Commits · master · The Samba Team / Samba

This project is mirrored from https://git.samba.org/samba.git. Pull mirroring updated Jan 25, 2021.

22 Jan, 2021 22 commits

torture: Fix a gcc qualifier ordering warning · b9f6e25f

VL authored Jan 20, 2021

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 22 21:07:57 UTC 2021 on sn-devel-184

b9f6e25f

lib: Make accept_recv() return the listening socket · e593f969

VL authored Jan 17, 2021

This is helpful if you are in a listening loop with the same receiver
for many sockets doing the same thing.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

e593f969

rpc_server: Fix a "bool==true" condition · f055d3f7

VL authored Jan 20, 2021

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

f055d3f7

rpc_server: Fix a typo · 10d3a1c0

VL authored Jan 20, 2021

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

10d3a1c0

torture: Align integer types · 181eb572

VL authored Jan 20, 2021

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

181eb572

lib: Align integer types · fa9d4570

VL authored Jan 15, 2021

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

fa9d4570

librpc: Fix a small memleak in epm_floor_string() · b4077f79

VL authored Jan 15, 2021

Use GUID_buf_string(), don't leak the output of GUID_string()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

b4077f79

smbd: Simplify sendfile_short_send() · c3ea181e

VL authored Jan 14, 2021

Allocate 1024 bytes on the stack instead of using calloc
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

c3ea181e

sharesec: Simplify add_ace() · 791b477c

VL authored Jan 14, 2021

Use ADD_TO_ARRAY
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

791b477c

libcli: make_sec_acl() copies the ace_list, make that const · 90ea83b7
VL authored Jan 14, 2021
```
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
```
90ea83b7

smbcacls: Simplify add_ace_with_ctx() · f8f58301

VL authored Jan 14, 2021

Use ADD_TO_ARRAY()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

f8f58301

libsmb: Simplify add_ace() · d4bbaee8

VL authored Jan 14, 2021

Use ADD_TO_ARRAY()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

d4bbaee8

libsmb: Simplify sec_desc_parse() · 3fa00ac3

VL authored Jan 14, 2021

Avoid CALLOC for just one struct dom_sids
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

3fa00ac3

smbcacls: Simplify sec_desc_parse() · 5a018c70

VL authored Jan 14, 2021

Don't use SMB_CALLOC_ARRAY for just one element.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

5a018c70

lib: Make accept_recv() return struct samba_sockaddr · 40e49589

VL authored Jan 11, 2021

Avoid casting problems by using the samba_sockaddr union
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

40e49589

rpc_server: Slightly simplify dcesrv_bind() · b417fd19

VL authored Jan 14, 2021

Factor out dereferencing conn->dce_ctx
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

b417fd19

rpc_server: Slightly simplify dcesrv_bind() · ec4850d5

VL authored Jan 14, 2021

We have already dereferenced call->conn in a variable, use that.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ec4850d5

vfs: Simplify vfs_gluster_getwd() · d6d49638

VL authored Jan 14, 2021

Avoid a malloc, we allocate PATH_MAX chars on the stack elsewhere too
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

d6d49638

lib: Use hex_byte() in strhex_to_str() · c5c9406b

VL authored Jan 14, 2021

I had completely missed that one in the last round...
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

c5c9406b

lib: Avoid an "includes.h" · 7d0981f5

VL authored Jan 14, 2021

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

7d0981f5

rpc_server: Fix a typo · d6c3faa1

VL authored Jan 13, 2021

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

d6c3faa1

s3:idmap_hash: reliable return ID_TYPE_BOTH · d8339056

Stefan Metzmacher authored Oct 23, 2020

idmap_hash used to bounce back the requested type,
which was ID_TYPE_UID, ID_TYPE_GID or ID_TYPE_NOT_SPECIFIED
before as the winbindd parent always used a lookupsids.
When the lookupsids failed because of an unknown domain,
the idmap child weren't requested at all and the caller
sees ID_TYPE_NOT_SPECIFIED.

This module should have supported ID_TYPE_BOTH since
samba-4.1.0, similar to idmap_rid and idmap_autorid.

Now that the winbindd parent will pass ID_TYPE_BOTH in order to
indicate that the domain exists, it's better to always return
ID_TYPE_BOTH instead of a random mix of ID_TYPE_UID, ID_TYPE_GID
or ID_TYPE_BOTH. In order to request a type_hint it will return
ID_REQUIRE_TYPE for ID_TYPE_NOT_SPECIFIED, which means that
the parent at least assures that the domain sid exists.
And the caller still gets ID_TYPE_NOT_SPECIFIED if the
domain doesn't exist.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jan 22 11:32:46 UTC 2021 on sn-devel-184

d8339056

21 Jan, 2021 18 commits

winbind: remove legacy flags fallback · 73528f26

Ralph Böhme authored Jan 11, 2021

Some very old NT4 DCs might have not returned the account flags filled in. This
shouldn't be a problem anymore. Additionally, on a typical domain member server,
this request is (and can only be) send to the primary domain, so this will not
work with accounts from trusted domains.
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan 21 22:56:20 UTC 2021 on sn-devel-184

73528f26

s3/auth: implement "winbind:ignore domains" · df5fe2d8

Ralph Böhme authored Jan 15, 2021

Under the following conditions a user from an ignored domain might be able to
authenticate:

- using Kerberos

- successfully previous authentication so the idmap and name caches are filled

- winbind not running (fwiw, winbindd is mandatory on a domain member)

- nscd running with a cached getpwnam for the ignored user (otherwise auth fails
  because getpwnam fails)

- lookup_name() function being modified to look into the name cache before
  contacting winbindd. Currently it talks directly to winbindd and that will
  check the cache.

