summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* VERSION: Disable GIT_SNAPSHOTS for the 4.7.0rc1 releasesamba-4.7.0rc1Karolin Seeger2017-07-041-1/+1
| | | | | Signed-off-by: Karolin Seeger <kseeger@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* VERSION: Bump version up to 4.7.0rc1Karolin Seeger2017-07-041-2/+2
| | | | | Signed-off-by: Karolin Seeger <kseeger@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* WHATSNEW: Prepare release notes for Samba 4.7.0rc1.Karolin Seeger2017-07-041-1/+1
| | | | | Signed-off-by: Karolin Seeger <kseeger@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* ctdb-daemon: Increase priority of logs when recovery happensAmitay Isaacs2017-07-041-2/+2
| | | | | Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
* ctdb-daemon: Increase priority of logs when shutting downAmitay Isaacs2017-07-041-2/+2
| | | | | Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
* ctdb-daemon: Increase priority of logs when ctdb starts up disabled/stoppedAmitay Isaacs2017-07-041-2/+4
| | | | | Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
* ctdb-daemon: Increase priority of logs when node is stopped/continuedAmitay Isaacs2017-07-041-2/+2
| | | | | Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
* ctdb-daemon: Increase priority of logs for recmaster changesAmitay Isaacs2017-07-041-2/+2
| | | | | Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
* ctdb-daemon: Increase priority of logs for node connect/disconnectAmitay Isaacs2017-07-041-2/+2
| | | | | Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
* WHATSNEW: Fix typoAndrew Bartlett2017-07-041-1/+1
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* WHATSNEW: Add docs for ntlm auth changesAndrew Bartlett2017-07-041-0/+7
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/tests: add a net cache samlogon testRalph Boehme2017-07-042-0/+47
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=12875 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* net: fix net cache samlogon list outputRalph Boehme2017-07-041-4/+5
| | | | | | | | | Don't print the table header for every entry. Bug: https://bugzilla.samba.org/show_bug.cgi?id=12875 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* smbldap: expose bind callback via API and increase smbldap ABI versionAlexander Bokovoy2017-07-044-7/+50
| | | | | | | | | | | | | | | | Until we fully migrate to use gensec in smbldap, we need to continue exposing bind callback to allow FreeIPA to integrate with smbldap. Since smbldap API is now lacking direct access to 'struct smbldap_state' and new API functions were added to give access to individual members of this structure, it makes sense to increase ABI version too. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Jul 4 11:14:49 CEST 2017 on sn-devel-144
* samr: Disable NTLM-based password changes on the server if NTLM is disabledAndrew Bartlett2017-07-043-1/+19
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Disable NTLM authentication in ktest environmentTim Beale2017-07-042-0/+6
| | | | | | | | | This allows us to prove that "ntlm auth = disabled" works Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923
* param: Add new "disabled" value to "ntlm auth" to disable NTLM totallyAndrew Bartlett2017-07-044-1/+13
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923 Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Add test to confirm NTLM authentication is enabledTim Beale2017-07-042-0/+73
| | | | | | | | | (or later, that it is disabled) Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923
* param: Disable LanMan authentication unless NTLMv1 is also enabledAndrew Bartlett2017-07-045-3/+36
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923
* selftest: Use new ntlmv2-only and mschapv2-and-ntlmv2-only optionsAndrew Bartlett2017-07-043-3/+13
| | | | | | | This will allow the py_credentials test to tell if these are in use Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* auth: Allow NTLMv1 if MSV1_0_ALLOW_MSVCHAPV2 is given and re-factor 'ntlm ↵Andrew Bartlett2017-07-046-12/+69
