summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* auth: Fix a typo in auth/gensec/ncalrpc.cVolker Lendecke2021-12-101-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* librpc: Add named_pipe_auth_req_info5->transportVolker Lendecke2021-12-105-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | This will serve as a check to make sure that in particular a SAMR client is really root. This is for example used in get_user_info_18() handing out a machine password. The unix domain sockets for NCACN_NP can only be contacted by root, the "np\" subdirectory for those sockets is root/root 0700. Connecting to such a socket is done in two situations: First, local real root processes connecting and smbd on behalf of SMB clients connecting to \\pipe\name, smbd does become_root() there. Via the named_pipe_auth_req_info4 smbd hands over the SMB session information that the RPC server blindly trusts. The session information (i.e. the NT token) is heavily influenced by external sources like the KDC. It is highly unlikely that we get a system token via SMB, but who knows, this is information not fully controlled by smbd. This is where this additional field in named_pipe_auth_req_info5 makes a difference: This field is set to NCACN_NP by smbd's code, not directly controlled by the clients. Other clients directly connecting to a socket in "np\" is root anyway (only smbd can do become_root()) and can set this field to NCALRPC. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* named_pipe_auth.idl: Add "need_idle_server"Volker Lendecke2021-12-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Once RPC services are done by individual processes, we need to avoid recursion between processes: Any RPC server process will be able to serve multiple client requests simultaneously, but each request is served in a single-threaded blocking manner. For example the netlogon RPC service needs to ask samr for something. The netlogon->samr connection will initially be handled by a central dispatcher assigning clients to processes. This dispatcher needs to know that this connection can't end up in the same process that originated the request. With this flag an RPC client can request a samr server process that exclusively serves its own requests and that will not serve anybody else while serving netlogon. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* named_pipe_auth: Bump info4 to info5Volker Lendecke2021-12-103-60/+60
| | | | | | | We'll add a field soon Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* Update WHATSNEW.txt with removal of wildcard copy, rename and unlink.Jeremy Allison2021-12-091-0/+16
| | | | | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Thu Dec 9 18:57:15 UTC 2021 on sn-devel-184
* s3: smbd: Remove 'const char *src_original_lcomp' from reply_mv().Jeremy Allison2021-12-091-11/+0
| | | | | | | No longer used. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Remove 'const char *src_original_lcomp' parameter from ↵Jeremy Allison2021-12-094-5/+0
| | | | | | | | | rename_internals(). No longer used. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Inside rename_internals() remove '{ ... }' block around singleton ↵Jeremy Allison2021-12-091-68/+64
| | | | | | | | | | | rename code. Best viewed with 'git show -b' As we're touching the DEBUG() code, change it to modern DBG_NOTICE(). Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Remove the commented out resolve_wildcards().Jeremy Allison2021-12-091-129/+0
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Remove all wildcard code from rename_internals().Jeremy Allison2021-12-091-197/+4
| | | | | | | | | We no longer use resolve_wildcards() so comment it out for later removal. Keep the '{ ... }' block around the singleton rename for now, to keep the diff small. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Remove dest_has_wild and all associated code from rename_internals()Jeremy Allison2021-12-091-19/+0
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Prepare to remove wildcard matching from rename_internals().Jeremy Allison2021-12-091-14/+0
| | | | | | | src_has_wild and dest_has_wild can never be true. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: In reply_ntrename() remove 'bool dest_has_wcard' and all uses.Jeremy Allison2021-12-091-20/+12
| | | | | | | It's always false now. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: In reply_ntrename(), never set dest_has_wcard.Jeremy Allison2021-12-091-4/+0
| | | | | | | It can never be true. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: In reply_ntrename() remove the UCF_ALWAYS_ALLOW_WCARD_LCOMP flag ↵Jeremy Allison2021-12-091-8/+0
| | | | | | | | | for destination lookups. We know the destination will never be a wildcard. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: In SMBntrename (0xa5) prevent wildcards in destination name.Jeremy Allison2021-12-091-0/+5
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: In smb_file_rename_information() (SMB_FILE_RENAME_INFORMATION info ↵Jeremy Allison2021-12-091-2/+1
| | | | | | | level) prevent destination wildcards. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Remove UCF_ALWAYS_ALLOW_WCARD_LCOMP flag from pathname processing ↵Jeremy Allison2021-12-091-4/+2
| | | | | | | | | | in reply_mv(). We are no longer supporting wildcard rename via SMBmv (0x7) as WindowsXP SMB1 and above do not use it. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Remove 'bool has_wild' parameter from unlink_internals().Jeremy Allison2021-12-094-8/+5
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Change unlink_internals() to ignore has_wild parameter.Jeremy Allison2021-12-091-203/+26
| | | | | | | | It's always passed as false now so we can remove the (horrible) enumeration code for unlink. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: In reply_unlink() remove the possibility of receiving a wildcard name.Jeremy Allison2021-12-091-17/+2
| | | | | | | | | | This was the only user of "has_wild=true" passed to unlink_internals(). Next commit will remove this functionality from unlink_internals(). Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: smbd: Remove support for SMBcopy SMB_COM_COPY (0x29)Jeremy Allison2021-12-091-408/+11
| | | | | | | | | | | | | | | | | It's not used in our client code or tested. From MS-CIFS. This command was introduced in the LAN Manager 1.0 dialect It was rendered obsolete in the NT LAN Manager dialect. This command was used to perform server-side file copies, but is no longer used. Clients SHOULD NOT send requests using this command code. Servers receiving requests with this command code SHOULD return STATUS_NOT_IMPLEMENTED (ERRDOS/ERRbadfunc). Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: Remove the wildcard unlink test code.Jeremy Allison2021-12-093-72/+1
