(self.schema_dn, mod)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn)
+ class_dn = self.create_schema_class(_ldb)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
@@ -774,9 +764,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
mod = "(A;CI;WDCC;;;AU)"
self.sd_utils.dacl_add_ace(self.schema_dn, mod)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn)
+ class_dn = self.create_schema_class(_ldb)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
@@ -791,9 +779,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
mod = "(A;CI;WDCC;;;AU)"
self.sd_utils.dacl_add_ace(self.schema_dn, mod)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn)
+ class_dn = self.create_schema_class(_ldb)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
@@ -808,9 +794,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
mod = "(A;CI;WDCC;;;AU)"
self.sd_utils.dacl_add_ace(self.schema_dn, mod)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn)
+ class_dn = self.create_schema_class(_ldb)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
@@ -829,9 +813,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
# Create a custom security descriptor
desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn, desc_sddl)
+ class_dn = self.create_schema_class(_ldb, desc_sddl)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual("O:DAG:DA", res)
@@ -847,9 +829,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
# Create a custom security descriptor
desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn, desc_sddl)
+ class_dn = self.create_schema_class(_ldb, desc_sddl)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual("O:DAG:DA", res)
@@ -864,9 +844,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
user_sid = self.sd_utils.get_object_sid( self.get_users_domain_dn(user_name) )
desc_sddl = "O:%sG:DAD:(A;;RP;;;DU)" % str(user_sid)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn, desc_sddl)
+ class_dn = self.create_schema_class(_ldb, desc_sddl)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
@@ -881,9 +859,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
user_sid = self.sd_utils.get_object_sid( self.get_users_domain_dn(user_name) )
desc_sddl = "O:%sG:DAD:(A;;RP;;;DU)" % str(user_sid)
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn, desc_sddl)
+ class_dn = self.create_schema_class(_ldb, desc_sddl)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
@@ -899,9 +875,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
# Create a custom security descriptor
desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn, desc_sddl)
+ class_dn = self.create_schema_class(_ldb, desc_sddl)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual("O:DAG:DA", res)
@@ -917,9 +891,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
# Create a custom security descriptor
desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn, desc_sddl)
+ class_dn = self.create_schema_class(_ldb, desc_sddl)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual("O:DAG:DA", res)
@@ -935,9 +907,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
# Create a custom security descriptor
desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn, desc_sddl)
+ class_dn = self.create_schema_class(_ldb, desc_sddl)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual("O:DAG:DA", res)
@@ -953,9 +923,7 @@ class OwnerGroupDescriptorTests(DescriptorTests):
# Create a custom security descriptor
desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
# Create example Schema class
- class_name = self.get_unique_schema_class_name()
- class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
- self.create_schema_class(_ldb, class_dn, desc_sddl)
+ class_dn = self.create_schema_class(_ldb, desc_sddl)
desc_sddl = self.sd_utils.get_sd_as_sddl(class_dn)
res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
self.assertEqual("O:DAG:DA", res)
--
Samba Shared Repository
Amitay Isaacs
2017-01-12 07:00:02 UTC
Permalink
The branch, master has been updated
via 7794497 ctdb-tests: Add robust mutex test
via 3a56a16 ctdb-locking: Explicitly unlock record/db in lock helper
via 5b1076d ctdb-locking: Remove support for locking multiple databases
from b4f40e4 s4:tests/sec_descriptor: use more unique oid values

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 7794497bc909fa7b02da9d9ce1fc496a8fa2a9ae
Author: Amitay Isaacs <***@gmail.com>
Date: Fri Dec 2 15:11:20 2016 +1100

ctdb-tests: Add robust mutex test

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12469

This demonstrates robust mutex bug on linux/glibc system.

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

Autobuild-User(master): Amitay Isaacs <***@samba.org>
Autobuild-Date(master): Thu Jan 12 07:59:34 CET 2017 on sn-devel-144

commit 3a56a16b06cf6d1cce613ec29f5ea46630902072
Author: Amitay Isaacs <***@gmail.com>
Date: Tue Nov 29 17:20:45 2016 +1100

ctdb-locking: Explicitly unlock record/db in lock helper

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12469

Instead of killing lock helper processes with SIGKILL, send SIGTERM so
lock helper processes can explicitly unlock record/db.

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

commit 5b1076dc61f5e3f006c1b8cef98e7d2d3cc1bfba
Author: Amitay Isaacs <***@gmail.com>
Date: Tue Nov 29 17:13:41 2016 +1100

ctdb-locking: Remove support for locking multiple databases

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12469

The code to lock multiple databases has been dropped from ctdb_lock.c.

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

-----------------------------------------------------------------------

Summary of changes:
ctdb/server/ctdb_lock.c | 6 +-
ctdb/server/ctdb_lock_helper.c | 194 ++++++++++++++++++++++++-----
ctdb/tests/src/test_mutex_raw.c | 261 ++++++++++++++++++++++++++++++++++++++++
ctdb/wscript | 8 +-
4 files changed, 435 insertions(+), 34 deletions(-)
create mode 100644 ctdb/tests/src/test_mutex_raw.c


Changeset truncated at 500 lines:

diff --git a/ctdb/server/ctdb_lock.c b/ctdb/server/ctdb_lock.c
index 0203369..b2c6d15 100644
--- a/ctdb/server/ctdb_lock.c
+++ b/ctdb/server/ctdb_lock.c
@@ -192,7 +192,7 @@ static int ctdb_lock_context_destructor(struct lock_context *lock_ctx)
lock_ctx->request->lctx = NULL;
}
if (lock_ctx->child > 0) {
- ctdb_kill(lock_ctx->ctdb, lock_ctx->child, SIGKILL);
+ ctdb_kill(lock_ctx->ctdb, lock_ctx->child, SIGTERM);
if (lock_ctx->type == LOCK_RECORD) {
DLIST_REMOVE(lock_ctx->ctdb_db->lock_current, lock_ctx);
} else {
@@ -683,7 +683,7 @@ static void ctdb_lock_schedule(struct ctdb_context *ctdb)
ctdb_lock_timeout_handler,
(void *)lock_ctx);
if (lock_ctx->ttimer == NULL) {
- ctdb_kill(ctdb, lock_ctx->child, SIGKILL);
+ ctdb_kill(ctdb, lock_ctx->child, SIGTERM);
lock_ctx->child = -1;
close(lock_ctx->fd[0]);
return;
@@ -698,7 +698,7 @@ static void ctdb_lock_schedule(struct ctdb_context *ctdb)
(void *)lock_ctx);
if (lock_ctx->tfd == NULL) {
TALLOC_FREE(lock_ctx->ttimer);
- ctdb_kill(ctdb, lock_ctx->child, SIGKILL);
+ ctdb_kill(ctdb, lock_ctx->child, SIGTERM);
lock_ctx->child = -1;
close(lock_ctx->fd[0]);
return;
diff --git a/ctdb/server/ctdb_lock_helper.c b/ctdb/server/ctdb_lock_helper.c
index 34823fb..8b9f5aa 100644
--- a/ctdb/server/ctdb_lock_helper.c
+++ b/ctdb/server/ctdb_lock_helper.c
@@ -20,11 +20,14 @@
#include "replace.h"
#include "system/filesys.h"
#include "system/network.h"
+#include "system/wait.h"

#include <talloc.h>
+#include <tevent.h>
#include <tdb.h>

#include "lib/util/sys_rw.h"
+#include "lib/util/tevent_unix.h"

#include "protocol/protocol.h"

@@ -33,6 +36,11 @@
static char *progname = NULL;
static bool realtime = true;

+struct lock_state {
+ struct tdb_context *tdb;
+ TDB_DATA key;
+};
+
static void set_priority(void)
{
const char *ptr;
@@ -73,7 +81,7 @@ static void usage(void)
{
fprintf(stderr, "\n");
fprintf(stderr, "Usage: %s <ctdbd-pid> <output-fd> RECORD <db-path> <db-flags> <db-key>\n", progname);
- fprintf(stderr, " %s <ctdbd-pid> <output-fd> DB <db1-path> <db1-flags> [<db2-path> <db2-flags>...]\n", progname);
+ fprintf(stderr, " %s <ctdbd-pid> <output-fd> DB <db-path> <db-flags>\n", progname);
}

static uint8_t *hex_decode_talloc(TALLOC_CTX *mem_ctx,
@@ -93,10 +101,9 @@ static uint8_t *hex_decode_talloc(TALLOC_CTX *mem_ctx,
return buffer;
}

-static int lock_record(const char *dbpath, const char *dbflags, const char *dbkey)
+static int lock_record(const char *dbpath, const char *dbflags,
+ const char *dbkey, struct lock_state *state)
{
- TDB_DATA key;
- struct tdb_context *tdb;
int tdb_flags;

/* No error checking since CTDB always passes sane values */
@@ -104,23 +111,24 @@ static int lock_record(const char *dbpath, const char *dbflags, const char *dbke

/* Convert hex key to key */
if (strcmp(dbkey, "NULL") == 0) {
- key.dptr = NULL;
- key.dsize = 0;
+ state->key.dptr = NULL;
+ state->key.dsize = 0;
} else {
- key.dptr = hex_decode_talloc(NULL, dbkey, &key.dsize);
+ state->key.dptr = hex_decode_talloc(NULL, dbkey,
+ &state->key.dsize);
}

- tdb = tdb_open(dbpath, 0, tdb_flags, O_RDWR, 0600);
- if (tdb == NULL) {
+ state->tdb = tdb_open(dbpath, 0, tdb_flags, O_RDWR, 0600);
+ if (state->tdb == NULL) {
fprintf(stderr, "locking: Error opening database %s\n", dbpath);
return 1;
}

set_priority();

- if (tdb_chainlock(tdb, key) < 0) {
+ if (tdb_chainlock(state->tdb, state->key) < 0) {
fprintf(stderr, "locking: Error getting record lock (%s)\n",
- tdb_errorstr(tdb));
+ tdb_errorstr(state->tdb));
return 1;
}

@@ -130,26 +138,25 @@ static int lock_record(const char *dbpath, const char *dbflags, const char *dbke

}

-
-static int lock_db(const char *dbpath, const char *dbflags)
+static int lock_db(const char *dbpath, const char *dbflags,
+ struct lock_state *state)
{
- struct tdb_context *tdb;
int tdb_flags;

/* No error checking since CTDB always passes sane values */
tdb_flags = strtol(dbflags, NULL, 0);

- tdb = tdb_open(dbpath, 0, tdb_flags, O_RDWR, 0600);
- if (tdb == NULL) {
+ state->tdb = tdb_open(dbpath, 0, tdb_flags, O_RDWR, 0600);
+ if (state->tdb == NULL) {
fprintf(stderr, "locking: Error opening database %s\n", dbpath);
return 1;
}

set_priority();

- if (tdb_lockall(tdb) < 0) {
+ if (tdb_lockall(state->tdb) < 0) {
fprintf(stderr, "locking: Error getting db lock (%s)\n",
- tdb_errorstr(tdb));
+ tdb_errorstr(state->tdb));
return 1;
}

@@ -158,13 +165,114 @@ static int lock_db(const char *dbpath, const char *dbflags)
return 0;
}

+struct wait_for_parent_state {
+ struct tevent_context *ev;
+ pid_t ppid;
+};
+
+static void wait_for_parent_check(struct tevent_req *subreq);
+
+static struct tevent_req *wait_for_parent_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ pid_t ppid)
+{
+ struct tevent_req *req, *subreq;
+ struct wait_for_parent_state *state;
+
+ req = tevent_req_create(mem_ctx, &state, struct wait_for_parent_state);
+ if (req == NULL) {
+ return NULL;
+ }
+
+ state->ev = ev;
+ state->ppid = ppid;
+
+ if (ppid == 1) {
+ tevent_req_done(req);
+ return tevent_req_post(req, ev);
+ }
+
+ subreq = tevent_wakeup_send(state, ev,
+ tevent_timeval_current_ofs(5,0));
+ if (tevent_req_nomem(subreq, req)) {
+ return tevent_req_post(req, ev);
+ }
+ tevent_req_set_callback(subreq, wait_for_parent_check, req);
+
+ return req;
+}
+
+static void wait_for_parent_check(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(
+ subreq, struct tevent_req);
+ struct wait_for_parent_state *state = tevent_req_data(
+ req, struct wait_for_parent_state);
+ bool status;
+
+ status = tevent_wakeup_recv(subreq);
+ TALLOC_FREE(subreq);
+ if (! status) {
+ /* Ignore error */
+ fprintf(stderr, "locking: tevent_wakeup_recv() failed\n");
+ }
+
+ if (kill(state->ppid, 0) == -1 && errno == ESRCH) {
+ tevent_req_done(req);
+ return;
+ }
+
+ subreq = tevent_wakeup_send(state, state->ev,
+ tevent_timeval_current_ofs(5,0));
+ if (tevent_req_nomem(subreq, req)) {
+ return;
+ }
+ tevent_req_set_callback(subreq, wait_for_parent_check, req);
+}
+
+static bool wait_for_parent_recv(struct tevent_req *req)
+{
+ if (tevent_req_is_unix_error(req, NULL)) {
+ return false;
+ }
+
+ return true;
+}
+
+static void cleanup(struct lock_state *state)
+{
+ if (state->tdb != NULL) {
+ if (state->key.dsize == 0) {
+ tdb_unlockall(state->tdb);
+ } else {
+ tdb_chainunlock(state->tdb, state->key);
+ }
+ tdb_close(state->tdb);
+ }
+}
+
+static void signal_handler(struct tevent_context *ev,
+ struct tevent_signal *se,
+ int signum, int count, void *siginfo,
+ void *private_data)
+{
+ struct lock_state *state = (struct lock_state *)private_data;
+
+ cleanup(state);
+ exit(0);
+}

int main(int argc, char *argv[])
{
+ struct tevent_context *ev;
+ struct tevent_signal *se;
+ struct tevent_req *req;
+ struct lock_state state = { 0 };
int write_fd;
char result = 0;
int ppid;
const char *lock_type;
+ bool status;

reset_scheduler();

@@ -179,6 +287,20 @@ int main(int argc, char *argv[])
write_fd = atoi(argv[2]);
lock_type = argv[3];

+ ev = tevent_context_init(NULL);
+ if (ev == NULL) {
+ fprintf(stderr, "locking: tevent_context_init() failed\n");
+ exit(1);
+ }
+
+ se = tevent_add_signal(ev, ev, SIGTERM, 0,
+ signal_handler, &state);
+ if (se == NULL) {
+ fprintf(stderr, "locking: tevent_add_signal() failed\n");
+ talloc_free(ev);
+ exit(1);
+ }
+
if (strcmp(lock_type, "RECORD") == 0) {
if (argc != 7) {
fprintf(stderr,
@@ -187,20 +309,17 @@ int main(int argc, char *argv[])
usage();
exit(1);
}
- result = lock_record(argv[4], argv[5], argv[6]);
+ result = lock_record(argv[4], argv[5], argv[6], &state);

} else if (strcmp(lock_type, "DB") == 0) {
- int n;
-
- /* If there are no databases specified, no need for lock */
- if (argc > 4) {
- for (n=4; n+1<argc; n+=2) {
- result = lock_db(argv[n], argv[n+1]);
- if (result != 0) {
- break;
- }
- }
+ if (argc != 6) {
+ fprintf(stderr,
+ "locking: Invalid number of arguments (%d)\n",
+ argc);
+ usage();
+ exit(1);
}
+ result = lock_db(argv[4], argv[5], &state);

} else {
fprintf(stderr, "locking: Invalid lock-type '%s'\n", lock_type);
@@ -210,6 +329,21 @@ int main(int argc, char *argv[])

send_result(write_fd, result);

- ctdb_wait_for_process_to_exit(ppid);
+ req = wait_for_parent_send(ev, ev, ppid);
+ if (req == NULL) {
+ fprintf(stderr, "locking: wait_for_parent_send() failed\n");
+ cleanup(&state);
+ exit(1);
+ }
+
+ tevent_req_poll(req, ev);
+
+ status = wait_for_parent_recv(req);
+ if (! status) {
+ fprintf(stderr, "locking: wait_for_parent_recv() failed\n");
+ }
+
+ talloc_free(ev);
+ cleanup(&state);
return 0;
}
diff --git a/ctdb/tests/src/test_mutex_raw.c b/ctdb/tests/src/test_mutex_raw.c
new file mode 100644
index 0000000..8e3cae3
--- /dev/null
+++ b/ctdb/tests/src/test_mutex_raw.c
@@ -0,0 +1,261 @@
+/*
+ Robust mutex test
+
+ Copyright (C) Amitay Isaacs 2016
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, see <http://www.gnu.org/licenses/>.
+*/
+
+/*
+ * Run this test as follows:
+ *
+ * 1. Running all processes at normal priority
+ *
+ * $ while true ; do ./bin/test_mutex_raw /tmp/foo 10 0 ; done
+ *
+ * 2. Running all processes at real-time priority
+ *
+ * # while true ; do ./bin/test_mutex_raw /tmp/foo 10 1 ; done
+ *
+ * The test will block after few iterations. At this time none of the
+ * child processes is holding the mutex.
+ *
+ * To check which process is holding a lock:
+ *
+ * $ ./bin/test_mutex_raw /tmp/foo debug
+ *
+ * If no pid is printed, then no process is holding the mutex.
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <inttypes.h>
+#include <sys/types.h>
+#include <sys/fcntl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/wait.h>
+#include <sched.h>
+#include <sys/mman.h>
+#include <pthread.h>
+#include <errno.h>
+#include <stdbool.h>
+
+int pthread_mutex_consistent_np(pthread_mutex_t *);
+
+static void set_realtime(void)
+{
+ struct sched_param p;
+ int ret;
+
+ p.sched_priority = 1;
+
+ ret = sched_setscheduler(0, SCHED_FIFO, &p);
+ if (ret == -1) {
+ fprintf(stderr, "Failed to set scheduler to SCHED_FIFO\n");
+ }
+}
+
+static void high_priority(void)
+{
+ int ret;
+
+ ret = nice(-20);
+ if (ret == -1) {
+ fprintf(stderr, "Failed to set high priority\n");
+ }
+}
+
+static void run_child(const char *filename)
+{
+ pthread_mutex_t *mutex;
+ void *addr;
+ int ret, fd;
+
+ fd = open(filename, O_RDWR, 0600);
+ if (fd == -1) {
+ exit(1);
+ }
+
+ addr = mmap(NULL, sizeof(pthread_mutex_t), PROT_READ|PROT_WRITE,
+ MAP_SHARED|MAP_FILE, fd, 0);
+ if (addr == NULL) {
+ exit(2);
+ }
+
+ mutex = (pthread_mutex_t *)addr;
+
+again:
+ ret = pthread_mutex_lock(mutex);
+ if (ret == EOWNERDEAD) {
+ ret = pthread_mutex_consistent_np(mutex);
+ } else if (ret == EAGAIN) {
+ goto again;
+ }
+ if (ret != 0) {
+ fprintf(stderr, "pid %u lock failed, ret=%d\n", getpid(), ret);
+ exit(3);
+ }
+
+ fprintf(stderr, "pid %u locked\n", getpid());
+ kill(getpid(), SIGKILL);
+}
+
+#define PRIO_NORMAL 0
+#define PRIO_REALTIME 1
+#define PRIO_NICE_20 2
+
+int main(int argc, const char **argv)
+{
+ pthread_mutexattr_t ma;
+ pthread_mutex_t *mutex;
+ int fd, ret, i;
+ pid_t pid;
+ void *addr;
+ int num_children;
+ int priority = PRIO_NORMAL;
+
+ if (argc < 3 || argc > 4) {
+ fprintf(stderr, "Usage: %s <file> <n> [0|1|2]\n", argv[0]);
+ fprintf(stderr, " %s <file> debug\n", argv[0]);
+ exit(1);
+ }
+
+ if (argc == 4) {
+ priority = atoi(argv[3]);
+ }
+
+ if (priority == PRIO_REALTIME) {
+ set_realtime();
+ } else if (priority == PRIO_NICE_20) {
+ high_priority();
+ }
+
+ fd = open(argv[1], O_CREAT|O_RDWR, 0600);
+ if (fd == -1) {
+ fprintf(stderr, "open failed\n");
+ exit(1);
+ }
+
+ ret = lseek(fd, 0, SEEK_SET);
+ if (ret != 0) {
+ fprintf(stderr, "lseek failed\n");
+ exit(1);
+ }
+
+ ret = ftruncate(fd, sizeof(pthread_mutex_t));
--
Samba Shared Repository
Karolin Seeger
2017-01-12 14:35:03 UTC
Permalink
The branch, master has been updated
via 7870c64 script/release.sh: fix off by 1 error in announce.${tagname}.mail.txt creation
from 7794497 ctdb-tests: Add robust mutex test

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 7870c645b79da647bae45b4dc95e7d6e9abcd91a
Author: Stefan Metzmacher <***@samba.org>
Date: Thu Jan 12 10:40:37 2017 +0100

script/release.sh: fix off by 1 error in announce.${tagname}.mail.txt creation

Pair-Programmed-With: Karolin Seeger <***@samba.org>

Signed-off-by: Stefan Metzmacher <***@samba.org>
Signed-off-by: Karolin Seeger <***@samba.org>

Autobuild-User(master): Karolin Seeger <***@samba.org>
Autobuild-Date(master): Thu Jan 12 15:34:25 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
script/release.sh | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/script/release.sh b/script/release.sh
index 769f742..b533e25 100755
--- a/script/release.sh
+++ b/script/release.sh
@@ -830,7 +830,8 @@ announcement_samba_stable() {
top=$(cat ${TMPDIR}/WHATSNEW.txt | wc -l)
}
local skip=$(cat ${TMPDIR}/WHATSNEW.txt | grep -n '^[^ ]' | head -1 | cut -d ':' -f1)
- local bottom=$(expr ${top} - \( ${skip} - 1 \))
+ local headlimit=$(expr ${top} - 1 )
+ local taillimit=$(expr ${headlimit} - \( ${skip} - 1 \))

cat "announce.${tagname}.quotation.txt"
echo ""
@@ -838,7 +839,7 @@ announcement_samba_stable() {
echo "Release Announcements"
echo "---------------------"
echo ""
- head -${top} ${TMPDIR}/WHATSNEW.txt | tail -${bottom}
+ head -${headlimit} ${TMPDIR}/WHATSNEW.txt | tail -${taillimit}
echo ""
echo "================"
echo "Download Details"
--
Samba Shared Repository
Stefan Metzmacher
2017-01-12 18:24:03 UTC
Permalink
The branch, master has been updated
via d35ff9e lib: talloc: Make it clear that talloc_get_size(NULL) returns 0.
via 99ffef3 auth/gensec: convert external.c to provide update_send/recv
via ac6083e auth/gensec: convert ncalrpc.c to provide update_send/recv
via b8abd4a auth/gensec: convert schannel.c to provide update_send/recv
via c9f5a89 auth/gensec: remove unused prototype headers
via 278c921 script/autobuild.py: try to make TMPDIR handling more verbose
via 96277a9 script/autobuild.py: add a do_print() wrapper function that flushes after each message
via 5a8d7a5 script/autobuild.py: export PYTHONUNBUFFERED=1
via f9e1887 script/autobuild.py: cleanup the task subdirs when they're done.
via b919994 s3-spoolss: globally set print server environment/architecture.
via 92fc6a6 s3-spoolss: make us appear as a 64bit print server.
via 0e7302d spoolss: Fix PROCESSOR_AMD_X8664 value in IDL
via d6a9377 s3-spoolss: Use a more accurate DefaultSpoolDirectory
via 03a4741 spoolss: allow truncated driver version in spoolss_driver_version_to_qword()
via 34218e0 s3-spoolss: Fix architecture handling in spoolss_DeletePrinterDriverEx call
via 06e4d1c s4-torture: cleanup after printing tests that had to add a driver
via 39489a8 s4-torture: cleanup architecture handling in spoolss driver tests.
via 14d65fb script/autobuild.py: use --enable-developer and --picky-developer for the ctdb build
via f981e2c credentials: Create a smb_gss_krb5_copy_ccache() function
via 72fe43f mit-kdb: Remove unneeded memset()
via adcb8a9 mit-kdb: Use calloc() to allocate memory
via e467eef gensec: Cast data for MIT Kerberos correctly
via 9b263c5 gensec: Fix picky developer with MIT Kerberos
via ecec8bb docs: Bump version up to 4.7.
via 5d9eb27 WHATSNEW: Start release notes for Samba 4.7.0pre1.
from 7870c64 script/release.sh: fix off by 1 error in announce.${tagname}.mail.txt creation

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit d35ff9e9bdae79e5f5b2c9b5bf8cfe05199da804
Author: Jeremy Allison <***@samba.org>
Date: Wed Jan 11 11:48:25 2017 -0800

lib: talloc: Make it clear that talloc_get_size(NULL) returns 0.

This *isn't* a behavior change, as the previous code could potentially
return the size of null_context, which (currently) is defined as
a named talloc region of ZERO size, but this makes it very clear
what the ABI behavior should be.

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Thu Jan 12 19:23:25 CET 2017 on sn-devel-144

commit 99ffef3de297395a62bab3279519f2fab990b42b
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 30 01:53:27 2016 +0100

auth/gensec: convert external.c to provide update_send/recv

Signed-off-by: Stefan Metzmacher <***@samba.org>

commit ac6083eb72e96b5880859caa08ccd95694d38412
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 30 01:35:18 2016 +0100

auth/gensec: convert ncalrpc.c to provide update_send/recv

Signed-off-by: Stefan Metzmacher <***@samba.org>

commit b8abd4a8a23b465c7fc6a585d198ec1fcf8ce13b
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Dec 30 01:30:13 2016 +0100

auth/gensec: convert schannel.c to provide update_send/recv

Signed-off-by: Stefan Metzmacher <***@samba.org>

commit c9f5a89809c65770ba4c333db80cd58dcbb493b7
Author: Stefan Metzmacher <***@samba.org>
Date: Mon Dec 23 09:13:33 2013 +0100

auth/gensec: remove unused prototype headers

Signed-off-by: Stefan Metzmacher <***@samba.org>

commit 278c921263550c1473df8944260bbb4e62a0e0e6
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Jan 11 14:13:00 2017 +0100

script/autobuild.py: try to make TMPDIR handling more verbose

This hopefully gives some hints regarding flakey tests where
the tmpdir is not available.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 96277a9f82379c7fedf36ca13644eb3493dcd1e2
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Jan 11 15:02:17 2017 +0100

script/autobuild.py: add a do_print() wrapper function that flushes after each message

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 5a8d7a5446c23985a7dd3a9cb4856481b94931db
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Jan 11 14:48:45 2017 +0100

script/autobuild.py: export PYTHONUNBUFFERED=1

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit f9e188747753225e77f254fe41aad95ff11fec53
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Jan 11 14:42:08 2017 +0100

script/autobuild.py: cleanup the task subdirs when they're done.

This hopefully reduces the used space on the memdisk.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit b9199945e7c28f8e5603727896c2af295376dc5b
Author: Günther Deschner <***@samba.org>
Date: Mon Nov 21 12:46:02 2016 +0100

s3-spoolss: globally set print server environment/architecture.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 92fc6a6c254703b771dec0b56b598c2684b4278a
Author: Günther Deschner <***@samba.org>
Date: Mon Nov 21 11:29:56 2016 +0100

s3-spoolss: make us appear as a 64bit print server.

This makes us behave like all recent windows systems.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 0e7302dd1078d0743d90ff719184d832ebe486cb
Author: Günther Deschner <***@samba.org>
Date: Wed Jan 4 16:08:59 2017 +0100

spoolss: Fix PROCESSOR_AMD_X8664 value in IDL

Microsoft got their docs wrong in MS-RPRN Section 2.2.1.10.1 (footnote
65): PROCESSOR_AMD_X8664 must be 0x000021D8 and not 0x000022A0.

This is what recent windows versions report back from a spoolss
getprinter level 0 RPC call.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit d6a9377b6d96ee0b6c75f15fe4ab81a3cb5e864f
Author: Günther Deschner <***@samba.org>
Date: Fri Nov 18 18:21:39 2016 +0100

s3-spoolss: Use a more accurate DefaultSpoolDirectory

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 03a4741bc768351334c92c8c7ddb0a4e84260c19
Author: Günther Deschner <***@samba.org>
Date: Fri Nov 11 16:35:03 2016 +0100

spoolss: allow truncated driver version in spoolss_driver_version_to_qword()

This has been seen in real life Konica driver defintions.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 34218e0448bca3fda9661c67f18bbd0b9886d079
Author: Andreas Schneider <***@samba.org>
Date: Tue Jan 10 18:25:22 2017 +0100

s3-spoolss: Fix architecture handling in spoolss_DeletePrinterDriverEx call

Pair-Programmed-With: Guenther Deschner <***@samba.org>
Signed-off-by: Andreas Schneider <***@samba.org>
Signed-off-by: Guenther Deschner <***@samba.org>

commit 06e4d1c174b27f001ece0d57abed3e472674b2e4
Author: Günther Deschner <***@samba.org>
Date: Tue Jan 10 18:23:14 2017 +0100

s4-torture: cleanup after printing tests that had to add a driver

We were only removing drivers from the upload area but did not delete
them via spoolss.

Guenther

Pair-Programmed-With: Andreas Schneider <***@samba.org>
Signed-off-by: Guenther Deschner <***@samba.org>
Signed-off-by: Andreas Schneider <***@samba.org>

commit 39489a8ca958ad6ffc9d299486e7bff36c296adf
Author: Andreas Schneider <***@samba.org>
Date: Tue Jan 10 18:20:18 2017 +0100

s4-torture: cleanup architecture handling in spoolss driver tests.

Make sure the architecture field of the driver8 definition is always set
to the local environment (the one of the driver to be uploaded and
tested)

Pair-Programmed-With: Guenther Deschner <***@samba.org>
Signed-off-by: Andreas Schneider <***@samba.org>
Signed-off-by: Guenther Deschner <***@samba.org>

commit 14d65fbc77cd504237fe924f4c7e63bd47fa3e9f
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Jan 11 08:14:49 2017 +0100

script/autobuild.py: use --enable-developer and --picky-developer for the ctdb build

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Martin Schwenke <***@meltin.net>

commit f981e2c9801cab2fbbf8017cd72a9c4987195f10
Author: Andreas Schneider <***@samba.org>
Date: Thu Dec 22 13:50:05 2016 +0100

credentials: Create a smb_gss_krb5_copy_ccache() function

This sets the default principal on the copied ccache if it hasn't been
set yet.

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 72fe43f218f712c6807126b62550472500cd37b4
Author: Andreas Schneider <***@samba.org>
Date: Thu Dec 15 17:51:24 2016 +0100

mit-kdb: Remove unneeded memset()

The memory has been allocated with calloc() already.

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit adcb8a91971f12b4a97bca2e5cd88ee23aa15355
Author: Andreas Schneider <***@samba.org>
Date: Thu Dec 15 17:50:53 2016 +0100

mit-kdb: Use calloc() to allocate memory

This avoids a memset().

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit e467eefb10a1ce80128e3b111a474306a71d696b
Author: Andreas Schneider <***@samba.org>
Date: Wed Dec 14 17:26:11 2016 +0100

gensec: Cast data for MIT Kerberos correctly

In Heimdal the data pointer is a void pointer so casting to 'char *' is
not an issue.

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 9b263c5778438a18e9277c0dd8c655bc4b3f036f
Author: Andreas Schneider <***@samba.org>
Date: Wed Dec 14 17:22:28 2016 +0100

gensec: Fix picky developer with MIT Kerberos

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit ecec8bb8d575d9ca5df604621033ec3d285f8ece
Author: Karolin Seeger <***@samba.org>
Date: Thu Jan 12 09:01:54 2017 +0100

docs: Bump version up to 4.7.

Signed-off-by: Karolin Seeger <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 5d9eb27c8f995da380bae7c8a11580aadae96b7f
Author: Karolin Seeger <***@samba.org>
Date: Thu Jan 12 08:59:06 2017 +0100

WHATSNEW: Start release notes for Samba 4.7.0pre1.

Signed-off-by: Karolin Seeger <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
WHATSNEW.txt | 167 +-------------------------
auth/credentials/credentials_krb5.c | 133 +++++++++++++++++++-
auth/gensec/external.c | 54 ++++++++-
auth/gensec/ncalrpc.c | 79 +++++++++++-
auth/gensec/schannel.c | 73 ++++++++++-
auth/gensec/wscript_build | 5 +-
docs-xml/manpages/cifsdd.8.xml | 2 +-
docs-xml/manpages/dbwrap_tool.1.xml | 2 +-
docs-xml/manpages/eventlogadm.8.xml | 2 +-
docs-xml/manpages/findsmb.1.xml | 2 +-
docs-xml/manpages/idmap_ad.8.xml | 2 +-
docs-xml/manpages/idmap_autorid.8.xml | 2 +-
docs-xml/manpages/idmap_hash.8.xml | 2 +-
docs-xml/manpages/idmap_ldap.8.xml | 2 +-
docs-xml/manpages/idmap_nss.8.xml | 2 +-
docs-xml/manpages/idmap_rfc2307.8.xml | 2 +-
docs-xml/manpages/idmap_rid.8.xml | 2 +-
docs-xml/manpages/idmap_script.8.xml | 2 +-
docs-xml/manpages/idmap_tdb.8.xml | 2 +-
docs-xml/manpages/idmap_tdb2.8.xml | 2 +-
docs-xml/manpages/libsmbclient.7.xml | 2 +-
docs-xml/manpages/lmhosts.5.xml | 2 +-
docs-xml/manpages/log2pcap.1.xml | 2 +-
docs-xml/manpages/net.8.xml | 2 +-
docs-xml/manpages/nmbd.8.xml | 2 +-
docs-xml/manpages/nmblookup.1.xml | 2 +-
docs-xml/manpages/ntlm_auth.1.xml | 2 +-
docs-xml/manpages/pam_winbind.8.xml | 2 +-
docs-xml/manpages/pam_winbind.conf.5.xml | 2 +-
docs-xml/manpages/pdbedit.8.xml | 2 +-
docs-xml/manpages/profiles.1.xml | 2 +-
docs-xml/manpages/rpcclient.1.xml | 2 +-
docs-xml/manpages/samba-regedit.8.xml | 2 +-
docs-xml/manpages/samba-tool.8.xml | 2 +-
docs-xml/manpages/samba.7.xml | 2 +-
docs-xml/manpages/samba.8.xml | 2 +-
docs-xml/manpages/sharesec.1.xml | 2 +-
docs-xml/manpages/smb.conf.5.xml | 2 +-
docs-xml/manpages/smbcacls.1.xml | 2 +-
docs-xml/manpages/smbclient.1.xml | 2 +-
docs-xml/manpages/smbcontrol.1.xml | 2 +-
docs-xml/manpages/smbcquotas.1.xml | 2 +-
docs-xml/manpages/smbd.8.xml | 2 +-
docs-xml/manpages/smbget.1.xml | 2 +-
docs-xml/manpages/smbgetrc.5.xml | 2 +-
docs-xml/manpages/smbpasswd.5.xml | 2 +-
docs-xml/manpages/smbpasswd.8.xml | 2 +-
docs-xml/manpages/smbspool.8.xml | 2 +-
docs-xml/manpages/smbspool_krb5_wrapper.8.xml | 2 +-
docs-xml/manpages/smbstatus.1.xml | 2 +-
docs-xml/manpages/smbtar.1.xml | 2 +-
docs-xml/manpages/smbtree.1.xml | 2 +-
docs-xml/manpages/testparm.1.xml | 2 +-
docs-xml/manpages/vfs_acl_tdb.8.xml | 2 +-
docs-xml/manpages/vfs_acl_xattr.8.xml | 2 +-
docs-xml/manpages/vfs_aio_fork.8.xml | 2 +-
docs-xml/manpages/vfs_aio_linux.8.xml | 2 +-
docs-xml/manpages/vfs_aio_pthread.8.xml | 2 +-
docs-xml/manpages/vfs_audit.8.xml | 2 +-
docs-xml/manpages/vfs_btrfs.8.xml | 2 +-
docs-xml/manpages/vfs_cacheprime.8.xml | 2 +-
docs-xml/manpages/vfs_cap.8.xml | 2 +-
docs-xml/manpages/vfs_catia.8.xml | 2 +-
docs-xml/manpages/vfs_ceph.8.xml | 2 +-
docs-xml/manpages/vfs_commit.8.xml | 2 +-
docs-xml/manpages/vfs_crossrename.8.xml | 2 +-
docs-xml/manpages/vfs_default_quota.8.xml | 2 +-
docs-xml/manpages/vfs_dirsort.8.xml | 2 +-
docs-xml/manpages/vfs_extd_audit.8.xml | 2 +-
docs-xml/manpages/vfs_fake_perms.8.xml | 2 +-
docs-xml/manpages/vfs_fileid.8.xml | 2 +-
docs-xml/manpages/vfs_fruit.8.xml | 2 +-
docs-xml/manpages/vfs_full_audit.8.xml | 2 +-
docs-xml/manpages/vfs_glusterfs.8.xml | 2 +-
docs-xml/manpages/vfs_gpfs.8.xml | 2 +-
docs-xml/manpages/vfs_linux_xfs_sgid.8.xml | 2 +-
docs-xml/manpages/vfs_media_harmony.8.xml | 2 +-
docs-xml/manpages/vfs_netatalk.8.xml | 2 +-
docs-xml/manpages/vfs_offline.8.xml | 2 +-
docs-xml/manpages/vfs_prealloc.8.xml | 2 +-
docs-xml/manpages/vfs_preopen.8.xml | 2 +-
docs-xml/manpages/vfs_readahead.8.xml | 2 +-
docs-xml/manpages/vfs_readonly.8.xml | 2 +-
docs-xml/manpages/vfs_recycle.8.xml | 2 +-
docs-xml/manpages/vfs_shadow_copy.8.xml | 2 +-
docs-xml/manpages/vfs_shadow_copy2.8.xml | 2 +-
docs-xml/manpages/vfs_shell_snap.8.xml | 2 +-
docs-xml/manpages/vfs_snapper.8.xml | 2 +-
docs-xml/manpages/vfs_streams_depot.8.xml | 2 +-
docs-xml/manpages/vfs_streams_xattr.8.xml | 2 +-
docs-xml/manpages/vfs_syncops.8.xml | 2 +-
docs-xml/manpages/vfs_time_audit.8.xml | 2 +-
docs-xml/manpages/vfs_tsmsm.8.xml | 2 +-
docs-xml/manpages/vfs_unityed_media.8.xml | 2 +-
docs-xml/manpages/vfs_worm.8.xml | 2 +-
docs-xml/manpages/vfs_xattr_tdb.8.xml | 2 +-
docs-xml/manpages/vfs_zfsacl.8.xml | 2 +-
docs-xml/manpages/vfstest.1.xml | 2 +-
docs-xml/manpages/wbinfo.1.xml | 2 +-
docs-xml/manpages/winbind_krb5_locator.7.xml | 2 +-
docs-xml/manpages/winbindd.8.xml | 2 +-
lib/talloc/talloc.c | 3 -
librpc/idl/spoolss.idl | 10 +-
script/autobuild.py | 59 +++++----
source3/printing/nt_printing.c | 41 ++++---
source3/rpc_client/init_spoolss.c | 6 +-
source3/rpc_server/spoolss/srv_spoolss_nt.c | 28 ++++-
source4/auth/gensec/gensec_krb5.c | 14 +--
source4/kdc/mit-kdb/kdb_samba_principals.c | 6 +-
source4/torture/rpc/spoolss.c | 116 +++++++++++-------
110 files changed, 590 insertions(+), 394 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index a521813..761f73f 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,190 +1,27 @@
Release Announcements
=====================

-This is the first preview release of Samba 4.6. This is *not*
+This is the first preview release of Samba 4.7. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.

-Samba 4.6 will be the next version of the Samba suite.
+Samba 4.7 will be the next version of the Samba suite.