| | | | | | | | | | | | | | | | | | | | | | | | | auth =' The ntlm auth parameter is expanded to more clearly describe the role of each option, and to allow the new mode that permits MSCHAPv2 (as declared by the client over the NETLOGON protocol) while still banning NTLMv1. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12252 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Based on a patch by Mantas Mikulėnas <mantas@utenos-kolegija.lt>: Commit 0b500d413c5b ("Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth") added the --allow-mschapv2 option, but didn't implement checking for it server-side. This implements such checking. Additionally, Samba now disables NTLMv1 authentication by default for security reasons. To avoid having to re-enable it globally, 'ntlm auth' becomes an enum and a new setting is added to allow only MSCHAPv2. Signed-off-by: Mantas Mikulėnas <mantas@utenos-kolegija.lt> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Add test for support for MSCHAPv2 and NTLMv1 on a serverAndrew Bartlett2017-07-041-4/+98
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s3-rpc_server: Disable the NETLOGON server by defaultAndrew Bartlett2017-07-042-0/+20
| | | | | | | | | The NETLOGON server is only needed when the classic/NT4 DC is enabled and has been the source of security issues in the past. Therefore reduce the attack surface. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* tests: Add simple check whether netlogon server is runningTim Beale2017-07-042-0/+74
| | | | | | | | | | Netlogon only needs to run in DC environment. This is a simple test to check whether the netlogon service is running. This will allow us to disable the netlogon service on setups that don't require it. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Disable SChannel authentication if we are not a DCAndrew Bartlett2017-07-041-1/+16
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dns_server: Only install common library if AD DC is enabled.Andrew Bartlett2017-07-041-1/+2
| | | | | | | | | | The library is used in selftest, so must still be built This reverts commit d32b66b40c931fe8214faa2e1d40b34b86667d4c and replaces the behaviour. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* net: add net cache samlogon list|show|ndrdump|deleteRalph Boehme2017-07-041-0/+232
| | | | | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Tue Jul 4 00:12:46 CEST 2017 on sn-devel-144
* samlogon_cache: add netsamlog_cache_for_all()Ralph Boehme2017-07-032-0/+107
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* netlogon.idl: mark session keys with NDR_SECRETRalph Boehme2017-07-031-2/+2
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4/torture: test fetching a resume key twiceRalph Boehme2017-07-032-0/+64
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/smbd: remove unneeded flags argument from SMB_VFS_OFFLOAD_WRITE_SENDRalph Boehme2017-07-0312-112/+66
| | | | | | | | | | | | ...and instead use the fsctl to infer required behaviour in the VFS backends. Note that this removes the check from vfs_default because there we only handle FSCTL_SRV_COPYCHUNK(_WRITE) and must always perform the lock checks. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/smbd: get rid of files_struct.aapl_copyfile_supportedRalph Boehme2017-07-032-22/+10
| | | | | | | | A previous commit removed the special hook from the SMB layer, so we don't need this anymore. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4/torture: more tests for copy-chunk across sharesRalph Boehme2017-07-031-0/+166
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/vfs: make SMB_VFS_OFFLOAD_WRITE_SEND offload token basedRalph Boehme2017-07-0315-134/+242
| | | | | | | | | | | | | Remove the source fsp argument and instead pass the offload token generated with SMB_VFS_OFFLOAD_READ_SEND/RECV. An actual offload fsctl is not implemented yet, neither in the VFS nor at the SMB ioctl layer, and returns NT_STATUS_NOT_IMPLEMENTED With these changes we now pass the copy-chunk-across-shares test. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4/torture: add a test for copy-chunk across sharesRalph Boehme2017-07-032-0/+87
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/smbd: redesign macOS copyfile copy-chunkRalph Boehme2017-07-032-45/+37
| | | | | | | | | | | | | | | | | | The copy-chunk request chunk_count can be 0 and Windows server just returns success saying number of copied chunks is 0. macOS client overload this after negotiating AAPL via their SMB2 extensions, meaning it's a so called copyfile request (copy whole file and all streams). We previously checked this at the SMB layer, with this patch we just send this down the VFS, if vfs_fruit is loaded it implements the macOS copyile semantics, otherwise we get Windows behavour.. No change in behaviour. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/smbd: remove copy-chunk chunk merging optimisationRalph Boehme2017-07-031-74/+4