| | | | | | | | | This is pre WindowXP SMB1 functionality, and we need to remove this from the server in order to move towards SMB2-only, so the test must go. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: torture: Remove the wildcard rename test code.Jeremy Allison2021-12-091-33/+0
| | | | | | | | | This is pre WindowXP SMB1 functionality, and we need to remove this from the server in order to move towards SMB2-only, so the test must go. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: torture: Remove the wildcard unlink test code.Jeremy Allison2021-12-091-72/+0
| | | | | | | | | This is pre WindowXP SMB1 functionality, and we need to remove this from the server in order to move towards SMB2-only, so the test must go. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In run_smb1_wild_mangle_unlink_test() use a valid pathname for ↵Jeremy Allison2021-12-091-1/+1
| | | | | | | | | rename target. The server will not be supporting wildcard rename soon. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In torture_mangle(), use torture_deltree() for setup and cleanup.Jeremy Allison2021-12-091-7/+2
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In test_mask(), use torture_deltree() for setup.Jeremy Allison2021-12-091-2/+1
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In run_streamerror(), use torture_deltree() for setup.Jeremy Allison2021-12-091-2/+1
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In torture_chkpath_test(), use torture_deltree() for setup and ↵Jeremy Allison2021-12-091-6/+2
| | | | | | | cleanup. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In torture_casetable(), use torture_deltree() for setup and ↵Jeremy Allison2021-12-091-4/+2
| | | | | | | cleanup. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In torture_utable(), use torture_deltree() for setup.Jeremy Allison2021-12-091-1/+1
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In run_smb1_wild_mangle_rename_test() use torture_deltree() for ↵Jeremy Allison2021-12-091-8/+2
| | | | | | | setup and cleanup. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: In run_smb1_wild_mangle_unlink_test() use torture_deltree() for ↵Jeremy Allison2021-12-091-8/+2
| | | | | | | setup and cleanup. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3: torture: Add torture_deltree() for setup and teardown.Jeremy Allison2021-12-092-0/+128
| | | | | | | Not yet used. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: libcli: smbcli_unlink() is no longer used with wildcard patterns.Jeremy Allison2021-12-091-5/+1
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: torture: Use smbcli_unlink_wcard() to setup and cleanup in masktest.Jeremy Allison2021-12-091-1/+1
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: torture: Use smbcli_unlink_wcard() in base.casetable test.Jeremy Allison2021-12-091-1/+1
| | | | | | | Avoid smbcli_unlink() calls with a wildcard path. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: torture: Use smbcli_unlink_wcard() to cleanup in base.mangle test.Jeremy Allison2021-12-091-1/+1
| | | | | | | Avoid using smbcli_unlink() calls with wildcard names. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: torture: Use smbcli_unlink_wcard() to remove wildcards in base.chkpath test.Jeremy Allison2021-12-091-2/+2
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: torture: In raw.notify test use smbcli_unlink_wcard() in place of ↵Jeremy Allison2021-12-091-1/+1
| | | | | | | | | smbcli_unlink(). We know we have a wildcard mask here. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: libcli: In smbcli_deltree() use smbcli_unlink_wcard() in place of ↵Jeremy Allison2021-12-091-1/+1
| | | | | | | | | smbcli_unlink(). We know we have a wildcard mask here. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: libcli: Add smbcli_unlink_wcard().Jeremy Allison2021-12-092-0/+101
| | | | | | | | | | We will use this in place of smbcli_unlink() when we know we are using a wildcard pattern. If can be used to generally replace smbcli_unlink() as it calls down to smbcli_unlink() is no wildcard is detected. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4-auth: Remove unused headersAndrew Bartlett2021-12-092-2/+0
| | | | | | | | | | | | These changes were submitted in a patch by Stefan Metzmacher <metze@samba.org> in his lorikeet-heimdal import branch of patches to upgrade to a modern Heimdal. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Thu Dec 9 14:14:12 UTC 2021 on sn-devel-184
* auth/credentials: Fix cli_credentials_shallow_ccache error caseStefan Metzmacher2021-12-091-3/+8
| | | | | | | Avoid dangling values if something fails... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* auth/credentials: Handle ENOENT when obtaining ccache lifetimeStefan Metzmacher2021-12-091-1/+1
| | | | | | | The new Heimdal may return ENOENT instead of KRB5_CC_END. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* librpc: match gensec_gssapi and call gsskrb5_set_dns_canonicalize() for HeimdalAndrew Bartlett2021-12-091-6/+36
| | | | | | | | | | This is needed to ensure Heimdal does not attempt to use nss to canonicalize the name. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Dec 9 07:42:38 UTC 2021 on sn-devel-184
* build: Add missing dependency on addnsAndrew Bartlett2021-12-091-1/+2
| | | | | | | This becomes noticed when we upgrade Heimdal as we do not find the correct gssapi headers any more. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* hdb: Initialise HDB structureJoseph Sutton2021-12-091-1/+1
| | | | | | | | | | | | Additional fields may be added to this structure without us explicitly initialising them. This could cause Heimdal to crash upon reading garbage data, so we should zero-initialise the structure. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Dec 9 02:47:27 UTC 2021 on sn-devel-184
* tests/krb5: Allow PADATA-ENCRYPTED-CHALLENGE to be missing for skew errorsJoseph Sutton2021-12-071-1/+2
| | | | | | | | | | | | A skew error means the client just tried using PADATA-ENC-TIMESTAMP or PADATA-ENCRYPTED-CHALLENGE, so it might not be necessary to announce them in that case. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Dec 7 08:32:42 UTC 2021 on sn-devel-184
View Lorry Controller Status