UPGRADING
=========

-vfs_fruit option "fruit:resource" spelling correction
------------------------------------------------------
-
-Due to a spelling error in the vfs_fruit option parsing for the "fruit:resource"
-option, users who have set this option in their smb.conf were still using the
-default setting "fruit:resource = file" as the parser was looking for the string
-"fruit:ressource" (two "s").
-
-After upgrading to this Samba version 4.6, you MUST either remove the option
-from your smb.conf or set it to the default "fruit:resource = file", otherwise
-your macOS clients will not be able to access the resource fork data.
-
-This version Samba 4.6 accepts both the correct and incorrect spelling, but the
-next Samba version 4.7 will not accept the wrong spelling.
-
-Users who were using the wrong spelling "ressource" with two "s" can keep the
-setting, but are advised to switch to the correct spelling.
-
-ID Mapping
-----------
-We discovered that the majority of users have an invalid or incorrect
-ID mapping configuration. We implemented checks in the 'testparm' tool to
-validate the ID mapping configuration. You should run it and check if it prints
-any warnings or errors after upgrading! If it does you should fix them. See the
-'IDENTITY MAPPING CONSIDERATIONS' section in the smb.conf manpage.
-There are some ID mapping backends which are not allowed to be used for the
-default backend. Winbind will no longer start if an invalid backend is
-configured as the default backend.
-
-To avoid problems in future we advise all users to run 'testparm' after
-changing the smb.conf file!
-

NEW FEATURES/CHANGES
====================

-Kerberos client encryption types
---------------------------------
-Some parts of Samba (most notably winbindd) perform Kerberos client
-operations based on a Samba-generated krb5.conf file. A new
-parameter, "kerberos encryption types" allows configuring the
-encryption types set in this file, thereby allowing the user to
-enforce strong or legacy encryption in Kerberos exchanges.
-
-The default value of "all" is compatible with previous behavior, allowing
-all encryption algorithms to be negotiated. Setting the parameter to "strong"
-only allows AES-based algorithms to be negotiated. Setting the parameter to
-"legacy" allows only RC4-HMAC-MD5 - the legacy algorithm for Active Directory.
-This can solves some corner cases of mixed environments with Server 2003R2 and
-newer DCs.
-
-Printing
---------
-Support for uploading printer drivers from newer Windows clients (Windows 10)
-has been added until our implementation of [MS-PAR] protocol is ready.
-Several issues with uploading different printing drivers have been addressed.
-
-The OS Version for the printing server has been increased to announce
-Windows Server 2003 R2 SP2. If a driver needs a newer version then you should
-check the smb.conf manpage for details.
-
-new option for owner inheritance
---------------------------------
-The "inherit owner" smb.conf parameter instructs smbd to set the
-owner of files to be the same as the parent directory's owner.
-Up until now, this parameter could be set to "yes" or "no".
-A new option, "unix only", enables this feature only for the UNIX owner
-of the file, not affecting the SID owner in the Windows NT ACL of the
-file. This can be used to emulate something very similar to folder quotas.
-
-Multi-process Netlogon support
-------------------------------
-
-The Netlogon server in the Samba AD DC can now run as multiple
-processes. The Netlogon server is a part of the AD DC that handles
-NTLM authentication on behalf of domain members, including file
-servers, NTLM-authenticated web servers and 802.1x gateways. The
-previous restriction to running as a single process has been removed,
-and it will now run in the same process model as the rest of the
-'samba' binary.
-
-As part of this change, the NETLOGON service will now run on a distinct
-TCP port, rather than being shared with all other RPC services (LSA,
-SAMR, DRSUAPI etc).
-
-new options for controlling TCP ports used for RPC services
------------------------------------------------------------
-
-The new 'rpc server port' option controls the default port used for
-RPC services other than Netlogon. The Netlogon server honors instead
-the 'rpc server port:netlogon' option. The default value for both
-these options is the first available port including or after 1024.
-
-Improve AD performance and replication improvements
----------------------------------------------------
-
-Samba's LDB and replication code continues to improve, particularly in
-respect to the handling of large numbers of linked attributes. We now
-respect an 'uptodateness vector' which will dramatically reduce the
-over-replication of links from new DCs. We have also made the parsing
-of on-disk linked attributes much more efficient.
-
-DNS improvements
-----------------
-
-The samba-tool dns subcommand is now much more robust and can delete
-records in a number of situations where it was not possible to do so
-in the past.
-
-On the server side, DNS names are now more strictly validated.
-
-CTDB changes
-------------
-
-* "ctdb event" is a new top-level command for interacting with event scripts
-
- "ctdb event status" replaces "ctdb scriptstatus" - the latter is
- maintained for backward compatibility but the output format has been
- cleaned up
-
- "ctdb event run" replaces "ctdb eventscript"
-
- "ctdb event script enable" replaces "ctdb enablescript"
-
- "ctdb event script disable" replaces "ctdb disablescript"
-
- The new command "ctdb event script list" lists event scripts.
-
-* CTDB's back-end for running event scripts has been replaced by a
- separate, long-running daemon ctdbd_eventd.
-
-* Running ctdb interactively will log to stderr
-
-* CTDB logs now include process id for each process
-
-* CTDB tags log messages differently. Changes include:
-
- ctdb-recoverd: Messages from CTDB's recovery daemon
- ctdb-recovery: Messages from CTDB database recovery
- ctdb-eventd: Messages from CTDB's event daemon
- ctdb-takeover: Messgaes from CTDB's public IP takeover subsystem
-
-* The mapping between symbolic and numeric debug levels has changed
-
- Configurations containing numeric debug levels should be updated.
- Symbolic debug levels are recommended. See the DEBUG LEVEL section
- of ctdb(7) for details.
-
-* Tunable IPAllocAlgorithm replaces LCP2PublicIPs, DeterministicIPs
-
- See ctdb-tunables(7) for details
-
-* CTDB's configuration tunables should be consistently set across a cluster
-
- This has always been the cases for most tunables but this fact is
- now documented.
-
-* CTDB ships with recovery lock helper call-outs for etcd and Ceph RADOS
-
- To build/install these, use the --enable-etcd-reclock and
- --enable-ceph-reclock configure options.
-

smb.conf changes
================

Parameter Name Description Default
-------------- ----------- -------
- kerberos encryption types New all
- inherit owner New option
- fruit:resource Spelling correction
- lsa over netlogon New (deprecated) no
- rpc server port New 0


KNOWN ISSUES
diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index a0346a2..3663e1d 100644
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -63,6 +63,130 @@ static int free_dccache(struct ccache_container *ccc)
return 0;
}

+static uint32_t smb_gss_krb5_copy_ccache(uint32_t *min_stat,
+ gss_cred_id_t cred,
+ struct ccache_container *ccc)
+{
+#ifndef SAMBA4_USES_HEIMDAL /* MIT 1.10 */
+ krb5_context context = ccc->smb_krb5_context->krb5_context;
+ krb5_ccache dummy_ccache = NULL;
+ krb5_creds creds = {0};
+ krb5_cc_cursor cursor = NULL;
+ krb5_principal princ = NULL;
+ krb5_error_code code;
+ char *dummy_name;
+ uint32_t maj_stat = GSS_S_FAILURE;
+
+ dummy_name = talloc_asprintf(ccc,
+ "MEMORY:gss_krb5_copy_ccache-%p",
+ &ccc->ccache);
+ if (dummy_name == NULL) {
+ *min_stat = ENOMEM;
+ return GSS_S_FAILURE;
+ }
+
+ /*
+ * Create a dummy ccache, so we can iterate over the credentials
+ * and find the default principal for the ccache we want to
+ * copy. The new ccache needs to be initialized with this
+ * principal.
+ */
+ code = krb5_cc_resolve(context, dummy_name, &dummy_ccache);
+ TALLOC_FREE(dummy_name);
+ if (code != 0) {
+ *min_stat = code;
+ return GSS_S_FAILURE;
+ }
+
+ /*
+ * We do not need set a default principal on the temporary dummy
+ * ccache, as we do consume it at all in this function.
+ */
+ maj_stat = gss_krb5_copy_ccache(min_stat, cred, dummy_ccache);
+ if (maj_stat != 0) {
+ krb5_cc_close(context, dummy_ccache);
+ return maj_stat;
+ }
+
+ code = krb5_cc_start_seq_get(context, dummy_ccache, &cursor);
+ if (code != 0) {
+ krb5_cc_close(context, dummy_ccache);
+ *min_stat = EINVAL;
+ return GSS_S_FAILURE;
+ }
+
+ code = krb5_cc_next_cred(context,
+ dummy_ccache,
+ &cursor,
+ &creds);
+ if (code != 0) {
+ krb5_cc_close(context, dummy_ccache);
+ *min_stat = EINVAL;
+ return GSS_S_FAILURE;
+ }
+
+ do {
+ if (creds.ticket_flags & TKT_FLG_PRE_AUTH) {
+ krb5_data *tgs;
+
+ tgs = krb5_princ_component(context,
+ creds.server,
+ 0);
+ if (tgs != NULL && tgs->length >= 1) {
+ int cmp;
+
+ cmp = memcmp(tgs->data,
+ KRB5_TGS_NAME,
+ tgs->length);
+ if (cmp == 0 && creds.client != NULL) {
+ princ = creds.client;
+ code = KRB5_CC_END;
+ break;
+ }
+ }
+ }
+
+ krb5_free_cred_contents(context, &creds);
+
+ code = krb5_cc_next_cred(context,
+ dummy_ccache,
+ &cursor,
+ &creds);
+ } while (code == 0);
+
+ if (code == KRB5_CC_END) {
+ krb5_cc_end_seq_get(context, dummy_ccache, &cursor);
+ code = 0;
+ }
+ krb5_cc_close(context, dummy_ccache);
+
+ if (code != 0 || princ == NULL) {
+ krb5_free_cred_contents(context, &creds);
+ *min_stat = EINVAL;
+ return GSS_S_FAILURE;
+ }
+
+ /*
+ * Set the default principal for the cache we copy
+ * into. This is needed to be able that other calls
+ * can read it with e.g. gss_acquire_cred() or
+ * krb5_cc_get_principal().
+ */
+ code = krb5_cc_initialize(context, ccc->ccache, princ);
+ if (code != 0) {
+ krb5_free_cred_contents(context, &creds);
+ *min_stat = EINVAL;
+ return GSS_S_FAILURE;
+ }
+ krb5_free_cred_contents(context, &creds);
+
+#endif /* SAMBA4_USES_HEIMDAL */
+
+ return gss_krb5_copy_ccache(min_stat,
+ cred,
+ ccc->ccache);
+}
+
_PUBLIC_ int cli_credentials_get_krb5_context(struct cli_credentials *cred,
struct loadparm_context *lp_ctx,
struct smb_krb5_context **smb_krb5_context)
@@ -712,8 +836,8 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
{
int ret;
OM_uint32 maj_stat, min_stat;
- struct ccache_container *ccc;
- struct gssapi_creds_container *gcc;
+ struct ccache_container *ccc = NULL;
+ struct gssapi_creds_container *gcc = NULL;
if (cred->client_gss_creds_obtained > obtained) {
return 0;
}
@@ -729,8 +853,9 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
return ret;
}

- maj_stat = gss_krb5_copy_ccache(&min_stat,
- gssapi_cred, ccc->ccache);
+ maj_stat = smb_gss_krb5_copy_ccache(&min_stat,
+ gssapi_cred,
+ ccc);
if (maj_stat) {
if (min_stat) {
ret = min_stat;
diff --git a/auth/gensec/external.c b/auth/gensec/external.c
index a26e435..9c17888 100644
--- a/auth/gensec/external.c
+++ b/auth/gensec/external.c
@@ -20,6 +20,8 @@
*/

#include "includes.h"
+#include <tevent.h>
+#include "lib/util/tevent_ntstatus.h"
#include "auth/credentials/credentials.h"
#include "auth/gensec/gensec.h"
#include "auth/gensec/gensec_internal.h"
@@ -42,12 +44,51 @@ static NTSTATUS gensec_external_start(struct gensec_security *gensec_security)
return NT_STATUS_OK;
}

-static NTSTATUS gensec_external_update(struct gensec_security *gensec_security,
- TALLOC_CTX *out_mem_ctx,
- struct tevent_context *ev,
- const DATA_BLOB in, DATA_BLOB *out)
+struct gensec_external_update_state {
+ DATA_BLOB out;
+};
+
+static struct tevent_req *gensec_external_update_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct gensec_security *gensec_security,
+ const DATA_BLOB in)
+{
+ struct tevent_req *req;
+ struct gensec_external_update_state *state = NULL;
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct gensec_external_update_state);
+ if (req == NULL) {
+ return NULL;
+ }
+
+ state->out = data_blob_talloc(state, "", 0);
+ if (tevent_req_nomem(state->out.data, req)) {
+ return tevent_req_post(req, ev);
+ }
+
+ tevent_req_done(req);
+ return tevent_req_post(req, ev);
+}
+
+static NTSTATUS gensec_external_update_recv(struct tevent_req *req,
+ TALLOC_CTX *out_mem_ctx,
+ DATA_BLOB *out)
{
- *out = data_blob_talloc(out_mem_ctx, "", 0);
+ struct gensec_external_update_state *state =
+ tevent_req_data(req,
+ struct gensec_external_update_state);
+ NTSTATUS status;
+
+ *out = data_blob_null;
+
+ if (tevent_req_is_nterror(req, &status)) {
+ tevent_req_received(req);
+ return status;
+ }
+
+ *out = state->out;
+ tevent_req_received(req);
return NT_STATUS_OK;
}

@@ -62,7 +103,8 @@ static const struct gensec_security_ops gensec_external_ops = {
.name = "sasl-EXTERNAL",
.sasl_name = "EXTERNAL",
.client_start = gensec_external_start,
- .update = gensec_external_update,
+ .update_send = gensec_external_update_send,
+ .update_recv = gensec_external_update_recv,
.have_feature = gensec_external_have_feature,
.enabled = true,
.priority = GENSEC_EXTERNAL
diff --git a/auth/gensec/ncalrpc.c b/auth/gensec/ncalrpc.c
index d5537a4..e6f33f3 100644
--- a/auth/gensec/ncalrpc.c
+++ b/auth/gensec/ncalrpc.c
@@ -21,6 +21,8 @@
*/

#include "includes.h"
+#include <tevent.h>
+#include "lib/util/tevent_ntstatus.h"
#include "auth/auth.h"
#include "auth/gensec/gensec.h"
#include "auth/gensec/gensec_internal.h"
@@ -71,11 +73,52 @@ static NTSTATUS gensec_ncalrpc_server_start(struct gensec_security *gensec_secur
return NT_STATUS_OK;
}

-static NTSTATUS gensec_ncalrpc_update(struct gensec_security *gensec_security,
- TALLOC_CTX *mem_ctx,
- struct tevent_context *ev,
- const DATA_BLOB in,
- DATA_BLOB *out)
+struct gensec_ncalrpc_update_state {
+ NTSTATUS status;
+ DATA_BLOB out;
+};
+
+static NTSTATUS gensec_ncalrpc_update_internal(
+ struct gensec_security *gensec_security,
+ TALLOC_CTX *mem_ctx,
+ const DATA_BLOB in,
+ DATA_BLOB *out);
+
+static struct tevent_req *gensec_ncalrpc_update_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct gensec_security *gensec_security,
+ const DATA_BLOB in)
+{
+ struct tevent_req *req;
+ struct gensec_ncalrpc_update_state *state = NULL;
+ NTSTATUS status;
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct gensec_ncalrpc_update_state);
+ if (req == NULL) {
+ return NULL;
+ }
+
+ status = gensec_ncalrpc_update_internal(gensec_security,
+ state, in,
+ &state->out);
+ state->status = status;
+ if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ status = NT_STATUS_OK;
+ }
+ if (tevent_req_nterror(req, status)) {
+ return tevent_req_post(req, ev);
+ }
+
+ tevent_req_done(req);
+ return tevent_req_post(req, ev);
+}
+
+static NTSTATUS gensec_ncalrpc_update_internal(
+ struct gensec_security *gensec_security,
--
Samba Shared Repository
Martin Schwenke
2017-01-12 22:12:04 UTC
Permalink
The branch, master has been updated
via 4d8cba6 ctdb-tests: Add takeover helper tests with banned/disconnected nodes
via a5b1872 ctdb-takeover: Handle case where there are no RELEASE_IPs to send
via b7cfac7 ctdb-takeover: Known and available IP lists should be the same size as nodemap
from d35ff9e lib: talloc: Make it clear that talloc_get_size(NULL) returns 0.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 4d8cba6f5db1851a738d74030b6b6a118c535c45
Author: Martin Schwenke <***@meltin.net>
Date: Wed Jan 11 19:20:08 2017 +1100

ctdb-tests: Add takeover helper tests with banned/disconnected nodes

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12511

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

Autobuild-User(master): Martin Schwenke <***@samba.org>
Autobuild-Date(master): Thu Jan 12 23:11:28 CET 2017 on sn-devel-144

commit a5b187202fa13661aec14cb9e4cbb3b93d4c33f6
Author: Martin Schwenke <***@meltin.net>
Date: Thu Jan 12 06:52:32 2017 +1100

ctdb-takeover: Handle case where there are no RELEASE_IPs to send

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12511

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit b7cfac778e8813b22d29859102bab1598cdb5ff0
Author: Amitay Isaacs <***@gmail.com>
Date: Wed Jan 11 16:49:33 2017 +1100

ctdb-takeover: Known and available IP lists should be the same size as nodemap

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12511

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

-----------------------------------------------------------------------

Summary of changes:
ctdb/server/ctdb_takeover_helper.c | 23 ++++++++++++++++++-----
ctdb/tests/takeover_helper/{010.sh => 027.sh} | 10 +++++-----
ctdb/tests/takeover_helper/{010.sh => 028.sh} | 10 +++++-----
3 files changed, 28 insertions(+), 15 deletions(-)
copy ctdb/tests/takeover_helper/{010.sh => 027.sh} (72%)
copy ctdb/tests/takeover_helper/{010.sh => 028.sh} (72%)


Changeset truncated at 500 lines:

diff --git a/ctdb/server/ctdb_takeover_helper.c b/ctdb/server/ctdb_takeover_helper.c
index f83b914..5f537c4 100644
--- a/ctdb/server/ctdb_takeover_helper.c
+++ b/ctdb/server/ctdb_takeover_helper.c
@@ -91,7 +91,7 @@ struct get_public_ips_state {
struct tevent_context *ev;
struct ctdb_client_context *client;
uint32_t *pnns;
- int count;
+ int count, num_nodes;
struct ctdb_public_ip_list *ips;
};

@@ -102,7 +102,7 @@ static struct tevent_req *get_public_ips_send(
struct tevent_context *ev,
struct ctdb_client_context *client,
uint32_t *pnns,
- int count,
+ int count, int num_nodes,
bool available_only)
{
struct tevent_req *req, *subreq;
@@ -116,6 +116,7 @@ static struct tevent_req *get_public_ips_send(

state->pnns = pnns;
state->count = count;
+ state->num_nodes = num_nodes;
state->ips = NULL;

ctdb_req_control_get_public_ips(&request, available_only);
@@ -164,7 +165,7 @@ static void get_public_ips_done(struct tevent_req *subreq)
}

state->ips = talloc_zero_array(state, struct ctdb_public_ip_list,
- state->count);
+ state->num_nodes);
if (tevent_req_nomem(state->ips, req)) {
return;
}
@@ -294,6 +295,12 @@ static struct tevent_req *release_ip_send(TALLOC_CTX *mem_ctx,
}
}

+ if (substate->count == 0) {
+ /* No releases to send for this address... */
+ TALLOC_FREE(substate);
+ continue;
+ }
+
ip.pnn = tmp_ip->pnn;
ip.addr = tmp_ip->addr;
ctdb_req_control_release_ip(&request, &ip);
@@ -310,6 +317,12 @@ static struct tevent_req *release_ip_send(TALLOC_CTX *mem_ctx,
state->num_sent++;
}

+ /* None sent, finished... */
+ if (state->num_sent == 0) {
+ tevent_req_done(req);
+ return tevent_req_post(req, ev);
+ }
+
return req;
}

@@ -832,7 +845,7 @@ static void takeover_nodemap_done(struct tevent_req *subreq)

subreq = get_public_ips_send(state, state->ev, state->client,
state->pnns_active, state->num_active,
- false);
+ state->num_nodes, false);
if (tevent_req_nomem(subreq, req)) {
return;
}
@@ -860,7 +873,7 @@ static void takeover_known_ips_done(struct tevent_req *subreq)

subreq = get_public_ips_send(state, state->ev, state->client,
state->pnns_active, state->num_active,
- true);
+ state->num_nodes, true);
if (tevent_req_nomem(subreq, req)) {
return;
}
diff --git a/ctdb/tests/takeover_helper/010.sh b/ctdb/tests/takeover_helper/027.sh
similarity index 72%
copy from ctdb/tests/takeover_helper/010.sh
copy to ctdb/tests/takeover_helper/027.sh
index 1275156..1c36d87 100755
--- a/ctdb/tests/takeover_helper/010.sh
+++ b/ctdb/tests/takeover_helper/027.sh
@@ -2,13 +2,13 @@

. "${TEST_SCRIPTS_DIR}/unit.sh"

-define_test "3 nodes, all ok, IPs all unassigned"
+define_test "3 nodes, 2 banned, IPs all unassigned"

setup_ctdbd <<EOF
NODEMAP
0 192.168.20.41 0x0 CURRENT RECMASTER
-1 192.168.20.42 0x0
-2 192.168.20.43 0x0
+1 192.168.20.42 0x8
+2 192.168.20.43 0x8

IFACES
:Name:LinkStatus:References:
@@ -26,8 +26,8 @@ test_takeover_helper

required_result 0 <<EOF
Public IPs on ALL nodes
-10.0.0.31 2
-10.0.0.32 1
+10.0.0.31 0
+10.0.0.32 0
10.0.0.33 0
EOF
test_ctdb_ip_all
diff --git a/ctdb/tests/takeover_helper/010.sh b/ctdb/tests/takeover_helper/028.sh
similarity index 72%
copy from ctdb/tests/takeover_helper/010.sh
copy to ctdb/tests/takeover_helper/028.sh
index 1275156..a69cd47 100755
--- a/ctdb/tests/takeover_helper/010.sh
+++ b/ctdb/tests/takeover_helper/028.sh
@@ -2,13 +2,13 @@

. "${TEST_SCRIPTS_DIR}/unit.sh"

-define_test "3 nodes, all ok, IPs all unassigned"
+define_test "3 nodes, 2 banned, IPs all unassigned"

setup_ctdbd <<EOF
NODEMAP
0 192.168.20.41 0x0 CURRENT RECMASTER
-1 192.168.20.42 0x0
-2 192.168.20.43 0x0
+1 192.168.20.42 0x1
+2 192.168.20.43 0x1

IFACES
:Name:LinkStatus:References:
@@ -26,8 +26,8 @@ test_takeover_helper

required_result 0 <<EOF
Public IPs on ALL nodes
-10.0.0.31 2
-10.0.0.32 1
+10.0.0.31 0
+10.0.0.32 0
10.0.0.33 0
EOF
test_ctdb_ip_all
--
Samba Shared Repository
Andreas Schneider
2017-01-13 12:34:03 UTC
Permalink
The branch, master has been updated
via e1874bb winbind: Fix CID 1398534 Dereference before null check
from 4d8cba6 ctdb-tests: Add takeover helper tests with banned/disconnected nodes

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit e1874bbf26eaa162cd6a5f11d96c564a983c9893
Author: Jeremy Allison <***@samba.org>
Date: Wed Jan 11 11:52:44 2017 -0800

winbind: Fix CID 1398534 Dereference before null check

Make all query_user_list backends consistent.

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Andreas Schneider <***@cryptomilk.org>
Autobuild-Date(master): Fri Jan 13 13:33:37 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
source3/winbindd/winbindd_ads.c | 8 ++++----
source3/winbindd/winbindd_samr.c | 6 ++----
2 files changed, 6 insertions(+), 8 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/winbindd/winbindd_ads.c b/source3/winbindd/winbindd_ads.c
index b14f21e..077c6ec 100644
--- a/source3/winbindd/winbindd_ads.c
+++ b/source3/winbindd/winbindd_ads.c
@@ -293,14 +293,12 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain,
ADS_STRUCT *ads = NULL;
const char *attrs[] = { "sAMAccountType", "objectSid", NULL };
int count;
- uint32_t *rids;
+ uint32_t *rids = NULL;
ADS_STATUS rc;
LDAPMessage *res = NULL;
LDAPMessage *msg = NULL;
NTSTATUS status = NT_STATUS_UNSUCCESSFUL;

- *prids = NULL;
-
DEBUG(3,("ads: query_user_list\n"));

if ( !winbindd_can_contact_domain( domain ) ) {
@@ -375,7 +373,9 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain,
}

rids = talloc_realloc(mem_ctx, rids, uint32_t, count);
- *prids = rids;
+ if (prids != NULL) {
+ *prids = rids;
+ }

status = NT_STATUS_OK;

diff --git a/source3/winbindd/winbindd_samr.c b/source3/winbindd/winbindd_samr.c
index 224f105..1a73fc4 100644
--- a/source3/winbindd/winbindd_samr.c
+++ b/source3/winbindd/winbindd_samr.c
@@ -169,15 +169,13 @@ static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
{
struct rpc_pipe_client *samr_pipe = NULL;
struct policy_handle dom_pol = { 0 };
- uint32_t *rids;
+ uint32_t *rids = NULL;
TALLOC_CTX *tmp_ctx;
NTSTATUS status, result;
struct dcerpc_binding_handle *b = NULL;

DEBUG(3,("samr_query_user_list\n"));

- *prids = NULL;
-
tmp_ctx = talloc_stackframe();
if (tmp_ctx == NULL) {
return NT_STATUS_NO_MEMORY;
@@ -199,7 +197,7 @@ static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
goto done;
}

- if (prids) {
+ if (prids != NULL) {
*prids = talloc_move(mem_ctx, &rids);
}
--
Samba Shared Repository
Martin Schwenke
2017-01-16 14:47:02 UTC
Permalink
The branch, master has been updated
via ff0d45c ctdb-tests: Fix name of the variable representing init script
via ec3415e ctdb-scripts: Drop configuration variable CTDB_SCRIPT_DEBUGLEVEL
via a987053 ctdb-scripts: Drop function ctdb_check_command()
via c8249df ctdb-scripts: Inline simple uses of service_start() and service_stop()
via e847ec3 ctdb-scripts: Remove ctdb_service_start() and ctdb_service_stop()
via a9e3b63 ctdb-scripts: Drop unnecessary function ctdb_check_tcp_init()
via 26b7841 ctdb-scripts: Simplify TCP port checking
via e70e773 ctdb-scripts: Drop configuration variable CTDB_SERVICE_AUTOSTARTSTOP
from e1874bb winbind: Fix CID 1398534 Dereference before null check

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit ff0d45c403d45e13bc07013a5ff47314f83dd647
Author: Amitay Isaacs <***@gmail.com>
Date: Mon Jan 16 20:54:59 2017 +1100

ctdb-tests: Fix name of the variable representing init script

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

Autobuild-User(master): Martin Schwenke <***@samba.org>
Autobuild-Date(master): Mon Jan 16 15:46:42 CET 2017 on sn-devel-144

commit ec3415e5830399d145422ceb35a44531d27ace98
Author: Martin Schwenke <***@meltin.net>
Date: Mon Jan 9 15:26:22 2017 +1100

ctdb-scripts: Drop configuration variable CTDB_SCRIPT_DEBUGLEVEL

The debug() function, which is the only user of this variable, is no
longer used. It is also dropped.

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit a9870538c9876072bcd4b5f9b907a256d8737249
Author: Martin Schwenke <***@meltin.net>
Date: Mon Jan 9 15:19:26 2017 +1100

ctdb-scripts: Drop function ctdb_check_command()

This is only used in 1 place, so just inline the check.

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit c8249dfa0e72ece7d816ecf822a78843deabfeaa
Author: Martin Schwenke <***@meltin.net>
Date: Sun Dec 18 07:59:03 2016 +1100

ctdb-scripts: Inline simple uses of service_start() and service_stop()

This makes the scripts more readable.

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit e847ec3ae24cc6c8c69284c7fe0791a319cf7142
Author: Martin Schwenke <***@meltin.net>
Date: Sun Dec 18 07:26:02 2016 +1100

ctdb-scripts: Remove ctdb_service_start() and ctdb_service_stop()

They contain too much unnecessary complexity, some of which was used
to support CTDB_SERVICE_AUTOSTARTSTOP.

Also removed unused functions for service management.

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit a9e3b6353892b7ffbe37740d8677274dfb70d62b
Author: Martin Schwenke <***@meltin.net>
Date: Sat Dec 17 22:48:57 2016 +1100

ctdb-scripts: Drop unnecessary function ctdb_check_tcp_init()

The flag this sets is no longer used by ctdb_check_tcp_ports()

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit 26b7841aa6e51dfd5330695f21acab620f7dbed4
Author: Martin Schwenke <***@meltin.net>
Date: Sat Dec 17 22:40:05 2016 +1100

ctdb-scripts: Simplify TCP port checking

Commit 86792724a2a911da9cd3e75622d35084c88eb8ce added complications on
top of the multiple TCP port checking methods that used to exist.
Life is simpler now and the cause of any failures is obvious. So just
print a simple message if the port check fails.

Tweak tests to match changes. Drop one test that becomes a duplicate.

Temporarily tweak ctdb_check_command() so that it passes shellcheck
tests. It will be removed anyway in a subsequent commit.

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit e70e77383ca0e1ea9ccbe3f7698f0c6e3ba3c889
Author: Martin Schwenke <***@meltin.net>
Date: Sun Dec 18 06:21:27 2016 +1100

ctdb-scripts: Drop configuration variable CTDB_SERVICE_AUTOSTARTSTOP

This has bit-rotted, at least for NFS. It can be fixed but it is
better to remove it because it adds a lot of unnecessary complexity.

Variable event_name becomes unused so remove it. Also remove
associated tests.

To continue to manage/unmanage services while CTDB is running:

* Start service by hand and then flag it as managed

* Mark service as unmanaged and shut it down by hand

In some cases CTDB does something fancy - e.g. start Samba under
"nice", so care is needed. One technique is to disable the
eventscript, mark as managed, run the startup event by hand and then
re-enable the eventscript.

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

-----------------------------------------------------------------------

Summary of changes:
ctdb/config/events.d/06.nfs | 2 -
ctdb/config/events.d/31.clamd | 17 +-
ctdb/config/events.d/40.vsftpd | 18 +-
ctdb/config/events.d/41.httpd | 7 +-
ctdb/config/events.d/49.winbind | 12 +-
ctdb/config/events.d/50.samba | 6 +-
ctdb/config/events.d/60.nfs | 2 -
ctdb/config/events.d/70.iscsi | 2 -
ctdb/config/functions | 215 +++-------------------
ctdb/doc/ctdbd.conf.5.xml | 27 ---
ctdb/tests/eventscripts/40.vsftpd.monitor.002.sh | 4 +-
ctdb/tests/eventscripts/49.winbind.monitor.050.sh | 16 --
ctdb/tests/eventscripts/49.winbind.monitor.051.sh | 17 --
ctdb/tests/eventscripts/50.samba.monitor.050.sh | 16 --
ctdb/tests/eventscripts/50.samba.monitor.051.sh | 17 --
ctdb/tests/eventscripts/50.samba.monitor.103.sh | 2 +-
ctdb/tests/eventscripts/50.samba.monitor.104.sh | 2 +-
ctdb/tests/eventscripts/50.samba.monitor.107.sh | 17 --
ctdb/tests/scripts/script_install_paths.sh | 2 +-
ctdb/tests/shellcheck/init_script.sh | 2 +-
20 files changed, 56 insertions(+), 347 deletions(-)
delete mode 100755 ctdb/tests/eventscripts/49.winbind.monitor.050.sh
delete mode 100755 ctdb/tests/eventscripts/49.winbind.monitor.051.sh
delete mode 100755 ctdb/tests/eventscripts/50.samba.monitor.050.sh
delete mode 100755 ctdb/tests/eventscripts/50.samba.monitor.051.sh
delete mode 100755 ctdb/tests/eventscripts/50.samba.monitor.107.sh


Changeset truncated at 500 lines:

diff --git a/ctdb/config/events.d/06.nfs b/ctdb/config/events.d/06.nfs
index 0ecbb57..e59f265 100755
--- a/ctdb/config/events.d/06.nfs
+++ b/ctdb/config/events.d/06.nfs
@@ -27,8 +27,6 @@ nfs_callout_pre ()

nfs_callout_init "$service_state_dir"

-ctdb_start_stop_service
-
is_ctdb_managed_service || exit 0

case "$1" in
diff --git a/ctdb/config/events.d/31.clamd b/ctdb/config/events.d/31.clamd
index 2d301eb..1b76365 100755
--- a/ctdb/config/events.d/31.clamd
+++ b/ctdb/config/events.d/31.clamd
@@ -23,26 +23,19 @@ redhat)
;;
esac

-service_start ()
-{
- service $service_name stop > /dev/null 2>&1
- service $service_name start
-}
-
loadconfig

-ctdb_start_stop_service
-
is_ctdb_managed_service || exit 0

case "$1" in
startup)
- ctdb_service_start
- ;;
+ service "$service_name" stop > /dev/null 2>&1
+ service "$service_name" start || exit $?
+ ;;

shutdown)
- ctdb_service_stop
- ;;
+ service "$service_name"_stop
+ ;;

monitor)
ctdb_check_unix_socket "$CTDB_CLAMD_SOCKET" || exit $?
diff --git a/ctdb/config/events.d/40.vsftpd b/ctdb/config/events.d/40.vsftpd
index 703edaf..f3c4848 100755
--- a/ctdb/config/events.d/40.vsftpd
+++ b/ctdb/config/events.d/40.vsftpd
@@ -7,16 +7,6 @@
. "${CTDB_BASE}/functions"

service_name="vsftpd"
-# make sure the service is stopped first
-service_start ()
-{
- service $service_name stop > /dev/null 2>&1
- service $service_name start
-}
-service_stop ()
-{
- service $service_name stop
-}

service_reconfigure ()
{
@@ -25,17 +15,17 @@ service_reconfigure ()

loadconfig

-ctdb_start_stop_service
-
is_ctdb_managed_service || exit 0

case "$1" in
startup)
- ctdb_service_start
+ service "$service_name" stop > /dev/null 2>&1
+ service "$service_name" start
+ ctdb_counter_init
;;

shutdown)
- ctdb_service_stop
+ service "$service_name" stop
;;

takeip|releaseip)
diff --git a/ctdb/config/events.d/41.httpd b/ctdb/config/events.d/41.httpd
index 4d04b39..b9aa7e1 100755
--- a/ctdb/config/events.d/41.httpd
+++ b/ctdb/config/events.d/41.httpd
@@ -47,17 +47,16 @@ service_stop ()

loadconfig

-ctdb_start_stop_service
-
is_ctdb_managed_service || exit 0

case "$1" in
startup)
- ctdb_service_start
+ service_start
+ ctdb_counter_int
;;

shutdown)
- ctdb_service_stop
+ service_stop
;;

monitor)
diff --git a/ctdb/config/events.d/49.winbind b/ctdb/config/events.d/49.winbind
index d95f90f..5e93737 100755
--- a/ctdb/config/events.d/49.winbind
+++ b/ctdb/config/events.d/49.winbind
@@ -34,23 +34,25 @@ service_stop ()

###########################

-ctdb_start_stop_service
-
is_ctdb_managed_service || exit 0

###########################

case "$1" in
startup)
- ctdb_service_start
+ service_start
;;

shutdown)
- ctdb_service_stop
+ service_stop
;;

monitor)
- ctdb_check_command wbinfo -p
+ if ! out=$(wbinfo -p 2>&1) ; then
+ echo "ERROR: wbinfo -p returned error"
+ echo "$out"
+ exit 1
+ fi
;;
esac

diff --git a/ctdb/config/events.d/50.samba b/ctdb/config/events.d/50.samba
index 161a885..4c32e4e 100755
--- a/ctdb/config/events.d/50.samba
+++ b/ctdb/config/events.d/50.samba
@@ -149,19 +149,17 @@ list_samba_ports ()

###########################

-ctdb_start_stop_service
-
is_ctdb_managed_service || exit 0

###########################

case "$1" in
startup)
- ctdb_service_start
+ service_start
;;

shutdown)
- ctdb_service_stop
+ service_stop
;;

monitor)
diff --git a/ctdb/config/events.d/60.nfs b/ctdb/config/events.d/60.nfs
index 02d6e2b..bd6be78 100755
--- a/ctdb/config/events.d/60.nfs
+++ b/ctdb/config/events.d/60.nfs
@@ -250,8 +250,6 @@ nfs_update_lock_info ()

nfs_callout_init "$service_state_dir"

-ctdb_start_stop_service
-
is_ctdb_managed_service || exit 0

case "$1" in
diff --git a/ctdb/config/events.d/70.iscsi b/ctdb/config/events.d/70.iscsi
index 0937a12..8851c59 100755
--- a/ctdb/config/events.d/70.iscsi
+++ b/ctdb/config/events.d/70.iscsi
@@ -13,8 +13,6 @@ service_name="iscsi"

loadconfig

-ctdb_start_stop_service
-
is_ctdb_managed_service || exit 0

[ -z "$CTDB_START_ISCSI_SCRIPTS" ] && {
diff --git a/ctdb/config/functions b/ctdb/config/functions
index 7e37bbb..f453968 100755
--- a/ctdb/config/functions
+++ b/ctdb/config/functions
@@ -97,26 +97,6 @@ loadconfig () {

##############################################################

-# CTDB_SCRIPT_DEBUGLEVEL can be overwritten by setting it in a
-# configuration file.
-debug ()
-{
- if [ "${CTDB_SCRIPT_DEBUGLEVEL:-NOTICE}" = "DEBUG" ] ; then
- # If there are arguments then echo them. Otherwise expect to
- # use stdin, which allows us to pass lots of debug using a
- # here document.
- if [ -n "$1" ] ; then
- echo "DEBUG: $*"
- else
- sed -e 's@^@DEBUG: @'
- fi
- else
- if [ -z "$1" ] ; then
- cat >/dev/null
- fi
- fi
-}
-
die ()
{
_msg="$1"
@@ -358,67 +338,40 @@ ctdb_check_directories()
# usage: ctdb_check_tcp_ports <ports...>
######################################################

-# This flag file is created when a service is initially started. It
-# is deleted the first time TCP port checks for that service succeed.
-# Until then ctdb_check_tcp_ports() prints a more subtle "error"
-# message if a port check fails.
-_ctdb_check_tcp_common ()
-{
- assert_service_name
- _d="${CTDB_SCRIPT_VARDIR}/failcount"
- _ctdb_service_started_file="${_d}/${service_name}.started"
-}
-
-ctdb_check_tcp_init ()
-{
- _ctdb_check_tcp_common
- mkdir -p "${_ctdb_service_started_file%/*}" # dirname
- touch "$_ctdb_service_started_file"
-}
-
# Check whether something is listening on all of the given TCP ports
# using the "ctdb checktcpport" command.
ctdb_check_tcp_ports()
{
- if [ -z "$1" ] ; then
- echo "INTERNAL ERROR: ctdb_check_tcp_ports - no ports specified"
- exit 1
- fi
-
- for _p ; do # process each function argument (port)
- _cmd="$CTDB checktcpport $_p"
- _out=$($_cmd 2>&1)
- _ret=$?
- case "$_ret" in
- 0)
- _ctdb_check_tcp_common
- if [ ! -f "$_ctdb_service_started_file" ] ; then
- echo "ERROR: $service_name tcp port $_p is not responding"
- debug "\"ctdb checktcpport $_p\" was able to bind to port"
- else
- echo "INFO: $service_name tcp port $_p is not responding"
- fi
+ if [ -z "$1" ] ; then
+ echo "INTERNAL ERROR: ctdb_check_tcp_ports - no ports specified"
+ exit 1
+ fi

- return 1
- ;;
- 98)
- # Couldn't bind, something already listening, next port...
- continue
- ;;
- *)
- echo "ERROR: unexpected error running \"ctdb checktcpport\""
- debug <<EOF
-$CTDB checktcpport (exited with $_ret) with output:
-$_out"
-EOF
- return $_ret
- esac
- done
+ for _p ; do # process each function argument (port)
+ _cmd="$CTDB checktcpport $_p"
+ _out=$($_cmd 2>&1)
+ _ret=$?
+ case "$_ret" in
+ 0)
+ echo "$service_name not listening on TCP port $_p"
+ return 1
+ ;;
+ 98)
+ # Couldn't bind, something already listening, next port
+ continue
+ ;;
+ *)
+ echo "unexpected error (${_ret}) running \"${_cmd}\""
+ if [ -n "$_out" ] ; then
+ echo "$_out"
+ fi
+ return $_ret
+ ;;
+ esac
+ done

- # All ports listening
- _ctdb_check_tcp_common
- rm -f "$_ctdb_service_started_file"
- return 0
+ # All ports listening
+ return 0
}

######################################################
@@ -435,19 +388,6 @@ ctdb_check_unix_socket() {
fi
}

-######################################################
-# check a command returns zero status
-# usage: ctdb_check_command <command>
-######################################################
-ctdb_check_command ()
-{
- _out=$("$@" 2>&1) || {
- echo "ERROR: $* returned error"
- echo "$_out" | debug
- exit 1
- }
-}
-
################################################
# kill off any TCP connections with the given IP
################################################
@@ -782,33 +722,6 @@ ctdb_setup_service_state_dir ()
echo "$_service_state_dir"
}

-########################################################
-# Managed status history, for auto-start/stop
-
-_ctdb_managed_common ()
-{
- _ctdb_managed_file="${CTDB_SCRIPT_VARDIR}/managed_history/${service_name}"
-}
-
-ctdb_service_managed ()
-{
- _ctdb_managed_common
- mkdir -p "${_ctdb_managed_file%/*}" # dirname
- touch "$_ctdb_managed_file"
-}
-
-ctdb_service_unmanaged ()
-{
- _ctdb_managed_common
- rm -f "$_ctdb_managed_file"
-}
-
-is_ctdb_previously_managed_service ()
-{
- _ctdb_managed_common
- [ -f "$_ctdb_managed_file" ]
-}
-
##################################################################
# Reconfigure a service on demand

@@ -854,7 +767,7 @@ service_reconfigure ()
}

##################################################################
-# Does CTDB manage this service? - and associated auto-start/stop
+# Does CTDB manage this service?

ctdb_compat_managed_service ()
{
@@ -893,75 +806,6 @@ is_ctdb_managed_service ()
[ "${t#* ${service_name} }" != "${t}" ]
}

-ctdb_start_stop_service ()
-{
- assert_service_name
-
- # Allow service-start/service-stop pseudo-events to start/stop
- # services when we're not auto-starting/stopping and we're not
- # monitoring.
- case "$event_name" in
- service-start)
- if is_ctdb_managed_service ; then
- die 'service-start event not permitted when service is managed'
- fi
- if [ "$CTDB_SERVICE_AUTOSTARTSTOP" = "yes" ] ; then
- die 'service-start event not permitted with CTDB_SERVICE_AUTOSTARTSTOP=yes'
- fi
- ctdb_service_start
- exit $?
- ;;
- service-stop)
- if is_ctdb_managed_service ; then
- die 'service-stop event not permitted when service is managed'
- fi
- if [ "$CTDB_SERVICE_AUTOSTARTSTOP" = "yes" ] ; then
- die 'service-stop event not permitted with CTDB_SERVICE_AUTOSTARTSTOP=yes'
- fi
- ctdb_service_stop
- exit $?
- ;;
- esac
-
- # Do nothing unless configured to...
- [ "$CTDB_SERVICE_AUTOSTARTSTOP" = "yes" ] || return 0
-
- [ "$event_name" = "monitor" ] || return 0
-
- if is_ctdb_managed_service ; then
- if ! is_ctdb_previously_managed_service ; then
- echo "Starting service \"$service_name\" - now managed"
- background_with_logging ctdb_service_start
- exit $?
- fi
- else
- if is_ctdb_previously_managed_service ; then
- echo "Stopping service \"$service_name\" - no longer managed"
- background_with_logging ctdb_service_stop
- exit $?
- fi
- fi
-}
-
-ctdb_service_start ()
-{
- # The service is marked managed if we've ever tried to start it.
- ctdb_service_managed
-
- service_start || return $?
-
- # Intentionally have this use $service_name as default
- # shellcheck disable=SC2119
- ctdb_counter_init
- ctdb_check_tcp_init
-}
-
-ctdb_service_stop ()
-{
- ctdb_service_unmanaged
- service_stop
-}
-
# Default service_start() and service_stop() functions.