| | | | | | | | | | | | | As we won't have the source fsp around with the coming token based offload read/write based code, we can't merge chunks as that requires checking against the source file size. We could still merge chunks without checking, but getting the error handling correct would require comlicated logic for the SMB2 ioctl copy-chunk error reporting. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/smbd: remove unused arg smb1req from copychunk_check_handles()Ralph Boehme2017-07-031-4/+2
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/smbd: remove flags2 FLAGS2_READ_PERMIT_EXECUTE hack in the SMB2 codeRalph Boehme2017-07-034-17/+18
| | | | | | | | | | | | | | | | By adding a SMB2 specific CHECK_READ_SMB2 macro called that always grants read access if execute was granted, we can get rid of the flags2 hack. All callers in the SMB2 code are converted to use the CHECK_READ_SMB2 macro. Amongs other things, this later allows moving the handle checks in copychunk_check_handles() down into the VFS layer where we don't have access to the smbreq. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/smbd: remove ununsed req arg from CHECK_READ_IOCTL macroRalph Boehme2017-07-032-2/+2
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/vfs: rename SMB_VFS_COPY_CHUNK_SEND/RECV to SMB_VFS_OFFLOAD_WRITE_SEND/RECVRalph Boehme2017-07-0313-204/+211
| | | | | | | | | No change in behaviour, just a rename in preperation of more changes to SMB_VFS_OFFLOAD_WRITE_SEND. It helps keeping the diff of the actual changes smaller. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/smbd: use SMB_VFS_OFFLOAD_READ_SEND/RECVRalph Boehme2017-07-032-49/+91
| | | | | | | | | | | | | | | | No change in behaviour, this just uses the new SMB_VFS_OFFLOAD_READ_SEND in the duplicate extents and the resume key ioctls. In the copy-chunk/resume-key case this means using SMB_VFS_OFFLOAD_READ_SEND to create the resume-key token that is returned to the client. In the duplicate-extents case this ensures we can later call offload-write, which requires a previous call to offload-read that associates a token with a file-handle. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3/vfs: add SMB_VFS_OFFLOAD_READ_SEND/RECVRalph Boehme2017-07-0313-3/+907
| | | | | | | | | | | | | | | | | | Add SMB_VFS_OFFLOAD_READ_SEND an SMB_VFS_OFFLOAD_READ_RECV. This paves the way for supporting server-side copy-chunk with source and destination file-handles on different shares. It can be used to implement copy offload fsctl in the future, but for now this will be used as a mere copy-chunk replacement. SMB_VFS_OFFLOAD_READ generates a token that associates an fsp with the token and stores the fsp in a in-memory db. Initially only a copy-chunk resume key fsctl is supported. In the future this can be enhanced to support real offload fsctl. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4/torture: pass destination tree to test_setup_copy_chunkRalph Boehme2017-07-031-28/+30
| | | | | | | No change in behaviour, will be used in subsequent commits. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* librpc/idl: make use storage_offload_tokenRalph Boehme2017-07-031-2/+2
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* librpc/idl: fix STORAGE_OFFLOAD_TOKEN_TYPE_ZERO_DATA definitionRalph Boehme2017-07-031-2/+2
| | | | | | | | STORAGE_OFFLOAD_TOKEN_TYPE_ZERO_DATA is defined as 0xffff0001 in MS-FSCC 2.3.79. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* librpc/idl: convert offload flags to a bitmapRalph Boehme2017-07-031-5/+8
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* lib/util: add more tfork testsRalph Boehme2017-07-031-0/+438
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* lib/util: adjust loglevel in tfork test with samba_runcmd_send()Ralph Boehme2017-07-031-1/+1
| | | | | | | | No change in behaviour, this just ensures stdout and stderror are logged with log level 0. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* lib/util: make use of tfork in samba_runcmd_send()Ralph Boehme2017-07-032-50/+59
| | | | | | | | This makes it possible to use samba_runcmd_send() in processes like smbd that install a SIGCHLD handler that reaps all terminated children. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
View Lorry Controller Status