Currently, authentication will only fail because creating the local token for
the user fails because an LSA lookupname RPC call fails (because winbindd is not
running).

All of this makes a successfull authentication unlikelly, but that is more by
accident then by design.

To ensures that if winbindd is not running and as such winbindd itself can not
enforce the restriction, also implement the ignored domains check in the auth
system as a last line of defense.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
RN: "winbind:ignore domains" doesn't prevent user login from trusted domain
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

df5fe2d8

winbind: check for allowed domains in winbindd_pam_auth_pac_verify() · da474ddd

Ralph Böhme authored Jan 14, 2021

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

da474ddd

winbind: check for allowed domains in winbindd_dual_pam_chauthtok() · 88e92faa

Ralph Böhme authored Jan 11, 2021

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

88e92faa

winbind: check for allowed domains in winbindd_dual_pam_chng_pswd_auth_crap() · 4bc17600

Ralph Böhme authored Jan 11, 2021

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

4bc17600

winbind: check for allowed domains in winbindd_dual_pam_auth_crap() · c17bc9c6

Ralph Böhme authored Jan 11, 2021

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

c17bc9c6

winbind: check for allowed domains in winbindd_dual_pam_auth() · 4cefdf03

Ralph Böhme authored Jan 11, 2021

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

4cefdf03

winbind: move "winbind:ignore domain" logic to a seperate function · 894caca7

Ralph Böhme authored Jan 11, 2021

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

894caca7

selftest: add a test for "winbind:ignore domains" · 32197d21

Ralph Böhme authored Jan 13, 2021

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

32197d21

winbind: handle MSG_SMB_CONF_UPDATED in the winbinds children · 072ef480

Ralph Böhme authored Jan 20, 2021

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

072ef480

winbind: set logfile after reloading config · 0c4497f8

Ralph Böhme authored Jan 20, 2021

lp_load_global() will overwrite whatever we've set with lp_set_logfile().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

0c4497f8

winbind: move config-reloading code to winbindd_dual.c · 81edc65e

Ralph Böhme authored Jan 20, 2021

In preperation of forwarding MSG_SMB_CONF_UPDATED to all childs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

81edc65e

selftest: use correct DNS domain name for wrapper hosts file · e1fc8413

Ralph Böhme authored Jan 14, 2021

For some reason the join fails to register the DNS records when provisioning the
member env:

   Using short domain name -- SAMBA2008R2
   Joined 'IDMAPADMEMBER' to dns domain 'samba2008r2.example.com'
   DNS Update for idmapadmember.samba.example.com failed: ERROR_DNS_UPDATE_FAILED

At the same time the hosts file used by the wrappers contains the wrong fqdn. As
a result the test that the next commit is going do add fails due do the broken
DNS resolution:

...
UNEXPECTED(failure): samba3.blackbox.winbind_ignore_domain.test_winbind_ignore_domains_ok_krb5(ad_member_idmap_ad:local)
REASON: Exception: Exception: do_connect: Connection to idmapadmember.samba2008r2.example.com failed (Error NT_STATUS_UNSUCCESSFUL)
...

Checking DNS in the testenv, first the working record for the main DC:

testenv$ dig @10.53.57.64 dc7.samba2008r2.example.com +short
10.53.57.27

testenv$ bin/samba-tool dns query dc7 samba2008r2.example.com dc7 A -U Administrator%locDCpass7
  Name=, Records=1, Children=0
    A: 10.53.57.27 (flags=f0, serial=1, ttl=900)

Now the failing idmapadmember:

testenv$ dig @10.53.57.64 idmapadmember.samba2008r2.example.com +short

testenv$ bin/samba-tool dns query dc7 samba2008r2.example.com idmapadmember A -U Administrator%locDCpass7
ERROR: Record or zone does not exist.

Fixing the hosts file lets the tests work, fixing the broken DNS record
registration is a task for another day.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

e1fc8413

VFS: unityed_media: Fixup um_mknodat() to correctly use the dirfsp path. · e02b3484
Jeremy Allison authored Jan 20, 2021
```
Missed in my original fixes.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
```
e02b3484

VFS: unityed_media: Fix um_mkdirat() to correctly look at the full pathname. · 83686ff1

Jeremy Allison authored Jan 20, 2021

Missed in the original mkdirat fixes.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

83686ff1

VFS: time_audit: Fixup smb_time_audit_mknodat() to log the dirfsp path. · 9884d178
Jeremy Allison authored Jan 20, 2021
```
Missed in my original fixes.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
```
9884d178

VFS: syncops: Fixup all uses of the SYNCOPS_NEXT_SMB_FNAME macro to correctly use the dirfsp path. · 4c004d16

Jeremy Allison authored Jan 20, 2021

Remove the temp solution added to syncops_mkdirat()
as we now have a generic fix.

Missed in my original fixes.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

4c004d16

VFS: shadow_copy2: Fixup shadow_copy2_mknodat() to correctly use the dirfsp path. · 2f74056a
Jeremy Allison authored Jan 20, 2021
```
Missed in my original fixes.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
```
2f74056a