# These may be overridden in an eventscript.
@@ -1168,4 +1012,3 @@ update_tickles ()
}

script_name="${0##*/}" # basename
-event_name="$1"
diff --git a/ctdb/doc/ctdbd.conf.5.xml b/ctdb/doc/ctdbd.conf.5.xml
index bbc02c6..1259fd3 100644
--- a/ctdb/doc/ctdbd.conf.5.xml
+++ b/ctdb/doc/ctdbd.conf.5.xml
@@ -1485,19 +1485,6 @@ CTDB_PER_IP_ROUTING_TABLE_ID_HIGH=9000
</listitem>
</varlistentry>

- <varlistentry>
- <term>CTDB_SERVICE_AUTOSTARTSTOP=yes|no</term>
- <listitem>
- <para>
- When CTDB should start and stop services if they become
- managed or unmanaged.
- </para>
- <para>
- Default is no.
- </para>
- </listitem>
- </varlistentry>
-
</variablelist>

</refsect2>
@@ -1697,20 +1684,6 @@ CTDB_SET_MonitorInterval=20
--
Samba Shared Repository
Stefan Metzmacher
2017-01-16 20:17:02 UTC
Permalink
The branch, master has been updated
via ed722c3 ctdb-common: Add wait_send/wait_recv to sock_daemon_funcs
via d09469e ctdb-common: Avoid any processing after finishing tevent_req
via d5be557 ctdb-common: Pass tevent_req to the computation sub-functions
via 31274cf ctdb-common: Use consistent naming for sock_daemon_run computation functions
via 9e09a25 ctdb-common: Correct name of sock_daemon_run_send/recv state structure
from ff0d45c ctdb-tests: Fix name of the variable representing init script

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit ed722c3aa9690873af495cb467dd440c1a714d82
Author: Amitay Isaacs <***@gmail.com>
Date: Wed Jan 11 20:37:00 2017 +1100

ctdb-common: Add wait_send/wait_recv to sock_daemon_funcs

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12510

To be able to terminate the daemon from within the implementation,
create a subreq using wait_send() provided by the implementation.
When the subreq is finished, it signals the sock_daemon code to terminate
the daemon.

This avoids the need to keep track of the top level tevent_req causing
layer violation and keeps the code flow straighforward.

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Mon Jan 16 21:16:51 CET 2017 on sn-devel-144

commit d09469e575233242eab2a8c1c0767f52e7cad1e5
Author: Amitay Isaacs <***@gmail.com>
Date: Wed Jan 11 19:54:36 2017 +1100

ctdb-common: Avoid any processing after finishing tevent_req

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12510

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit d5be55725000eb34611dc76a2e8e7188eea2503f
Author: Amitay Isaacs <***@gmail.com>
Date: Fri Jan 13 10:43:44 2017 +1100

ctdb-common: Pass tevent_req to the computation sub-functions

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12510

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 31274cf7aec1bb26e8dac0dbd1b9a3fa799b2b85
Author: Amitay Isaacs <***@gmail.com>
Date: Fri Jan 13 10:40:43 2017 +1100

ctdb-common: Use consistent naming for sock_daemon_run computation functions

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12510

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 9e09a253b4ca1b5f9aa432c986c1755a173a9566
Author: Amitay Isaacs <***@gmail.com>
Date: Wed Jan 11 19:50:34 2017 +1100

ctdb-common: Correct name of sock_daemon_run_send/recv state structure

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12510

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
ctdb/common/sock_daemon.c | 132 +++++++++++++----------
ctdb/common/sock_daemon.h | 14 ++-
ctdb/tests/cunit/sock_daemon_test_001.sh | 2 +
ctdb/tests/src/sock_daemon_test.c | 175 ++++++++++++++++++++++++-------
4 files changed, 226 insertions(+), 97 deletions(-)


Changeset truncated at 500 lines:

diff --git a/ctdb/common/sock_daemon.c b/ctdb/common/sock_daemon.c
index ca4086d..b53b4d8 100644
--- a/ctdb/common/sock_daemon.c
+++ b/ctdb/common/sock_daemon.c
@@ -70,7 +70,6 @@ struct sock_daemon_context {

struct pidfile_context *pid_ctx;
struct sock_socket *socket_list;
- struct tevent_req *req;
};

/*
@@ -451,8 +450,6 @@ bool sock_socket_write_recv(struct tevent_req *req, int *perr)
* Socket daemon
*/

-static int sock_daemon_context_destructor(struct sock_daemon_context *sockd);
-
int sock_daemon_setup(TALLOC_CTX *mem_ctx, const char *daemon_name,
const char *logging, const char *debug_level,
const char *pidfile,
@@ -487,21 +484,10 @@ int sock_daemon_setup(TALLOC_CTX *mem_ctx, const char *daemon_name,
}
}

- talloc_set_destructor(sockd, sock_daemon_context_destructor);
-
*out = sockd;
return 0;
}

-static int sock_daemon_context_destructor(struct sock_daemon_context *sockd)
-{
- if (sockd->req != NULL) {
- tevent_req_done(sockd->req);
- }
-
- return 0;
-}
-
int sock_daemon_add_unix(struct sock_daemon_context *sockd,
const char *sockpath,
struct sock_socket_funcs *funcs,
@@ -529,7 +515,7 @@ int sock_daemon_add_unix(struct sock_daemon_context *sockd,
* Run socket daemon
*/

-struct sock_daemon_start_state {
+struct sock_daemon_run_state {
struct tevent_context *ev;
struct sock_daemon_context *sockd;
pid_t pid_watch;
@@ -537,15 +523,16 @@ struct sock_daemon_start_state {
int fd;
};

-static void sock_daemon_started(struct tevent_req *subreq);
-static void sock_daemon_signal_handler(struct tevent_context *ev,
- struct tevent_signal *se,
- int signum, int count, void *siginfo,
- void *private_data);
-static void sock_daemon_socket_fail(struct tevent_req *subreq);
-static void sock_daemon_watch_pid(struct tevent_req *subreq);
-static void sock_daemon_reconfigure(struct sock_daemon_start_state *state);
-static void sock_daemon_shutdown(struct sock_daemon_start_state *state);
+static void sock_daemon_run_started(struct tevent_req *subreq);
+static void sock_daemon_run_signal_handler(struct tevent_context *ev,
+ struct tevent_signal *se,
+ int signum, int count, void *siginfo,
+ void *private_data);
+static void sock_daemon_run_reconfigure(struct tevent_req *req);
+static void sock_daemon_run_shutdown(struct tevent_req *req);
+static void sock_daemon_run_socket_fail(struct tevent_req *subreq);
+static void sock_daemon_run_watch_pid(struct tevent_req *subreq);
+static void sock_daemon_run_wait_done(struct tevent_req *subreq);

struct tevent_req *sock_daemon_run_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
@@ -553,12 +540,12 @@ struct tevent_req *sock_daemon_run_send(TALLOC_CTX *mem_ctx,
pid_t pid_watch)
{
struct tevent_req *req, *subreq;
- struct sock_daemon_start_state *state;
+ struct sock_daemon_run_state *state;
struct tevent_signal *se;
struct sock_socket *sock;

req = tevent_req_create(mem_ctx, &state,
- struct sock_daemon_start_state);
+ struct sock_daemon_run_state);
if (req == NULL) {
return NULL;
}
@@ -573,28 +560,28 @@ struct tevent_req *sock_daemon_run_send(TALLOC_CTX *mem_ctx,
if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);
}
- tevent_req_set_callback(subreq, sock_daemon_started, req);
+ tevent_req_set_callback(subreq, sock_daemon_run_started, req);

se = tevent_add_signal(ev, state, SIGHUP, 0,
- sock_daemon_signal_handler, req);
+ sock_daemon_run_signal_handler, req);
if (tevent_req_nomem(se, req)) {
return tevent_req_post(req, ev);
}

se = tevent_add_signal(ev, state, SIGUSR1, 0,
- sock_daemon_signal_handler, req);
+ sock_daemon_run_signal_handler, req);
if (tevent_req_nomem(se, req)) {
return tevent_req_post(req, ev);
}

se = tevent_add_signal(ev, state, SIGINT, 0,
- sock_daemon_signal_handler, req);
+ sock_daemon_run_signal_handler, req);
if (tevent_req_nomem(se, req)) {
return tevent_req_post(req, ev);
}

se = tevent_add_signal(ev, state, SIGTERM, 0,
- sock_daemon_signal_handler, req);
+ sock_daemon_run_signal_handler, req);
if (tevent_req_nomem(se, req)) {
return tevent_req_post(req, ev);
}
@@ -604,7 +591,8 @@ struct tevent_req *sock_daemon_run_send(TALLOC_CTX *mem_ctx,
if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);
}
- tevent_req_set_callback(subreq, sock_daemon_socket_fail, req);
+ tevent_req_set_callback(subreq, sock_daemon_run_socket_fail,
+ req);

sock->req = subreq;
}
@@ -615,20 +603,30 @@ struct tevent_req *sock_daemon_run_send(TALLOC_CTX *mem_ctx,
if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);
}
- tevent_req_set_callback(subreq, sock_daemon_watch_pid, req);
+ tevent_req_set_callback(subreq, sock_daemon_run_watch_pid,
+ req);
}

- sockd->req = req;
+ if (sockd->funcs != NULL && sockd->funcs->wait_send != NULL &&
+ sockd->funcs->wait_recv != NULL) {
+ subreq = sockd->funcs->wait_send(state, ev,
+ sockd->private_data);
+ if (tevent_req_nomem(subreq, req)) {
+ return tevent_req_post(req, ev);
+ }
+ tevent_req_set_callback(subreq, sock_daemon_run_wait_done,
+ req);
+ }

return req;
}

-static void sock_daemon_started(struct tevent_req *subreq)
+static void sock_daemon_run_started(struct tevent_req *subreq)
{
struct tevent_req *req = tevent_req_callback_data(
subreq, struct tevent_req);
- struct sock_daemon_start_state *state = tevent_req_data(
- req, struct sock_daemon_start_state);
+ struct sock_daemon_run_state *state = tevent_req_data(
+ req, struct sock_daemon_run_state);
struct sock_daemon_context *sockd = state->sockd;

D_NOTICE("daemon started, pid=%u\n", getpid());
@@ -638,31 +636,31 @@ static void sock_daemon_started(struct tevent_req *subreq)
}
}

-static void sock_daemon_signal_handler(struct tevent_context *ev,
- struct tevent_signal *se,
- int signum, int count, void *siginfo,
- void *private_data)
+static void sock_daemon_run_signal_handler(struct tevent_context *ev,
+ struct tevent_signal *se,
+ int signum, int count, void *siginfo,
+ void *private_data)
{
struct tevent_req *req = talloc_get_type_abort(
private_data, struct tevent_req);
- struct sock_daemon_start_state *state = tevent_req_data(
- req, struct sock_daemon_start_state);

D_NOTICE("Received signal %d\n", signum);

if (signum == SIGHUP || signum == SIGUSR1) {
- sock_daemon_reconfigure(state);
+ sock_daemon_run_reconfigure(req);
return;
}

if (signum == SIGINT || signum == SIGTERM) {
- sock_daemon_shutdown(state);
+ sock_daemon_run_shutdown(req);
tevent_req_error(req, EINTR);
}
}

-static void sock_daemon_reconfigure(struct sock_daemon_start_state *state)
+static void sock_daemon_run_reconfigure(struct tevent_req *req)
{
+ struct sock_daemon_run_state *state = tevent_req_data(
+ req, struct sock_daemon_run_state);
struct sock_daemon_context *sockd = state->sockd;

if (sockd->funcs != NULL && sockd->funcs->reconfigure != NULL) {
@@ -670,8 +668,10 @@ static void sock_daemon_reconfigure(struct sock_daemon_start_state *state)
}
}

-static void sock_daemon_shutdown(struct sock_daemon_start_state *state)
+static void sock_daemon_run_shutdown(struct tevent_req *req)
{
+ struct sock_daemon_run_state *state = tevent_req_data(
+ req, struct sock_daemon_run_state);
struct sock_daemon_context *sockd = state->sockd;
struct sock_socket *sock;

@@ -690,32 +690,29 @@ static void sock_daemon_shutdown(struct sock_daemon_start_state *state)
TALLOC_FREE(sockd->pid_ctx);
}

-static void sock_daemon_socket_fail(struct tevent_req *subreq)
+static void sock_daemon_run_socket_fail(struct tevent_req *subreq)
{
struct tevent_req *req = tevent_req_callback_data(
subreq, struct tevent_req);
- struct sock_daemon_start_state *state = tevent_req_data(
- req, struct sock_daemon_start_state);
int ret = 0;
bool status;

status = sock_socket_start_recv(subreq, &ret);
TALLOC_FREE(subreq);
+ sock_daemon_run_shutdown(req);
if (! status) {
tevent_req_error(req, ret);
} else {
tevent_req_done(req);
}
-
- sock_daemon_shutdown(state);
}

-static void sock_daemon_watch_pid(struct tevent_req *subreq)
+static void sock_daemon_run_watch_pid(struct tevent_req *subreq)
{
struct tevent_req *req = tevent_req_callback_data(
subreq, struct tevent_req);
- struct sock_daemon_start_state *state = tevent_req_data(
- req, struct sock_daemon_start_state);
+ struct sock_daemon_run_state *state = tevent_req_data(
+ req, struct sock_daemon_run_state);
int ret;
bool status;

@@ -730,7 +727,7 @@ static void sock_daemon_watch_pid(struct tevent_req *subreq)
if (ret == -1) {
if (errno == ESRCH) {
D_ERR("PID %d gone away, exiting\n", state->pid_watch);
- sock_daemon_shutdown(state);
+ sock_daemon_run_shutdown(req);
tevent_req_error(req, ESRCH);
return;
} else {
@@ -744,7 +741,27 @@ static void sock_daemon_watch_pid(struct tevent_req *subreq)
if (tevent_req_nomem(subreq, req)) {
return;
}
- tevent_req_set_callback(subreq, sock_daemon_watch_pid, req);
+ tevent_req_set_callback(subreq, sock_daemon_run_watch_pid, req);
+}
+
+static void sock_daemon_run_wait_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(
+ subreq, struct tevent_req);
+ struct sock_daemon_run_state *state = tevent_req_data(
+ req, struct sock_daemon_run_state);
+ struct sock_daemon_context *sockd = state->sockd;
+ int ret;
+ bool status;
+
+ status = sockd->funcs->wait_recv(subreq, &ret);
+ TALLOC_FREE(subreq);
+ sock_daemon_run_shutdown(req);
+ if (! status) {
+ tevent_req_error(req, ret);
+ } else {
+ tevent_req_done(req);
+ }
}

bool sock_daemon_run_recv(struct tevent_req *req, int *perr)
@@ -777,7 +794,6 @@ int sock_daemon_run(struct tevent_context *ev,
tevent_req_poll(req, ev);

status = sock_daemon_run_recv(req, &ret);
- sockd->req = NULL;
TALLOC_FREE(req);
if (! status) {
return ret;
diff --git a/ctdb/common/sock_daemon.h b/ctdb/common/sock_daemon.h
index 6c474ac..81853f6 100644
--- a/ctdb/common/sock_daemon.h
+++ b/ctdb/common/sock_daemon.h
@@ -50,12 +50,24 @@ struct sock_client_context;
* startup() is called when the daemon starts running
* either via sock_daemon_run() or via sock_daemon_run_send()
* reconfigure() is called when process receives SIGUSR1 or SIGHUP
- * shutdown() is called when process receives SIGINT or SIGTERM
+ * shutdown() is called when process receives SIGINT or SIGTERM or
+ * when wait computation has finished
+ *
+ * wait_send() starts the async computation to keep running the daemon
+ * wait_recv() ends the async computation to keep running the daemon
+ *
+ * If wait_send()/wait_recv() is NULL, then daemon will keep running forever.
+ * If wait_send() returns req, then when req is over, daemon will shutdown.
*/
struct sock_daemon_funcs {
void (*startup)(void *private_data);
void (*reconfigure)(void *private_data);
void (*shutdown)(void *private_data);
+
+ struct tevent_req * (*wait_send)(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ void *private_data);
+ bool (*wait_recv)(struct tevent_req *req, int *perr);
};

/**
diff --git a/ctdb/tests/cunit/sock_daemon_test_001.sh b/ctdb/tests/cunit/sock_daemon_test_001.sh
index 036b6ac..72e5532 100755
--- a/ctdb/tests/cunit/sock_daemon_test_001.sh
+++ b/ctdb/tests/cunit/sock_daemon_test_001.sh
@@ -47,6 +47,7 @@ unit_test sock_daemon_test "$pidfile" "$sockpath" 3

ok <<EOF
test4[PID]: daemon started, pid=PID
+test4[PID]: Shutting down
EOF
unit_test sock_daemon_test "$pidfile" "$sockpath" 4

@@ -61,5 +62,6 @@ unit_test sock_daemon_test "$pidfile" "$sockpath" 5
ok <<EOF
test6[PID]: listening on $sockpath
test6[PID]: daemon started, pid=PID
+test6[PID]: Shutting down
EOF
unit_test sock_daemon_test "$pidfile" "$sockpath" 6
diff --git a/ctdb/tests/src/sock_daemon_test.c b/ctdb/tests/src/sock_daemon_test.c
index 4a085c0..278dcab 100644
--- a/ctdb/tests/src/sock_daemon_test.c
+++ b/ctdb/tests/src/sock_daemon_test.c
@@ -254,17 +254,68 @@ static void test3(TALLOC_CTX *mem_ctx, const char *pidfile,
assert(ret == -1);
}

-static void test4_handler(struct tevent_context *ev,
- struct tevent_timer *te,
- struct timeval curtime,
- void *private_data)
+struct test4_wait_state {
+};
+
+static void test4_wait_done(struct tevent_req *subreq);
+
+static struct tevent_req *test4_wait_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ void *private_data)
{
- struct sock_daemon_context *sockd = talloc_get_type_abort(
- private_data, struct sock_daemon_context);
+ struct tevent_req *req, *subreq;
+ struct test4_wait_state *state;

- talloc_free(sockd);
+ req = tevent_req_create(mem_ctx, &state, struct test4_wait_state);
+ if (req == NULL) {
+ return NULL;
+ }
+
+ subreq = tevent_wakeup_send(state, ev,
+ tevent_timeval_current_ofs(10,0));
+ if (tevent_req_nomem(subreq, req)) {
+ return tevent_req_post(req, ev);
+ }
+ tevent_req_set_callback(subreq, test4_wait_done, req);
+
+ return req;
}

+static void test4_wait_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(
+ subreq, struct tevent_req);
+ bool status;
+
+ status = tevent_wakeup_recv(subreq);
+ TALLOC_FREE(subreq);
+
+ if (! status) {
+ tevent_req_error(req, EIO);
+ } else {
+ tevent_req_done(req);
+ }
+}
+
+static bool test4_wait_recv(struct tevent_req *req, int *perr)
+{
+ int ret;
+
+ if (tevent_req_is_unix_error(req, &ret)) {
+ if (perr != NULL) {
+ *perr = ret;
+ }
+ return false;
+ }
+
+ return true;
+}
+
+static struct sock_daemon_funcs test4_funcs = {
+ .wait_send = test4_wait_send,
+ .wait_recv = test4_wait_recv,
+};
+
static void test4(TALLOC_CTX *mem_ctx, const char *pidfile,
const char *sockpath)
{
@@ -278,19 +329,14 @@ static void test4(TALLOC_CTX *mem_ctx, const char *pidfile,
if (pid == 0) {
struct tevent_context *ev;
struct sock_daemon_context *sockd;
- struct tevent_timer *te;

ev = tevent_context_init(mem_ctx);
assert(ev != NULL);

ret = sock_daemon_setup(mem_ctx, "test4", "file:", "NOTICE",
- NULL, NULL, NULL, &sockd);
+ pidfile, &test4_funcs, NULL, &sockd);
assert(ret == 0);

- te = tevent_add_timer(ev, ev, tevent_timeval_current_ofs(10,0),
- test4_handler, sockd);
- assert(te != NULL);
-
ret = sock_daemon_run(ev, sockd, -1);
assert(ret == 0);

@@ -666,7 +712,7 @@ static void test6_client(const char *sockpath)

struct test6_server_state {
struct sock_daemon_context *sockd;
- int done;
+ int fd, done;
};

struct test6_read_state {
@@ -752,35 +798,90 @@ static struct sock_socket_funcs test6_client_funcs = {

static void test6_startup(void *private_data)
{
- int fd = *(int *)private_data;
+ struct test6_server_state *server_state =
+ (struct test6_server_state *)private_data;
int ret = 1;
ssize_t nwritten;

- nwritten = write(fd, &ret, sizeof(ret));
+ nwritten = write(server_state->fd, &ret, sizeof(ret));
assert(nwritten == sizeof(ret));
- close(fd);
+ close(server_state->fd);
+ server_state->fd = -1;
}

-static struct sock_daemon_funcs test6_funcs = {
- .startup = test6_startup,
+struct test6_wait_state {
+ struct test6_server_state *server_state;
};

-static void test6_handler(struct tevent_context *ev,
- struct tevent_timer *te,
- struct timeval curtime,
- void *private_data)
+static void test6_wait_done(struct tevent_req *subreq);
+
+static struct tevent_req *test6_wait_send(TALLOC_CTX *mem_ctx,
--
Samba Shared Repository
Amitay Isaacs
2017-01-17 05:03:02 UTC
Permalink
The branch, master has been updated
via eaa508b ctdb-tests: Add "13.per_ip_routing shutdown" test
via f9368f8 ctdb-scripts: Fix regression when cleaning up routing table IDs
via 5e00a6b ctdb-scripts: Fix remaining uses of "ctdb gratiousarp"
from ed722c3 ctdb-common: Add wait_send/wait_recv to sock_daemon_funcs

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit eaa508b82650197a7d473a24b3362e9e9c329937
Author: Martin Schwenke <***@meltin.net>
Date: Mon Jan 16 11:08:51 2017 +1100

ctdb-tests: Add "13.per_ip_routing shutdown" test

Ensure that it doesn't mangle the rt_tables file.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12516

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

Autobuild-User(master): Amitay Isaacs <***@samba.org>
Autobuild-Date(master): Tue Jan 17 06:02:23 CET 2017 on sn-devel-144

commit f9368f8e129cb32ee30cb6501a6fe728db37e1d5
Author: Martin Schwenke <***@meltin.net>
Date: Mon Jan 16 07:24:15 2017 +1100

ctdb-scripts: Fix regression when cleaning up routing table IDs

Commit 0ca00267cd2620a14968961738bcd2a69b597e95 removed explicit
continuations in strings for awk programs. In one case this causes a
disconnect between condition and action, where an implicit
continuation does not work. This results in duplicate lines in the
rt_tables file.

Move the opening brace for the action to make the implicit
continuation work as expected.

An alternative would be to revert the removal of the explicit
continuations and add shellcheck tags. However, that doesn't mean
that an author of future code will necessarily use explicit
continuations, so the same mistake might still be make in the future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12516

Reported-by: Barry Evans <***@pixitmedia.com>
Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit 5e00a6b346325f52e35b9785eaffd72239aebcf5
Author: Martin Schwenke <***@meltin.net>
Date: Mon Jan 16 13:38:50 2017 +1100

ctdb-scripts: Fix remaining uses of "ctdb gratiousarp"

This changed to "ctdb gratarp" some time ago but the scripts were
never updated.

Fix the documentation for the ctdb tool too.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12512

Reported-by: Ralph Böhme <***@samba.org>
Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

-----------------------------------------------------------------------

Summary of changes:
ctdb/config/events.d/10.interface | 4 +--
ctdb/config/events.d/13.per_ip_routing | 8 +++---
ctdb/config/events.d/91.lvs | 2 +-
ctdb/doc/ctdb.1.xml | 4 +--
ctdb/tests/eventscripts/13.per_ip_routing.024.sh | 31 ++++++++++++++++++++++++
ctdb/tests/eventscripts/stubs/ctdb | 2 +-
6 files changed, 41 insertions(+), 10 deletions(-)
create mode 100755 ctdb/tests/eventscripts/13.per_ip_routing.024.sh


Changeset truncated at 500 lines:

diff --git a/ctdb/config/events.d/10.interface b/ctdb/config/events.d/10.interface
index 073bc85..97227e8 100755
--- a/ctdb/config/events.d/10.interface
+++ b/ctdb/config/events.d/10.interface
@@ -215,7 +215,7 @@ updateip)
# 2) remove the IP from the old interface (and new interface, to be sure)
# 3) add the IP to the new interface
# 4) remove the firewall rule
- # 5) use ctdb gratiousarp to propagate the new mac address
+ # 5) use ctdb gratarp to propagate the new mac address
# 6) use netstat -tn to find existing connections, and tickle them
_oiface=$2
niface=$3
@@ -247,7 +247,7 @@ updateip)
flush_route_cache

# propagate the new mac address
- $CTDB gratiousarp "$ip" "$niface"
+ $CTDB gratarp "$ip" "$niface"

# tickle all existing connections, so that dropped packets
# are retransmited and the tcp streams work
diff --git a/ctdb/config/events.d/13.per_ip_routing b/ctdb/config/events.d/13.per_ip_routing
index c4b2535..4fff73b 100755
--- a/ctdb/config/events.d/13.per_ip_routing
+++ b/ctdb/config/events.d/13.per_ip_routing
@@ -184,8 +184,8 @@ clean_up_table_ids ()
-v pre="$table_id_prefix" \
'/^#/ ||
!(min <= $1 && $1 <= max) &&
- !(index($2, pre) == 1)
- { print $0 }' "$rt_tables" >"$_tmp"
+ !(index($2, pre) == 1) {
+ print $0 }' "$rt_tables" >"$_tmp"

mv "$_tmp" "$rt_tables"
) 9>"$rt_tables_lock"
@@ -396,7 +396,7 @@ takeip)
# flush our route cache
set_proc sys/net/ipv4/route/flush 1

- $CTDB gratiousarp "$ip" "$iface"
+ $CTDB gratarp "$ip" "$iface"
;;

updateip)
@@ -414,7 +414,7 @@ updateip)
# flush our route cache
set_proc sys/net/ipv4/route/flush 1

- $CTDB gratiousarp "$ip" "$niface"
+ $CTDB gratarp "$ip" "$niface"
tickle_tcp_connections "$ip"
;;

diff --git a/ctdb/config/events.d/91.lvs b/ctdb/config/events.d/91.lvs
index 052b509..9725ee8 100755
--- a/ctdb/config/events.d/91.lvs
+++ b/ctdb/config/events.d/91.lvs
@@ -110,7 +110,7 @@ ipreallocated)
ipvsadm -a -t "$CTDB_LVS_PUBLIC_IP" -r 127.0.0.1
ipvsadm -a -u "$CTDB_LVS_PUBLIC_IP" -r 127.0.0.1

- $CTDB gratiousarp \
+ $CTDB gratarp \
"$CTDB_LVS_PUBLIC_IP" "$CTDB_LVS_PUBLIC_IFACE" >/dev/null 2>&1

flush_route_cache
diff --git a/ctdb/doc/ctdb.1.xml b/ctdb/doc/ctdb.1.xml
index 1d6979a..f24f8dd 100644
--- a/ctdb/doc/ctdb.1.xml
+++ b/ctdb/doc/ctdb.1.xml
@@ -1479,9 +1479,9 @@ dbid:0xb775fff6 name:secrets.tdb path:/usr/local/var/lib/ctdb/persistent/secrets
</refsect2>

<refsect2>
- <title>gratiousarp <parameter>IPADDR</parameter> <parameter>INTERFACE</parameter></title>
+ <title>gratarp <parameter>IPADDR</parameter> <parameter>INTERFACE</parameter></title>
<para>
- Send out a gratious ARP for the specified interface through
+ Send out a gratuitous ARP for the specified interface through
the specified interface. This command is mainly used by the
ctdb eventscripts.
</para>
diff --git a/ctdb/tests/eventscripts/13.per_ip_routing.024.sh b/ctdb/tests/eventscripts/13.per_ip_routing.024.sh
new file mode 100755
index 0000000..7daacbb
--- /dev/null
+++ b/ctdb/tests/eventscripts/13.per_ip_routing.024.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+. "${TEST_SCRIPTS_DIR}/unit.sh"
+
+define_test "Single IP, restores original rt_tables"
+
+setup_ctdb
+setup_ctdb_policy_routing
+
+create_policy_routing_config 1 default
+
+_rt_tables="$CTDB_SYS_ETCDIR/iproute2/rt_tables"
+_rt_orig=$(mktemp --tmpdir="$EVENTSCRIPTS_TESTS_VAR_DIR")
+cp "$_rt_tables" "$_rt_orig"
+
+ctdb_get_1_public_address | {
+ read dev ip bits
+
+ ok_null
+ simple_test_event "takeip" $dev $ip $bits
+
+ ok <<EOF
+Removing ip rule for public address ${ip} for routing table ctdb.${ip}
+EOF
+ simple_test_event "shutdown"
+}
+
+ok_null
+simple_test_command diff -u "$_rt_orig" "$_rt_tables"
+
+check_routes 0
diff --git a/ctdb/tests/eventscripts/stubs/ctdb b/ctdb/tests/eventscripts/stubs/ctdb
index 10a4859..c304dde 100755
--- a/ctdb/tests/eventscripts/stubs/ctdb
+++ b/ctdb/tests/eventscripts/stubs/ctdb
@@ -481,7 +481,7 @@ case "$1" in
echo "|${2:-monitor}|${_b}|${_code}|${_status}|${_d1}|${_d2}|${_err_out}|"
done
;;
- gratiousarp) : ;; # Do nothing for now
+ gratarp) : ;; # Do nothing for now
ip) ctdb_ip "$@" ;;
pnn|xpnn) ctdb_pnn ;;
enable) ctdb_enable "$@";;
--
Samba Shared Repository
Martin Schwenke
2017-01-17 14:01:01 UTC
Permalink
The branch, master has been updated
via 49fb663 ctdb-daemon: Remove stale eventd socket
from eaa508b ctdb-tests: Add "13.per_ip_routing shutdown" test

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 49fb663d6e48e9c8a4759cc4c68bc877c798c6c2
Author: Amitay Isaacs <***@gmail.com>
Date: Fri Jan 13 16:00:45 2017 +1100

ctdb-daemon: Remove stale eventd socket

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12513

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

Autobuild-User(master): Martin Schwenke <***@samba.org>
Autobuild-Date(master): Tue Jan 17 15:00:15 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
ctdb/server/eventscript.c | 9 +++++++++
1 file changed, 9 insertions(+)


Changeset truncated at 500 lines:

diff --git a/ctdb/server/eventscript.c b/ctdb/server/eventscript.c
index decbaa8..22cd873 100644
--- a/ctdb/server/eventscript.c
+++ b/ctdb/server/eventscript.c
@@ -171,6 +171,15 @@ int ctdb_start_eventd(struct ctdb_context *ctdb)

ectx = ctdb->ectx;

+ ret = unlink(ectx->socket);
+ if (ret == 0) {
+ D_WARNING("Removed stale eventd socket %s\n", ectx->socket);
+ } else if (errno != ENOENT) {
+ D_ERR("Failed to remove stale eventd socket %s\n",
+ ectx->socket);
+ return -1;
+ }
+
argv = talloc_array(ectx, const char *, 14);
if (argv == NULL) {
return -1;
--
Samba Shared Repository
Volker Lendecke
2017-01-18 16:20:03 UTC
Permalink
The branch, master has been updated
via ca5d36d s3/winbindd: fix invalid free
from 49fb663 ctdb-daemon: Remove stale eventd socket

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit ca5d36d8425d7b173b977ff4fd02d057a7e23d44
Author: Aurelien Aptel <***@suse.com>
Date: Tue Jan 17 14:39:03 2017 +0100

s3/winbindd: fix invalid free

coverity fix.

TALLOC_FREE() might be called on uninitialized 'rids' at the end of the
function in case of an early error. Initialize it to NULL to turn the
TALLOC_FREE() to a noop in this case.

Signed-off-by: Aurelien Aptel <***@suse.com>
Reviewed-by: Volker Lendecke <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Wed Jan 18 17:19:39 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
source3/winbindd/winbindd_msrpc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/source3/winbindd/winbindd_msrpc.c b/source3/winbindd/winbindd_msrpc.c
index 0d0e4ca..5ace4d1 100644
--- a/source3/winbindd/winbindd_msrpc.c
+++ b/source3/winbindd/winbindd_msrpc.c
@@ -53,7 +53,7 @@ static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
{
struct rpc_pipe_client *samr_pipe = NULL;
struct policy_handle dom_pol;
- uint32_t *rids;
+ uint32_t *rids = NULL;
TALLOC_CTX *tmp_ctx;
NTSTATUS status;
--
Samba Shared Repository
Andreas Schneider
2017-01-20 14:01:02 UTC
Permalink
The branch, master has been updated
via be8e90f s3/rpc_server: move rpc_modules.c to its own subsystem
via 9a55940 libgpo: Fix error check in gp_inifile_init_context_direct()
from ca5d36d s3/winbindd: fix invalid free

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit be8e90f27a70f3ba8d708e984cf7b2a34e8c2628
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 16 12:24:54 2017 +0100

s3/rpc_server: move rpc_modules.c to its own subsystem

The source file rpc_modules.c was used in two places which lead to the
following build error when configuring with '--nonshared-binary=smbd/smbd':

ERROR: source source3/rpc_server/rpc_modules.c is in more than one
subsystem of target 'smbd/smbd': ['RPC_SERVICE', 'MDSSD']

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12524

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Noel Power <***@suse.com>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Andreas Schneider <***@cryptomilk.org>
Autobuild-Date(master): Fri Jan 20 15:00:45 CET 2017 on sn-devel-144

commit 9a55940e95909900b72726b2e216b36cbbd305ab
Author: Günther Deschner <***@samba.org>
Date: Thu Jan 19 16:49:38 2017 +0100

libgpo: Fix error check in gp_inifile_init_context_direct()

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
libgpo/gpo_ini.c | 4 ++--
source3/rpc_server/wscript_build | 11 ++++++++---
2 files changed, 10 insertions(+), 5 deletions(-)


Changeset truncated at 500 lines:

diff --git a/libgpo/gpo_ini.c b/libgpo/gpo_ini.c
index 198e8af..c1b1698 100644
--- a/libgpo/gpo_ini.c
+++ b/libgpo/gpo_ini.c
@@ -359,7 +359,7 @@ NTSTATUS gp_inifile_init_context_direct(TALLOC_CTX *mem_ctx,
{
struct gp_inifile_context *gp_ctx = NULL;
NTSTATUS status;
- int rv;
+ bool rv;
char *tmp_filename = NULL;

if (unix_path == NULL || pgp_ctx == NULL) {
@@ -382,7 +382,7 @@ NTSTATUS gp_inifile_init_context_direct(TALLOC_CTX *mem_ctx,
change_section,
store_keyval_pair,
gp_ctx);
- if (rv != 0) {
+ if (!rv) {
return NT_STATUS_NO_SUCH_FILE;
}

diff --git a/source3/rpc_server/wscript_build b/source3/rpc_server/wscript_build
index 55373e7..ad3a141 100644
--- a/source3/rpc_server/wscript_build
+++ b/source3/rpc_server/wscript_build
@@ -39,6 +39,10 @@ bld.SAMBA3_SUBSYSTEM('RPC_SERVER',
NDR_NAMED_PIPE_AUTH
''')

+bld.SAMBA3_SUBSYSTEM('RPC_MODULES',
+ source='rpc_modules.c',
+ deps='samba-util')
+
### RPC_SERVICES
bld.SAMBA3_SUBSYSTEM('RPC_DSSETUP',
source='''dssetup/srv_dssetup_nt.c
@@ -156,11 +160,12 @@ bld.SAMBA3_SUBSYSTEM('RPC_SERVER_REGISTER',
deps='samba-util')

bld.SAMBA3_SUBSYSTEM('RPC_SERVICE',
- source='rpc_service_setup.c rpc_modules.c',
+ source='rpc_service_setup.c',
deps='''
rpc
RPC_SERVER
RPC_SERVER_REGISTER
+ RPC_MODULES
RPC_SAMR
RPC_LSARPC
RPC_WINREG
@@ -199,6 +204,6 @@ bld.SAMBA3_SUBSYSTEM('FSSD',
deps='samba-util')

bld.SAMBA3_SUBSYSTEM('MDSSD',
- source='mdssd.c rpc_modules.c',
- deps='RPC_SOCK_HELPER samba-util',
+ source='mdssd.c',
+ deps='RPC_SOCK_HELPER RPC_MODULES samba-util',
enabled=bld.env.with_spotlight)
--
Samba Shared Repository
Martin Schwenke
2017-01-20 17:48:02 UTC
Permalink
The branch, master has been updated
via 296845e ctdb-docs: Document configuration variable CTDB_NFS_CHECKS_DIR
via 8eafa2c ctdb-scripts: Avoid log noise when NFS checks directory is empty
via e7c2f27 ctdb-tests: Drop calls to ctdb_service_managed and ctdb_service_unmanaged
from be8e90f s3/rpc_server: move rpc_modules.c to its own subsystem

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 296845e5f2a0c17e108d5b4d17204753cd284bde
Author: Martin Schwenke <***@meltin.net>
Date: Fri Jan 20 11:16:55 2017 +1100

ctdb-docs: Document configuration variable CTDB_NFS_CHECKS_DIR

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

Autobuild-User(master): Martin Schwenke <***@samba.org>
Autobuild-Date(master): Fri Jan 20 18:47:04 CET 2017 on sn-devel-144

commit 8eafa2c5dfe78432b8b29d6063c2d2a1224470f0
Author: Martin Schwenke <***@meltin.net>
Date: Thu Jan 19 14:40:20 2017 +1100

ctdb-scripts: Avoid log noise when NFS checks directory is empty

Signed-off-by: Martin Schwenke <***@meltin.net>
Reviewed-by: Amitay Isaacs <***@gmail.com>

commit e7c2f270b5d37e75a6176b4a3dce923b981ef191
Author: Amitay Isaacs <***@gmail.com>
Date: Thu Jan 19 17:04:20 2017 +1100

ctdb-tests: Drop calls to ctdb_service_managed and ctdb_service_unmanaged

These functions have been removed as part of dropping
CTDB_SERVICE_AUTOSTARTSTOP functionality.

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

-----------------------------------------------------------------------

Summary of changes:
ctdb/config/events.d/60.nfs | 2 ++
ctdb/doc/ctdbd.conf.5.xml | 28 ++++++++++++++++++++++++++++
ctdb/tests/eventscripts/scripts/local.sh | 12 ------------
3 files changed, 30 insertions(+), 12 deletions(-)


Changeset truncated at 500 lines:

diff --git a/ctdb/config/events.d/60.nfs b/ctdb/config/events.d/60.nfs
index bd6be78..eaa260b 100755
--- a/ctdb/config/events.d/60.nfs
+++ b/ctdb/config/events.d/60.nfs
@@ -37,6 +37,8 @@ nfs_check_services ()

# Files must end with .check - avoids editor backups, RPM fu, ...
for _f in "$_dir"/[0-9][0-9].*.check ; do
+ [ -r "$_f" ] || continue
+
_t="${_f%.check}"
_progname="${_t##*/[0-9][0-9].}"

diff --git a/ctdb/doc/ctdbd.conf.5.xml b/ctdb/doc/ctdbd.conf.5.xml
index 1259fd3..fc58c31 100644
--- a/ctdb/doc/ctdbd.conf.5.xml
+++ b/ctdb/doc/ctdbd.conf.5.xml
@@ -1103,6 +1103,34 @@ CTDB_PER_IP_ROUTING_TABLE_ID_HIGH=9000
</varlistentry>

<varlistentry>
+ <term>CTDB_NFS_CHECKS_DIR=<parameter>DIRECTORY</parameter></term>
+ <listitem>
+ <para>
+ Specifies the path to a DIRECTORY containing files that
+ describe how to monitor the responsiveness of NFS RPC
+ services. See the README file for this directory for an
+ explanation of the contents of these "check" files.
+ </para>
+ <para>
+ CTDB_NFS_CHECKS_DIR can be used to point to different
+ sets of checks for different NFS servers.
+ </para>
+ <para>
+ One way of using this is to have it point to, say,
+ <filename>/usr/local/etc/ctdb/nfs-checks-enabled.d</filename>
+ and populate it with symbolic links to the desired check
+ files. This avoids duplication and is upgrade-safe.
+ </para>
+ <para>
+ Default is
+ <filename>/usr/local/etc/ctdb/nfs-checks.d</filename>,
+ which contains NFS RPC checks suitable for Linux kernel
+ NFS.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term>CTDB_NFS_SKIP_SHARE_CHECK=yes|no</term>
<listitem>
<para>
diff --git a/ctdb/tests/eventscripts/scripts/local.sh b/ctdb/tests/eventscripts/scripts/local.sh
index b7b4848..5a638df 100644
--- a/ctdb/tests/eventscripts/scripts/local.sh
+++ b/ctdb/tests/eventscripts/scripts/local.sh
@@ -802,8 +802,6 @@ setup_samba ()
if [ "$1" != "down" ] ; then

debug "Marking Samba services as up, listening and managed by CTDB"
- # Get into known state.
- eventscript_call ctdb_service_managed

# All possible service names for all known distros.
for i in "smb" "nmb" "samba" "smbd" "nmbd" ; do
@@ -822,8 +820,6 @@ setup_samba ()
export FAKE_SLEEP_FORCE=0.1
else
debug "Marking Samba services as down, not listening and not managed by CTDB"
- # Get into known state.
- eventscript_call ctdb_service_unmanaged

# All possible service names for all known distros.
for i in "smb" "nmb" "samba" "smbd" "nmbd" ; do
@@ -865,8 +861,6 @@ setup_winbind ()
if [ "$1" != "down" ] ; then

debug "Marking Winbind service as up and managed by CTDB"
- # Get into known state.
- eventscript_call ctdb_service_managed

service "winbind" force-started

@@ -876,8 +870,6 @@ setup_winbind ()

else
debug "Marking Winbind service as down and not managed by CTDB"
- # Get into known state.
- eventscript_call ctdb_service_unmanaged

service "winbind" force-stopped

@@ -919,7 +911,6 @@ setup_nfs ()
if [ "$1" != "down" ] ; then
debug "Setting up NFS environment: all RPC services up, NFS managed by CTDB"

- eventscript_call ctdb_service_managed
service "nfs" force-started
service "nfslock" force-started

@@ -933,7 +924,6 @@ setup_nfs ()
else
debug "Setting up NFS environment: all RPC services down, NFS not managed by CTDB"

- eventscript_call ctdb_service_unmanaged
service "nfs" force-stopped
service "nfslock" force-stopped

@@ -1187,7 +1177,6 @@ setup_vsftpd ()
else
debug "Setting up VSFTPD environment: service down, not managed by CTDB"

- eventscript_call ctdb_service_unmanaged
service vsftpd force-stopped

export CTDB_MANAGED_SERVICES="foo"
@@ -1207,7 +1196,6 @@ setup_httpd ()
debug "Setting up HTTPD environment: service down, not managed by CTDB"

for service_name in "apache2" "httpd" ; do
- eventscript_call ctdb_service_unmanaged
service "$service_name" force-stopped
done
--
Samba Shared Repository
Volker Lendecke
2017-01-20 21:34:02 UTC
Permalink
The branch, master has been updated
via 98d05dc smbcontrol: add ringbuf-log
via a6bb4e2 s4/messaging: register for MSG_REQ_RINGBUF_LOG
via 7b3f230 s3/debug: listen for MSG_REQ_RINGBUF_LOG
via bdff813 messaging.idl: add ringbuf message types
via 1f6d5f2 debug: add "ringbuf" backend logging to a ringbuffer
via bf59d97 debug: parse, store and pass backend option
from 296845e ctdb-docs: Document configuration variable CTDB_NFS_CHECKS_DIR

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 98d05dcac39da0a6589f9d47a30c47a650e08470
Author: Ralph Boehme <***@samba.org>
Date: Sun Jan 8 16:47:30 2017 +0100

smbcontrol: add ringbuf-log

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Fri Jan 20 22:33:14 CET 2017 on sn-devel-144

commit a6bb4e27e76ea583a0ae13569cf0ec78d9849cca
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 9 22:33:55 2017 +0100

s4/messaging: register for MSG_REQ_RINGBUF_LOG

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

commit 7b3f2302b23b4f6966c7db69c7d2205e0523a2e8
Author: Ralph Boehme <***@samba.org>
Date: Sun Jan 8 14:08:27 2017 +0100

s3/debug: listen for MSG_REQ_RINGBUF_LOG

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

commit bdff81348d0fc29b3e20eead021e695634246363
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 9 22:35:17 2017 +0100

messaging.idl: add ringbuf message types

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

commit 1f6d5f2c090ee6bb6e0215b8cfa365eb96453917
Author: Ralph Boehme <***@samba.org>
Date: Sat Jan 7 14:36:24 2017 +0100

debug: add "ringbuf" backend logging to a ringbuffer

This is useful for debugging bugs that involve timing effects and are
not reproducible when logging at higher debug levels with the file
backend.

The log can be dumped to a file with gdb:

(gdb) dump binary memory samba.log debug_ringbuf debug_ringbuf+SIZE

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

commit bf59d97f80a7894672a46a312259cc4118576637
Author: Ralph Boehme <***@samba.org>
Date: Sat Jan 7 19:34:46 2017 +0100

debug: parse, store and pass backend option

Will be used in the next commit by new "ringbuf" backend.

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Volker Lendecke <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
docs-xml/manpages/smbcontrol.1.xml | 7 ++
docs-xml/smbdotconf/logging/logging.xml | 5 ++
lib/util/debug.c | 114 +++++++++++++++++++++++++++++---
lib/util/debug.h | 3 +
lib/util/debug_s3.c | 22 ++++++
librpc/idl/messaging.idl | 3 +
source3/utils/smbcontrol.c | 45 +++++++++++++
source4/lib/messaging/messaging.c | 22 ++++++
8 files changed, 212 insertions(+), 9 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/smbcontrol.1.xml b/docs-xml/manpages/smbcontrol.1.xml
index 99f141d..127e919 100644
--- a/docs-xml/manpages/smbcontrol.1.xml
+++ b/docs-xml/manpages/smbcontrol.1.xml
@@ -257,6 +257,13 @@
</varlistentry>

<varlistentry>
+ <term>ringbuf-log</term>
+ <listitem><para>Fetch and print the ringbuf log. Requires
+ <parameter>logging = ringbuf</parameter>. Available for smbd, winbindd
+ and nmbd.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
<term>drvupgrade</term>
<listitem><para>Force clients of printers using specified driver
to update their local version of the driver. Can only be
diff --git a/docs-xml/smbdotconf/logging/logging.xml b/docs-xml/smbdotconf/logging/logging.xml
index 8524884..b152d0c 100644
--- a/docs-xml/smbdotconf/logging/logging.xml
+++ b/docs-xml/smbdotconf/logging/logging.xml
@@ -31,8 +31,13 @@
<listitem><para><parameter moreinfo="none">systemd</parameter></para></listitem>
<listitem><para><parameter moreinfo="none">lttng</parameter></para></listitem>
<listitem><para><parameter moreinfo="none">gpfs</parameter></para></listitem>
+ <listitem><para><parameter moreinfo="none">ringbuf</parameter></para></listitem>
</itemizedlist>

+ <para>The <parameter moreinfo="none">ringbuf</parameter> backend supports an
+ optional size argument to change the buffer size used, the default is 1 MB:
+ <parameter moreinfo="none">ringbuf:size=NBYTES</parameter></para>
+
</description>
<value type="default"></value>
<value type="example">***@1 file</value>
diff --git a/lib/util/debug.c b/lib/util/debug.c
index 37582db..08954c3 100644
--- a/lib/util/debug.c
+++ b/lib/util/debug.c
@@ -149,7 +149,7 @@ static void debug_file_log(int msg_level,

#ifdef WITH_SYSLOG
static void debug_syslog_reload(bool enabled, bool previously_enabled,
- const char *prog_name)
+ const char *prog_name, char *option)
{
if (enabled && !previously_enabled) {
#ifdef LOG_DAEMON
@@ -207,7 +207,7 @@ static void debug_lttng_log(int msg_level,
#ifdef HAVE_GPFS
#include "gpfswrap.h"
static void debug_gpfs_reload(bool enabled, bool previously_enabled,
- const char *prog_name)
+ const char *prog_name, char *option)
{
gpfswrap_init();

@@ -236,12 +236,92 @@ static void debug_gpfs_log(int msg_level,
}
#endif /* HAVE_GPFS */

+#define DEBUG_RINGBUF_SIZE (1024 * 1024)
+#define DEBUG_RINGBUF_SIZE_OPT "size="
+
+static char *debug_ringbuf;
+static size_t debug_ringbuf_size;
+static size_t debug_ringbuf_ofs;
+
+/* We ensure in debug_ringbuf_log() that this is always \0 terminated */
+char *debug_get_ringbuf(void)
+{
+ return debug_ringbuf;
+}
+
+/* Return the size of the ringbuf (including a \0 terminator) */
+size_t debug_get_ringbuf_size(void)
+{
+ return debug_ringbuf_size;
+}
+
+static void debug_ringbuf_reload(bool enabled, bool previously_enabled,
+ const char *prog_name, char *option)
+{
+ bool cmp;
+ size_t optlen = strlen(DEBUG_RINGBUF_SIZE_OPT);
+
+ debug_ringbuf_size = DEBUG_RINGBUF_SIZE;
+ debug_ringbuf_ofs = 0;
+
+ SAFE_FREE(debug_ringbuf);
+
+ if (!enabled) {
+ return;
+ }
+
+ if (option != NULL) {
+ cmp = strncmp(option, DEBUG_RINGBUF_SIZE_OPT, optlen);
+ if (cmp == 0) {
+ debug_ringbuf_size = (size_t)strtoull(
+ option + optlen, NULL, 10);
+ }
+ }
+
+ debug_ringbuf = calloc(debug_ringbuf_size, sizeof(char));
+ if (debug_ringbuf == NULL) {
+ return;
+ }
+}
+
+static void debug_ringbuf_log(int msg_level,
+ const char *msg,
+ const char *msg_no_nl)
+{
+ size_t msglen = strlen(msg);
+ size_t allowed_size;
+
+ if (debug_ringbuf == NULL) {
+ return;
+ }
+
+ /* Ensure the buffer is always \0 terminated */
+ allowed_size = debug_ringbuf_size - 1;
+
+ if (msglen > allowed_size) {
+ return;
+ }
+
+ if ((debug_ringbuf_ofs + msglen) < debug_ringbuf_ofs) {
+ return;
+ }
+
+ if ((debug_ringbuf_ofs + msglen) > allowed_size) {
+ debug_ringbuf_ofs = 0;
+ }
+
+ memcpy(debug_ringbuf + debug_ringbuf_ofs, msg, msglen);
+ debug_ringbuf_ofs += msglen;
+}
+
static struct debug_backend {
const char *name;
int log_level;
int new_log_level;
- void (*reload)(bool enabled, bool prev_enabled, const char *prog_name);
+ void (*reload)(bool enabled, bool prev_enabled,
+ const char *prog_name, char *option);
void (*log)(int msg_level, const char *msg, const char *msg_no_nl);
+ char *option;
} debug_backends[] = {
{
.name = "file",
@@ -276,6 +356,11 @@ static struct debug_backend {
.log = debug_gpfs_log,
},
#endif
+ {
+ .name = "ringbuf",
+ .log = debug_ringbuf_log,
+ .reload = debug_ringbuf_reload,
+ },
};

static struct debug_backend *debug_find_backend(const char *name)
@@ -297,6 +382,7 @@ static struct debug_backend *debug_find_backend(const char *name)
static void debug_backend_parse_token(char *tok)
{
char *backend_name_option, *backend_name,*backend_level, *saveptr;
+ char *backend_option;
struct debug_backend *b;

/*
@@ -317,12 +403,7 @@ static void debug_backend_parse_token(char *tok)
return;
}

- /*
- * No backend is using the option yet.
- */
-#if 0
backend_option = strtok_r(NULL, "\0", &saveptr);
-#endif

/*
* Find and update backend
@@ -337,6 +418,13 @@ static void debug_backend_parse_token(char *tok)
} else {
b->new_log_level = atoi(backend_level);
}
+
+ if (backend_option != NULL) {
+ b->option = strdup(backend_option);
+ if (b->option == NULL) {
+ return;
+ }
+ }
}

/*
@@ -355,6 +443,7 @@ static void debug_set_backends(const char *param)
* disabled
*/
for (i = 0; i < ARRAY_SIZE(debug_backends); i++) {
+ SAFE_FREE(debug_backends[i].option);
debug_backends[i].new_log_level = -1;
}

@@ -380,7 +469,8 @@ static void debug_set_backends(const char *param)
bool enabled = b->new_log_level > -1;
bool previously_enabled = b->log_level > -1;

- b->reload(enabled, previously_enabled, state.prog_name);
+ b->reload(enabled, previously_enabled, state.prog_name,
+ b->option);
}
b->log_level = b->new_log_level;
}
@@ -508,6 +598,8 @@ static void debug_init(void);

void gfree_debugsyms(void)
{
+ unsigned i;
+
TALLOC_FREE(classname_table);

if ( DEBUGLEVEL_CLASS != debug_class_list_initial ) {
@@ -518,6 +610,10 @@ void gfree_debugsyms(void)
debug_num_classes = 0;

state.initialized = false;
+
+ for (i = 0; i < ARRAY_SIZE(debug_backends); i++) {
+ SAFE_FREE(debug_backends[i].option);
+ }
}

/****************************************************************************
diff --git a/lib/util/debug.h b/lib/util/debug.h
index b50bf50..43c6aa0 100644
--- a/lib/util/debug.h
+++ b/lib/util/debug.h
@@ -287,4 +287,7 @@ typedef void (*debug_callback_fn)(void *private_ptr, int level, const char *msg)
*/
void debug_set_callback(void *private_ptr, debug_callback_fn fn);

+char *debug_get_ringbuf(void);
+size_t debug_get_ringbuf_size(void);
+
#endif /* _SAMBA_DEBUG_H */
diff --git a/lib/util/debug_s3.c b/lib/util/debug_s3.c
index 98e7b00..b05d422 100644
--- a/lib/util/debug_s3.c
+++ b/lib/util/debug_s3.c
@@ -21,6 +21,7 @@
#include "includes.h"
#include "librpc/gen_ndr/messaging.h"
#include "messages.h"
+#include "lib/util/memory.h"

/* This is the Samba3-specific implementation of reopen_logs(), which
* calls out to the s3 loadparm code, and means that we don't depend
@@ -98,9 +99,30 @@ static void debuglevel_message(struct messaging_context *msg_ctx,

TALLOC_FREE(message);
}
+
+static void debug_ringbuf_log(struct messaging_context *msg_ctx,
+ void *private_data,
+ uint32_t msg_type,
+ struct server_id src,
+ DATA_BLOB *data)
+{
+ char *log = debug_get_ringbuf();
+ size_t logsize = debug_get_ringbuf_size();
+
+ if (log == NULL) {
+ log = discard_const_p(char, "*disabled*\n");
+ logsize = strlen(log) + 1;
+ }
+
+ messaging_send_buf(msg_ctx, src, MSG_RINGBUF_LOG, (uint8_t *)log,
+ logsize);
+}
+
void debug_register_msgs(struct messaging_context *msg_ctx)
{
messaging_register(msg_ctx, NULL, MSG_DEBUG, debug_message);
messaging_register(msg_ctx, NULL, MSG_REQ_DEBUGLEVEL,
debuglevel_message);
+ messaging_register(msg_ctx, NULL, MSG_REQ_RINGBUF_LOG,
+ debug_ringbuf_log);
}
diff --git a/librpc/idl/messaging.idl b/librpc/idl/messaging.idl
index a54d13c..032f95e 100644
--- a/librpc/idl/messaging.idl
+++ b/librpc/idl/messaging.idl
@@ -45,6 +45,9 @@ interface messaging
MSG_PREFORK_CHILD_EVENT = 0x0031,
MSG_PREFORK_PARENT_EVENT = 0x0032,

+ MSG_REQ_RINGBUF_LOG = 0x0033,
+ MSG_RINGBUF_LOG = 0x0034,
+
/* nmbd messages */
MSG_FORCE_ELECTION = 0x0101,
MSG_WINS_NEW_ENTRY = 0x0102,
diff --git a/source3/utils/smbcontrol.c b/source3/utils/smbcontrol.c
index ad602b3..8c0f636 100644
--- a/source3/utils/smbcontrol.c
+++ b/source3/utils/smbcontrol.c
@@ -886,6 +886,50 @@ static bool do_poolusage(struct tevent_context *ev_ctx,
return num_replies;
}

+/* Fetch and print the ringbuf log */
+
+static void print_ringbuf_log_cb(struct messaging_context *msg,
+ void *private_data,
+ uint32_t msg_type,
+ struct server_id pid,
+ DATA_BLOB *data)
+{
+ printf("%s", (const char *)data->data);
+ num_replies++;
+}
+
+static bool do_ringbuflog(struct tevent_context *ev_ctx,
+ struct messaging_context *msg_ctx,
+ const struct server_id pid,
+ const int argc, const char **argv)
+{
+ if (argc != 1) {
+ fprintf(stderr, "Usage: smbcontrol <dest> ringbuf-log\n");
+ return false;
+ }
+
+ messaging_register(msg_ctx, NULL, MSG_RINGBUF_LOG,
+ print_ringbuf_log_cb);
+
+ /* Send a message and register our interest in a reply */
+
+ if (!send_message(msg_ctx, pid, MSG_REQ_RINGBUF_LOG, NULL, 0)) {
+ return false;
+ }
+
+ wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
+
+ /* No replies were received within the timeout period */
+
+ if (num_replies == 0) {
+ printf("No replies received\n");
+ }
+
+ messaging_deregister(msg_ctx, MSG_RINGBUF_LOG, NULL);
+
+ return num_replies != 0;
+}
+
/* Perform a dmalloc mark */

static bool do_dmalloc_mark(struct tevent_context *ev_ctx,
@@ -1385,6 +1429,7 @@ static const struct {
{ "lockretry", do_lockretry, "Force a blocking lock retry" },
{ "brl-revalidate", do_brl_revalidate, "Revalidate all brl entries" },
{ "pool-usage", do_poolusage, "Display talloc memory usage" },
+ { "ringbuf-log", do_ringbuflog, "Display ringbuf log" },
{ "dmalloc-mark", do_dmalloc_mark, "" },
{ "dmalloc-log-changed", do_dmalloc_changed, "" },
{ "shutdown", do_shutdown, "Shut down daemon" },
diff --git a/source4/lib/messaging/messaging.c b/source4/lib/messaging/messaging.c
index 6fca9b8..22d3ad8 100644
--- a/source4/lib/messaging/messaging.c
+++ b/source4/lib/messaging/messaging.c
@@ -114,6 +114,27 @@ static void pool_message(struct imessaging_context *msg, void *private_data,
talloc_free(report);
}

+static void ringbuf_log_msg(struct imessaging_context *msg,
+ void *private_data,
+ uint32_t msg_type,
+ struct server_id src,
+ DATA_BLOB *data)
+{
+ char *log = debug_get_ringbuf();
+ size_t logsize = debug_get_ringbuf_size();
+ DATA_BLOB blob;
+
+ if (log == NULL) {
+ log = discard_const_p(char, "*disabled*\n");
+ logsize = strlen(log) + 1;
+ }
+
+ blob.data = (uint8_t *)log;
+ blob.length = logsize;
+
+ imessaging_send(msg, src, MSG_RINGBUF_LOG, &blob);
+}
+
/*
return uptime of messaging server via irpc
*/
@@ -408,6 +429,7 @@ struct imessaging_context *imessaging_init(TALLOC_CTX *mem_ctx,
imessaging_register(msg, NULL, MSG_PING, ping_message);
imessaging_register(msg, NULL, MSG_REQ_POOL_USAGE, pool_message);
imessaging_register(msg, NULL, MSG_IRPC, irpc_handler);
+ imessaging_register(msg, NULL, MSG_REQ_RINGBUF_LOG, ringbuf_log_msg);
IRPC_REGISTER(msg, irpc, IRPC_UPTIME, irpc_uptime, msg);

DLIST_ADD(msg_ctxs, msg);
--
Samba Shared Repository
Ralph Böhme
2017-01-21 12:14:02 UTC
Permalink
The branch, master has been updated
via 35460d9 s3/rpc_server/mdssvc: prefix public flex and bison global symbols
via 7933c2a s3/rpc_server/mdssvc: use flex noyyalloc noyyrealloc
from 98d05dc smbcontrol: add ringbuf-log

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 35460d92bbf3ee0af00b10a0a3a72887049f09ff
Author: Ralph Boehme <***@samba.org>
Date: Wed Jan 18 19:18:40 2017 +0100

s3/rpc_server/mdssvc: prefix public flex and bison global symbols

This fixes a clash with a parser in Heimdal when building with
--nonshared-binary=smbd/smbd:

...
[3139/3620] Linking default/source3/smbd/smbd
...
default/source4/heimdal/lib/hx509/sel-lex_116.o: In function `yy_get_previous_state':
/usr/build/packages/samba-4.5/bin/../source4/heimdal/lib/hx509/sel-lex.c:1122:multiple definition of `yyin'
default/source3/rpc_server/mdssvc/sparql_lexer_28.o:/usr/build/packages/samba-4.5/bin/sparql_lexer.c:1149:first defined here
...

The fix is to use namespace prefixes in the parser and the lexer as
described here:
<https://www.gnu.org/software/bison/manual/html_node/Multiple-Parsers.html>

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12528

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): Ralph Böhme <***@samba.org>
Autobuild-Date(master): Sat Jan 21 13:13:19 CET 2017 on sn-devel-144

commit 7933c2a60fed8b18e88957cfc267990d8d7f0041
Author: Ralph Boehme <***@samba.org>
Date: Thu Jan 19 07:39:37 2017 +0100

s3/rpc_server/mdssvc: use flex noyyalloc noyyrealloc

Redefine the symbols used for malloc and realloc in the flex source
instead of running sed over the generated one.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12528

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
source3/rpc_server/mdssvc/Makefile | 3 -
source3/rpc_server/mdssvc/sparql_lexer.c | 561 ++++++++++++++++--------------
source3/rpc_server/mdssvc/sparql_lexer.l | 10 +-
source3/rpc_server/mdssvc/sparql_parser.c | 152 ++++----
source3/rpc_server/mdssvc/sparql_parser.h | 24 +-
source3/rpc_server/mdssvc/sparql_parser.y | 25 +-
6 files changed, 412 insertions(+), 363 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/rpc_server/mdssvc/Makefile b/source3/rpc_server/mdssvc/Makefile
index 3b0983f..3de4a46 100644
--- a/source3/rpc_server/mdssvc/Makefile
+++ b/source3/rpc_server/mdssvc/Makefile
@@ -1,6 +1,5 @@
BISON=bison
FLEX=flex
-SED=sed

PARSER=sparql_parser
LEXER=sparql_lexer
@@ -12,5 +11,3 @@ $(PARSER).c: $(PARSER).y

$(LEXER).c: $(LEXER).l
$(FLEX) -o $@ $<
- $(SED) -i s/malloc/SMB_MALLOC/g $@
- $(SED) -i s/realloc/SMB_REALLOC/g $@
diff --git a/source3/rpc_server/mdssvc/sparql_lexer.c b/source3/rpc_server/mdssvc/sparql_lexer.c
index 34bc0ca..39539c5 100644
--- a/source3/rpc_server/mdssvc/sparql_lexer.c
+++ b/source3/rpc_server/mdssvc/sparql_lexer.c
@@ -6,10 +6,29 @@

/* A lexical scanner generated by flex */

+#define yy_create_buffer mdsyy_create_buffer
+#define yy_delete_buffer mdsyy_delete_buffer
+#define yy_flex_debug mdsyy_flex_debug
+#define yy_init_buffer mdsyy_init_buffer
+#define yy_flush_buffer mdsyy_flush_buffer
+#define yy_load_buffer_state mdsyy_load_buffer_state
+#define yy_switch_to_buffer mdsyy_switch_to_buffer
+#define yyin mdsyyin
+#define yyleng mdsyyleng
+#define yylex mdsyylex
+#define yylineno mdsyylineno
+#define yyout mdsyyout
+#define yyrestart mdsyyrestart
+#define yytext mdsyytext
+#define yywrap mdsyywrap
+#define yyalloc mdsyyalloc
+#define yyrealloc mdsyyrealloc
+#define yyfree mdsyyfree
+
#define FLEX_SCANNER
#define YY_FLEX_MAJOR_VERSION 2
-#define YY_FLEX_MINOR_VERSION 5
-#define YY_FLEX_SUBMINOR_VERSION 37
+#define YY_FLEX_MINOR_VERSION 6
+#define YY_FLEX_SUBMINOR_VERSION 0
#if YY_FLEX_SUBMINOR_VERSION > 0
#define FLEX_BETA
#endif
@@ -136,13 +155,21 @@ typedef unsigned int flex_uint32_t;
#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1)

/* Special action meaning "start processing a new file". */
-#define YY_NEW_FILE yyrestart(yyin )
+#define YY_NEW_FILE mdsyyrestart(mdsyyin )

#define YY_END_OF_BUFFER_CHAR 0

/* Size of default input buffer. */
#ifndef YY_BUF_SIZE
+#ifdef __ia64__
+/* On IA-64, the buffer size is 16k, not 8k.
+ * Moreover, YY_BUF_SIZE is 2*YY_READ_BUF_SIZE in the general case.
+ * Ditto for the __ia64__ case accordingly.
+ */
+#define YY_BUF_SIZE 32768
+#else
#define YY_BUF_SIZE 16384
+#endif /* __ia64__ */
#endif

/* The state buf must be large enough to hold one state per character in the main buffer.
@@ -159,27 +186,28 @@ typedef struct yy_buffer_state *YY_BUFFER_STATE;
typedef size_t yy_size_t;
#endif

-extern yy_size_t yyleng;
+extern yy_size_t mdsyyleng;

-extern FILE *yyin, *yyout;
+extern FILE *mdsyyin, *mdsyyout;

#define EOB_ACT_CONTINUE_SCAN 0
#define EOB_ACT_END_OF_FILE 1
#define EOB_ACT_LAST_MATCH 2

#define YY_LESS_LINENO(n)
+ #define YY_LINENO_REWIND_TO(ptr)

/* Return all but the first "n" matched characters back to the input stream. */
#define yyless(n) \
do \
{ \
- /* Undo effects of setting up yytext. */ \
- int yyless_macro_arg = (n); \
+ /* Undo effects of setting up mdsyytext. */ \
+ yy_size_t yyless_macro_arg = (n); \
YY_LESS_LINENO(yyless_macro_arg);\
*yy_cp = (yy_hold_char); \
YY_RESTORE_YY_MORE_OFFSET \
(yy_c_buf_p) = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \
- YY_DO_BEFORE_ACTION; /* set up yytext again */ \
+ YY_DO_BEFORE_ACTION; /* set up mdsyytext again */ \
} \
while ( 0 )

@@ -205,7 +233,7 @@ struct yy_buffer_state
yy_size_t yy_n_chars;

/* Whether we "own" the buffer - i.e., we know we created it,
- * and can SMB_REALLOC() it to grow it, and should free() it to
+ * and can realloc() it to grow it, and should free() it to
* delete it.
*/
int yy_is_our_buffer;
@@ -242,8 +270,8 @@ struct yy_buffer_state
* possible backing-up.
*
* When we actually see the EOF, we change the status to "new"
- * (via yyrestart()), so that the user can continue scanning by
- * just pointing yyin at a new input file.
+ * (via mdsyyrestart()), so that the user can continue scanning by
+ * just pointing mdsyyin at a new input file.
*/
#define YY_BUFFER_EOF_PENDING 2

@@ -270,51 +298,51 @@ static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */
*/
#define YY_CURRENT_BUFFER_LVALUE (yy_buffer_stack)[(yy_buffer_stack_top)]

-/* yy_hold_char holds the character lost when yytext is formed. */
+/* yy_hold_char holds the character lost when mdsyytext is formed. */
static char yy_hold_char;
static yy_size_t yy_n_chars; /* number of characters read into yy_ch_buf */
-yy_size_t yyleng;
+yy_size_t mdsyyleng;

/* Points to current character in buffer. */
static char *yy_c_buf_p = (char *) 0;
static int yy_init = 0; /* whether we need to initialize */
static int yy_start = 0; /* start state number */

-/* Flag which is used to allow yywrap()'s to do buffer switches
- * instead of setting up a fresh yyin. A bit of a hack ...
+/* Flag which is used to allow mdsyywrap()'s to do buffer switches
+ * instead of setting up a fresh mdsyyin. A bit of a hack ...
*/
static int yy_did_buffer_switch_on_eof;

-void yyrestart (FILE *input_file );
-void yy_switch_to_buffer (YY_BUFFER_STATE new_buffer );
-YY_BUFFER_STATE yy_create_buffer (FILE *file,int size );
-void yy_delete_buffer (YY_BUFFER_STATE b );
-void yy_flush_buffer (YY_BUFFER_STATE b );
-void yypush_buffer_state (YY_BUFFER_STATE new_buffer );
-void yypop_buffer_state (void );
+void mdsyyrestart (FILE *input_file );
+void mdsyy_switch_to_buffer (YY_BUFFER_STATE new_buffer );
+YY_BUFFER_STATE mdsyy_create_buffer (FILE *file,int size );
+void mdsyy_delete_buffer (YY_BUFFER_STATE b );
+void mdsyy_flush_buffer (YY_BUFFER_STATE b );
+void mdsyypush_buffer_state (YY_BUFFER_STATE new_buffer );
+void mdsyypop_buffer_state (void );

-static void yyensure_buffer_stack (void );
-static void yy_load_buffer_state (void );
-static void yy_init_buffer (YY_BUFFER_STATE b,FILE *file );
+static void mdsyyensure_buffer_stack (void );
+static void mdsyy_load_buffer_state (void );
+static void mdsyy_init_buffer (YY_BUFFER_STATE b,FILE *file );

-#define YY_FLUSH_BUFFER yy_flush_buffer(YY_CURRENT_BUFFER )
+#define YY_FLUSH_BUFFER mdsyy_flush_buffer(YY_CURRENT_BUFFER )

-YY_BUFFER_STATE yy_scan_buffer (char *base,yy_size_t size );
-YY_BUFFER_STATE yy_scan_string (yyconst char *yy_str );
-YY_BUFFER_STATE yy_scan_bytes (yyconst char *bytes,yy_size_t len );
+YY_BUFFER_STATE mdsyy_scan_buffer (char *base,yy_size_t size );
+YY_BUFFER_STATE mdsyy_scan_string (yyconst char *yy_str );
+YY_BUFFER_STATE mdsyy_scan_bytes (yyconst char *bytes,yy_size_t len );

-void *yyalloc (yy_size_t );
-void *yySMB_REALLOC (void *,yy_size_t );
-void yyfree (void * );
+void *mdsyyalloc (yy_size_t );
+void *mdsyyrealloc (void *,yy_size_t );
+void mdsyyfree (void * );

-#define yy_new_buffer yy_create_buffer
+#define yy_new_buffer mdsyy_create_buffer

#define yy_set_interactive(is_interactive) \
{ \
if ( ! YY_CURRENT_BUFFER ){ \
- yyensure_buffer_stack (); \
+ mdsyyensure_buffer_stack (); \
YY_CURRENT_BUFFER_LVALUE = \
- yy_create_buffer(yyin,YY_BUF_SIZE ); \
+ mdsyy_create_buffer(mdsyyin,YY_BUF_SIZE ); \
} \
YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \
}
@@ -322,9 +350,9 @@ void yyfree (void * );
#define yy_set_bol(at_bol) \
{ \
if ( ! YY_CURRENT_BUFFER ){\
- yyensure_buffer_stack (); \
+ mdsyyensure_buffer_stack (); \
YY_CURRENT_BUFFER_LVALUE = \
- yy_create_buffer(yyin,YY_BUF_SIZE ); \
+ mdsyy_create_buffer(mdsyyin,YY_BUF_SIZE ); \
} \
YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \
}
@@ -335,28 +363,34 @@ void yyfree (void * );

typedef unsigned char YY_CHAR;

-FILE *yyin = (FILE *) 0, *yyout = (FILE *) 0;
+FILE *mdsyyin = (FILE *) 0, *mdsyyout = (FILE *) 0;

typedef int yy_state_type;

-extern int yylineno;
+extern int mdsyylineno;

-int yylineno = 1;
+int mdsyylineno = 1;

-extern char *yytext;
-#define yytext_ptr yytext
+extern char *mdsyytext;
+#ifdef yytext_ptr
+#undef yytext_ptr
+#endif
+#define yytext_ptr mdsyytext

static yy_state_type yy_get_previous_state (void );
static yy_state_type yy_try_NUL_trans (yy_state_type current_state );
static int yy_get_next_buffer (void );
+#if defined(__GNUC__) && __GNUC__ >= 3
+__attribute__((__noreturn__))
+#endif
static void yy_fatal_error (yyconst char msg[] );

/* Done after the current pattern has been matched and before the
- * corresponding action - sets up yytext.
+ * corresponding action - sets up mdsyytext.
*/
#define YY_DO_BEFORE_ACTION \
(yytext_ptr) = yy_bp; \
- yyleng = (size_t) (yy_cp - yy_bp); \
+ mdsyyleng = (size_t) (yy_cp - yy_bp); \
(yy_hold_char) = *yy_cp; \
*yy_cp = '\0'; \
(yy_c_buf_p) = yy_cp;
@@ -380,7 +414,7 @@ static yyconst flex_int16_t yy_accept[57] =
16, 0, 1, 0, 2, 0
} ;

-static yyconst flex_int32_t yy_ec[256] =
+static yyconst YY_CHAR yy_ec[256] =
{ 0,
1, 1, 1, 1, 1, 1, 1, 1, 2, 2,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
@@ -412,7 +446,7 @@ static yyconst flex_int32_t yy_ec[256] =
1, 1, 1, 1, 1
} ;

-static yyconst flex_int32_t yy_meta[35] =
+static yyconst YY_CHAR yy_meta[35] =
{ 0,
1, 1, 1, 1, 1, 1, 1, 1, 2, 1,
2, 1, 1, 1, 2, 2, 2, 2, 2, 2,
@@ -420,7 +454,7 @@ static yyconst flex_int32_t yy_meta[35] =
1, 2, 2, 2
} ;

-static yyconst flex_int16_t yy_base[58] =
+static yyconst flex_uint16_t yy_base[58] =
{ 0,
0, 0, 91, 92, 92, 77, 92, 61, 82, 92,
92, 3, 92, 92, 74, 92, 14, 25, 15, 56,
@@ -440,7 +474,7 @@ static yyconst flex_int16_t yy_def[58] =
17, 56, 17, 56, 56, 0, 56
} ;

-static yyconst flex_int16_t yy_nxt[127] =
+static yyconst flex_uint16_t yy_nxt[127] =
{ 0,
4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
12, 14, 15, 16, 17, 12, 12, 12, 18, 12,
@@ -479,8 +513,8 @@ static yyconst flex_int16_t yy_chk[127] =
static yy_state_type yy_last_accepting_state;
static char *yy_last_accepting_cpos;

-extern int yy_flex_debug;
-int yy_flex_debug = 0;
+extern int mdsyy_flex_debug;
+int mdsyy_flex_debug = 0;

/* The intent behind this definition is that it'll catch
* any uses of REJECT which flex missed.
@@ -489,7 +523,7 @@ int yy_flex_debug = 0;
#define yymore() yymore_used_but_not_detected
#define YY_MORE_ADJ 0
#define YY_RESTORE_YY_MORE_OFFSET
-char *yytext;
+char *mdsyytext;
#line 1 "sparql_lexer.l"
/*
Unix SMB/CIFS implementation.
@@ -515,7 +549,9 @@ char *yytext;
#include "sparql_parser.h"

#define YY_NO_INPUT
-#line 519 "sparql_lexer.c"
+#define mdsyyalloc SMB_MALLOC
+#define mdsyyrealloc SMB_REALLOC
+#line 555 "sparql_lexer.c"

#define INITIAL 0

@@ -536,31 +572,31 @@ static int yy_init_globals (void );
/* Accessor methods to globals.
These are made visible to non-reentrant scanners for convenience. */

-int yylex_destroy (void );
+int mdsyylex_destroy (void );

-int yyget_debug (void );
+int mdsyyget_debug (void );

-void yyset_debug (int debug_flag );
+void mdsyyset_debug (int debug_flag );

-YY_EXTRA_TYPE yyget_extra (void );
+YY_EXTRA_TYPE mdsyyget_extra (void );

-void yyset_extra (YY_EXTRA_TYPE user_defined );
+void mdsyyset_extra (YY_EXTRA_TYPE user_defined );

-FILE *yyget_in (void );
+FILE *mdsyyget_in (void );

-void yyset_in (FILE * in_str );
+void mdsyyset_in (FILE * _in_str );

-FILE *yyget_out (void );
+FILE *mdsyyget_out (void );

-void yyset_out (FILE * out_str );
+void mdsyyset_out (FILE * _out_str );

-yy_size_t yyget_leng (void );
+yy_size_t mdsyyget_leng (void );

-char *yyget_text (void );
+char *mdsyyget_text (void );

-int yyget_lineno (void );
+int mdsyyget_lineno (void );

-void yyset_lineno (int line_number );
+void mdsyyset_lineno (int _line_number );

/* Macros after this point can all be overridden by user definitions in
* section 1.
@@ -568,10 +604,14 @@ void yyset_lineno (int line_number );

#ifndef YY_SKIP_YYWRAP
#ifdef __cplusplus
-extern "C" int yywrap (void );
+extern "C" int mdsyywrap (void );
#else
-extern int yywrap (void );
+extern int mdsyywrap (void );
+#endif
#endif
+
+#ifndef YY_NO_UNPUT
+
#endif

#ifndef yytext_ptr
@@ -594,7 +634,12 @@ static int input (void );

/* Amount of stuff to slurp up with each read. */
#ifndef YY_READ_BUF_SIZE
+#ifdef __ia64__
+/* On IA-64, the buffer size is 16k, not 8k */
+#define YY_READ_BUF_SIZE 16384
+#else
#define YY_READ_BUF_SIZE 8192
+#endif /* __ia64__ */
#endif

/* Copy whatever the last rule matched to the standard output. */
@@ -602,7 +647,7 @@ static int input (void );
/* This used to be an fputs(), but since the string might contain NUL's,
* we now use fwrite().
*/
-#define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0)
+#define ECHO do { if (fwrite( mdsyytext, mdsyyleng, 1, mdsyyout )) {} } while (0)
#endif

/* Gets input and stuffs it into "buf". number of characters read, or YY_NULL,
@@ -615,18 +660,18 @@ static int input (void );
int c = '*'; \
size_t n; \
for ( n = 0; n < max_size && \
- (c = getc( yyin )) != EOF && c != '\n'; ++n ) \
+ (c = getc( mdsyyin )) != EOF && c != '\n'; ++n ) \
buf[n] = (char) c; \
if ( c == '\n' ) \
buf[n++] = (char) c; \
- if ( c == EOF && ferror( yyin ) ) \
+ if ( c == EOF && ferror( mdsyyin ) ) \
YY_FATAL_ERROR( "input in flex scanner failed" ); \
result = n; \
} \
else \
{ \
errno=0; \
- while ( (result = fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \
+ while ( (result = fread(buf, 1, max_size, mdsyyin))==0 && ferror(mdsyyin)) \
{ \
if( errno != EINTR) \
{ \
@@ -634,7 +679,7 @@ static int input (void );
break; \
} \
errno=0; \
- clearerr(yyin); \
+ clearerr(mdsyyin); \
} \
}\
\
@@ -667,12 +712,12 @@ static int input (void );
#ifndef YY_DECL
#define YY_DECL_IS_OURS 1

-extern int yylex (void);
+extern int mdsyylex (void);

-#define YY_DECL int yylex (void)
+#define YY_DECL int mdsyylex (void)
#endif /* !YY_DECL */

-/* Code executed at the beginning of each rule, after yytext and yyleng
+/* Code executed at the beginning of each rule, after mdsyytext and mdsyyleng
* have been set up.
*/
#ifndef YY_USER_ACTION
@@ -681,7 +726,7 @@ extern int yylex (void);

/* Code executed at the end of each rule. */
#ifndef YY_BREAK
-#define YY_BREAK break;
+#define YY_BREAK /*LINTED*/break;
#endif

#define YY_RULE_SETUP \
@@ -691,14 +736,10 @@ extern int yylex (void);
*/
YY_DECL
{
- register yy_state_type yy_current_state;
- register char *yy_cp, *yy_bp;
- register int yy_act;
+ yy_state_type yy_current_state;
+ char *yy_cp, *yy_bp;
+ int yy_act;

-#line 39 "sparql_lexer.l"
-
-#line 701 "sparql_lexer.c"
-
if ( !(yy_init) )
{
(yy_init) = 1;
@@ -710,26 +751,31 @@ YY_DECL
if ( ! (yy_start) )
(yy_start) = 1; /* first start state */

- if ( ! yyin )
- yyin = stdin;
+ if ( ! mdsyyin )
+ mdsyyin = stdin;

- if ( ! yyout )
- yyout = stdout;
+ if ( ! mdsyyout )
+ mdsyyout = stdout;

if ( ! YY_CURRENT_BUFFER ) {
--
Samba Shared Repository
Björn Jacke
2017-01-21 16:01:02 UTC
Permalink
The branch, master has been updated
via 5059c8e vfs_default: unlock the right file in copy chunk
via a5c2396 replace: fix some trailing whitespaces
via fe149d7 vfs_fruit: fix a typo
from 35460d9 s3/rpc_server/mdssvc: prefix public flex and bison global symbols

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 5059c8e2e3a6159bc2917ddd80d09fab35b39e66
Author: Björn Jacke <***@sernet.de>
Date: Thu Jan 19 21:51:41 2017 +0100

vfs_default: unlock the right file in copy chunk

Signed-off-by: Bjoern Jacke <***@sernet.de>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): Björn Jacke <***@sernet.de>
Autobuild-Date(master): Sat Jan 21 17:00:54 CET 2017 on sn-devel-144

commit a5c2396173aabb7ba1c44481a944f2238bc962f9
Author: Björn Jacke <***@sernet.de>
Date: Thu Dec 8 18:54:33 2016 +0100

replace: fix some trailing whitespaces

Signed-off-by: Bjoern Jacke <***@sernet.de>
Reviewed-by: David Disseldorp <***@samba.org>

commit fe149d7b0197e26c53cdbeca67b2d878f831ea9d
Author: Björn Jacke <***@sernet.de>
Date: Thu Jan 19 23:49:54 2017 +0100

vfs_fruit: fix a typo

Signed-off-by: Bjoern Jacke <***@sernet.de>
Reviewed-by: David Disseldorp <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
lib/replace/getifaddrs.c | 20 ++++++++++----------
source3/modules/vfs_default.c | 2 +-
source3/modules/vfs_fruit.c | 2 +-
3 files changed, 12 insertions(+), 12 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/replace/getifaddrs.c b/lib/replace/getifaddrs.c
index c2d20f8..9e377e5 100644
--- a/lib/replace/getifaddrs.c
+++ b/lib/replace/getifaddrs.c
@@ -1,4 +1,4 @@
-/*
+/*
Unix SMB/CIFS implementation.
Samba utility functions
Copyright (C) Andrew Tridgell 1998
@@ -94,17 +94,17 @@ int rep_getifaddrs(struct ifaddrs **ifap)
if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) == -1) {
return -1;
}
-
+
ifc.ifc_len = sizeof(buff);
ifc.ifc_buf = buff;

if (ioctl(fd, SIOCGIFCONF, &ifc) != 0) {
close(fd);
return -1;
- }
+ }

ifr = ifc.ifc_req;
-
+
n = ifc.ifc_len / sizeof(struct ifreq);

/* Loop through interfaces, looking for given IP address */
@@ -171,7 +171,7 @@ int rep_getifaddrs(struct ifaddrs **ifap)
close(fd);

return 0;
-}
+}

#define _FOUND_IFACE_ANY
#endif /* HAVE_IFACE_IFCONF */
@@ -200,14 +200,14 @@ int rep_getifaddrs(struct ifaddrs **ifap)
if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) == -1) {
return -1;
}
-
+
strioctl.ic_cmd = SIOCGIFCONF;
strioctl.ic_dp = buff;
strioctl.ic_len = sizeof(buff);
if (ioctl(fd, I_STR, &strioctl) < 0) {
close(fd);
return -1;
- }
+ }

/* we can ignore the possible sizeof(int) here as the resulting
number of interface structures won't change */
@@ -217,16 +217,16 @@ int rep_getifaddrs(struct ifaddrs **ifap)
at the start of the buffer if the offered size is a
multiple of the structure size plus an int */
if (n*sizeof(struct ifreq) + sizeof(int) == strioctl.ic_len) {
- ifr = (struct ifreq *)(buff + sizeof(int));
+ ifr = (struct ifreq *)(buff + sizeof(int));
} else {
- ifr = (struct ifreq *)buff;
+ ifr = (struct ifreq *)buff;
}

/* Loop through interfaces */

for (i = 0; i<n; i++) {
ifreq = ifr[i];
-
+
curif = calloc(1, sizeof(struct ifaddrs));
if (lastif == NULL) {
*ifap = curif;
diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index 4e8605b..d4610f7 100644
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -1710,7 +1710,7 @@ static struct tevent_req *vfswrap_copy_chunk_send(struct vfs_handle_struct *hand
saved_errno = errno;
}

- SMB_VFS_STRICT_UNLOCK(src_fsp->conn, src_fsp, &lck);
+ SMB_VFS_STRICT_UNLOCK(dest_fsp->conn, dest_fsp, &lck);

if (ret == -1) {
errno = saved_errno;
diff --git a/source3/modules/vfs_fruit.c b/source3/modules/vfs_fruit.c
index 605b3e0..9e8a78c 100644
--- a/source3/modules/vfs_fruit.c
+++ b/source3/modules/vfs_fruit.c
@@ -3807,7 +3807,7 @@ static void fruit_copy_chunk_done(struct tevent_req *subreq)
}

/*
- * Now copy all reamining streams. We know the share supports
+ * Now copy all remaining streams. We know the share supports
* streams, because we're in vfs_fruit. We don't do this async
* because streams are few and small.
*/
--
Samba Shared Repository
Ralph Böhme
2017-01-22 21:16:02 UTC
Permalink
The branch, master has been updated
via 02729863 selftest: Remove unsued variables WINBINDD_PRIV_PIPE_DIR and wbsockprivdir
via bd8d955 param: Remove winbindd privileged socket directory option
via a551d38 lib/util: Avoid a talloc in ms_fnmatch_protocol
via b4ed72a s3/lib: Use ms_fnmatch_protocol in mask_match
via f969be5 lib: Add "is_case_sensitive" to ms_fnmatch_protocol
via 07d9a90 lib/util/charset: Optimize next_codepoint for the ascii case
via 66cba99 s3/locking: Avoid a talloc for nonexisting fetch_share_mode_unlocked
via 27daed8 smbd: Streamline get_ea_names_from_file
via f827650 smbd: Fix an indentation
via c687924 smbd: Fix a few signed/unsigned hickups
via 1395823 lib: Avoid a "includes.h"
via 6faf30b smbd: Fix a typo
via 9bed3e3 lib: Avoid an includes.h
via 9af73f6 lib: Add lib/util/server_id.h
from 5059c8e vfs_default: unlock the right file in copy chunk

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 0272986377aecf06f00b7730379fd32b7066dc91
Author: Andrew Bartlett <***@samba.org>
Date: Wed Jan 4 07:58:15 2017 +1300

selftest: Remove unsued variables WINBINDD_PRIV_PIPE_DIR and wbsockprivdir

I can not find anything that uses these in the testsuite

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

Autobuild-User(master): Ralph Böhme <***@samba.org>
Autobuild-Date(master): Sun Jan 22 22:15:01 CET 2017 on sn-devel-144

commit bd8d9559bf8e6cdbf080902bc2460dbc12848054
Author: Andrew Bartlett <***@samba.org>
Date: Tue Jan 3 20:46:59 2017 +1300

param: Remove winbindd privileged socket directory option

This option is unused and has not been used since before Samba 4.3
when the source4/ winbindd code went away.

The associated dynconfig parameters used for the default are also removed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10066

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit a551d3826d885f22eed33aac56df697f32f854d4
Author: Volker Lendecke <***@samba.org>
Date: Tue Oct 25 12:46:00 2016 +0200

lib/util: Avoid a talloc in ms_fnmatch_protocol

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit b4ed72a2d3b08128ee03202512914cfbe21b6c91
Author: Volker Lendecke <***@samba.org>
Date: Tue Oct 25 12:28:44 2016 +0200

s3/lib: Use ms_fnmatch_protocol in mask_match

This avoids the talloc/free through push_ucs2_talloc

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit f969be54417a0d4d2bab0f854ce1c9f9d4639711
Author: Volker Lendecke <***@samba.org>
Date: Tue Oct 25 11:53:53 2016 +0200

lib: Add "is_case_sensitive" to ms_fnmatch_protocol

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 07d9a909ba6853fb0b96f6d86e4cf0d5d1b35b28
Author: Volker Lendecke <***@samba.org>
Date: Tue Oct 25 12:28:12 2016 +0200

lib/util/charset: Optimize next_codepoint for the ascii case

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 66cba9939b76fbfad91a6fe7156feb898b51b2ad
Author: Volker Lendecke <***@samba.org>
Date: Mon Oct 24 17:32:17 2016 +0200

s3/locking: Avoid a talloc for nonexisting fetch_share_mode_unlocked

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 27daed8fcf95eed2df112dc1c30c3a40b5c9565b
Author: Volker Lendecke <***@samba.org>
Date: Thu Oct 20 16:33:55 2016 +0200

smbd: Streamline get_ea_names_from_file

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit f827650c65e36526abe9d87a52966fec5be1a2dd
Author: Volker Lendecke <***@samba.org>
Date: Wed Oct 26 12:20:39 2016 +0200

smbd: Fix an indentation

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit c687924eed221b800bb29a7a3e00393b0e7876a4
Author: Volker Lendecke <***@samba.org>
Date: Wed Oct 26 12:56:53 2016 +0200

smbd: Fix a few signed/unsigned hickups

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 13958236a983531fc04a7143daf32b11745f813f
Author: Volker Lendecke <***@samba.org>
Date: Tue Oct 25 15:42:28 2016 +0200

lib: Avoid a "includes.h"

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 6faf30b31cc7394360a6d3dafbf6a1f16842f6ad
Author: Volker Lendecke <***@samba.org>
Date: Thu Oct 20 16:48:12 2016 +0200

smbd: Fix a typo

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 9bed3e3043a8a96c69669a6733c86ba63037a022
Author: Volker Lendecke <***@samba.org>
Date: Sun Jan 1 20:05:12 2017 +0000

lib: Avoid an includes.h

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 9af73f62ce87cb5d1e050a58a581dee3d790d848
Author: Volker Lendecke <***@samba.org>
Date: Sun Jan 1 20:00:55 2017 +0000

lib: Add lib/util/server_id.h

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
docs-xml/smbdotconf/generate-file-list.sh | 1 -
.../winbind/winbinddprivilegedsocketdirectory.xml | 14 ----
.../smbdotconf/winbind/winbinddsocketdirectory.xml | 2 -
dynconfig/dynconfig.c | 1 -
dynconfig/dynconfig.h | 1 -
dynconfig/wscript | 5 --
lib/param/loadparm.c | 1 -
lib/util/charset/codepoints.c | 4 +
lib/util/debug_s3.c | 1 +
lib/util/ms_fnmatch.c | 39 +++++----
lib/util/samba_util.h | 33 +-------
lib/util/server_id.c | 6 +-
lib/util/server_id.h | 56 +++++++++++++
lib/util/server_id_db.c | 1 +
selftest/selftest.pl | 1 -
selftest/target/Samba3.pm | 2 -
selftest/target/Samba4.pm | 2 -
source3/lib/dbwrap/dbwrap_watch.c | 1 +
source3/lib/g_lock.c | 1 +
source3/lib/messages.c | 1 +
source3/lib/messages_ctdbd.c | 1 +
source3/lib/messages_util.c | 1 +
source3/lib/ms_fnmatch.c | 2 +-
source3/lib/server_id_db_util.c | 1 +
source3/lib/serverid.c | 1 +
source3/lib/tevent_barrier.c | 2 +-
source3/lib/util.c | 3 +-
source3/locking/brlock.c | 1 +
source3/locking/locking.c | 1 +
source3/locking/posix.c | 1 +
source3/locking/share_mode_lock.c | 33 ++++----
source3/param/loadparm.c | 4 -
source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 1 +
source3/smbd/close.c | 1 +
source3/smbd/durable.c | 1 +
source3/smbd/notify_msg.c | 1 +
source3/smbd/notifyd/notifyd.c | 1 +
source3/smbd/open.c | 1 +
source3/smbd/oplock.c | 1 +
source3/smbd/posix_acls.c | 18 ++--
source3/smbd/scavenger.c | 2 +-
source3/smbd/server.c | 1 +
source3/smbd/sesssetup.c | 1 +
source3/smbd/smbXsrv_client.c | 1 +
source3/smbd/smbXsrv_open.c | 1 +
source3/smbd/smbXsrv_session.c | 1 +
source3/smbd/smbXsrv_tcon.c | 1 +
source3/smbd/trans2.c | 96 ++++++++++++----------
source3/torture/msg_sink.c | 1 +
source3/torture/msg_source.c | 1 +
source3/utils/net_g_lock.c | 1 +
source3/utils/net_notify.c | 1 +
source3/utils/net_serverid.c | 1 +
source3/utils/net_status.c | 1 +
source3/utils/smbcontrol.c | 1 +
source3/utils/status.c | 1 +
source4/client/client.c | 8 +-
source4/dsdb/samdb/ldb_modules/ridalloc.c | 1 +
source4/lib/messaging/messaging.c | 1 +
source4/ntvfs/cifs_posix_cli/svfs_util.c | 3 +-
source4/ntvfs/posix/pvfs_dirlist.c | 12 ++-
source4/ntvfs/simple/svfs_util.c | 3 +-
source4/scripting/devel/config_base | 1 -
source4/smb_server/smb/receive.c | 1 +
source4/smbd/server.c | 1 -
source4/smbd/service_stream.c | 1 +
source4/torture/masktest.c | 3 +-
67 files changed, 233 insertions(+), 163 deletions(-)
delete mode 100644 docs-xml/smbdotconf/winbind/winbinddprivilegedsocketdirectory.xml
create mode 100644 lib/util/server_id.h


Changeset truncated at 500 lines:

diff --git a/docs-xml/smbdotconf/generate-file-list.sh b/docs-xml/smbdotconf/generate-file-list.sh
index 6125908..9cfcd42 100755
--- a/docs-xml/smbdotconf/generate-file-list.sh
+++ b/docs-xml/smbdotconf/generate-file-list.sh
@@ -13,7 +13,6 @@ echo "<!DOCTYPE section [
<!ENTITY pathconfig.PRIVATE_DIR '\${prefix}/private'>
<!ENTITY pathconfig.SMB_PASSWD_FILE '\${prefix}/private/smbpasswd'>
<!ENTITY pathconfig.WINBINDD_SOCKET_DIR '\${prefix}/var/run/winbindd'>
-<!ENTITY pathconfig.WINBINDD_PRIVILEGED_SOCKET_DIR '\${prefix}/var/lib/winbindd_privileged'>
<!ENTITY pathconfig.CACHEDIR '\${prefix}/var/cache'>
<!ENTITY pathconfig.NTP_SIGND_SOCKET_DIR '\${prefix}/var/lib/ntp_signd'>
]>"
diff --git a/docs-xml/smbdotconf/winbind/winbinddprivilegedsocketdirectory.xml b/docs-xml/smbdotconf/winbind/winbinddprivilegedsocketdirectory.xml
deleted file mode 100644
index e8be177..0000000
--- a/docs-xml/smbdotconf/winbind/winbinddprivilegedsocketdirectory.xml
+++ /dev/null
@@ -1,14 +0,0 @@
-<samba:parameter name="winbindd privileged socket directory"
- context="G"
- type="string"
- constant="1"
- xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
-<description>
- <para>This setting controls the location of the winbind daemon's privileged
- socket.</para>
-</description>
-
-<related>winbindd socket directory</related>
-
-<value type="default">&pathconfig.WINBINDD_PRIVILEGED_SOCKET_DIR;</value>
-</samba:parameter>
diff --git a/docs-xml/smbdotconf/winbind/winbinddsocketdirectory.xml b/docs-xml/smbdotconf/winbind/winbinddsocketdirectory.xml
index 9b20fbe..e88cc2a 100644
--- a/docs-xml/smbdotconf/winbind/winbinddsocketdirectory.xml
+++ b/docs-xml/smbdotconf/winbind/winbinddsocketdirectory.xml
@@ -12,7 +12,5 @@
varaible.</para>
</description>

-<related>winbindd privileged socket directory</related>
-
<value type="default">&pathconfig.WINBINDD_SOCKET_DIR;</value>
</samba:parameter>
diff --git a/dynconfig/dynconfig.c b/dynconfig/dynconfig.c
index 9614152..e75d7db 100644
--- a/dynconfig/dynconfig.c
+++ b/dynconfig/dynconfig.c
@@ -100,7 +100,6 @@ DEFINE_DYN_CONFIG_PARAM(NMBDSOCKETDIR)
DEFINE_DYN_CONFIG_PARAM(DATADIR)
DEFINE_DYN_CONFIG_PARAM(SETUPDIR)
DEFINE_DYN_CONFIG_PARAM(WINBINDD_SOCKET_DIR) /* from winbind_struct_protocol.h in s3 autoconf */
-DEFINE_DYN_CONFIG_PARAM(WINBINDD_PRIVILEGED_SOCKET_DIR)
DEFINE_DYN_CONFIG_PARAM(NTP_SIGND_SOCKET_DIR)
DEFINE_DYN_CONFIG_PARAM(PYTHONDIR)
DEFINE_DYN_CONFIG_PARAM(PYTHONARCHDIR)
diff --git a/dynconfig/dynconfig.h b/dynconfig/dynconfig.h
index 2a45f1f..4d07c10 100644
--- a/dynconfig/dynconfig.h
+++ b/dynconfig/dynconfig.h
@@ -51,7 +51,6 @@ DEFINE_DYN_CONFIG_PROTO(NMBDSOCKETDIR)
DEFINE_DYN_CONFIG_PROTO(DATADIR)
DEFINE_DYN_CONFIG_PROTO(SETUPDIR)
DEFINE_DYN_CONFIG_PROTO(WINBINDD_SOCKET_DIR)
-DEFINE_DYN_CONFIG_PROTO(WINBINDD_PRIVILEGED_SOCKET_DIR)
DEFINE_DYN_CONFIG_PROTO(NTP_SIGND_SOCKET_DIR)
DEFINE_DYN_CONFIG_PROTO(PYTHONDIR)
DEFINE_DYN_CONFIG_PROTO(PYTHONARCHDIR)
diff --git a/dynconfig/wscript b/dynconfig/wscript
index 2d17e7c..4eaa4c0 100644
--- a/dynconfig/wscript
+++ b/dynconfig/wscript
@@ -221,11 +221,6 @@ dynconfig = {
'FHS-PATH': '${SOCKET_DIR}/winbindd',
'DELAY': True,
},
- 'WINBINDD_PRIVILEGED_SOCKET_DIR' : {
- 'STD-PATH': '${PRIVILEGED_SOCKET_DIR}/winbindd_privileged',
- 'FHS-PATH': '${PRIVILEGED_SOCKET_DIR}/winbindd_privileged',
- 'DELAY': True,
- },
'NMBDSOCKETDIR' : {
'STD-PATH': '${SOCKET_DIR}/nmbd',
'FHS-PATH': '${SOCKET_DIR}/nmbd',
diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index 6aa757f..a056101 100644
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -2648,7 +2648,6 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
lpcfg_do_global_parameter(lp_ctx, "winbind sealed pipes", "True");
lpcfg_do_global_parameter(lp_ctx, "require strong key", "True");
lpcfg_do_global_parameter(lp_ctx, "winbindd socket directory", dyn_WINBINDD_SOCKET_DIR);
- lpcfg_do_global_parameter(lp_ctx, "winbindd privileged socket directory", dyn_WINBINDD_PRIVILEGED_SOCKET_DIR);
lpcfg_do_global_parameter(lp_ctx, "ntp signd socket directory", dyn_NTP_SIGND_SOCKET_DIR);
lpcfg_do_global_parameter_var(lp_ctx, "dns update command", "%s/samba_dnsupdate", dyn_SCRIPTSBINDIR);
lpcfg_do_global_parameter_var(lp_ctx, "spn update command", "%s/samba_spnupdate", dyn_SCRIPTSBINDIR);
diff --git a/lib/util/charset/codepoints.c b/lib/util/charset/codepoints.c
index 3d444a6..2c9a9c4 100644
--- a/lib/util/charset/codepoints.c
+++ b/lib/util/charset/codepoints.c
@@ -16817,6 +16817,10 @@ _PUBLIC_ codepoint_t next_codepoint_ext(const char *str, size_t len,

_PUBLIC_ codepoint_t next_codepoint(const char *str, size_t *size)
{
+ if ((str[0] & 0x80) == 0) {
+ *size = 1;
+ return str[0];
+ }
return next_codepoint_handle(get_iconv_handle(), str, size);
}

diff --git a/lib/util/debug_s3.c b/lib/util/debug_s3.c
index b05d422..99ba2e7 100644
--- a/lib/util/debug_s3.c
+++ b/lib/util/debug_s3.c
@@ -19,6 +19,7 @@
*/

#include "includes.h"
+#include "lib/util/server_id.h"
#include "librpc/gen_ndr/messaging.h"
#include "messages.h"
#include "lib/util/memory.h"
diff --git a/lib/util/ms_fnmatch.c b/lib/util/ms_fnmatch.c
index ede9eff..c0f61ab 100644
--- a/lib/util/ms_fnmatch.c
+++ b/lib/util/ms_fnmatch.c
@@ -59,7 +59,8 @@ struct max_n {
not contain a '.', otherwise it points at the last dot in 'n'.
*/
static int ms_fnmatch_core(const char *p, const char *n,
- struct max_n *max_n, const char *ldot)
+ struct max_n *max_n, const char *ldot,
+ bool is_case_sensitive)
{
codepoint_t c, c2;
int i;
@@ -76,7 +77,7 @@ static int ms_fnmatch_core(const char *p, const char *n,
}
for (i=0; n[i]; i += size_n) {
next_codepoint(n+i, &size_n);
- if (ms_fnmatch_core(p, n+i, max_n+1, ldot) == 0) {
+ if (ms_fnmatch_core(p, n+i, max_n+1, ldot, is_case_sensitive) == 0) {
return 0;
}
}
@@ -95,9 +96,9 @@ static int ms_fnmatch_core(const char *p, const char *n,
}
for (i=0; n[i]; i += size_n) {
next_codepoint(n+i, &size_n);
- if (ms_fnmatch_core(p, n+i, max_n+1, ldot) == 0) return 0;
+ if (ms_fnmatch_core(p, n+i, max_n+1, ldot, is_case_sensitive) == 0) return 0;
if (n+i == ldot) {
- if (ms_fnmatch_core(p, n+i+size_n, max_n+1, ldot) == 0) return 0;
+ if (ms_fnmatch_core(p, n+i+size_n, max_n+1, ldot, is_case_sensitive) == 0) return 0;
if (!max_n->postdot || max_n->postdot > n) max_n->postdot = n;
return -1;
}
@@ -140,8 +141,13 @@ static int ms_fnmatch_core(const char *p, const char *n,

default:
c2 = next_codepoint(n, &size_n);
- if (c != c2 && codepoint_cmpi(c, c2) != 0) {
- return -1;
+ if (c != c2) {
+ if (is_case_sensitive) {
+ return -1;
+ }
+ if (codepoint_cmpi(c, c2) != 0) {
+ return -1;
+ }
}
n += size_n;
break;
@@ -155,10 +161,10 @@ static int ms_fnmatch_core(const char *p, const char *n,
return -1;
}

-int ms_fnmatch_protocol(const char *pattern, const char *string, int protocol)
+int ms_fnmatch_protocol(const char *pattern, const char *string, int protocol,
+ bool is_case_sensitive)
{
int ret, count, i;
- struct max_n *max_n = NULL;

if (strcmp(string, "..") == 0) {
string = ".";
@@ -193,7 +199,8 @@ int ms_fnmatch_protocol(const char *pattern, const char *string, int protocol)
p[i] = '<';
}
}
- ret = ms_fnmatch_protocol(p, string, PROTOCOL_NT1);
+ ret = ms_fnmatch_protocol(p, string, PROTOCOL_NT1,
+ is_case_sensitive);
talloc_free(p);
return ret;
}
@@ -202,14 +209,14 @@ int ms_fnmatch_protocol(const char *pattern, const char *string, int protocol)
if (pattern[i] == '*' || pattern[i] == '<') count++;
}

- max_n = talloc_zero_array(NULL, struct max_n, count);
- if (max_n == NULL) {
- return -1;
- }
+ {
+ struct max_n max_n[count];

- ret = ms_fnmatch_core(pattern, string, max_n, strrchr(string, '.'));
+ memset(max_n, 0, sizeof(struct max_n) * count);

- talloc_free(max_n);
+ ret = ms_fnmatch_core(pattern, string, max_n, strrchr(string, '.'),
+ is_case_sensitive);
+ }

return ret;
}
@@ -218,5 +225,5 @@ int ms_fnmatch_protocol(const char *pattern, const char *string, int protocol)
/** a generic fnmatch function - uses for non-CIFS pattern matching */
int gen_fnmatch(const char *pattern, const char *string)
{
- return ms_fnmatch_protocol(pattern, string, PROTOCOL_NT1);
+ return ms_fnmatch_protocol(pattern, string, PROTOCOL_NT1, false);
}
diff --git a/lib/util/samba_util.h b/lib/util/samba_util.h
index c19e246..aad44dc 100644
--- a/lib/util/samba_util.h
+++ b/lib/util/samba_util.h
@@ -526,7 +526,8 @@ _PUBLIC_ int sys_fsusage(const char *path, uint64_t *dfree, uint64_t *dsize);
* @brief MS-style Filename matching
*/

-int ms_fnmatch_protocol(const char *pattern, const char *string, int protocol);
+int ms_fnmatch_protocol(const char *pattern, const char *string, int protocol,
+ bool is_case_sensitive);

/** a generic fnmatch function - uses for non-CIFS pattern matching */
int gen_fnmatch(const char *pattern, const char *string);
@@ -688,36 +689,6 @@ char *data_path(TALLOC_CTX *mem_ctx, const char *name);
**/
const char *shlib_ext(void);

-struct server_id;
-
-struct server_id_buf { char buf[48]; }; /* probably a bit too large ... */
-char *server_id_str_buf(struct server_id id, struct server_id_buf *dst);
-size_t server_id_str_buf_unique(struct server_id id, char *buf, size_t buflen);
-
-bool server_id_same_process(const struct server_id *p1,
- const struct server_id *p2);
-bool server_id_equal(const struct server_id *p1, const struct server_id *p2);
-struct server_id server_id_from_string(uint32_t local_vnn,
- const char *pid_string);
-
-/**
- * Set the serverid to the special value that represents a disconnected
- * client for (e.g.) durable handles.
- */
-void server_id_set_disconnected(struct server_id *id);
-
-/**
- * check whether a serverid is the special placeholder for
- * a disconnected client
- */
-bool server_id_is_disconnected(const struct server_id *id);
-
-#define SERVER_ID_BUF_LENGTH 24
-void server_id_put(uint8_t buf[SERVER_ID_BUF_LENGTH],
- const struct server_id id);
-void server_id_get(struct server_id *id,
- const uint8_t buf[SERVER_ID_BUF_LENGTH]);
-
/*
* Samba code should use samba_tevent_context_init() instead of
* tevent_context_init() in order to get the debug output.
diff --git a/lib/util/server_id.c b/lib/util/server_id.c
index 77c5ee1..2904e80 100644
--- a/lib/util/server_id.c
+++ b/lib/util/server_id.c
@@ -17,7 +17,11 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/

-#include "includes.h"
+#include "replace.h"
+#include "lib/util/debug.h"
+#include "lib/util/fault.h"
+#include "lib/util/server_id.h"
+#include "lib/util/byteorder.h"
#include "librpc/gen_ndr/server_id.h"

bool server_id_same_process(const struct server_id *p1,
diff --git a/lib/util/server_id.h b/lib/util/server_id.h
new file mode 100644
index 0000000..6dda86c
--- /dev/null
+++ b/lib/util/server_id.h
@@ -0,0 +1,56 @@
+/*
+ Unix SMB/CIFS implementation.
+ Samba utility functions
+ Copyright (C) Andrew Bartlett 2011
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef __LIB_UTIL_SERVER_ID_H__
+#define __LIB_UTIL_SERVER_ID_H__
+
+#include "replace.h"
+
+struct server_id;
+
+struct server_id_buf { char buf[48]; }; /* probably a bit too large ... */
+
+bool server_id_same_process(const struct server_id *p1,
+ const struct server_id *p2);
+bool server_id_equal(const struct server_id *p1, const struct server_id *p2);
+char *server_id_str_buf(struct server_id id, struct server_id_buf *dst);
+size_t server_id_str_buf_unique(struct server_id id, char *buf, size_t buflen);
+
+struct server_id server_id_from_string(uint32_t local_vnn,
+ const char *pid_string);
+
+/**
+ * Set the serverid to the special value that represents a disconnected
+ * client for (e.g.) durable handles.
+ */
+void server_id_set_disconnected(struct server_id *id);
+
+/**
+ * check whether a serverid is the special placeholder for
+ * a disconnected client
+ */
+bool server_id_is_disconnected(const struct server_id *id);
+
+#define SERVER_ID_BUF_LENGTH 24
+void server_id_put(uint8_t buf[SERVER_ID_BUF_LENGTH],
+ const struct server_id id);
+void server_id_get(struct server_id *id,
+ const uint8_t buf[SERVER_ID_BUF_LENGTH]);
+
+#endif
diff --git a/lib/util/server_id_db.c b/lib/util/server_id_db.c
index 1e65ce2..e0b8476 100644
--- a/lib/util/server_id_db.c
+++ b/lib/util/server_id_db.c
@@ -19,6 +19,7 @@

#include "replace.h"
#include "system/filesys.h"
+#include "lib/util/server_id.h"
#include "lib/util/server_id_db.h"
#include "lib/tdb_wrap/tdb_wrap.h"
#include "lib/util/strv.h"
diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index e1c3429..14ac58f 100755
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -839,7 +839,6 @@ my @exported_envvars = (
"KRB5_CONFIG",
"KRB5CCNAME",
"SELFTEST_WINBINDD_SOCKET_DIR",
- "WINBINDD_PRIV_PIPE_DIR",
"NMBD_SOCKET_DIR",
"LOCAL_PATH",
"DNS_FORWARDER1",
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 1d77c97..1ae270a 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1239,7 +1239,6 @@ sub provision($$$$$$$$)

# this gets autocreated by winbindd
my $wbsockdir="$prefix_abs/winbindd";
- my $wbsockprivdir="$lockdir/winbindd_privileged";

my $nmbdsockdir="$prefix_abs/nmbd";
unlink($nmbdsockdir);
@@ -1963,7 +1962,6 @@ force_user:x:$gid_force_user:
$ret{PASSWORD} = $password;
$ret{PIDDIR} = $piddir;
$ret{SELFTEST_WINBINDD_SOCKET_DIR} = $wbsockdir;
- $ret{WINBINDD_PRIV_PIPE_DIR} = $wbsockprivdir;
$ret{NMBD_SOCKET_DIR} = $nmbdsockdir;
$ret{SOCKET_WRAPPER_DEFAULT_IFACE} = $swiface;
$ret{NSS_WRAPPER_PASSWD} = $nss_wrapper_passwd;
diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 8855135..dacdab4 100755
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -442,7 +442,6 @@ sub provision_raw_prepare($$$$$$$$$$$)
$ctx->{statedir} = "$prefix_abs/statedir";
$ctx->{cachedir} = "$prefix_abs/cachedir";
$ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
- $ctx->{winbindd_privileged_socket_dir} = "$prefix_abs/winbindd_privileged_socket";
$ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
$ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
$ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
@@ -560,7 +559,6 @@ sub provision_raw_step1($$)
state directory = $ctx->{statedir}
cache directory = $ctx->{cachedir}
winbindd socket directory = $ctx->{winbindd_socket_dir}
- winbindd privileged socket directory = $ctx->{winbindd_privileged_socket_dir}
ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
winbind separator = /
interfaces = $ctx->{interfaces}
diff --git a/source3/lib/dbwrap/dbwrap_watch.c b/source3/lib/dbwrap/dbwrap_watch.c
index a44f6f1..842ab86 100644
--- a/source3/lib/dbwrap/dbwrap_watch.c
+++ b/source3/lib/dbwrap/dbwrap_watch.c
@@ -19,6 +19,7 @@

#include "includes.h"
#include "system/filesys.h"
+#include "lib/util/server_id.h"
#include "dbwrap/dbwrap.h"
#include "dbwrap_watch.h"
#include "dbwrap_open.h"
diff --git a/source3/lib/g_lock.c b/source3/lib/g_lock.c
index f954978..1815796 100644
--- a/source3/lib/g_lock.c
+++ b/source3/lib/g_lock.c
@@ -19,6 +19,7 @@

#include "includes.h"
#include "system/filesys.h"
+#include "lib/util/server_id.h"
#include "dbwrap/dbwrap.h"
#include "dbwrap/dbwrap_open.h"
#include "dbwrap/dbwrap_watch.h"
diff --git a/source3/lib/messages.c b/source3/lib/messages.c
index 533e869..d7ad49d 100644
--- a/source3/lib/messages.c
+++ b/source3/lib/messages.c
@@ -46,6 +46,7 @@
*/

#include "includes.h"
+#include "lib/util/server_id.h"
#include "dbwrap/dbwrap.h"
#include "serverid.h"
#include "messages.h"
diff --git a/source3/lib/messages_ctdbd.c b/source3/lib/messages_ctdbd.c
index bee2685..a32a80d 100644
--- a/source3/lib/messages_ctdbd.c
+++ b/source3/lib/messages_ctdbd.c
@@ -18,6 +18,7 @@
*/

#include "includes.h"
+#include "lib/util/server_id.h"
#include "messages.h"
#include "util_tdb.h"
#include "lib/util/iov_buf.h"
diff --git a/source3/lib/messages_util.c b/source3/lib/messages_util.c
index 7c11ecf..d712dfe 100644
--- a/source3/lib/messages_util.c
+++ b/source3/lib/messages_util.c
@@ -18,6 +18,7 @@
*/

#include "replace.h"
+#include "lib/util/server_id.h"
#include "lib/util/samba_util.h"
#include "librpc/gen_ndr/server_id.h"
#include "lib/util/byteorder.h"
diff --git a/source3/lib/ms_fnmatch.c b/source3/lib/ms_fnmatch.c
index e32d094..9763afe 100644
--- a/source3/lib/ms_fnmatch.c
+++ b/source3/lib/ms_fnmatch.c
@@ -161,7 +161,7 @@ int ms_fnmatch(const char *pattern, const char *string, bool translate_pattern,
}

if (strpbrk(pattern, "<>*?\"") == NULL) {
- /* this is not just an optmisation - it is essential
+ /* this is not just an optimisation - it is essential
for LANMAN1 correctness */
if (is_case_sensitive) {
return strcmp(pattern, string);
diff --git a/source3/lib/server_id_db_util.c b/source3/lib/server_id_db_util.c
index 6c6d8ed..e73af24 100644
--- a/source3/lib/server_id_db_util.c
+++ b/source3/lib/server_id_db_util.c
@@ -19,6 +19,7 @@

#include "replace.h"
#include "server_id_db_util.h"
--
Samba Shared Repository
Andrew Bartlett
2017-01-23 07:27:03 UTC
Permalink
The branch, master has been updated
via 8ec6d8a Add explicit dependency on samba-debug from libinterfaces and libserverrole.
from 02729863 selftest: Remove unsued variables WINBINDD_PRIV_PIPE_DIR and wbsockprivdir

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 8ec6d8a6f27bf6330f214cdad37b396d251b03ee
Author: Zentaro Kavanagh <***@google.com>
Date: Tue Jan 17 12:40:01 2017 -0800

Add explicit dependency on samba-debug from libinterfaces and libserverrole.

Currently these dependencies are indirect via a SAMBA_SUBSYSTEM
which does not propagate private library information. This results
in these 2 libraries getting generated with no RPATH information
in the ELF header.

Additional discussion [1].

[1] -
https://lists.samba.org/archive/samba-technical/2017-January/118078.html

Signed-off-by: Zentaro Kavanagh <***@google.com>
Reviewed-by: Ralph Böhme <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

Autobuild-User(master): Andrew Bartlett <***@samba.org>
Autobuild-Date(master): Mon Jan 23 08:26:43 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
lib/param/wscript_build | 2 +-
lib/socket/wscript_build | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/param/wscript_build b/lib/param/wscript_build
index c7fe577..20c8bca 100644
--- a/lib/param/wscript_build
+++ b/lib/param/wscript_build
@@ -32,7 +32,7 @@ bld.SAMBA_GENERATOR('param_table_gen.c',

bld.SAMBA_LIBRARY('server-role',
source='loadparm_server_role.c',
- deps='samba-util',
+ deps='samba-util samba-debug',
private_library=True)

bld.SAMBA_LIBRARY('samba-hostconfig',
diff --git a/lib/socket/wscript_build b/lib/socket/wscript_build
index 61bde12..92e5aef 100644
--- a/lib/socket/wscript_build
+++ b/lib/socket/wscript_build
@@ -2,6 +2,6 @@

bld.SAMBA_LIBRARY('interfaces',
source='interfaces.c',
- deps='samba-util',
+ deps='samba-util samba-debug',
private_library=True
)
--
Samba Shared Repository
Jeremy Allison
2017-01-24 01:37:03 UTC
Permalink
The branch, master has been updated
via 9b0fc29 winbind: Don't add duplicate IDs in wbinfo -r
via a4733c7 libcli: Add an overflow check
via a3737ef libcli: Do not overwrite pointer on realloc failure
via 18332a1 winbind: Fix a typo
via 3267659 s3/smbd: check for invalid access_mask smbd_calculate_access_mask()
via a3781d1 selftest: also run test base.createx_access against ad_dc
from 8ec6d8a Add explicit dependency on samba-debug from libinterfaces and libserverrole.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 9b0fc295eff69120593211863d0253bdd9ecd0fe
Author: Volker Lendecke <***@samba.org>
Date: Wed Jan 18 16:54:03 2017 +0100

winbind: Don't add duplicate IDs in wbinfo -r

We look at the netsamlogon_cache entry twice: Once in queryuser and
once in lookupusergroups_cached. This can add the group SID twice.

Use add_sid_to_array_unique to avoid this.

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Tue Jan 24 02:36:19 CET 2017 on sn-devel-144

commit a4733c7fde1764dd42a24412c744794410e570ba
Author: Volker Lendecke <***@samba.org>
Date: Wed Jan 18 16:43:56 2017 +0100

libcli: Add an overflow check

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit a3737ef6bca739952e72e9df7a96a5dd74eea2ac
Author: Volker Lendecke <***@samba.org>
Date: Wed Jan 18 16:43:35 2017 +0100

libcli: Do not overwrite pointer on realloc failure

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 18332a1743401d0ddefce879ba1ca97bddbeba29
Author: Volker Lendecke <***@samba.org>
Date: Fri Jan 13 07:33:24 2017 +0100

winbind: Fix a typo

Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 326765923f1d384e5cd8b7fda048b459c67a4bf5
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 23 16:19:06 2017 +0100

s3/smbd: check for invalid access_mask smbd_calculate_access_mask()

This makes us pass "base.createx_access".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12536

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit a3781d1cfe7d5e7df20fc65a9a7653937f03808c
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 23 17:35:51 2017 +0100

selftest: also run test base.createx_access against ad_dc

Fails currently, will be made to work in the next commit.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12536

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
libcli/security/util_sid.c | 12 ++++--
source3/selftest/tests.py | 4 +-
source3/smbd/open.c | 6 +++
source3/winbindd/wb_gettoken.c | 81 +++++++++++++++++++----------------------
source3/winbindd/wb_sids2xids.c | 2 +-
5 files changed, 57 insertions(+), 48 deletions(-)


Changeset truncated at 500 lines:

diff --git a/libcli/security/util_sid.c b/libcli/security/util_sid.c
index 2f3fceb..ac44876 100644
--- a/libcli/security/util_sid.c
+++ b/libcli/security/util_sid.c
@@ -337,12 +337,18 @@ int sid_compare_domain(const struct dom_sid *sid1, const struct dom_sid *sid2)
NTSTATUS add_sid_to_array(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
struct dom_sid **sids, uint32_t *num)
{
- *sids = talloc_realloc(mem_ctx, *sids, struct dom_sid,
- (*num)+1);
- if (*sids == NULL) {
+ struct dom_sid *tmp;
+
+ if ((*num) == UINT32_MAX) {
+ return NT_STATUS_INTEGER_OVERFLOW;
+ }
+
+ tmp = talloc_realloc(mem_ctx, *sids, struct dom_sid, (*num)+1);
+ if (tmp == NULL) {
*num = 0;
return NT_STATUS_NO_MEMORY;
}
+ *sids = tmp;

sid_copy(&((*sids)[*num]), sid);
*num += 1;
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 37cf1a4..0b5a0ce 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -284,7 +284,7 @@ plantestsuite("samba3.async_req", "nt4_dc",

#smbtorture4 tests

-base = ["base.attr", "base.charset", "base.chkpath", "base.defer_open", "base.delaywrite", "base.delete",
+base = ["base.attr", "base.charset", "base.chkpath", "base.createx_access", "base.defer_open", "base.delaywrite", "base.delete",
"base.deny1", "base.deny2", "base.deny3", "base.denydos", "base.dir1", "base.dir2",
"base.disconnect", "base.fdpass", "base.lock",
"base.mangle", "base.negnowait", "base.ntdeny1",
@@ -340,6 +340,8 @@ tests= base + raw + smb2 + rpc + unix + local + rap + nbt + libsmbclient + idmap
for t in tests:
if t == "base.delaywrite":
plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD -k yes --maximum-runtime=900')
+ if t == "base.createx_access":
+ plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD -k yes --maximum-runtime=900')
elif t == "rap.sam":
plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD --option=doscharset=ISO-8859-1')
plansmbtorture4testsuite(t, "ad_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD --option=doscharset=ISO-8859-1')
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 404a259..931d76d 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -2275,6 +2275,12 @@ NTSTATUS smbd_calculate_access_mask(connection_struct *conn,
uint32_t orig_access_mask = access_mask;
uint32_t rejected_share_access;

+ if (access_mask & SEC_MASK_INVALID) {
+ DBG_DEBUG("access_mask [%8x] contains invalid bits\n",
+ access_mask);
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
/*
* Convert GENERIC bits to specific bits.
*/
diff --git a/source3/winbindd/wb_gettoken.c b/source3/winbindd/wb_gettoken.c
index d8867c3..07c7fc7 100644
--- a/source3/winbindd/wb_gettoken.c
+++ b/source3/winbindd/wb_gettoken.c
@@ -27,14 +27,15 @@ struct wb_gettoken_state {
struct tevent_context *ev;
struct dom_sid usersid;
bool expand_local_aliases;
- int num_sids;
+ uint32_t num_sids;
struct dom_sid *sids;
};

-static bool wb_add_rids_to_sids(TALLOC_CTX *mem_ctx,
- int *pnum_sids, struct dom_sid **psids,
- const struct dom_sid *domain_sid,
- int num_rids, uint32_t *rids);
+static NTSTATUS wb_add_rids_to_sids(TALLOC_CTX *mem_ctx,
+ uint32_t *pnum_sids,
+ struct dom_sid **psids,
+ const struct dom_sid *domain_sid,
+ int num_rids, uint32_t *rids);

static void wb_gettoken_gotuser(struct tevent_req *subreq);
static void wb_gettoken_gotlocalgroups(struct tevent_req *subreq);
@@ -70,10 +71,9 @@ static void wb_gettoken_gotuser(struct tevent_req *subreq)
subreq, struct tevent_req);
struct wb_gettoken_state *state = tevent_req_data(
req, struct wb_gettoken_state);
- struct dom_sid *sids;
struct winbindd_domain *domain;
struct wbint_userinfo *info;
- uint32_t num_groups;
+ uint32_t i, num_groups;
struct dom_sid *groups;
NTSTATUS status;

@@ -83,11 +83,10 @@ static void wb_gettoken_gotuser(struct tevent_req *subreq)
return;
}

- sids = talloc_array(state, struct dom_sid, 2);
- if (tevent_req_nomem(sids, req)) {
+ state->sids = talloc_array(state, struct dom_sid, 2);
+ if (tevent_req_nomem(state->sids, req)) {
return;
}
- state->sids = sids;
state->num_sids = 2;

sid_copy(&state->sids[0], &info->user_sid);
@@ -102,21 +101,14 @@ static void wb_gettoken_gotuser(struct tevent_req *subreq)
return;
}

- if (num_groups + state->num_sids < num_groups) {
- tevent_req_nterror(req, NT_STATUS_INTEGER_OVERFLOW);
- return;
- }
+ for (i=0; i<num_groups; i++) {
+ status = add_sid_to_array_unique(
+ state, &groups[i], &state->sids, &state->num_sids);

- sids = talloc_realloc(state, state->sids, struct dom_sid,
- state->num_sids+num_groups);
- if (tevent_req_nomem(sids, req)) {
- return;
+ if (tevent_req_nterror(req, status)) {
+ return;
+ }
}
- state->sids = sids;
-
- memcpy(&state->sids[state->num_sids], groups,
- num_groups * sizeof(struct dom_sid));
- state->num_sids += num_groups;

if (!state->expand_local_aliases) {
tevent_req_done(req);
@@ -156,9 +148,10 @@ static void wb_gettoken_gotlocalgroups(struct tevent_req *subreq)
if (tevent_req_nterror(req, status)) {
return;
}
- if (!wb_add_rids_to_sids(state, &state->num_sids, &state->sids,
- get_global_sam_sid(), num_rids, rids)) {
- tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+
+ status = wb_add_rids_to_sids(state, &state->num_sids, &state->sids,
+ get_global_sam_sid(), num_rids, rids);
+ if (tevent_req_nterror(req, status)) {
return;
}
TALLOC_FREE(rids);
@@ -196,9 +189,9 @@ static void wb_gettoken_gotbuiltins(struct tevent_req *subreq)
if (tevent_req_nterror(req, status)) {
return;
}
- if (!wb_add_rids_to_sids(state, &state->num_sids, &state->sids,
- &global_sid_Builtin, num_rids, rids)) {
- tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+ status = wb_add_rids_to_sids(state, &state->num_sids, &state->sids,
+ &global_sid_Builtin, num_rids, rids);
+ if (tevent_req_nterror(req, status)) {
return;
}
tevent_req_done(req);
@@ -219,24 +212,26 @@ NTSTATUS wb_gettoken_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
return NT_STATUS_OK;
}

-static bool wb_add_rids_to_sids(TALLOC_CTX *mem_ctx,
- int *pnum_sids, struct dom_sid **psids,
- const struct dom_sid *domain_sid,
- int num_rids, uint32_t *rids)
+static NTSTATUS wb_add_rids_to_sids(TALLOC_CTX *mem_ctx,
+ uint32_t *pnum_sids,
+ struct dom_sid **psids,
+ const struct dom_sid *domain_sid,
+ int num_rids, uint32_t *rids)
{
- struct dom_sid *sids;
int i;

- sids = talloc_realloc(mem_ctx, *psids, struct dom_sid,
- *pnum_sids + num_rids);
- if (sids == NULL) {
- return false;
- }
for (i=0; i<num_rids; i++) {
- sid_compose(&sids[i+*pnum_sids], domain_sid, rids[i]);
+ NTSTATUS status;
+ struct dom_sid sid;
+
+ sid_compose(&sid, domain_sid, rids[i]);
+
+ status = add_sid_to_array_unique(
+ mem_ctx, &sid, psids, pnum_sids);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
}

- *pnum_sids += num_rids;
- *psids = sids;
- return true;
+ return NT_STATUS_OK;
}
diff --git a/source3/winbindd/wb_sids2xids.c b/source3/winbindd/wb_sids2xids.c
index 25260be..9bb8fa8 100644
--- a/source3/winbindd/wb_sids2xids.c
+++ b/source3/winbindd/wb_sids2xids.c
@@ -40,7 +40,7 @@ struct wb_sids2xids_state {
/*
* Domain array to use for the idmap call. The output from
* lookupsids cannot be used directly since for migrated
- * objects the returned domain SID can be different that the
+ * objects the returned domain SID can be different than the
* original one. The new domain SID cannot be combined with
* the RID from the previous domain.
*
--
Samba Shared Repository
GÃŒnther Deschner
2017-01-24 13:43:03 UTC
Permalink
The branch, master has been updated
via 17a6e57 s4-torture: add more NDR tests for GetCorePrinterDrivers
via db7b812 librpc/ndr: add [to_null] keyword to szPackageId in spoolss_CorePrinterDriver.
via 56255c1 s4-torture: add some NDR tests for validating ndr_push_charset behavior.
via d30b008 pidl: use ndr_push_charset_to_null() when [to_null] keyword is used in IDL
via 303ae2a librpc/ndr: add ndr_push_charset_to_null and increase library version (abi change)
from 9b0fc29 winbind: Don't add duplicate IDs in wbinfo -r

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 17a6e57fcc37c56d4d9b52fad475531f32abac10
Author: Günther Deschner <***@samba.org>
Date: Fri Nov 25 17:32:51 2016 +0100

s4-torture: add more NDR tests for GetCorePrinterDrivers

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Günther Deschner <***@samba.org>
Autobuild-Date(master): Tue Jan 24 14:42:34 CET 2017 on sn-devel-144

commit db7b8121496bc68679b450d1a413c0d010bf7c52
Author: Günther Deschner <***@samba.org>
Date: Tue Nov 1 18:19:02 2016 +0100

librpc/ndr: add [to_null] keyword to szPackageId in spoolss_CorePrinterDriver.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 56255c1c602fa24654ac41c518a6aaa75bc6415b
Author: Günther Deschner <***@samba.org>
Date: Fri Jan 13 13:16:22 2017 +0100

s4-torture: add some NDR tests for validating ndr_push_charset behavior.

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit d30b008a642c9bb0d85519f42aef56a53e44cc77
Author: Günther Deschner <***@samba.org>
Date: Mon Jan 23 14:50:45 2017 +0100

pidl: use ndr_push_charset_to_null() when [to_null] keyword is used in IDL

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

commit 303ae2a023dda7686cfded36951ec2baad30d9b6
Author: Günther Deschner <***@samba.org>
Date: Wed Jan 11 16:57:49 2017 +0100

librpc/ndr: add ndr_push_charset_to_null and increase library version (abi change)

We were crashing earlier when calculating the length of NULL strings in
fixed size arrays (noticed while replying with an empty
spoolss_CorePrinterDriver struct within the spoolss_GetCorePrinterDrivers
call).

Guenther

Signed-off-by: Guenther Deschner <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
librpc/ABI/{ndr-0.0.8.sigs => ndr-0.0.9.sigs} | 1 +
librpc/idl/spoolss.idl | 2 +-
librpc/ndr/libndr.h | 1 +
librpc/ndr/ndr_string.c | 16 +++
librpc/wscript_build | 2 +-
pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm | 6 +-
source4/torture/ndr/charset.c | 91 ++++++++++++++++
source4/torture/ndr/ndr.c | 1 +
source4/torture/ndr/spoolss.c | 143 ++++++++++++++++++++++++++
source4/torture/wscript_build | 1 +
10 files changed, 261 insertions(+), 3 deletions(-)
copy librpc/ABI/{ndr-0.0.8.sigs => ndr-0.0.9.sigs} (99%)
create mode 100644 source4/torture/ndr/charset.c


Changeset truncated at 500 lines:

diff --git a/librpc/ABI/ndr-0.0.8.sigs b/librpc/ABI/ndr-0.0.9.sigs
similarity index 99%
copy from librpc/ABI/ndr-0.0.8.sigs
copy to librpc/ABI/ndr-0.0.9.sigs
index 6bf637c..b363b96 100644
--- a/librpc/ABI/ndr-0.0.8.sigs
+++ b/librpc/ABI/ndr-0.0.9.sigs
@@ -177,6 +177,7 @@ ndr_push_array_uint8: enum ndr_err_code (struct ndr_push *, int, const uint8_t *
ndr_push_blob: DATA_BLOB (struct ndr_push *)
ndr_push_bytes: enum ndr_err_code (struct ndr_push *, const uint8_t *, uint32_t)
ndr_push_charset: enum ndr_err_code (struct ndr_push *, int, const char *, uint32_t, uint8_t, charset_t)
+ndr_push_charset_to_null: enum ndr_err_code (struct ndr_push *, int, const char *, uint32_t, uint8_t, charset_t)
ndr_push_dlong: enum ndr_err_code (struct ndr_push *, int, int64_t)
ndr_push_double: enum ndr_err_code (struct ndr_push *, int, double)
ndr_push_enum_uint16: enum ndr_err_code (struct ndr_push *, int, uint16_t)
diff --git a/librpc/idl/spoolss.idl b/librpc/idl/spoolss.idl
index 078f69f..e759d2d 100644
--- a/librpc/idl/spoolss.idl
+++ b/librpc/idl/spoolss.idl
@@ -3288,7 +3288,7 @@ cpp_quote("#define spoolss_security_descriptor security_descriptor")
GUID core_driver_guid;
NTTIME driver_date;
hyper driver_version;
- [charset(UTF16)] uint16 szPackageID[260];
+ [charset(UTF16),to_null] uint16 szPackageID[260];
} spoolss_CorePrinterDriver;

[public] HRESULT spoolss_GetCorePrinterDrivers(
diff --git a/librpc/ndr/libndr.h b/librpc/ndr/libndr.h
index 0c3c55a..7337e86 100644
--- a/librpc/ndr/libndr.h
+++ b/librpc/ndr/libndr.h
@@ -656,6 +656,7 @@ enum ndr_err_code ndr_check_string_terminator(struct ndr_pull *ndr, uint32_t cou
enum ndr_err_code ndr_pull_charset(struct ndr_pull *ndr, int ndr_flags, const char **var, uint32_t length, uint8_t byte_mul, charset_t chset);
enum ndr_err_code ndr_pull_charset_to_null(struct ndr_pull *ndr, int ndr_flags, const char **var, uint32_t length, uint8_t byte_mul, charset_t chset);
enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags, const char *var, uint32_t length, uint8_t byte_mul, charset_t chset);
+enum ndr_err_code ndr_push_charset_to_null(struct ndr_push *ndr, int ndr_flags, const char *var, uint32_t length, uint8_t byte_mul, charset_t chset);

/* GUIDs */
bool GUID_equal(const struct GUID *u1, const struct GUID *u2);
diff --git a/librpc/ndr/ndr_string.c b/librpc/ndr/ndr_string.c
index 2229b2e..f9366b4 100644
--- a/librpc/ndr/ndr_string.c
+++ b/librpc/ndr/ndr_string.c
@@ -648,6 +648,11 @@ _PUBLIC_ enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags,

if (required) {
size_t size = 0;
+
+ if (var == NULL) {
+ return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+ }
+
if (!convert_string(CH_UNIX, chset,
var, strlen(var),
ndr->data+ndr->offset, required, &size)) {
@@ -666,6 +671,17 @@ _PUBLIC_ enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags,
return NDR_ERR_SUCCESS;
}

+_PUBLIC_ enum ndr_err_code ndr_push_charset_to_null(struct ndr_push *ndr, int ndr_flags, const char *var, uint32_t length, uint8_t byte_mul, charset_t chset)
+{
+ const char *str = var;
+
+ if (str == NULL) {
+ str = "";
+ }
+
+ return ndr_push_charset(ndr, ndr_flags, str, length, byte_mul, chset);
+}
+
/* Return number of elements in a string in the specified charset */
_PUBLIC_ uint32_t ndr_charset_length(const void *var, charset_t chset)
{
diff --git a/librpc/wscript_build b/librpc/wscript_build
index 2b4cc05..fdfe641 100644
--- a/librpc/wscript_build
+++ b/librpc/wscript_build
@@ -715,7 +715,7 @@ bld.SAMBA_LIBRARY('ndr',
public_deps='samba-errors talloc samba-util',
public_headers='gen_ndr/misc.h gen_ndr/ndr_misc.h ndr/libndr.h:ndr.h',
header_path= [('*gen_ndr*', 'gen_ndr')],
- vnum='0.0.8',
+ vnum='0.0.9',
abi_directory='ABI',
abi_match='ndr_* GUID_*',
)
diff --git a/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm b/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
index 94f4855..87ef6ce 100644
--- a/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
+++ b/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
@@ -636,7 +636,11 @@ sub ParseElementPushLevel

# Allow speedups for arrays of scalar types
if (is_charset_array($e,$l)) {
- $self->pidl("NDR_CHECK(ndr_push_charset($ndr, $ndr_flags, $var_name, $length, sizeof(" . mapTypeName($nl->{DATA_TYPE}) . "), CH_$e->{PROPERTIES}->{charset}));");
+ if ($l->{IS_TO_NULL}) {
+ $self->pidl("NDR_CHECK(ndr_push_charset_to_null($ndr, $ndr_flags, $var_name, $length, sizeof(" . mapTypeName($nl->{DATA_TYPE}) . "), CH_$e->{PROPERTIES}->{charset}));");
+ } else {
+ $self->pidl("NDR_CHECK(ndr_push_charset($ndr, $ndr_flags, $var_name, $length, sizeof(" . mapTypeName($nl->{DATA_TYPE}) . "), CH_$e->{PROPERTIES}->{charset}));");
+ }
return;
} elsif (has_fast_array($e,$l)) {
$self->pidl("NDR_CHECK(ndr_push_array_$nl->{DATA_TYPE}($ndr, $ndr_flags, $var_name, $length));");
diff --git a/source4/torture/ndr/charset.c b/source4/torture/ndr/charset.c
new file mode 100644
index 0000000..7062ce1
--- /dev/null
+++ b/source4/torture/ndr/charset.c
@@ -0,0 +1,91 @@
+/*
+ Unix SMB/CIFS implementation.
+ test suite for charset ndr operations
+
+ Copyright (C) Guenther Deschner 2017
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "torture/ndr/ndr.h"
+#include "torture/ndr/proto.h"
+
+static bool test_ndr_push_charset(struct torture_context *tctx)
+{
+ const char *strs[] = {
+ NULL,
+ "",
+ "test"
+ };
+ int i;
+
+ struct ndr_push *ndr;
+
+ ndr = talloc_zero(tctx, struct ndr_push);
+
+ for (i = 0; i < ARRAY_SIZE(strs); i++) {
+
+ enum ndr_err_code expected_ndr_err = NDR_ERR_SUCCESS;
+
+ if (strs[i] == NULL) {
+ expected_ndr_err = NDR_ERR_INVALID_POINTER;
+ }
+
+ torture_assert_ndr_err_equal(tctx,
+ ndr_push_charset(ndr, NDR_SCALARS, strs[i], 256, 2, CH_UTF16LE),
+ expected_ndr_err,
+ "failed to push charset");
+ }
+
+ return true;
+}
+
+static bool test_ndr_push_charset_to_null(struct torture_context *tctx)
+{
+ const char *strs[] = {
+ NULL,
+ "",
+ "test"
+ };
+ int i;
+
+ struct ndr_push *ndr;
+
+ ndr = talloc_zero(tctx, struct ndr_push);
+
+
+ for (i = 0; i < ARRAY_SIZE(strs); i++) {
+
+ torture_assert_ndr_success(tctx,
+ ndr_push_charset_to_null(ndr, NDR_SCALARS, strs[i], 256, 2, CH_UTF16LE),
+ "failed to push charset to null");
+ }
+
+ return true;
+}
+
+
+struct torture_suite *ndr_charset_suite(TALLOC_CTX *ctx)
+{
+ struct torture_suite *suite = torture_suite_create(ctx, "charset");
+
+ suite->description = talloc_strdup(suite, "NDR - charset focused push/pull tests");
+
+ torture_suite_add_simple_test(suite, "push", test_ndr_push_charset);
+ torture_suite_add_simple_test(suite, "push_to_null", test_ndr_push_charset_to_null);
+
+ return suite;
+}
+
diff --git a/source4/torture/ndr/ndr.c b/source4/torture/ndr/ndr.c
index d67585c..17c3b19 100644
--- a/source4/torture/ndr/ndr.c
+++ b/source4/torture/ndr/ndr.c
@@ -570,6 +570,7 @@ struct torture_suite *torture_local_ndr(TALLOC_CTX *mem_ctx)
torture_suite_add_suite(suite, ndr_string_suite(suite));
torture_suite_add_suite(suite, ndr_krb5pac_suite(suite));
torture_suite_add_suite(suite, ndr_cabinet_suite(suite));
+ torture_suite_add_suite(suite, ndr_charset_suite(suite));

torture_suite_add_simple_test(suite, "string terminator",
test_check_string_terminator);
diff --git a/source4/torture/ndr/spoolss.c b/source4/torture/ndr/spoolss.c
index 72a4f5b..1628665 100644
--- a/source4/torture/ndr/spoolss.c
+++ b/source4/torture/ndr/spoolss.c
@@ -1741,6 +1741,137 @@ static const uint8_t getcoreprinterdrivers_64_req_data[] = {
0x04, 0x00, 0x00, 0x00
};

+static const uint8_t getcoreprinterdrivers_req_data[] = {
+ 0x00, 0x00, 0x02, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x0e, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x47, 0x00, 0x44, 0x00,
+ 0x57, 0x00, 0x32, 0x00, 0x4b, 0x00, 0x38, 0x00, 0x52, 0x00, 0x32, 0x00,
+ 0x44, 0x00, 0x43, 0x00, 0x31, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,
+ 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00,
+ 0x78, 0x00, 0x36, 0x00, 0x34, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x00, 0x00,
+ 0x0e, 0x00, 0x00, 0x00, 0x63, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x6e, 0x00,
+ 0x6f, 0x00, 0x6e, 0x00, 0x5c, 0x00, 0x73, 0x00, 0x65, 0x00, 0x6e, 0x00,
+ 0x73, 0x00, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+};
+
+static const uint8_t getcoreprinterdrivers_rep_data[] = {
+ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x04, 0x07, 0x80,
+};
+
+static const uint8_t getcoreprinterdrivers_req_data_unknown_guid[] = {
+ 0x00, 0x00, 0x02, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x0e, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x47, 0x00, 0x44, 0x00,
+ 0x57, 0x00, 0x32, 0x00, 0x4b, 0x00, 0x38, 0x00, 0x52, 0x00, 0x32, 0x00,
+ 0x44, 0x00, 0x43, 0x00, 0x31, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,
+ 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00,
+ 0x78, 0x00, 0x36, 0x00, 0x34, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00,
+ 0x28, 0x00, 0x00, 0x00, 0x7b, 0x00, 0x62, 0x00, 0x38, 0x00, 0x62, 0x00,
+ 0x37, 0x00, 0x33, 0x00, 0x61, 0x00, 0x36, 0x00, 0x34, 0x00, 0x2d, 0x00,
+ 0x65, 0x00, 0x35, 0x00, 0x66, 0x00, 0x65, 0x00, 0x2d, 0x00, 0x34, 0x00,
+ 0x65, 0x00, 0x65, 0x00, 0x32, 0x00, 0x2d, 0x00, 0x61, 0x00, 0x62, 0x00,
+ 0x61, 0x00, 0x65, 0x00, 0x2d, 0x00, 0x66, 0x00, 0x39, 0x00, 0x38, 0x00,
+ 0x64, 0x00, 0x61, 0x00, 0x64, 0x00, 0x32, 0x00, 0x33, 0x00, 0x32, 0x00,
+ 0x37, 0x00, 0x38, 0x00, 0x32, 0x00, 0x7d, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x01, 0x00, 0x00, 0x00
+};
+
+static const uint8_t getcoreprinterdrivers_rep_data_unknown_guid[] = {
+ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x04, 0x07, 0x80
+};
+
static const uint8_t setjobnamedproperty_req_data[] = {
0x00, 0x00, 0x00, 0x00, 0x3d, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x50, 0xdf, 0xe4, 0xce, 0x1a, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00,
@@ -1911,6 +2042,18 @@ struct torture_suite *ndr_spoolss_suite(TALLOC_CTX *ctx)
torture_suite_add_ndr_pull_fn_test_flags(suite, spoolss_GetCorePrinterDrivers, getcoreprinterdrivers_64_req_data, NDR_IN, LIBNDR_FLAG_NDR64, NULL);
torture_suite_add_ndr_pull_fn_test_flags(suite, winspool_AsyncGetCorePrinterDrivers, getcoreprinterdrivers_64_req_data, NDR_IN, LIBNDR_FLAG_NDR64, NULL);

+ torture_suite_add_ndr_pull_fn_test(suite, spoolss_GetCorePrinterDrivers, getcoreprinterdrivers_req_data, NDR_IN, NULL);
+ torture_suite_add_ndr_pull_fn_test(suite, winspool_AsyncGetCorePrinterDrivers, getcoreprinterdrivers_req_data, NDR_IN, NULL);
+
+ torture_suite_add_ndr_pull_io_test(suite, spoolss_GetCorePrinterDrivers, getcoreprinterdrivers_req_data, getcoreprinterdrivers_rep_data, NULL);
+ torture_suite_add_ndr_pull_io_test(suite, winspool_AsyncGetCorePrinterDrivers, getcoreprinterdrivers_req_data, getcoreprinterdrivers_rep_data, NULL);
+
+ torture_suite_add_ndr_pull_fn_test(suite, spoolss_GetCorePrinterDrivers, getcoreprinterdrivers_req_data_unknown_guid, NDR_IN, NULL);
+ torture_suite_add_ndr_pull_fn_test(suite, winspool_AsyncGetCorePrinterDrivers, getcoreprinterdrivers_req_data_unknown_guid, NDR_IN, NULL);
+
+ torture_suite_add_ndr_pull_io_test(suite, spoolss_GetCorePrinterDrivers, getcoreprinterdrivers_req_data_unknown_guid, getcoreprinterdrivers_rep_data_unknown_guid, NULL);
+ torture_suite_add_ndr_pull_io_test(suite, winspool_AsyncGetCorePrinterDrivers, getcoreprinterdrivers_req_data_unknown_guid, getcoreprinterdrivers_rep_data_unknown_guid, NULL);
+
torture_suite_add_ndr_pull_fn_test(suite, spoolss_SetJobNamedProperty, setjobnamedproperty_req_data, NDR_IN, setjobnamedproperty_req_check);
torture_suite_add_ndr_pull_fn_test(suite, winspool_AsyncSetJobNamedProperty, setjobnamedproperty_req_data, NDR_IN, NULL);

diff --git a/source4/torture/wscript_build b/source4/torture/wscript_build
index 72d3d29..c065eaa 100644
--- a/source4/torture/wscript_build
+++ b/source4/torture/wscript_build
@@ -64,6 +64,7 @@ bld.SAMBA_SUBSYSTEM('TORTURE_NDR',
ndr/krb5pac.c
ndr/winspool.c
ndr/cabinet.c
+ ndr/charset.c
''',
autoproto='ndr/proto.h',
deps='torture krb5samba'
--
Samba Shared Repository
Jeremy Allison
2017-01-25 03:23:03 UTC
Permalink
The branch, master has been updated
via 2cf141e waf: backport finding of pkg-config
from 17a6e57 s4-torture: add more NDR tests for GetCorePrinterDrivers

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 2cf141ed45b4f7b7754cb9525d987ff38495d789
Author: Uri Simchoni <***@samba.org>
Date: Thu Jan 19 07:46:57 2017 +0200

waf: backport finding of pkg-config

Allow the builder to customize the location of pkg-config
utility by setting PKGCONFIG environment variable.

This is backported from upstream waf.

Thanks to Zentaro Kavanagh <***@google.com> for
pointing that out and proposing the fix.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12529

Signed-off-by: Uri Simchoni <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Wed Jan 25 04:23:00 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
third_party/waf/wafadmin/Tools/config_c.py | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/third_party/waf/wafadmin/Tools/config_c.py b/third_party/waf/wafadmin/Tools/config_c.py
index 3ab447c..cdf3b3e 100644
--- a/third_party/waf/wafadmin/Tools/config_c.py
+++ b/third_party/waf/wafadmin/Tools/config_c.py
@@ -106,7 +106,9 @@ def ret_msg(self, f, kw):
@conf
def validate_cfg(self, kw):
if not 'path' in kw:
- kw['path'] = 'pkg-config --errors-to-stdout --print-errors'
+ if not self.env.PKGCONFIG:
+ self.find_program('pkg-config', var='PKGCONFIG')
+ kw['path'] = self.env.PKGCONFIG

# pkg-config version
if 'atleast_pkgconfig_version' in kw:
--
Samba Shared Repository
Stefan Metzmacher
2017-01-27 11:04:02 UTC
Permalink
The branch, master has been updated
via 348bcca selftest/Samba3: use "server min protocol = SMB3_00" for "ktest"
via c207f2a s3:smbd: allow "server min protocol = SMB3_00" to go via "SMB 2.???" negprot
via 5c75238 s3:libsmb: use a local got_kerberos_mechanism variable in cli_session_creds_prepare_krb5()
via 022fb7e s3:client: don't use cli->use_kerberos && cli->got_kerberos_mechanism in smbspool.c
via 9d60ad5 rpc_server: Allow to configure the port range for RPC services
via 35dfa5c rpc_server: Use the RPC TCPIP ports of Windows
from 2cf141e waf: backport finding of pkg-config

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 348bcca76855798d60c04ddb30f1e13b2ac2d7cd
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Jan 25 21:15:44 2017 +0100

selftest/Samba3: use "server min protocol = SMB3_00" for "ktest"

This verifies that clients can still connect with that setting.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12540

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Fri Jan 27 12:03:39 CET 2017 on sn-devel-144

commit c207f2a989fc791b5f9bf9043d3c6ac31db5cdfd
Author: Stefan Metzmacher <***@samba.org>
Date: Wed Jan 18 08:37:30 2017 +0100

s3:smbd: allow "server min protocol = SMB3_00" to go via "SMB 2.???" negprot

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12540

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

commit 5c7523890dbb1762a84c3092dc35d63a52358d0e
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Nov 4 12:57:28 2016 +0100

s3:libsmb: use a local got_kerberos_mechanism variable in cli_session_creds_prepare_krb5()

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 022fb7ea149745fdc85bc7c6bf000b4541be9705
Author: Stefan Metzmacher <***@samba.org>
Date: Fri Nov 4 12:53:43 2016 +0100

s3:client: don't use cli->use_kerberos && cli->got_kerberos_mechanism in smbspool.c

We already know if we want to use kerberos and there's no point
in altering the error message if we tried but failed to use kerberos.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

commit 9d60ad53b809281a5a6f6ad82a0daea99c989f2d
Author: Andreas Schneider <***@samba.org>
Date: Mon Jan 16 12:05:09 2017 +0100

rpc_server: Allow to configure the port range for RPC services

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12521

Pair-Programmed-With: Stefan Metzmacher <***@samba.org>

Signed-off-by: Andreas Schneider <***@samba.org>
Signed-off-by: Stefan Metzmacher <***@samba.org>

commit 35dfa5c6e2bf60f8f1efda5eb7026cabe8bf5ba3
Author: Andreas Schneider <***@samba.org>
Date: Mon Jan 16 11:43:12 2017 +0100

rpc_server: Use the RPC TCPIP ports of Windows

Since Windows Server 2008 Microsoft uses a different port range for RPC
services. Before it was 1024-65535 and they changed it to 49152-65535.

We should use the same range as these are the ports the firewall in AD
networks normally allow.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12521

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
docs-xml/smbdotconf/protocol/rpcserverport.xml | 14 +++++--
.../smbdotconf/rpc/rpcserverdynamicportrange.xml | 22 ++++++++++
lib/param/loadparm.c | 47 ++++++++++++++++++++++
lib/param/loadparm.h | 9 ++++-
lib/param/param.h | 3 ++
python/samba/tests/docs.py | 11 +++--
selftest/target/Samba3.pm | 2 +
source3/client/smbspool.c | 17 ++++----
source3/include/client.h | 1 -
source3/include/proto.h | 2 +
source3/libsmb/cliconnect.c | 9 ++---
source3/param/loadparm.c | 16 ++++++++
source3/rpc_server/rpc_server.c | 5 +--
source3/selftest/tests.py | 6 ++-
source3/smbd/negprot.c | 23 ++++++++++-
source4/smbd/service_stream.c | 8 ++--
16 files changed, 161 insertions(+), 34 deletions(-)
create mode 100644 docs-xml/smbdotconf/rpc/rpcserverdynamicportrange.xml


Changeset truncated at 500 lines:

diff --git a/docs-xml/smbdotconf/protocol/rpcserverport.xml b/docs-xml/smbdotconf/protocol/rpcserverport.xml
index 8a70835..0fd87d6 100644
--- a/docs-xml/smbdotconf/protocol/rpcserverport.xml
+++ b/docs-xml/smbdotconf/protocol/rpcserverport.xml
@@ -4,11 +4,19 @@
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
<description>
<para>Specifies which port the server should listen on for DCE/RPC over TCP/IP traffic.</para>
- <para>This controls default port for all protocols, except for NETLOGON. If unset, the first available port after 1024 is used.</para>
- <para>The NETLOGON server will use the next available port, eg 1025. To change this port use (eg) rpc server port:netlogon = 4000.</para>
+ <para>This controls the default port for all protocols, except for NETLOGON.</para>
+ <para>If unset, the first available port from <smbconfoption name="rpc server dynamic port range"/> is used, e.g. 49152.</para>
+ <para>The NETLOGON server will use the next available port, e.g. 49153. To change this port use (eg) rpc server port:netlogon = 4000.</para>
<para>Furthermore, all RPC servers can have the port they use specified independenty, with (for example) rpc server port:drsuapi = 5000.</para>

+ <para>This option applies currently only when
+ <citerefentry><refentrytitle>samba</refentrytitle> <manvolnum>8</manvolnum></citerefentry>
+ runs as an active directory domain controller.</para>
+
+ <para>The default value 0 causes Samba to select the first available port from <smbconfoption name="rpc server dynamic port range"/>.</para>
</description>
-<para>The default value 0 causes Samba to select the first available port after 1024.</para>
+
+<related>rpc server dynamic port range</related>
+
<value type="default">0</value>
</samba:parameter>
diff --git a/docs-xml/smbdotconf/rpc/rpcserverdynamicportrange.xml b/docs-xml/smbdotconf/rpc/rpcserverdynamicportrange.xml
new file mode 100644
index 0000000..a9c51d2
--- /dev/null
+++ b/docs-xml/smbdotconf/rpc/rpcserverdynamicportrange.xml
@@ -0,0 +1,22 @@
+<samba:parameter name="rpc server dynamic port range"
+ context="G"
+ type="string"
+ handler="handle_rpc_server_dynamic_port_range"
+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+ <para>
+ This parameter tells the RPC server which port range it is
+ allowed to use to create a listening socket for LSA, SAM,
+ Netlogon and others without wellknown tcp ports.
+ The first value is the lowest number of the port
+ range and the second the hightest.
+ </para>
+ <para>
+ This applies to RPC servers in all server roles.
+ </para>
+</description>
+
+<related>rpc server port</related>
+
+<value type="default">49152-65535</value>
+</samba:parameter>
diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index a056101..335c54a 100644
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -83,6 +83,16 @@ struct loadparm_service *lpcfg_default_service(struct loadparm_context *lp_ctx)
return lp_ctx->sDefault;
}

+int lpcfg_rpc_low_port(struct loadparm_context *lp_ctx)
+{
+ return lp_ctx->globals->rpc_low_port;
+}
+
+int lpcfg_rpc_high_port(struct loadparm_context *lp_ctx)
+{
+ return lp_ctx->globals->rpc_high_port;
+}
+
/**
* Convenience routine to grab string parameters into temporary memory
* and run standard_sub_basic on them.
@@ -1435,6 +1445,37 @@ bool handle_smb_ports(struct loadparm_context *lp_ctx, struct loadparm_service *
return true;
}

+bool handle_rpc_server_dynamic_port_range(struct loadparm_context *lp_ctx,
+ struct loadparm_service *service,
+ const char *pszParmValue,
+ char **ptr)
+{
+ int low_port = -1, high_port = -1;
+ int rc;
+
+ if (pszParmValue == NULL || pszParmValue[0] == '\0') {
+ return false;
+ }
+
+ rc = sscanf(pszParmValue, "%d - %d", &low_port, &high_port);
+ if (rc != 2) {
+ return false;
+ }
+
+ if (low_port > high_port) {
+ return false;
+ }
+
+ if (low_port < SERVER_TCP_PORT_MIN|| high_port > SERVER_TCP_PORT_MAX) {
+ return false;
+ }
+
+ lp_ctx->globals->rpc_low_port = low_port;
+ lp_ctx->globals->rpc_high_port = high_port;
+
+ return true;
+}
+
bool handle_smb2_max_credits(struct loadparm_context *lp_ctx,
struct loadparm_service *service,
const char *pszParmValue, char **ptr)
@@ -2498,6 +2539,8 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
lp_ctx->globals = talloc_zero(lp_ctx, struct loadparm_global);
/* This appears odd, but globals in s3 isn't a pointer */
lp_ctx->globals->ctx = lp_ctx->globals;
+ lp_ctx->globals->rpc_low_port = SERVER_TCP_LOW_PORT;
+ lp_ctx->globals->rpc_high_port = SERVER_TCP_HIGH_PORT;
lp_ctx->sDefault = talloc_zero(lp_ctx, struct loadparm_service);
lp_ctx->flags = talloc_zero_array(lp_ctx, unsigned int, num_parameters());

@@ -2901,6 +2944,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)

lpcfg_do_global_parameter(lp_ctx, "kerberos encryption types", "all");

+ lpcfg_do_global_parameter(lp_ctx,
+ "rpc server dynamic port range",
+ "49152-65535");
+
/* Allow modules to adjust defaults */
for (defaults_hook = defaults_hooks; defaults_hook;
defaults_hook = defaults_hook->next) {
diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h
index 6d01b37..d1e2b7c 100644
--- a/lib/param/loadparm.h
+++ b/lib/param/loadparm.h
@@ -194,6 +194,11 @@ enum printing_types {PRINT_BSD,PRINT_SYSV,PRINT_AIX,PRINT_HPUX,
#endif /* DEVELOPER */
};

+#define SERVER_TCP_LOW_PORT 49152
+#define SERVER_TCP_HIGH_PORT 65535
+
+#define SERVER_TCP_PORT_MIN 1024
+#define SERVER_TCP_PORT_MAX 65535



@@ -275,7 +280,9 @@ enum mangled_names_options {MANGLED_NAMES_NO, MANGLED_NAMES_YES, MANGLED_NAMES_I
#define LOADPARM_EXTRA_GLOBALS \
struct parmlist_entry *param_opt; \
char *dnsdomain; \
- char *realm_original;
+ char *realm_original; \
+ int rpc_low_port; \
+ int rpc_high_port;

const char* server_role_str(uint32_t role);
int lp_find_server_role(int server_role, int security, int domain_logons, int domain_master);
diff --git a/lib/param/param.h b/lib/param/param.h
index 66037e2..e123e67 100644
--- a/lib/param/param.h
+++ b/lib/param/param.h
@@ -313,6 +313,9 @@ void lpcfg_default_kdc_policy(struct loadparm_context *lp_ctx,
time_t *usr_tkt_lifetime,
time_t *renewal_lifetime);

+int lpcfg_rpc_port_low(struct loadparm_context *lp_ctx);
+int lpcfg_rpc_port_high(struct loadparm_context *lp_ctx);
+
/* The following definitions come from lib/version.c */

const char *samba_version_string(void);
diff --git a/python/samba/tests/docs.py b/python/samba/tests/docs.py
index 22e0225..65df573 100644
--- a/python/samba/tests/docs.py
+++ b/python/samba/tests/docs.py
@@ -108,7 +108,7 @@ class SmbDotConfTests(TestCase):
'lprm command', 'lpq command', 'print command', 'template homedir',
'spoolss: os_major', 'spoolss: os_minor', 'spoolss: os_build',
'max open files', 'fss: prune stale', 'fss: sequence timeout',
- 'include system krb5 conf'])
+ 'include system krb5 conf', 'rpc server dynamic port range'])

def setUp(self):
super(SmbDotConfTests, self).setUp()
@@ -162,14 +162,16 @@ class SmbDotConfTests(TestCase):
exceptions = ['client lanman auth',
'client plaintext auth',
'registry shares',
- 'smb ports'])
+ 'smb ports',
+ 'rpc server dynamic port range'])
self._test_empty(['bin/testparm'])

def test_default_s4(self):
self._test_default(['bin/samba-tool', 'testparm'])
self._set_defaults(['bin/samba-tool', 'testparm'])
self._set_arbitrary(['bin/samba-tool', 'testparm'],
- exceptions = ['smb ports'])
+ exceptions = ['smb ports',
+ 'rpc server dynamic port range'])
self._test_empty(['bin/samba-tool', 'testparm'])

def _test_default(self, program):
@@ -178,6 +180,7 @@ class SmbDotConfTests(TestCase):

for tuples in self.defaults:
param, default, context, param_type = tuples
+
if param in self.special_cases:
continue
section = None
@@ -206,7 +209,7 @@ class SmbDotConfTests(TestCase):
for tuples in self.defaults:
param, default, context, param_type = tuples

- if param in ['printing']:
+ if param in ['printing', 'rpc server dynamic port range']:
continue

section = None
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 1ae270a..32f0c6f 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -791,6 +791,8 @@ sub setup_ktest($$$)
security = ads
username map = $prefix/lib/username.map
server signing = required
+ server min protocol = SMB3_00
+ client max protocol = SMB3
";

my $ret = $self->provision($prefix,
diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c
index 10e89c7..49241c7 100644
--- a/source3/client/smbspool.c
+++ b/source3/client/smbspool.c
@@ -58,7 +58,7 @@
* Local functions...
*/

-static int get_exit_code(struct cli_state * cli, NTSTATUS nt_status);
+static int get_exit_code(struct cli_state * cli, NTSTATUS nt_status, bool use_kerberos);
static void list_devices(void);
static struct cli_state *smb_complete_connection(const char *, const char *,
int, const char *, const char *, const char *, const char *, int, bool *need_auth);
@@ -328,7 +328,8 @@ done:

static int
get_exit_code(struct cli_state * cli,
- NTSTATUS nt_status)
+ NTSTATUS nt_status,
+ bool use_kerberos)
{
int i;

@@ -355,7 +356,7 @@ get_exit_code(struct cli_state * cli,
}

if (cli) {
- if (cli->use_kerberos && cli->got_kerberos_mechanism)
+ if (use_kerberos)
fputs("ATTR: auth-info-required=negotiate\n", stderr);
else
fputs("ATTR: auth-info-required=username,password\n", stderr);
@@ -449,7 +450,7 @@ smb_complete_connection(const char *myname,
if (!NT_STATUS_IS_OK(nt_status)) {
fprintf(stderr, "ERROR: Session setup failed: %s\n", nt_errstr(nt_status));

- if (get_exit_code(cli, nt_status) == 2) {
+ if (get_exit_code(cli, nt_status, use_kerberos) == 2) {
*need_auth = true;
}

@@ -463,7 +464,7 @@ smb_complete_connection(const char *myname,
fprintf(stderr, "ERROR: Tree connect failed (%s)\n",
nt_errstr(nt_status));

- if (get_exit_code(cli, nt_status) == 2) {
+ if (get_exit_code(cli, nt_status, use_kerberos) == 2) {
*need_auth = true;
}

@@ -601,7 +602,7 @@ smb_print(struct cli_state * cli, /* I - SMB connection */
if (!NT_STATUS_IS_OK(nt_status)) {
fprintf(stderr, "ERROR: %s opening remote spool %s\n",
nt_errstr(nt_status), title);
- return get_exit_code(cli, nt_status);
+ return get_exit_code(cli, nt_status, false);
}

/*
@@ -619,7 +620,7 @@ smb_print(struct cli_state * cli, /* I - SMB connection */
status = cli_writeall(cli, fnum, 0, (uint8_t *)buffer,
tbytes, nbytes, NULL);
if (!NT_STATUS_IS_OK(status)) {
- int ret = get_exit_code(cli, status);
+ int ret = get_exit_code(cli, status, false);
fprintf(stderr, "ERROR: Error writing spool: %s\n",
nt_errstr(status));
fprintf(stderr, "DEBUG: Returning status %d...\n",
@@ -635,7 +636,7 @@ smb_print(struct cli_state * cli, /* I - SMB connection */
if (!NT_STATUS_IS_OK(nt_status)) {
fprintf(stderr, "ERROR: %s closing remote spool %s\n",
nt_errstr(nt_status), title);
- return get_exit_code(cli, nt_status);
+ return get_exit_code(cli, nt_status, false);
} else {
return (0);
}
diff --git a/source3/include/client.h b/source3/include/client.h
index 43ec39b..db8260d 100644
--- a/source3/include/client.h
+++ b/source3/include/client.h
@@ -80,7 +80,6 @@ struct cli_state {
bool fallback_after_kerberos;
bool use_ccache;
bool pw_nt_hash;
- bool got_kerberos_mechanism; /* Server supports krb5 in SPNEGO. */

bool use_oplocks; /* should we use oplocks? */

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 642900e..b3d3ca0 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -889,6 +889,8 @@ int lp_client_ipc_signing(void);
int lp_smb2_max_credits(void);
int lp_cups_encrypt(void);
bool lp_widelinks(int );
+int lp_rpc_low_port(void);
+int lp_rpc_high_port(void);

int lp_wi_scan_global_parametrics(
const char *regex, size_t max_matches,
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 55768bf..a9451fb 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -228,6 +228,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
const char *pass = NULL;
const char *target_hostname = NULL;
const DATA_BLOB *server_blob = NULL;
+ bool got_kerberos_mechanism = false;
enum credentials_use_kerberos krb5_state;
bool try_kerberos = false;
bool need_kinit = false;
@@ -235,9 +236,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
int ret;

target_hostname = smbXcli_conn_remote_name(cli->conn);
- if (!cli->got_kerberos_mechanism) {
- server_blob = smbXcli_conn_server_gss_blob(cli->conn);
- }
+ server_blob = smbXcli_conn_server_gss_blob(cli->conn);

/* the server might not even do spnego */
if (server_blob != NULL && server_blob->length != 0) {
@@ -275,7 +274,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,

if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
strcmp(OIDs[i], OID_KERBEROS5) == 0) {
- cli->got_kerberos_mechanism = true;
+ got_kerberos_mechanism = true;
break;
}
}
@@ -324,7 +323,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli,
need_kinit = false;
} else if (krb5_state == CRED_MUST_USE_KERBEROS) {
need_kinit = try_kerberos;
- } else if (!cli->got_kerberos_mechanism) {
+ } else if (!got_kerberos_mechanism) {
/*
* Most likely the server doesn't support
* Kerberos, don't waste time doing a kinit
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 0ce4f92..c65e613 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -929,6 +929,12 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)

Globals.aio_max_threads = 100;

+ lpcfg_string_set(Globals.ctx,
+ &Globals.rpc_server_dynamic_port_range,
+ "49152-65535");
+ Globals.rpc_low_port = SERVER_TCP_LOW_PORT;
+ Globals.rpc_high_port = SERVER_TCP_HIGH_PORT;
+
/* Now put back the settings that were set with lp_set_cmdline() */
apply_lp_set_cmdline();
}
@@ -4548,6 +4554,16 @@ int lp_client_ipc_signing(void)
return client_ipc_signing;
}

+int lp_rpc_low_port(void)
+{
+ return Globals.rpc_low_port;
+}
+
+int lp_rpc_high_port(void)
+{
+ return Globals.rpc_high_port;
+}
+
struct loadparm_global * get_globals(void)
{
return &Globals;
diff --git a/source3/rpc_server/rpc_server.c b/source3/rpc_server/rpc_server.c
index 5effe66..f7fb8ef 100644
--- a/source3/rpc_server/rpc_server.c
+++ b/source3/rpc_server/rpc_server.c
@@ -34,9 +34,6 @@
#include "rpc_server/srv_pipe_hnd.h"
#include "rpc_server/srv_pipe.h"

-#define SERVER_TCP_LOW_PORT 1024
-#define SERVER_TCP_HIGH_PORT 1300
-
/* Creates a pipes_struct and initializes it with the information
* sent from the client */
int make_server_pipes_struct(TALLOC_CTX *mem_ctx,
@@ -608,7 +605,7 @@ int create_tcpip_socket(const struct sockaddr_storage *ifss, uint16_t *port)
if (*port == 0) {
uint16_t i;

- for (i = SERVER_TCP_LOW_PORT; i <= SERVER_TCP_HIGH_PORT; i++) {
+ for (i = lp_rpc_low_port(); i <= lp_rpc_high_port(); i++) {
fd = open_socket_in(SOCK_STREAM,
i,
0,
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 0b5a0ce..4231e1d 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -454,8 +454,12 @@ for s in signseal_options:

# We should try more combinations in future, but this is all
# the pre-calculated credentials cache supports at the moment
+ #
+ # As the ktest env requires SMB3_00 we need to use "smb2" until
+ # dcerpc client code in smbtorture support autonegotiation
+ # of any smb dialect.
e = ""
- a = ""
+ a = "smb2"
binding_string = "ncacn_np:$SERVER[%s%s%s]" % (a, s, e)
options = binding_string + " -k yes --krb5-ccache=$PREFIX/ktest/krb5_ccache-2"
plansmbtorture4testsuite(test, "ktest", options, 'krb5 with old ccache ncacn_np with [%s%s%s] ' % (a, s, e))
diff --git a/source3/smbd/negprot.c b/source3/smbd/negprot.c
index bd09b1d..cdde334 100644
--- a/source3/smbd/negprot.c
+++ b/source3/smbd/negprot.c
@@ -544,6 +544,8 @@ void reply_negprot(struct smb_request *req)
struct smbXsrv_connection *xconn = req->xconn;
struct smbd_server_connection *sconn = req->sconn;
bool signing_required = true;
+ int max_proto;
+ int min_proto;

START_PROFILE(SMBnegprot);

@@ -688,11 +690,28 @@ void reply_negprot(struct smb_request *req)
FLAG_MSG_GENERAL|FLAG_MSG_SMBD
|FLAG_MSG_PRINT_GENERAL);

+ /*
+ * Anything higher than PROTOCOL_SMB2_10 still
+ * needs to go via "SMB 2.???", which is marked
+ * as PROTOCOL_SMB2_10.
+ *
+ * The real negotiation happens via reply_smb20ff()
+ * using SMB2 Negotiation.
+ */
+ max_proto = lp_server_max_protocol();
+ if (max_proto > PROTOCOL_SMB2_10) {
+ max_proto = PROTOCOL_SMB2_10;
+ }
+ min_proto = lp_server_min_protocol();
+ if (min_proto > PROTOCOL_SMB2_10) {
+ min_proto = PROTOCOL_SMB2_10;
+ }
+
/* Check for protocols, most desirable first */
for (protocol = 0; supported_protocols[protocol].proto_name; protocol++) {
i = 0;
- if ((supported_protocols[protocol].protocol_level <= lp_server_max_protocol()) &&
- (supported_protocols[protocol].protocol_level >= lp_server_min_protocol()))
+ if ((supported_protocols[protocol].protocol_level <= max_proto) &&
+ (supported_protocols[protocol].protocol_level >= min_proto))
while (i < num_cliprotos) {
if (strequal(cliprotos[i],supported_protocols[protocol].proto_name)) {
choice = i;
diff --git a/source4/smbd/service_stream.c b/source4/smbd/service_stream.c
--
Samba Shared Repository
Ralph Böhme
2017-01-27 19:59:02 UTC
Permalink
The branch, master has been updated
via f605332 docs: Improve description of "unix_primary_group" parameter in idmap_ad manpage
from 348bcca selftest/Samba3: use "server min protocol = SMB3_00" for "ktest"

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit f605332e1b87d87e0c454bcae2a374013d3ebf82
Author: John Mulligan <***@nasuni.com>
Date: Fri Jan 13 07:33:01 2017 +0100

docs: Improve description of "unix_primary_group" parameter in idmap_ad manpage

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12542

Signed-off-by: John Mulligan <***@nasuni.com>
Reviewed-by: Volker Lendecke <***@samba.org>
Reviewed-by: Ralph Boehme <***@samba.org>

Autobuild-User(master): Ralph Böhme <***@samba.org>
Autobuild-Date(master): Fri Jan 27 20:58:18 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
docs-xml/manpages/idmap_ad.8.xml | 27 +++++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/idmap_ad.8.xml b/docs-xml/manpages/idmap_ad.8.xml
index 355c08e..fa5ae72 100644
--- a/docs-xml/manpages/idmap_ad.8.xml
+++ b/docs-xml/manpages/idmap_ad.8.xml
@@ -70,23 +70,34 @@
For SFU 3.0 or 3.5 please choose "sfu", for SFU 2.0
please choose "sfu20".

- Please note that primary group membership is currently always calculated
- via the "primaryGroupID" LDAP attribute.
+ Please note that the behavior of primary group membership is
+ controlled by the <emphasis>unix_primary_group</emphasis> option.
</para></listitem>
</varlistentry>
<varlistentry>
<term>unix_primary_group = yes/no</term>
<listitem><para>
- Defines whether to retrieve the user's primary group
- from the SFU attributes.
- </para></listitem>
+ Defines whether the user's primary group is fetched from the SFU
+ attributes or the AD primary group. If set to
+ <parameter>yes</parameter> the primary group membership is fetched
+ from the LDAP attributes (gidNumber).
+ If set to <parameter>no</parameter> the primary group membership is
+ calculated via the "primaryGroupID" LDAP attribute.
+ </para>
+ <para>Default: no</para>
+ </listitem>
</varlistentry>
<varlistentry>
<term>unix_nss_info = yes/no</term>
<listitem><para>
- Defines whether to retrieve the login shell and
- home directory from the SFU attributes.
- </para></listitem>
+ If set to <parameter>yes</parameter> winbind will retrieve the login
+ shell and home directory from the LDAP attributes. If set to
+ <parameter>no</parameter> the or the AD LDAP entry lacks the SFU
+ attributes the options <emphasis>template shell</emphasis> and
+ <emphasis>template homedir</emphasis> are used.
+ </para>
+ <para>Default: no</para>
+ </listitem>
</varlistentry>
</variablelist>
</refsect1>
--
Samba Shared Repository
Jeremy Allison
2017-01-28 00:50:03 UTC
Permalink
The branch, master has been updated
via 9a3b64a vfs_fruit: checks wrong AAPL config state and so always uses readdirattr
via 21d030e selftest: add test for global "smb encrypt=off"
via 573e8e1 selftest: disable SMB encryption in simpleserver environment
via f8d937b docs: impact of a global "smb encrypt=off" on a share with "smb encrypt=required"
via b0b418c s3/smbd: ensure global "smb encrypt = off" is effective for share with "smb encrypt = desired"
via 6ae63d4 s3/smbd: ensure global "smb encrypt = off" is effective for SMB 3.1.1 clients
via 43a90ce s3/smbd: ensure global "smb encrypt = off" is effective for SMB 1 clients
from f605332 docs: Improve description of "unix_primary_group" parameter in idmap_ad manpage

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 9a3b64a24cc21124485b423c9b70b67ff5a96f10
Author: Ralph Boehme <***@samba.org>
Date: Thu Jan 26 11:49:55 2017 +0100

vfs_fruit: checks wrong AAPL config state and so always uses readdirattr

readdirattr should only be enabled if the client enables it via AAPL
negotitiation, not for all clients when vfs_fruit is loaded.

Unfortunately the check in fruit_readdir_attr() is

if (!config->use_aapl) {
return SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
}

This uses the wrong config state "use_aapl" which is always true by
default (config option "fruit:aapl").

We must use "nego_aapl" instead which is only true if the client
really negotiated this feature.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12541

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Sat Jan 28 01:49:11 CET 2017 on sn-devel-144

commit 21d030e5bdf7dc6ef8d5f4e70bed7e70b731cd15
Author: Ralph Boehme <***@samba.org>
Date: Wed Jan 18 16:23:40 2017 +0100

selftest: add test for global "smb encrypt=off"

Test various combinations of having encryption globally turned off and
enabled (desired/required) on a share, with SMB1 UNIX Extensions and SMB3.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 573e8e15b3ed27d6b593e635e9c24eea3fdf4fb9
Author: Ralph Boehme <***@samba.org>
Date: Tue Jan 17 17:23:51 2017 +0100

selftest: disable SMB encryption in simpleserver environment

Encryption is currently not tested in this env so we can safely turn it
off. The next commit will add a blackbox tests that test combinations of
having encryption globally turned off and enabled (desired/required) on
a share.

This also adds a new share "enc_desired" with "smb encrypt = desired"
which will be used by the test in the next commit.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit f8d937b331ac985264c76d76b447683fc494d38a
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 16 15:45:32 2017 +0100

docs: impact of a global "smb encrypt=off" on a share with "smb encrypt=required"

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit b0b418c22558fa1df547df9bdac2642343ac39e1
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 16 12:56:10 2017 +0100

s3/smbd: ensure global "smb encrypt = off" is effective for share with "smb encrypt = desired"

If encryption is disabled globally, per definition we shouldn't allow
enabling encryption on individual shares.

The behaviour of specifying

[Global]
smb encrypt = off

[share]
smb encrypt = desired

must be an unecrypted tree connect to the share "share".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 6ae63d42f5aacddf5b7b6dbdfbe620344989e4e5
Author: Ralph Boehme <***@samba.org>
Date: Thu Jan 5 12:14:35 2017 +0100

s3/smbd: ensure global "smb encrypt = off" is effective for SMB 3.1.1 clients

If encryption is disabled globally, per definition we shouldn't allow
enabling encryption on individual shares.

The behaviour of setting

[Global]
smb encrypt = off

[share]
smb encrypt = required

must be to completely deny access to the share "share".

This was working correctly for clients when using SMB 3 dialects <
3.1.1, but not for 3.1.1 with a negprot encryption context.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

commit 43a90cee46bb7a70f7973c4fc51eee7634e43145
Author: Ralph Boehme <***@samba.org>
Date: Wed Jan 18 16:19:15 2017 +0100

s3/smbd: ensure global "smb encrypt = off" is effective for SMB 1 clients

If encryption is disabled globally, per definition we shouldn't allow
enabling encryption on individual shares.

The behaviour of setting

[Global]
smb encrypt = off

[share_required]
smb encrypt = required

[share_desired]
smb encrypt = desired

must be to completely deny access to the share "share_required" and an
unencrypted connection to "share_desired".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12520

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
docs-xml/smbdotconf/security/smbencrypt.xml | 6 +-
selftest/target/Samba3.pm | 6 ++
source3/modules/vfs_fruit.c | 2 +-
.../script/tests/test_smbclient_encryption_off.sh | 65 ++++++++++++++++++++++
source3/selftest/tests.py | 5 ++
source3/smbd/service.c | 12 ++++
source3/smbd/smb2_negprot.c | 2 +-
source3/smbd/smb2_tcon.c | 3 +-
8 files changed, 97 insertions(+), 4 deletions(-)
create mode 100755 source3/script/tests/test_smbclient_encryption_off.sh


Changeset truncated at 500 lines:

diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml
index 0f08966..32a22cb 100644
--- a/docs-xml/smbdotconf/security/smbencrypt.xml
+++ b/docs-xml/smbdotconf/security/smbencrypt.xml
@@ -180,7 +180,11 @@
<listitem>
<para>
Setting it to <emphasis>off</emphasis> globally will
- completely disable the encryption feature.
+ completely disable the encryption feature for all
+ connections. Setting <parameter>smb encrypt =
+ required</parameter> for individual shares (while it's
+ globally off) will deny access to this shares for all
+ clients.
</para>
</listitem>

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 32f0c6f..0ec2917 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -579,6 +579,7 @@ sub setup_simpleserver($$)
ntlm auth = yes
vfs objects = xattr_tdb streams_depot time_audit full_audit
change notify = no
+ smb encrypt = off

full_audit:syslog = no
full_audit:success = none
@@ -596,6 +597,11 @@ sub setup_simpleserver($$)
store dos attributes = yes
hide files = /hidefile/
hide dot files = yes
+
+[enc_desired]
+ path = $prefix_abs/share
+ vfs objects =
+ smb encrypt = desired
";

my $vars = $self->provision($path,
diff --git a/source3/modules/vfs_fruit.c b/source3/modules/vfs_fruit.c
index 9e8a78c..3599dcb 100644
--- a/source3/modules/vfs_fruit.c
+++ b/source3/modules/vfs_fruit.c
@@ -3539,7 +3539,7 @@ static NTSTATUS fruit_readdir_attr(struct vfs_handle_struct *handle,
struct fruit_config_data,
return NT_STATUS_UNSUCCESSFUL);

- if (!config->use_aapl) {
+ if (!config->nego_aapl) {
return SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
}

diff --git a/source3/script/tests/test_smbclient_encryption_off.sh b/source3/script/tests/test_smbclient_encryption_off.sh
new file mode 100755
index 0000000..467a4ee
--- /dev/null
+++ b/source3/script/tests/test_smbclient_encryption_off.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+
+if [ $# -lt 4 ]; then
+cat <<EOF
+Usage: test_smbclient_encryption_off.sh USERNAME PASSWORD SERVER SMBCLIENT
+EOF
+exit 1;
+fi
+
+USERNAME="$1"
+PASSWORD="$2"
+SERVER="$3"
+SMBCLIENT="$VALGRIND $4"
+
+incdir=`dirname $0`/../../../testprogs/blackbox
+. $incdir/subunit.sh
+
+failed=0
+
+#
+# Let me introduce you to the shares used in this test:
+#
+# "tmp" has the default "smb encrypt" (which is "enabled")
+# "tmpenc" has "smb encrypt = required"
+# "enc_desired" has "smb encrypt = desired"
+#
+
+# Unencrypted connections should work of course, let's test em to be sure...
+
+# SMB1
+testit "smbclient //$SERVER/enc_desired" $SMBCLIENT -U $USERNAME%$PASSWORD //$SERVER/enc_desired -c quit || failed=`expr $failed + 1`
+testit "smbclient //$SERVER/tmp" $SMBCLIENT -U $USERNAME%$PASSWORD //$SERVER/tmp -c quit || failed=`expr $failed + 1`
+# SMB3_02
+testit "smbclient -m smb3_02 //$SERVER/enc_desired" $SMBCLIENT -m smb3_02 -U $USERNAME%$PASSWORD //$SERVER/enc_desired -c quit || failed=`expr $failed + 1`
+testit "smbclient -m smb3_02 //$SERVER/tmp" $SMBCLIENT -m smb3_02 -U $USERNAME%$PASSWORD //$SERVER/tmp -c quit || failed=`expr $failed + 1`
+# SMB3_11
+testit "smbclient -m smb3_11 //$SERVER/enc_desired" $SMBCLIENT -m smb3_11 -U $USERNAME%$PASSWORD //$SERVER/enc_desired -c quit || failed=`expr $failed + 1`
+testit "smbclient -m smb3_11 //$SERVER/tmp" $SMBCLIENT -m smb3_11 -U $USERNAME%$PASSWORD //$SERVER/tmp -c quit || failed=`expr $failed + 1`
+
+# These tests must fail, as encryption is globally off and in combination with "smb
+# encrypt=required" on the share "tmpenc" the server *must* reject the tcon.
+
+# SMB1
+testit_expect_failure "smbclient //$SERVER/tmpenc" $SMBCLIENT -U $USERNAME%$PASSWORD //$SERVER/tmpenc -c quit && failed=`expr $failed + 1`
+testit_expect_failure "smbclient -e //$SERVER/tmpenc" $SMBCLIENT -e -U $USERNAME%$PASSWORD //$SERVER/tmpenc -c quit && failed=`expr $failed + 1`
+# SMB3_02
+testit_expect_failure "smbclient -m smb3_02 //$SERVER/tmpenc" $SMBCLIENT -m smb3_02 -U $USERNAME%$PASSWORD //$SERVER/tmpenc -c quit && failed=`expr $failed + 1`
+testit_expect_failure "smbclient -e -m smb3_02 //$SERVER/tmpenc" $SMBCLIENT -e -m smb3_02 -U $USERNAME%$PASSWORD //$SERVER/tmpenc -c quit && failed=`expr $failed + 1`
+# SMB3_11
+testit_expect_failure "smbclient -m smb3_11 //$SERVER/tmpenc" $SMBCLIENT -m smb3_11 -U $USERNAME%$PASSWORD //$SERVER/tmpenc -c quit && failed=`expr $failed + 1`
+testit_expect_failure "smbclient -e -m smb3_11 //$SERVER/tmpenc" $SMBCLIENT -e -m smb3_11 -U $USERNAME%$PASSWORD //$SERVER/tmpenc -c quit && failed=`expr $failed + 1`
+
+# These tests must fail, as the client requires encryption and it's off on the server
+
+# SMB1
+testit_expect_failure "smbclient -e //$SERVER/enc_desired" $SMBCLIENT -e -U $USERNAME%$PASSWORD //$SERVER/enc_desired -c quit && failed=`expr $failed + 1`
+testit_expect_failure "smbclient -e //$SERVER/tmp" $SMBCLIENT -e -U $USERNAME%$PASSWORD //$SERVER/tmp -c quit && failed=`expr $failed + 1`
+# SMB3_02
+testit_expect_failure "smbclient -e -m smb3_02 //$SERVER/enc_desired" $SMBCLIENT -e -m smb3_02 -U $USERNAME%$PASSWORD //$SERVER/enc_desired -c quit && failed=`expr $failed + 1`
+testit_expect_failure "smbclient -e -m smb3_02 //$SERVER/tmp" $SMBCLIENT -e -m smb3_02 -U $USERNAME%$PASSWORD //$SERVER/tmp -c quit && failed=`expr $failed + 1`
+# SMB3_11
+testit_expect_failure "smbclient -e -m smb3_11 //$SERVER/enc_desired" $SMBCLIENT -e -m smb3_11 -U $USERNAME%$PASSWORD //$SERVER/enc_desired -c quit && failed=`expr $failed + 1`
+testit_expect_failure "smbclient -e -m smb3_11 //$SERVER/tmp" $SMBCLIENT -e -m smb3_11 -U $USERNAME%$PASSWORD //$SERVER/tmp -c quit && failed=`expr $failed + 1`
+
+testok $0 $failed
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 4231e1d..3a6186c 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -499,6 +499,11 @@ plantestsuite("samba3.blackbox.rpcclient.pw-nt-hash", "simpleserver",
"$USERNAME", "$PASSWORD", "$SERVER",
os.path.join(bindir(), "rpcclient")])

+plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver",
+ [os.path.join(samba3srcdir, "script/tests/test_smbclient_encryption_off.sh"),
+ "$USERNAME", "$PASSWORD", "$SERVER",
+ smbclient3])
+
options_list = ["", "-e"]
for options in options_list:
plantestsuite("samba3.blackbox.smbclient_krb5 old ccache %s" % options, "ktest:local",
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 3308e9d..ce4b8da 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -623,6 +623,18 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn,
conn->short_case_preserve = lp_short_preserve_case(snum);

conn->encrypt_level = lp_smb_encrypt(snum);
+ if (conn->encrypt_level > SMB_SIGNING_OFF) {
+ if (lp_smb_encrypt(-1) == SMB_SIGNING_OFF) {
+ if (conn->encrypt_level == SMB_SIGNING_REQUIRED) {
+ DBG_ERR("Service [%s] requires encryption, but "
+ "it is disabled globally!\n",
+ lp_servicename(talloc_tos(), snum));
+ status = NT_STATUS_ACCESS_DENIED;
+ goto err_root_exit;
+ }
+ conn->encrypt_level = SMB_SIGNING_OFF;
+ }
+ }

conn->veto_list = NULL;
conn->hide_list = NULL;
diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c
index 6cfa64f..d9ccdbe 100644
--- a/source3/smbd/smb2_negprot.c
+++ b/source3/smbd/smb2_negprot.c
@@ -441,7 +441,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
req->preauth = &req->xconn->smb2.preauth;
}

- if (in_cipher != NULL) {
+ if ((capabilities & SMB2_CAP_ENCRYPTION) && (in_cipher != NULL)) {
size_t needed = 2;
uint16_t cipher_count;
const uint8_t *p;
diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c
index 61e2a36..5330fc3 100644
--- a/source3/smbd/smb2_tcon.c
+++ b/source3/smbd/smb2_tcon.c
@@ -268,7 +268,8 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
}

if ((lp_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) &&
- (conn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) {
+ (conn->smb2.server.cipher != 0))
+ {
encryption_desired = true;
}
--
Samba Shared Repository
Ralph Böhme
2017-01-28 12:27:02 UTC
Permalink
The branch, master has been updated
via 1820209 s3/rpc_server/mdssvc: Generate flex/bison files in build
from 9a3b64a vfs_fruit: checks wrong AAPL config state and so always uses readdirattr

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 1820209b9ec182ae53fd569239e9e16f090afa4a
Author: Noel Power <***@suse.com>
Date: Tue Jan 17 16:02:27 2017 +0000

s3/rpc_server/mdssvc: Generate flex/bison files in build

Build the generated files at build time instead of using a committed version
generated at some point in the past.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12528

Signed-off-by: Noel Power <***@suse.com>
Reviewed-by: Ralph Boehme <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): Ralph Böhme <***@samba.org>
Autobuild-Date(master): Sat Jan 28 13:26:01 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
source3/rpc_server/mdssvc/Makefile | 13 -
source3/rpc_server/mdssvc/mdssvc.c | 2 +-
source3/rpc_server/mdssvc/sparql_lexer.c | 1869 ----------------------
source3/rpc_server/mdssvc/sparql_lexer.l | 2 +-
source3/rpc_server/mdssvc/sparql_parser.c | 1983 ------------------------
source3/rpc_server/mdssvc/sparql_parser.h | 100 --
source3/rpc_server/mdssvc/sparql_parser.y | 8 +-
source3/rpc_server/mdssvc/sparql_parser_test.c | 2 +-
source3/rpc_server/wscript_build | 4 +-
source3/wscript | 12 +
source3/wscript_build | 4 +-
11 files changed, 23 insertions(+), 3976 deletions(-)
delete mode 100644 source3/rpc_server/mdssvc/Makefile
delete mode 100644 source3/rpc_server/mdssvc/sparql_lexer.c
delete mode 100644 source3/rpc_server/mdssvc/sparql_parser.c
delete mode 100644 source3/rpc_server/mdssvc/sparql_parser.h


Changeset truncated at 500 lines:

diff --git a/source3/rpc_server/mdssvc/Makefile b/source3/rpc_server/mdssvc/Makefile
deleted file mode 100644
index 3de4a46..0000000
--- a/source3/rpc_server/mdssvc/Makefile
+++ /dev/null
@@ -1,13 +0,0 @@
-BISON=bison
-FLEX=flex
-
-PARSER=sparql_parser
-LEXER=sparql_lexer
-
-all: $(PARSER).c $(LEXER).c
-
-$(PARSER).c: $(PARSER).y
- $(BISON) -d -o $@ $<
-
-$(LEXER).c: $(LEXER).l
- $(FLEX) -o $@ $<
diff --git a/source3/rpc_server/mdssvc/mdssvc.c b/source3/rpc_server/mdssvc/mdssvc.c
index 44d7703..c32ba0c 100644
--- a/source3/rpc_server/mdssvc/mdssvc.c
+++ b/source3/rpc_server/mdssvc/mdssvc.c
@@ -27,7 +27,7 @@
#include "lib/dbwrap/dbwrap_rbt.h"
#include "libcli/security/dom_sid.h"
#include "mdssvc.h"
-#include "sparql_parser.h"
+#include "rpc_server/mdssvc/sparql_parser.tab.h"

#undef DBGC_CLASS
#define DBGC_CLASS DBGC_RPC_SRV
diff --git a/source3/rpc_server/mdssvc/sparql_lexer.c b/source3/rpc_server/mdssvc/sparql_lexer.c
deleted file mode 100644
index 39539c5..0000000
--- a/source3/rpc_server/mdssvc/sparql_lexer.c
+++ /dev/null
@@ -1,1869 +0,0 @@
-#line 2 "sparql_lexer.c"
-
-#line 4 "sparql_lexer.c"
-
-#define YY_INT_ALIGNED short int
-
-/* A lexical scanner generated by flex */
-
-#define yy_create_buffer mdsyy_create_buffer
-#define yy_delete_buffer mdsyy_delete_buffer
-#define yy_flex_debug mdsyy_flex_debug
-#define yy_init_buffer mdsyy_init_buffer
-#define yy_flush_buffer mdsyy_flush_buffer
-#define yy_load_buffer_state mdsyy_load_buffer_state
-#define yy_switch_to_buffer mdsyy_switch_to_buffer
-#define yyin mdsyyin
-#define yyleng mdsyyleng
-#define yylex mdsyylex
-#define yylineno mdsyylineno
-#define yyout mdsyyout
-#define yyrestart mdsyyrestart
-#define yytext mdsyytext
-#define yywrap mdsyywrap
-#define yyalloc mdsyyalloc
-#define yyrealloc mdsyyrealloc
-#define yyfree mdsyyfree
-
-#define FLEX_SCANNER
-#define YY_FLEX_MAJOR_VERSION 2
-#define YY_FLEX_MINOR_VERSION 6
-#define YY_FLEX_SUBMINOR_VERSION 0
-#if YY_FLEX_SUBMINOR_VERSION > 0
-#define FLEX_BETA
-#endif
-
-/* First, we deal with platform-specific or compiler-specific issues. */
-
-/* begin standard C headers. */
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <stdlib.h>
-
-/* end standard C headers. */
-
-/* flex integer type definitions */
-
-#ifndef FLEXINT_H
-#define FLEXINT_H
-
-/* C99 systems have <inttypes.h>. Non-C99 systems may or may not. */
-
-#if defined (__STDC_VERSION__) && __STDC_VERSION__ >= 199901L
-
-/* C99 says to define __STDC_LIMIT_MACROS before including stdint.h,
- * if you want the limit (max/min) macros for int types.
- */
-#ifndef __STDC_LIMIT_MACROS
-#define __STDC_LIMIT_MACROS 1
-#endif
-
-#include <inttypes.h>
-typedef int8_t flex_int8_t;
-typedef uint8_t flex_uint8_t;
-typedef int16_t flex_int16_t;
-typedef uint16_t flex_uint16_t;
-typedef int32_t flex_int32_t;
-typedef uint32_t flex_uint32_t;
-#else
-typedef signed char flex_int8_t;
-typedef short int flex_int16_t;
-typedef int flex_int32_t;
-typedef unsigned char flex_uint8_t;
-typedef unsigned short int flex_uint16_t;
-typedef unsigned int flex_uint32_t;
-
-/* Limits of integral types. */
-#ifndef INT8_MIN
-#define INT8_MIN (-128)
-#endif
-#ifndef INT16_MIN
-#define INT16_MIN (-32767-1)
-#endif
-#ifndef INT32_MIN
-#define INT32_MIN (-2147483647-1)
-#endif
-#ifndef INT8_MAX
-#define INT8_MAX (127)
-#endif
-#ifndef INT16_MAX
-#define INT16_MAX (32767)
-#endif
-#ifndef INT32_MAX
-#define INT32_MAX (2147483647)
-#endif
-#ifndef UINT8_MAX
-#define UINT8_MAX (255U)
-#endif
-#ifndef UINT16_MAX
-#define UINT16_MAX (65535U)
-#endif
-#ifndef UINT32_MAX
-#define UINT32_MAX (4294967295U)
-#endif
-
-#endif /* ! C99 */
-
-#endif /* ! FLEXINT_H */
-
-#ifdef __cplusplus
-
-/* The "const" storage-class-modifier is valid. */
-#define YY_USE_CONST
-
-#else /* ! __cplusplus */
-
-/* C99 requires __STDC__ to be defined as 1. */
-#if defined (__STDC__)
-
-#define YY_USE_CONST
-
-#endif /* defined (__STDC__) */
-#endif /* ! __cplusplus */
-
-#ifdef YY_USE_CONST
-#define yyconst const
-#else
-#define yyconst
-#endif
-
-/* Returned upon end-of-file. */
-#define YY_NULL 0
-
-/* Promotes a possibly negative, possibly signed char to an unsigned
- * integer for use as an array index. If the signed char is negative,
- * we want to instead treat it as an 8-bit unsigned char, hence the
- * double cast.
- */
-#define YY_SC_TO_UI(c) ((unsigned int) (unsigned char) c)
-
-/* Enter a start condition. This macro really ought to take a parameter,
- * but we do it the disgusting crufty way forced on us by the ()-less
- * definition of BEGIN.
- */
-#define BEGIN (yy_start) = 1 + 2 *
-
-/* Translate the current start state into a value that can be later handed
- * to BEGIN to return to the state. The YYSTATE alias is for lex
- * compatibility.
- */
-#define YY_START (((yy_start) - 1) / 2)
-#define YYSTATE YY_START
-
-/* Action number for EOF rule of a given start state. */
-#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1)
-
-/* Special action meaning "start processing a new file". */
-#define YY_NEW_FILE mdsyyrestart(mdsyyin )
-
-#define YY_END_OF_BUFFER_CHAR 0
-
-/* Size of default input buffer. */
-#ifndef YY_BUF_SIZE
-#ifdef __ia64__
-/* On IA-64, the buffer size is 16k, not 8k.
- * Moreover, YY_BUF_SIZE is 2*YY_READ_BUF_SIZE in the general case.
- * Ditto for the __ia64__ case accordingly.
- */
-#define YY_BUF_SIZE 32768
-#else
-#define YY_BUF_SIZE 16384
-#endif /* __ia64__ */
-#endif
-
-/* The state buf must be large enough to hold one state per character in the main buffer.
- */
-#define YY_STATE_BUF_SIZE ((YY_BUF_SIZE + 2) * sizeof(yy_state_type))
-
-#ifndef YY_TYPEDEF_YY_BUFFER_STATE
-#define YY_TYPEDEF_YY_BUFFER_STATE
-typedef struct yy_buffer_state *YY_BUFFER_STATE;
-#endif
-
-#ifndef YY_TYPEDEF_YY_SIZE_T
-#define YY_TYPEDEF_YY_SIZE_T
-typedef size_t yy_size_t;
-#endif
-
-extern yy_size_t mdsyyleng;
-
-extern FILE *mdsyyin, *mdsyyout;
-
-#define EOB_ACT_CONTINUE_SCAN 0
-#define EOB_ACT_END_OF_FILE 1
-#define EOB_ACT_LAST_MATCH 2
-
- #define YY_LESS_LINENO(n)
- #define YY_LINENO_REWIND_TO(ptr)
-
-/* Return all but the first "n" matched characters back to the input stream. */
-#define yyless(n) \
- do \
- { \
- /* Undo effects of setting up mdsyytext. */ \
- yy_size_t yyless_macro_arg = (n); \
- YY_LESS_LINENO(yyless_macro_arg);\
- *yy_cp = (yy_hold_char); \
- YY_RESTORE_YY_MORE_OFFSET \
- (yy_c_buf_p) = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \
- YY_DO_BEFORE_ACTION; /* set up mdsyytext again */ \
- } \
- while ( 0 )
-
-#define unput(c) yyunput( c, (yytext_ptr) )
-
-#ifndef YY_STRUCT_YY_BUFFER_STATE
-#define YY_STRUCT_YY_BUFFER_STATE
-struct yy_buffer_state
- {
- FILE *yy_input_file;
-
- char *yy_ch_buf; /* input buffer */
- char *yy_buf_pos; /* current position in input buffer */
-
- /* Size of input buffer in bytes, not including room for EOB
- * characters.
- */
- yy_size_t yy_buf_size;
-
- /* Number of characters read into yy_ch_buf, not including EOB
- * characters.
- */
- yy_size_t yy_n_chars;
-
- /* Whether we "own" the buffer - i.e., we know we created it,
- * and can realloc() it to grow it, and should free() it to
- * delete it.
- */
- int yy_is_our_buffer;
-
- /* Whether this is an "interactive" input source; if so, and
- * if we're using stdio for input, then we want to use getc()
- * instead of fread(), to make sure we stop fetching input after
- * each newline.
- */
- int yy_is_interactive;
-
- /* Whether we're considered to be at the beginning of a line.
- * If so, '^' rules will be active on the next match, otherwise
- * not.
- */
- int yy_at_bol;
-
- int yy_bs_lineno; /**< The line count. */
- int yy_bs_column; /**< The column count. */
-
- /* Whether to try to fill the input buffer when we reach the
- * end of it.
- */
- int yy_fill_buffer;
-
- int yy_buffer_status;
-
-#define YY_BUFFER_NEW 0
-#define YY_BUFFER_NORMAL 1
- /* When an EOF's been seen but there's still some text to process
- * then we mark the buffer as YY_EOF_PENDING, to indicate that we
- * shouldn't try reading from the input source any more. We might
- * still have a bunch of tokens to match, though, because of
- * possible backing-up.
- *
- * When we actually see the EOF, we change the status to "new"
- * (via mdsyyrestart()), so that the user can continue scanning by
- * just pointing mdsyyin at a new input file.
- */
-#define YY_BUFFER_EOF_PENDING 2
-
- };
-#endif /* !YY_STRUCT_YY_BUFFER_STATE */
-
-/* Stack of input buffers. */
-static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */
-static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */
-static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */
-
-/* We provide macros for accessing buffer states in case in the
- * future we want to put the buffer states in a more general
- * "scanner state".
- *
- * Returns the top of the stack, or NULL.
- */
-#define YY_CURRENT_BUFFER ( (yy_buffer_stack) \
- ? (yy_buffer_stack)[(yy_buffer_stack_top)] \
- : NULL)
-
-/* Same as previous macro, but useful when we know that the buffer stack is not
- * NULL or when we need an lvalue. For internal use only.
- */
-#define YY_CURRENT_BUFFER_LVALUE (yy_buffer_stack)[(yy_buffer_stack_top)]
-
-/* yy_hold_char holds the character lost when mdsyytext is formed. */
-static char yy_hold_char;
-static yy_size_t yy_n_chars; /* number of characters read into yy_ch_buf */
-yy_size_t mdsyyleng;
-
-/* Points to current character in buffer. */
-static char *yy_c_buf_p = (char *) 0;
-static int yy_init = 0; /* whether we need to initialize */
-static int yy_start = 0; /* start state number */
-
-/* Flag which is used to allow mdsyywrap()'s to do buffer switches
- * instead of setting up a fresh mdsyyin. A bit of a hack ...
- */
-static int yy_did_buffer_switch_on_eof;
-
-void mdsyyrestart (FILE *input_file );
-void mdsyy_switch_to_buffer (YY_BUFFER_STATE new_buffer );
-YY_BUFFER_STATE mdsyy_create_buffer (FILE *file,int size );
-void mdsyy_delete_buffer (YY_BUFFER_STATE b );
-void mdsyy_flush_buffer (YY_BUFFER_STATE b );
-void mdsyypush_buffer_state (YY_BUFFER_STATE new_buffer );
-void mdsyypop_buffer_state (void );
-
-static void mdsyyensure_buffer_stack (void );
-static void mdsyy_load_buffer_state (void );
-static void mdsyy_init_buffer (YY_BUFFER_STATE b,FILE *file );
-
-#define YY_FLUSH_BUFFER mdsyy_flush_buffer(YY_CURRENT_BUFFER )
-
-YY_BUFFER_STATE mdsyy_scan_buffer (char *base,yy_size_t size );
-YY_BUFFER_STATE mdsyy_scan_string (yyconst char *yy_str );
-YY_BUFFER_STATE mdsyy_scan_bytes (yyconst char *bytes,yy_size_t len );
-
-void *mdsyyalloc (yy_size_t );
-void *mdsyyrealloc (void *,yy_size_t );
-void mdsyyfree (void * );
-
-#define yy_new_buffer mdsyy_create_buffer
-
-#define yy_set_interactive(is_interactive) \
- { \
- if ( ! YY_CURRENT_BUFFER ){ \
- mdsyyensure_buffer_stack (); \
- YY_CURRENT_BUFFER_LVALUE = \
- mdsyy_create_buffer(mdsyyin,YY_BUF_SIZE ); \
- } \
- YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \
- }
-
-#define yy_set_bol(at_bol) \
- { \
- if ( ! YY_CURRENT_BUFFER ){\
- mdsyyensure_buffer_stack (); \
- YY_CURRENT_BUFFER_LVALUE = \
- mdsyy_create_buffer(mdsyyin,YY_BUF_SIZE ); \
- } \
- YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \
- }
-
-#define YY_AT_BOL() (YY_CURRENT_BUFFER_LVALUE->yy_at_bol)
-
-/* Begin user sect3 */
-
-typedef unsigned char YY_CHAR;
-
-FILE *mdsyyin = (FILE *) 0, *mdsyyout = (FILE *) 0;
-
-typedef int yy_state_type;
-
-extern int mdsyylineno;
-
-int mdsyylineno = 1;
-
-extern char *mdsyytext;
-#ifdef yytext_ptr
-#undef yytext_ptr
-#endif
-#define yytext_ptr mdsyytext
-
-static yy_state_type yy_get_previous_state (void );
-static yy_state_type yy_try_NUL_trans (yy_state_type current_state );
-static int yy_get_next_buffer (void );
-#if defined(__GNUC__) && __GNUC__ >= 3
-__attribute__((__noreturn__))
-#endif
-static void yy_fatal_error (yyconst char msg[] );
-
-/* Done after the current pattern has been matched and before the
- * corresponding action - sets up mdsyytext.
- */
-#define YY_DO_BEFORE_ACTION \
- (yytext_ptr) = yy_bp; \
- mdsyyleng = (size_t) (yy_cp - yy_bp); \
- (yy_hold_char) = *yy_cp; \
- *yy_cp = '\0'; \
- (yy_c_buf_p) = yy_cp;
-
-#define YY_NUM_RULES 18
-#define YY_END_OF_BUFFER 19
-/* This struct is not used in this scanner,
- but its presence is necessary. */
-struct yy_trans_info
- {
- flex_int32_t yy_verify;
- flex_int32_t yy_nxt;
- };
-static yyconst flex_int16_t yy_accept[57] =
- { 0,
- 0, 0, 19, 18, 17, 18, 5, 18, 18, 6,
- 7, 16, 15, 13, 12, 14, 16, 16, 16, 18,
- 18, 18, 18, 11, 0, 8, 16, 0, 0, 0,
- 10, 16, 16, 16, 9, 0, 0, 0, 16, 16,
- 16, 0, 0, 16, 16, 4, 0, 16, 3, 0,
- 16, 0, 1, 0, 2, 0
- } ;
-
-static yyconst YY_CHAR yy_ec[256] =
- { 0,
- 1, 1, 1, 1, 1, 1, 1, 1, 2, 2,
- 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
- 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
- 1, 2, 3, 4, 1, 5, 1, 6, 1, 7,
- 8, 9, 1, 10, 9, 11, 1, 9, 9, 9,
- 9, 9, 9, 9, 9, 9, 9, 9, 1, 12,
- 13, 14, 1, 1, 9, 9, 9, 9, 9, 9,
- 9, 9, 15, 9, 9, 9, 9, 9, 9, 9,
- 9, 16, 9, 9, 9, 9, 9, 9, 9, 9,
- 1, 1, 1, 1, 9, 1, 17, 9, 9, 9,
-
- 18, 19, 20, 9, 21, 9, 9, 22, 23, 24,
- 25, 9, 9, 26, 27, 28, 29, 9, 9, 9,
- 9, 9, 1, 30, 1, 1, 1, 31, 31, 31,
- 31, 31, 31, 31, 31, 31, 31, 31, 31, 31,
- 31, 31, 31, 31, 31, 31, 31, 31, 31, 31,
- 31, 31, 31, 31, 31, 31, 31, 31, 31, 31,
- 31, 31, 31, 31, 31, 31, 31, 31, 31, 31,
- 31, 31, 31, 31, 31, 31, 31, 31, 31, 31,
- 31, 31, 31, 31, 31, 31, 31, 31, 31, 31,
- 31, 1, 1, 32, 32, 32, 32, 32, 32, 32,
-
- 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
- 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
- 32, 32, 32, 33, 33, 33, 33, 33, 33, 33,
- 33, 33, 33, 33, 33, 33, 33, 33, 33, 34,
- 34, 34, 34, 34, 1, 1, 1, 1, 1, 1,
- 1, 1, 1, 1, 1
- } ;
-
-static yyconst YY_CHAR yy_meta[35] =
- { 0,
- 1, 1, 1, 1, 1, 1, 1, 1, 2, 1,
- 2, 1, 1, 1, 2, 2, 2, 2, 2, 2,
- 2, 2, 2, 2, 2, 2, 2, 2, 2, 1,
- 1, 2, 2, 2
- } ;
-
-static yyconst flex_uint16_t yy_base[58] =
- { 0,
- 0, 0, 91, 92, 92, 77, 92, 61, 82, 92,
- 92, 3, 92, 92, 74, 92, 14, 25, 15, 56,
- 54, 53, 52, 92, 61, 92, 57, 49, 48, 47,
- 92, 27, 28, 16, 92, 46, 45, 52, 36, 30,
--
Samba Shared Repository
Ralph Böhme
2017-01-30 11:25:02 UTC
Permalink
The branch, master has been updated
via 73deaec s3:winbindd: document "winbind:ignore domains"
from 1820209 s3/rpc_server/mdssvc: Generate flex/bison files in build

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 73deaecbd598dcda5b213c07bf9593fca2290c72
Author: David Mulder <***@suse.com>
Date: Mon Jan 23 14:44:03 2017 -0700

s3:winbindd: document "winbind:ignore domains"

The "winbind:ignore domains" smb.conf option is undocumented but used frequently.

Signed-off-by: David Mulder <***@suse.com>
Reviewed-by: Ralph Boehme <***@samba.org>
Reviewed-by: Andrew Bartlett <***@samba.org>

Autobuild-User(master): Ralph Böhme <***@samba.org>
Autobuild-Date(master): Mon Jan 30 12:24:47 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
docs-xml/smbdotconf/winbind/winbindignoredomains.xml | 14 ++++++++++++++
1 file changed, 14 insertions(+)
create mode 100644 docs-xml/smbdotconf/winbind/winbindignoredomains.xml


Changeset truncated at 500 lines:

diff --git a/docs-xml/smbdotconf/winbind/winbindignoredomains.xml b/docs-xml/smbdotconf/winbind/winbindignoredomains.xml
new file mode 100644
index 0000000..62a8f863
--- /dev/null
+++ b/docs-xml/smbdotconf/winbind/winbindignoredomains.xml
@@ -0,0 +1,14 @@
+<samba:parameter name="winbind:ignore domains"
+ context="G"
+ type="cmdlist"
+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+ <para>Allows to enter a list of trusted domains winbind should
+ ignore (untrust). This can avoid the overhead of resources from
+ attempting to login to DCs that should not be communicated with.
+ </para>
+
+</description>
+<value type="default"></value>
+<value type="example">DOMAIN1, DOMAIN2</value>
+</samba:parameter>
--
Samba Shared Repository
David Disseldorp
2017-01-30 16:25:02 UTC
Permalink
The branch, master has been updated
via 26ffc20 build: vfs_posix_eadb is only built with the AD DC enabled
from 73deaec s3:winbindd: document "winbind:ignore domains"

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 26ffc20cef841b33d3b7a55743e03d6ce9f58a05
Author: Andrew Bartlett <***@samba.org>
Date: Mon Jan 30 23:18:12 2017 +1300

build: vfs_posix_eadb is only built with the AD DC enabled

This was found building a static smbd without the AD DC

Signed-off-by: Andrew Bartlett <***@samba.org>
Reviewed-by: David Disseldorp <***@samba.org>

Autobuild-User(master): David Disseldorp <***@samba.org>
Autobuild-Date(master): Mon Jan 30 17:24:26 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
source3/wscript | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/source3/wscript b/source3/wscript
index 01d5274..443affd 100644
--- a/source3/wscript
+++ b/source3/wscript
@@ -1683,7 +1683,7 @@ main() {
vfs_recycle vfs_audit vfs_extd_audit vfs_full_audit vfs_netatalk
vfs_fake_perms vfs_default_quota vfs_readonly vfs_cap
vfs_expand_msdfs vfs_shadow_copy vfs_shadow_copy2
- vfs_readahead vfs_xattr_tdb vfs_posix_eadb
+ vfs_readahead vfs_xattr_tdb
vfs_streams_xattr vfs_streams_depot vfs_acl_xattr vfs_acl_tdb
vfs_preopen vfs_catia
vfs_media_harmony vfs_unityed_media vfs_fruit vfs_shell_snap
@@ -1706,6 +1706,7 @@ main() {

if conf.CONFIG_SET('AD_DC_BUILD_IS_ENABLED'):
default_static_modules.extend(TO_LIST('pdb_samba_dsdb auth_samba4 vfs_dfs_samba4'))
+ default_shared_modules.extend('vfs_posix_eadb')

if conf.CONFIG_SET('HAVE_FREEBSD_SUNACL_H'):
default_shared_modules.extend(TO_LIST('vfs_zfsacl'))
--
Samba Shared Repository
Jeremy Allison
2017-01-30 21:27:02 UTC
Permalink
The branch, master has been updated
via 0e1deb7 s3: VFS: Don't allow symlink, link or rename on already converted paths.
via cda6764 s3: VFS: shadow_copy2: Fix usage of saved_errno to only set errno on error.
via 4d339a8 s3: VFS: shadow_copy2: Fix a memory leak in the connectpath function.
via 128d5f2 s3: VFS: shadow_copy2: Fix module to work with variable current working directory.
via b94dc85 s3: VFS: Add utility function check_for_converted_path().
via cd4f940 s3: VFS: Ensure shadow:format cannot contain a / path separator.
via 42bd1ac s3: VFS: Allow shadow_copy2_connectpath() to return the cached path derived from $cwd.
via 27340df s3: VFS: shadow_copy2: Fix chdir to store off the needed private variables.
via 9d65107 s3: VFS: shadow_copy2: Add two currently unused functions to make pathnames absolute or relative to $cwd.
via 2887465 s3: VFS: shadow_copy2: Change a parameter name.
via 5aa1ea9 s3: VFS: shadow_copy2: Add a wrapper function to call the original shadow_copy2_strip_snapshot().
via 72fe2b6 s3: VFS: shadow_copy2: Add two new variables to the private data. Not yet used.
via 37ef8d3 s3: VFS: shadow_copy2: Fix length comparison to ensure we don't overstep a length.
via 979e392 s3: VFS: shadow_copy2: Ensure pathnames for parameters are correctly relative and terminated.
via 0a190f4 s3: VFS: shadow_copy2: Correctly initialize timestamp and stripped variables.
via d650d65 s3: smbd: Make set_conn_connectpath() call canonicalize_absolute_path().
via a513633 s3: smbtorture: Add new local test LOCAL-CANONICALIZE-PATH
via 82979af s3: lib: Fix two old, old bugs in set_conn_connectpath(), now in canonicalize_absolute_path().
via 02599c3 s3: lib: Add canonicalize_absolute_path().
via 39678ed s3: smbd: Correctly canonicalize any incoming shadow copy path.
from 26ffc20 build: vfs_posix_eadb is only built with the AD DC enabled

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 0e1deb77f2b310ad7e5dd784174207adacf1c981
Author: Jeremy Allison <***@samba.org>
Date: Thu Jan 26 17:19:24 2017 -0800

s3: VFS: Don't allow symlink, link or rename on already converted paths.

Snapshot paths are a read-only filesystem.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Mon Jan 30 22:26:29 CET 2017 on sn-devel-144

commit cda6764f1a8db96182bfd1855440bc6a1ba1abee
Author: Jeremy Allison <***@samba.org>
Date: Mon Jan 23 10:20:13 2017 -0800

s3: VFS: shadow_copy2: Fix usage of saved_errno to only set errno on error.

Rationale:

VFS calls must act like their POSIX equivalents, and the POSIX versions
*only* set errno on a failure. There is actually code in the upper smbd
layers that depends on errno being correct on a fail return from a VFS call.

For a compound VFS module like this, a common pattern is :

SMB_VFS_CALL_X()
{
int ret;

syscall1();
ret = syscall2();
syscall3();

return ret;
}

Where if *any* of the contained syscallX()'s fail, they'll set errno.
However, the actual errno we should return is *only* the one returned
if syscall2() fails (the others are lstat's checking for existence etc.).

So what we should do to correctly return only the errno from syscall2() is:

SMB_VFS_CALL_X()
{
int ret;
int saved_errno = 0;

syscall1()

ret = syscall2();
if (ret == -1) {
saved_errno = errno;
}
syscall3()

if (saved_errno != 0) {
errno = saved_errno;
}
return ret;
}

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 4d339a88851f601fae195ac8ff0691cbd3504f41
Author: Jeremy Allison <***@samba.org>
Date: Mon Jan 23 10:06:44 2017 -0800

s3: VFS: shadow_copy2: Fix a memory leak in the connectpath function.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 128d5f27cd42b0c7efcbe3d28fe3eee881e0734b
Author: Jeremy Allison <***@samba.org>
Date: Thu Jan 26 10:49:51 2017 -0800

s3: VFS: shadow_copy2: Fix module to work with variable current working directory.

Completely cleans up the horrible shadow_copy2_strip_snapshot()
and adds an explaination of what it's actually trying to do.

* This function does two things.
*
* 1). Checks if an incoming filename is already a
* snapshot converted pathname.
* If so, it returns the pathname truncated
* at the snapshot point which will be used
* as the connectpath, and then does an early return.
*
* 2). Checks if an incoming filename contains an
* SMB-layer @GMT- style timestamp.
* If so, it strips the timestamp, and returns
* both the timestamp and the stripped path
* (making it cwd-relative).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit b94dc85d339c9a10496edd07b85bdd7808d2e332
Author: Jeremy Allison <***@samba.org>
Date: Thu Jan 26 10:35:50 2017 -0800

s3: VFS: Add utility function check_for_converted_path().

Detects an already converted path. Not yet used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit cd4f940162b17e4f7345d392326a31ae478230fa
Author: Jeremy Allison <***@samba.org>
Date: Thu Jan 26 10:24:52 2017 -0800

s3: VFS: Ensure shadow:format cannot contain a / path separator.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 42bd1acad75a6b5ea81fe4b30c067dd82623c042
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 12:09:08 2017 -0800

s3: VFS: Allow shadow_copy2_connectpath() to return the cached path derived from $cwd.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 27340df4b52e4341f134667c59d71656a7a1fdae
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 12:06:55 2017 -0800

s3: VFS: shadow_copy2: Fix chdir to store off the needed private variables.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

This is not yet used, the users of this will be added later.

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 9d65107b8f2864dba8d41b3316c483b3f36d0697
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 12:00:08 2017 -0800

s3: VFS: shadow_copy2: Add two currently unused functions to make pathnames absolute or relative to $cwd.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 2887465108aef5e2e7c64417437ecb86c7460e16
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 11:56:21 2017 -0800

s3: VFS: shadow_copy2: Change a parameter name.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Allows easy substitution later.

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 5aa1ea95157475dfd2d056f0158b14b2b90895a9
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 11:54:56 2017 -0800

s3: VFS: shadow_copy2: Add a wrapper function to call the original shadow_copy2_strip_snapshot().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Allows an extra (currently unused) parameter to be added.

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 72fe2b62e3ee7462e5be855b01943f28b26c36c1
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 11:50:49 2017 -0800

s3: VFS: shadow_copy2: Add two new variables to the private data. Not yet used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 37ef8d3f65bd1215717eb51b2e1cdb84a7bed348
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 11:48:40 2017 -0800

s3: VFS: shadow_copy2: Fix length comparison to ensure we don't overstep a length.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 979e39252bcc88e8aacb543b8bf322dd6f17fe7f
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 11:45:54 2017 -0800

s3: VFS: shadow_copy2: Ensure pathnames for parameters are correctly relative and terminated.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 0a190f4dd950c947d47c42163d11ea4bd6e6e508
Author: Jeremy Allison <***@samba.org>
Date: Fri Jan 20 11:42:39 2017 -0800

s3: VFS: shadow_copy2: Correctly initialize timestamp and stripped variables.

Allow the called functions to be fixed to not touch them on error.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit d650d65488761b30fa34d42cb1ab400618a78c33
Author: Jeremy Allison <***@samba.org>
Date: Tue Jan 17 11:35:52 2017 -0800

s3: smbd: Make set_conn_connectpath() call canonicalize_absolute_path().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit a51363309a4330b65e34ae941ec99d180bdbab56
Author: Jeremy Allison <***@samba.org>
Date: Thu Jan 26 16:08:42 2017 -0800

s3: smbtorture: Add new local test LOCAL-CANONICALIZE-PATH

Tests new canonicalize_absolute_path() function.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 82979afc46cc5e466bdd999a94080e7a5df95518
Author: Jeremy Allison <***@samba.org>
Date: Thu Jan 19 15:18:41 2017 -0800

s3: lib: Fix two old, old bugs in set_conn_connectpath(), now in canonicalize_absolute_path().

Canonicalizing a path of /foo/bar/../baz would return /foo/barbaz
as moving forward 3 characters would delete the / character.

Canonicalizing /foo/.. would end up as '\0'.

Test to follow.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 02599c39337c3049762a6b0bd6290577817ee5a5
Author: Jeremy Allison <***@samba.org>
Date: Tue Jan 17 11:33:18 2017 -0800

s3: lib: Add canonicalize_absolute_path().

Resolves any invalid path components (.) (..)
in an absolute POSIX path.

We will be re-using this in several places.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

commit 39678ed6af708fb6f2760bfb51051add11e3c498
Author: Jeremy Allison <***@samba.org>
Date: Wed Jan 11 16:30:38 2017 -0800

s3: smbd: Correctly canonicalize any incoming shadow copy path.

Converts to:

@GMT-token/path/last_component

from all incoming path types. Allows shadow_copy modules
to work when current directory is changed after removing
last component.

Ultimately when the VFS ABI is changed to add a timestamp
to struct smb_filename, this is where the parsing will be
done.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Uri Simchoni <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
source3/lib/util_path.c | 139 ++++++
source3/lib/util_path.h | 1 +
source3/modules/vfs_shadow_copy2.c | 909 ++++++++++++++++++++++++++-----------
source3/selftest/tests.py | 1 +
source3/smbd/filename.c | 150 ++++++
source3/smbd/service.c | 103 +----
source3/torture/torture.c | 44 ++
7 files changed, 994 insertions(+), 353 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/lib/util_path.c b/source3/lib/util_path.c
index 509ba5f..6f58a03 100644
--- a/source3/lib/util_path.c
+++ b/source3/lib/util_path.c
@@ -93,3 +93,142 @@ char *cache_path(const char *name)
{
return xx_path(name, lp_cache_directory());
}
+
+/**
+ * @brief Removes any invalid path components in an absolute POSIX path.
+ *
+ * @param ctx Talloc context to return string.
+ *
+ * @param abs_path Absolute path string to process.
+ *
+ * @retval Pointer to a talloc'ed string containing the absolute full path.
+ **/
+
+char *canonicalize_absolute_path(TALLOC_CTX *ctx, const char *abs_path)
+{
+ char *destname;
+ char *d;
+ const char *s = abs_path;
+ bool start_of_name_component = true;
+
+ /* Allocate for strlen + '\0' + possible leading '/' */
+ destname = (char *)talloc_size(ctx, strlen(abs_path) + 2);
+ if (destname == NULL) {
+ return NULL;
+ }
+ d = destname;
+
+ *d++ = '/'; /* Always start with root. */
+
+ while (*s) {
+ if (*s == '/') {
+ /* Eat multiple '/' */
+ while (*s == '/') {
+ s++;
+ }
+ if ((d > destname + 1) && (*s != '\0')) {
+ *d++ = '/';
+ }
+ start_of_name_component = true;
+ continue;
+ }
+
+ if (start_of_name_component) {
+ if ((s[0] == '.') && (s[1] == '.') &&
+ (s[2] == '/' || s[2] == '\0')) {
+ /* Uh oh - "/../" or "/..\0" ! */
+
+ /* Go past the .. leaving us on the / or '\0' */
+ s += 2;
+
+ /* If we just added a '/' - delete it */
+ if ((d > destname) && (*(d-1) == '/')) {
+ *(d-1) = '\0';
+ d--;
+ }
+
+ /*
+ * Are we at the start ?
+ * Can't go back further if so.
+ */
+ if (d <= destname) {
+ *d++ = '/'; /* Can't delete root */
+ continue;
+ }
+ /* Go back one level... */
+ /*
+ * Decrement d first as d points to
+ * the *next* char to write into.
+ */
+ for (d--; d > destname; d--) {
+ if (*d == '/') {
+ break;
+ }
+ }
+
+ /*
+ * Are we at the start ?
+ * Can't go back further if so.
+ */
+ if (d <= destname) {
+ *d++ = '/'; /* Can't delete root */
+ continue;
+ }
+
+ /*
+ * We're still at the start of a name
+ * component, just the previous one.
+ */
+ continue;
+ } else if ((s[0] == '.') &&
+ ((s[1] == '\0') || s[1] == '/')) {
+ /*
+ * Component of pathname can't be "." only.
+ * Skip the '.' .
+ */
+ if (s[1] == '/') {
+ s += 2;
+ } else {
+ s++;
+ }
+ continue;
+ }
+ }
+
+ if (!(*s & 0x80)) {
+ *d++ = *s++;
+ } else {
+ size_t siz;
+ /* Get the size of the next MB character. */
+ next_codepoint(s,&siz);
+ switch(siz) {
+ case 5:
+ *d++ = *s++;
+ /*fall through*/
+ case 4:
+ *d++ = *s++;
+ /*fall through*/
+ case 3:
+ *d++ = *s++;
+ /*fall through*/
+ case 2:
+ *d++ = *s++;
+ /*fall through*/
+ case 1:
+ *d++ = *s++;
+ break;
+ default:
+ break;
+ }
+ }
+ start_of_name_component = false;
+ }
+ *d = '\0';
+
+ /* And must not end in '/' */
+ if (d > destname + 1 && (*(d-1) == '/')) {
+ *(d-1) = '\0';
+ }
+
+ return destname;
+}
diff --git a/source3/lib/util_path.h b/source3/lib/util_path.h
index 118a4be..16e2792 100644
--- a/source3/lib/util_path.h
+++ b/source3/lib/util_path.h
@@ -27,5 +27,6 @@
char *lock_path(const char *name);
char *state_path(const char *name);
char *cache_path(const char *name);
+char *canonicalize_absolute_path(TALLOC_CTX *ctx, const char *abs_path);

#endif
diff --git a/source3/modules/vfs_shadow_copy2.c b/source3/modules/vfs_shadow_copy2.c
index 6a25c87..402eb70 100644
--- a/source3/modules/vfs_shadow_copy2.c
+++ b/source3/modules/vfs_shadow_copy2.c
@@ -35,6 +35,7 @@
#include "system/filesys.h"
#include "include/ntioctl.h"
#include "util_tdb.h"
+#include "lib/util_path.h"

struct shadow_copy2_config {
char *gmt_format;
@@ -74,6 +75,11 @@ struct shadow_copy2_snaplist_info {
struct shadow_copy2_private {
struct shadow_copy2_config *config;
struct shadow_copy2_snaplist_info *snaps;
+ char *shadow_cwd; /* Absolute $cwd path. */
+ /* Absolute connectpath - can vary depending on $cwd. */
+ char *shadow_connectpath;
+ /* malloc'ed realpath return. */
+ char *shadow_realpath;
};

static int shadow_copy2_get_shadow_copy_data(
@@ -404,79 +410,254 @@ static char *shadow_copy2_snapshot_path(TALLOC_CTX *mem_ctx,
return result;
}

+static char *make_path_absolute(TALLOC_CTX *mem_ctx,
+ struct shadow_copy2_private *priv,
+ const char *name)
+{
+ char *newpath = NULL;
+ char *abs_path = NULL;
+
+ if (name[0] != '/') {
+ newpath = talloc_asprintf(mem_ctx,
+ "%s/%s",
+ priv->shadow_cwd,
+ name);
+ if (newpath == NULL) {
+ return NULL;
+ }
+ name = newpath;
+ }
+ abs_path = canonicalize_absolute_path(mem_ctx, name);
+ TALLOC_FREE(newpath);
+ return abs_path;
+}
+
+/* Return a $cwd-relative path. */
+static bool make_relative_path(const char *cwd, char *abs_path)
+{
+ size_t cwd_len = strlen(cwd);
+ size_t abs_len = strlen(abs_path);
+
+ if (abs_len < cwd_len) {
+ return false;
+ }
+ if (memcmp(abs_path, cwd, cwd_len) != 0) {
+ return false;
+ }
+ if (abs_path[cwd_len] != '/' && abs_path[cwd_len] != '\0') {
+ return false;
+ }
+ if (abs_path[cwd_len] == '/') {
+ cwd_len++;
+ }
+ memmove(abs_path, &abs_path[cwd_len], abs_len + 1 - cwd_len);
+ return true;
+}
+
+static bool shadow_copy2_snapshot_to_gmt(vfs_handle_struct *handle,
+ const char *name,
+ char *gmt, size_t gmt_len);
+
+/*
+ * Check if an incoming filename is already a snapshot converted pathname.
+ *
+ * If so, it returns the pathname truncated at the snapshot point which
+ * will be used as the connectpath.
+ */
+
+static int check_for_converted_path(TALLOC_CTX *mem_ctx,
+ struct vfs_handle_struct *handle,
+ struct shadow_copy2_private *priv,
+ char *abs_path,
+ bool *ppath_already_converted,
+ char **pconnectpath)
+{
+ size_t snapdirlen = 0;
+ char *p = strstr_m(abs_path, priv->config->snapdir);
+ char *q = NULL;
+ char *connect_path = NULL;
+ char snapshot[GMT_NAME_LEN+1];
+
+ *ppath_already_converted = false;
+
+ if (p == NULL) {
+ /* Must at least contain shadow:snapdir. */
+ return 0;
+ }
+
+ if (priv->config->snapdir[0] == '/' &&
+ p != abs_path) {
+ /* Absolute shadow:snapdir must be at the start. */
+ return 0;
+ }
+
+ snapdirlen = strlen(priv->config->snapdir);
+ if (p[snapdirlen] != '/') {
+ /* shadow:snapdir must end as a separate component. */
+ return 0;
+ }
+
+ if (p > abs_path && p[-1] != '/') {
+ /* shadow:snapdir must start as a separate component. */
+ return 0;
+ }
+
+ p += snapdirlen;
+ p++; /* Move past the / */
+
+ /*
+ * Need to return up to the next path
+ * component after the time.
+ * This will be used as the connectpath.
+ */
+ q = strchr(p, '/');
+ if (q == NULL) {
+ /*
+ * No next path component.
+ * Use entire string.
+ */
+ connect_path = talloc_strdup(mem_ctx,
+ abs_path);
+ } else {
+ connect_path = talloc_strndup(mem_ctx,
+ abs_path,
+ q - abs_path);
+ }
+ if (connect_path == NULL) {
+ return ENOMEM;
+ }
+
+ /*
+ * Point p at the same offset in connect_path as
+ * it is in abs_path.
+ */
+
+ p = &connect_path[p - abs_path];
+
+ /*
+ * Now ensure there is a time string at p.
+ * The SMB-format @GMT-token string is returned
+ * in snapshot.
+ */
+
+ if (!shadow_copy2_snapshot_to_gmt(handle,
+ p,
+ snapshot,
+ sizeof(snapshot))) {
+ TALLOC_FREE(connect_path);
+ return 0;
+ }
+
+ if (pconnectpath != NULL) {
+ *pconnectpath = connect_path;
+ }
+
+ *ppath_already_converted = true;
+
+ DBG_DEBUG("path |%s| is already converted. "
+ "connect path = |%s|\n",
+ abs_path,
+ connect_path);
+
+ return 0;
+}
+
/**
- * Strip a snapshot component from a filename as
- * handed in via the smb layer.
- * Returns the parsed timestamp and the stripped filename.
+ * This function does two things.
+ *
+ * 1). Checks if an incoming filename is already a
+ * snapshot converted pathname.
+ * If so, it returns the pathname truncated
+ * at the snapshot point which will be used
+ * as the connectpath, and then does an early return.
+ *
+ * 2). Checks if an incoming filename contains an
+ * SMB-layer @GMT- style timestamp.
+ * If so, it strips the timestamp, and returns
+ * both the timestamp and the stripped path
+ * (making it cwd-relative).
*/
-static bool shadow_copy2_strip_snapshot(TALLOC_CTX *mem_ctx,
+
+static bool shadow_copy2_strip_snapshot_internal(TALLOC_CTX *mem_ctx,
struct vfs_handle_struct *handle,
- const char *name,
+ const char *orig_name,
time_t *ptimestamp,
- char **pstripped)
+ char **pstripped,
+ char **psnappath)
{
struct tm tm;
- time_t timestamp;
+ time_t timestamp = 0;
const char *p;
char *q;
- char *stripped;
+ char *stripped = NULL;
size_t rest_len, dst_len;
struct shadow_copy2_private *priv;
- const char *snapdir;
- ssize_t snapdirlen;
ptrdiff_t len_before_gmt;
+ const char *name = orig_name;
+ char *abs_path = NULL;
+ bool ret = true;
+ bool already_converted = false;
+ int err = 0;

SMB_VFS_HANDLE_GET_DATA(handle, priv, struct shadow_copy2_private,
return false);

DEBUG(10, (__location__ ": enter path '%s'\n", name));

+ abs_path = make_path_absolute(mem_ctx, priv, name);
+ if (abs_path == NULL) {
+ ret = false;
+ goto out;
+ }
+ name = abs_path;
+
+ DEBUG(10, (__location__ ": abs path '%s'\n", name));
+
+ err = check_for_converted_path(mem_ctx,
+ handle,
+ priv,
+ abs_path,
+ &already_converted,
+ psnappath);
+ if (err != 0) {
+ /* error in conversion. */
+ ret = false;
+ goto out;
+ }
+
+ if (already_converted) {
+ goto out;
+ }
+
+ /*
+ * From here we're only looking to strip an
+ * SMB-layer @GMT- token.
+ */
+
p = strstr_m(name, "@GMT-");
if (p == NULL) {
DEBUG(11, ("@GMT not found\n"));
- goto no_snapshot;
+ goto out;
}
if ((p > name) && (p[-1] != '/')) {
/* the GMT-token does not start a path-component */
DEBUG(10, ("not at start, p=%p, name=%p, p[-1]=%d\n",
p, name, (int)p[-1]));
- goto no_snapshot;
+ goto out;
}

- /*
- * Figure out whether we got an already converted string. One
- * case where this happens is in a smb2 create call with the
- * mxac create blob set. We do the get_acl call on
- * fsp->fsp_name, which is already converted. We are converted
- * if we got a file name of the form ".snapshots/@GMT-",
- * i.e. ".snapshots/" precedes "p".
- */
-
- snapdir = lp_parm_const_string(SNUM(handle->conn), "shadow", "snapdir",
- ".snapshots");
- snapdirlen = strlen(snapdir);
len_before_gmt = p - name;

- if ((len_before_gmt >= (snapdirlen + 1)) && (p[-1] == '/')) {
- const char *parent_snapdir = p - (snapdirlen+1);
-
- DEBUG(10, ("parent_snapdir = %s\n", parent_snapdir));
-
- if (strncmp(parent_snapdir, snapdir, snapdirlen) == 0) {
- DEBUG(10, ("name=%s is already converted\n", name));
- goto no_snapshot;
- }
- }
q = strptime(p, GMT_FORMAT, &tm);
if (q == NULL) {
DEBUG(10, ("strptime failed\n"));
- goto no_snapshot;
+ goto out;
}
tm.tm_isdst = -1;
timestamp = timegm(&tm);
if (timestamp == (time_t)-1) {
DEBUG(10, ("timestamp==-1\n"));
- goto no_snapshot;
+ goto out;
}
if (q[0] == '\0') {
/*
@@ -496,12 +677,24 @@ static bool shadow_copy2_strip_snapshot(TALLOC_CTX *mem_ctx,
stripped = talloc_strndup(mem_ctx, name,
len_before_gmt);
if (stripped == NULL) {
- return false;
+ ret = false;
+ goto out;
+ }
+ if (orig_name[0] != '/') {
+ if (make_relative_path(priv->shadow_cwd,
+ stripped) == false) {
+ DEBUG(10, (__location__ ": path '%s' "
+ "doesn't start with cwd '%s\n",
+ stripped, priv->shadow_cwd));
+ ret = false;
+ errno = ENOENT;
+ goto out;
+ }
}
*pstripped = stripped;
}
*ptimestamp = timestamp;
- return true;
+ goto out;
}
if (q[0] != '/') {
/*
--
Samba Shared Repository
Jeremy Allison
2017-01-31 03:35:02 UTC
Permalink
The branch, master has been updated
via 76a2999 libcli/smb: outbuf length is a IVAL ie a uint32_t
via 9785fe5 s3/rpc_server: shared rpc modules loading
from 0e1deb7 s3: VFS: Don't allow symlink, link or rename on already converted paths.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 76a2999744cd3dd872e0113cc036bcebe2323a2a
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 30 06:49:58 2017 +0100

libcli/smb: outbuf length is a IVAL ie a uint32_t

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Tue Jan 31 04:34:29 CET 2017 on sn-devel-144

commit 9785fe5af6613a728a7d92c82bbc31cabbe3a0b9
Author: Ralph Boehme <***@samba.org>
Date: Mon Jan 30 18:49:39 2017 +0100

s3/rpc_server: shared rpc modules loading

The previous commit 58889e04bd545d7420d1193e134351bd0ccb8430 for this
bug was broken as it didn't move the goto into the "if (errno !=
ENOENT)" condition.

This updated fix folds the test "mod_init_fns == NULL" and the check for
the errno into one if condition.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12184

Signed-off-by: Ralph Boehme <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
libcli/smb/smb2cli_query_directory.c | 2 +-
source3/rpc_server/rpc_service_setup.c | 21 +++++++++------------
2 files changed, 10 insertions(+), 13 deletions(-)


Changeset truncated at 500 lines:

diff --git a/libcli/smb/smb2cli_query_directory.c b/libcli/smb/smb2cli_query_directory.c
index d1ccdb8..e6321ff 100644
--- a/libcli/smb/smb2cli_query_directory.c
+++ b/libcli/smb/smb2cli_query_directory.c
@@ -80,7 +80,7 @@ struct tevent_req *smb2cli_query_directory_send(TALLOC_CTX *mem_ctx,
SBVAL(fixed, 16, fid_volatile);
SSVAL(fixed, 24, SMB2_HDR_BODY + 32);
SSVAL(fixed, 26, dyn_len);
- SSVAL(fixed, 28, outbuf_len);
+ SIVAL(fixed, 28, outbuf_len);

if (dyn_len == 0) {
dyn = state->dyn_pad;
diff --git a/source3/rpc_server/rpc_service_setup.c b/source3/rpc_server/rpc_service_setup.c
index 263fcaf..751a638 100644
--- a/source3/rpc_server/rpc_service_setup.c
+++ b/source3/rpc_server/rpc_service_setup.c
@@ -535,18 +535,15 @@ bool dcesrv_ep_setup(struct tevent_context *ev_ctx,

/* Initialize shared modules */
mod_init_fns = load_samba_modules(tmp_ctx, "rpc");
- if (mod_init_fns == NULL) {
- if (errno != ENOENT) {
- /*
- * ENOENT means the directory doesn't exist
- * which can happen if all modules are
- * static. So ENOENT is ok, everything else is
- * not ok.
- */
- DBG_ERR("Loading shared RPC modules failed [%s]\n",
- strerror(errno));
- ok = false;
- }
+ if ((mod_init_fns == NULL) && (errno != ENOENT)) {
+ /*
+ * ENOENT means the directory doesn't exist which can happen if
+ * all modules are static. So ENOENT is ok, everything else is
+ * not ok.
+ */
+ DBG_ERR("Loading shared RPC modules failed [%s]\n",
+ strerror(errno));
+ ok = false;
goto done;
}
--
Samba Shared Repository
Stefan Metzmacher
2017-01-31 10:58:02 UTC
Permalink
The branch, master has been updated
via 39ac4ae ctdb-tests: Use replace headers instead of system headers
via 08b4a5f ctdb-tests: Do not build mutex test if robust mutexes are not supported
from 76a2999 libcli/smb: outbuf length is a IVAL ie a uint32_t

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 39ac4ae65eb3b8d4d3574987eab47eb7a290f2e4
Author: Amitay Isaacs <***@gmail.com>
Date: Tue Jan 31 16:49:14 2017 +1100

ctdb-tests: Use replace headers instead of system headers

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12469

This ensures that PTHREAD_MUTEX_ROBUST, pthread_mutexattr_setrobust()
and pthread_mutex_consistent() are always defined.

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Stefan Metzmacher <***@samba.org>
Autobuild-Date(master): Tue Jan 31 11:57:01 CET 2017 on sn-devel-144

commit 08b4a5f9f1575c882ab7174eb3249b574df6976f
Author: Amitay Isaacs <***@gmail.com>
Date: Tue Jan 31 14:50:53 2017 +1100

ctdb-tests: Do not build mutex test if robust mutexes are not supported

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12469

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Stefan Metzmacher <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
ctdb/tests/src/test_mutex_raw.c | 24 +++++++-----------------
ctdb/wscript | 9 +++++----
2 files changed, 12 insertions(+), 21 deletions(-)


Changeset truncated at 500 lines:

diff --git a/ctdb/tests/src/test_mutex_raw.c b/ctdb/tests/src/test_mutex_raw.c
index 8e3cae3..ab7aff9 100644
--- a/ctdb/tests/src/test_mutex_raw.c
+++ b/ctdb/tests/src/test_mutex_raw.c
@@ -38,21 +38,11 @@
* If no pid is printed, then no process is holding the mutex.
*/

-#include <stdio.h>
-#include <unistd.h>
-#include <inttypes.h>
-#include <sys/types.h>
-#include <sys/fcntl.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/wait.h>
-#include <sched.h>
-#include <sys/mman.h>
-#include <pthread.h>
-#include <errno.h>
-#include <stdbool.h>
-
-int pthread_mutex_consistent_np(pthread_mutex_t *);
+#include "replace.h"
+#include "system/filesys.h"
+#include "system/wait.h"
+#include "system/shmem.h"
+#include "system/threads.h"

static void set_realtime(void)
{
@@ -99,7 +89,7 @@ static void run_child(const char *filename)
again:
ret = pthread_mutex_lock(mutex);
if (ret == EOWNERDEAD) {
- ret = pthread_mutex_consistent_np(mutex);
+ ret = pthread_mutex_consistent(mutex);
} else if (ret == EAGAIN) {
goto again;
}
@@ -172,7 +162,7 @@ int main(int argc, const char **argv)
if (strcmp(argv[2], "debug") == 0) {
ret = pthread_mutex_trylock(mutex);
if (ret == EOWNERDEAD) {
- ret = pthread_mutex_consistent_np(mutex);
+ ret = pthread_mutex_consistent(mutex);
if (ret == 0) {
pthread_mutex_unlock(mutex);
}
diff --git a/ctdb/wscript b/ctdb/wscript
index b9a3072..446bd8d 100644
--- a/ctdb/wscript
+++ b/ctdb/wscript
@@ -830,10 +830,11 @@ def build(bld):
ib_deps,
install_path='${CTDB_TEST_LIBEXECDIR}')

- bld.SAMBA_BINARY('test_mutex_raw',
- source='tests/src/test_mutex_raw.c',
- deps='pthread',
- install_path='${CTDB_TEST_LIBEXECDIR}')
+ if bld.env.HAVE_ROBUST_MUTEXES:
+ bld.SAMBA_BINARY('test_mutex_raw',
+ source='tests/src/test_mutex_raw.c',
+ deps='pthread',
+ install_path='${CTDB_TEST_LIBEXECDIR}')

test_subdirs = [
'complex',
--
Samba Shared Repository
Jeremy Allison
2017-02-01 04:17:02 UTC
Permalink
The branch, master has been updated
via 7fd3eb6 util:charset: Return EILSEQ in smb_iconv() if newer libc is detected
via 669d215 auth: fix mem leak & use appropriate free function
from 39ac4ae ctdb-tests: Use replace headers instead of system headers

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 7fd3eb6c04bebd5c8cd25b81198dc0112703497a
Author: Andreas Schneider <***@samba.org>
Date: Mon Jan 30 17:17:38 2017 +0100

util:charset: Return EILSEQ in smb_iconv() if newer libc is detected

This is the behaviour of glibc 2.24 and newer.

Signed-off-by: Andreas Schneider <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Wed Feb 1 05:16:46 CET 2017 on sn-devel-144

commit 669d2152cb9c1111d36127daee64b4bbfc141b7a
Author: Aurelien Aptel <***@suse.com>
Date: Tue Jan 17 14:39:02 2017 +0100

auth: fix mem leak & use appropriate free function

coverity fix.

cli_credentials_set_principal does a strdup, we want to free 'name'
regardless of the result in 'ok'.

Signed-off-by: Aurelien Aptel <***@suse.com>
Reviewed-by: Andrew Bartlett <***@samba.org>
Reviewed-by: Jeremy Allison <***@samba.org>

-----------------------------------------------------------------------

Summary of changes:
auth/credentials/credentials_krb5.c | 2 +-
lib/util/charset/iconv.c | 6 +++---
lib/util/charset/wscript_configure | 20 ++++++++++++++++++++
3 files changed, 24 insertions(+), 4 deletions(-)


Changeset truncated at 500 lines:

diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index 3663e1d..d2a655e 100644
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -260,11 +260,11 @@ static int cli_credentials_set_from_ccache(struct cli_credentials *cred,
}

ok = cli_credentials_set_principal(cred, name, obtained);
+ krb5_free_unparsed_name(ccache->smb_krb5_context->krb5_context, name);
if (!ok) {
krb5_free_principal(ccache->smb_krb5_context->krb5_context, princ);
return ENOMEM;
}
- free(name);

realm = smb_krb5_principal_get_realm(ccache->smb_krb5_context->krb5_context,
princ);
diff --git a/lib/util/charset/iconv.c b/lib/util/charset/iconv.c
index bf561f2..e06fa2c 100644
--- a/lib/util/charset/iconv.c
+++ b/lib/util/charset/iconv.c
@@ -740,12 +740,12 @@ static size_t utf8_push(void *cd, const char **inbuf, size_t *inbytesleft,
}

if ((uc[1] & 0xfc) == 0xdc) {
- /* its the second part of a 4 byte sequence. Illegal */
+ errno = EILSEQ;
+#ifndef HAVE_ICONV_ERRNO_ILLEGAL_MULTIBYTE
if (in_left < 4) {
errno = EINVAL;
- } else {
- errno = EILSEQ;
}
+#endif
goto error;
}

diff --git a/lib/util/charset/wscript_configure b/lib/util/charset/wscript_configure
index 804c266..d5ac5d0 100644
--- a/lib/util/charset/wscript_configure
+++ b/lib/util/charset/wscript_configure
@@ -16,3 +16,23 @@ if (conf.CHECK_FUNCS_IN('iconv_open', 'iconv', checklibc=False, headers='iconv.h
conf.CHECK_FUNCS('iconv_open', headers='iconv.h')):

conf.DEFINE('HAVE_NATIVE_ICONV', 1)
+
+conf.CHECK_CODE('''
+ uint8_t inbuf[2] = { 0x30, 0xdf };
+ uint8_t outbuf[4] = { 0 };
+ char *ptr_in = (char *)inbuf;
+ char *ptr_out = (char *)outbuf;
+ size_t size_in = sizeof(inbuf);
+ size_t size_out = sizeof(outbuf);
+ size_t ret;
+ iconv_t cd;
+ cd = iconv_open("UTF-8", "UTF-16LE");
+ if (cd == 0 || cd == (iconv_t)-1) return -1;
+ ret = iconv(cd, &ptr_in, &size_in, &ptr_out, &size_out);
+ if (ret != (size_t)-1 || errno != EILSEQ) return -1;
+ ''',
+ define='HAVE_ICONV_ERRNO_ILLEGAL_MULTIBYTE',
+ execute=True,
+ msg='Checking errno of iconv for illegal multibyte sequence',
+ lib='iconv',
+ headers='errno.h iconv.h')
--
Samba Shared Repository
Volker Lendecke
2017-02-01 13:30:03 UTC
Permalink
The branch, master has been updated
via 2bea45e ctdb-common: ioctl(.. FIONREAD ..) returns an int value
from 7fd3eb6 util:charset: Return EILSEQ in smb_iconv() if newer libc is detected

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 2bea45e450e5ebd6544c2a8be4493242158b712e
Author: Amitay Isaacs <***@gmail.com>
Date: Wed Feb 1 15:52:48 2017 +1100

ctdb-common: ioctl(.. FIONREAD ..) returns an int value

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12549

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Volker Lendecke <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Wed Feb 1 14:29:14 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
ctdb/common/run_proc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/ctdb/common/run_proc.c b/ctdb/common/run_proc.c
index 96e422c..f9fee80 100644
--- a/ctdb/common/run_proc.c
+++ b/ctdb/common/run_proc.c
@@ -132,8 +132,9 @@ static void proc_read_handler(struct tevent_context *ev,
{
struct proc_context *proc = talloc_get_type_abort(
private_data, struct proc_context);
- size_t offset, len = 0;
+ size_t offset;
ssize_t nread;
+ int len = 0;
int ret;

ret = ioctl(proc->fd, FIONREAD, &len);
--
Samba Shared Repository
Andreas Schneider
2017-02-01 17:17:02 UTC
Permalink
The branch, master has been updated
via 3fe1f06 talloc/wscript: avoid passing pointless enabled=True to SAMBA_PYTHON()
from 2bea45e ctdb-common: ioctl(.. FIONREAD ..) returns an int value

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 3fe1f06278ce90d8c6a882c6703f583923615117
Author: Stefan Metzmacher <***@samba.org>
Date: Sun Jan 29 15:52:30 2017 +0100

talloc/wscript: avoid passing pointless enabled=True to SAMBA_PYTHON()

This is the default and should not be passed explicitly.

Signed-off-by: Stefan Metzmacher <***@samba.org>
Reviewed-by: Andreas Schneider <***@samba.org>

Autobuild-User(master): Andreas Schneider <***@cryptomilk.org>
Autobuild-Date(master): Wed Feb 1 18:16:58 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
lib/talloc/wscript | 2 --
1 file changed, 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/talloc/wscript b/lib/talloc/wscript
index 41f3be7..8ce4f59 100644
--- a/lib/talloc/wscript
+++ b/lib/talloc/wscript
@@ -141,13 +141,11 @@ def build(bld):
bld.SAMBA_PYTHON('pytalloc',
'pytalloc.c',
deps='talloc ' + name,
- enabled=True,
realname='talloc.so')

bld.SAMBA_PYTHON('test_pytalloc',
'test_pytalloc.c',
deps='pytalloc',
- enabled=True,
realname='_test_pytalloc.so',
install=False)
--
Samba Shared Repository
Volker Lendecke
2017-02-01 21:07:02 UTC
Permalink
The branch, master has been updated
via 129bc58 smbd: Fix "map acl inherit" = yes
from 3fe1f06 talloc/wscript: avoid passing pointless enabled=True to SAMBA_PYTHON()

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 129bc58eee4b1868b1aaec6194808752520517b4
Author: Volker Lendecke <***@samba.org>
Date: Wed Feb 1 14:41:43 2017 +0000

smbd: Fix "map acl inherit" = yes

Brown-Paper-Bag bug in f85c2a6852a. The assignment contains a self-reference
in get_pai_flags which I missed.

Fix an uninitialized read.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12551
Signed-off-by: Volker Lendecke <***@samba.org>
Reviewed-by: Stefan Metzmacher <***@samba.org>

Autobuild-User(master): Volker Lendecke <***@samba.org>
Autobuild-Date(master): Wed Feb 1 22:06:50 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
source3/smbd/posix_acls.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 9d02e8a..c8d2bb3 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -2699,9 +2699,9 @@ static canon_ace *canonicalise_acl(struct connection_struct *conn,
.attr = ALLOW_ACE,
.trustee = sid,
.unix_ug = unix_ug,
- .owner_type = owner_type,
- .ace_flags = get_pai_flags(pal, ace, is_default_acl)
+ .owner_type = owner_type
};
+ ace->ace_flags = get_pai_flags(pal, ace, is_default_acl);

DLIST_ADD(l_head, ace);
}
--
Samba Shared Repository
Jeremy Allison
2017-02-02 00:56:02 UTC
Permalink
The branch, master has been updated
via a24ba3e s3: VFS: vfs_streams_xattr.c: Make streams_xattr_open() store the same path as streams_xattr_recheck().
from 129bc58 smbd: Fix "map acl inherit" = yes

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit a24ba3e4083200ec9885363efc5769f43183fb6b
Author: Jeremy Allison <***@samba.org>
Date: Wed Feb 1 11:36:25 2017 -0800

s3: VFS: vfs_streams_xattr.c: Make streams_xattr_open() store the same path as streams_xattr_recheck().

If the open is changing directories, fsp->fsp_name->base_name
will be the full path from the share root, whilst
smb_fname will be relative to the $cwd.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12546

Signed-off-by: Jeremy Allison <***@samba.org>
Reviewed-by: Ralph Böhme <***@samba.org>

Autobuild-User(master): Jeremy Allison <***@samba.org>
Autobuild-Date(master): Thu Feb 2 01:55:42 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
source3/modules/vfs_streams_xattr.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/source3/modules/vfs_streams_xattr.c b/source3/modules/vfs_streams_xattr.c
index d9eb2e1..d3c988c 100644
--- a/source3/modules/vfs_streams_xattr.c
+++ b/source3/modules/vfs_streams_xattr.c
@@ -527,8 +527,15 @@ static int streams_xattr_open(vfs_handle_struct *handle,

sio->xattr_name = talloc_strdup(VFS_MEMCTX_FSP_EXTENSION(handle, fsp),
xattr_name);
+ /*
+ * so->base needs to be a copy of fsp->fsp_name->base_name,
+ * making it identical to streams_xattr_recheck(). If the
+ * open is changing directories, fsp->fsp_name->base_name
+ * will be the full path from the share root, whilst
+ * smb_fname will be relative to the $cwd.
+ */
sio->base = talloc_strdup(VFS_MEMCTX_FSP_EXTENSION(handle, fsp),
- smb_fname->base_name);
+ fsp->fsp_name->base_name);
sio->fsp_name_ptr = fsp->fsp_name;
sio->handle = handle;
sio->fsp = fsp;
--
Samba Shared Repository
Martin Schwenke
2017-02-02 07:26:02 UTC
Permalink
The branch, master has been updated
via ce9b72c ctdb-build: Install CTDB tests correctly from toplevel
from a24ba3e s3: VFS: vfs_streams_xattr.c: Make streams_xattr_open() store the same path as streams_xattr_recheck().

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit ce9b72c17abb156de8185b100f27d1ddd3c89b15
Author: Amitay Isaacs <***@gmail.com>
Date: Wed Feb 1 15:53:47 2017 +1100

ctdb-build: Install CTDB tests correctly from toplevel

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12547

Signed-off-by: Amitay Isaacs <***@gmail.com>
Reviewed-by: Martin Schwenke <***@meltin.net>

Autobuild-User(master): Martin Schwenke <***@samba.org>
Autobuild-Date(master): Thu Feb 2 08:25:57 CET 2017 on sn-devel-144

-----------------------------------------------------------------------

Summary of changes:
ctdb/wscript | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/ctdb/wscript b/ctdb/wscript
index 446bd8d..13384c8 100644
--- a/ctdb/wscript
+++ b/ctdb/wscript
@@ -850,8 +850,13 @@ def build(bld):
'tool'
]

+ if bld.env.standalone_ctdb:
+ testdir = 'tests'
+ else:
+ testdir = 'ctdb/tests'
+
for t in test_subdirs:
- files = SUBDIR_MODE('tests/%s' % t, trim_path='tests')
+ files = SUBDIR_MODE('%s/%s' % (testdir, t), trim_path=testdir)
for fmode in files:
bld.INSTALL_FILES(bld.env.CTDB_TEST_DATADIR, 'tests/%s' % fmode[0],
destname=fmode[0], chmod=fmode[1])
--
Samba Shared Repository
Loading...