summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* s4:libcli/smb_composite: make the first round to gensec asyncStefan Metzmacher2017-06-171-36/+58
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:libcli/smb_composite: move gensec_update_ev() out of session_setup_spnego()Stefan Metzmacher2017-06-171-16/+30
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:libcli/smb_composite: move session_setup_spnego_restart() to the callers ↵Stefan Metzmacher2017-06-171-7/+21
| | | | | | | of session_setup_spnego() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:libcli/smb_composite: split out session_setup_spnego_restart() from ↵Stefan Metzmacher2017-06-171-19/+37
| | | | | | | session_setup_spnego() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:libcli/smb_composite: move chosen_oid to state->chosen_oidStefan Metzmacher2017-06-171-10/+20
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:libcli/smb_composite: simplify gensec_update_ev() handling in ↵Stefan Metzmacher2017-06-171-13/+8
| | | | | | | session_setup_spnego() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: add GENSEC_UPDATE_IS_NTERROR() helper macroStefan Metzmacher2017-06-171-0/+6
| | | | | | | | | This allows us to write clearer code that checks for NT_STATUS_OK and NT_STATUS_MORE_PROCESSING_REQUIRED. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: clear the update_busy_ptr in gensec_subcontext_start()Stefan Metzmacher2017-06-171-0/+1
| | | | | | | | This is required to support async subcontexts. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ctdb-recovery: Delete empty records during recoveryAmitay Isaacs2017-06-171-31/+2
| | | | | | | | | | | | Persistent databases are now always recovered by sequence number. So there is no need to keep the empty records in the database since they will never be recovered record-by-record using RSN. Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net> Autobuild-User(master): Martin Schwenke <martins@samba.org> Autobuild-Date(master): Sat Jun 17 16:47:55 CEST 2017 on sn-devel-144
* ctdb-daemon: Delete empty records from persistent databaseAmitay Isaacs2017-06-171-2/+0
| | | | | | | | | Persistent databases are now always recovered by sequence number. So there is no need to keep the empty records in the database since they will never be recovered record-by-record using RSN. Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
* s3:smb2_sesssetup: allow a compound request after a SessionSetupStefan Metzmacher2017-06-171-0/+1
| | | | | | | | | | | | | | | | This is not a full fix yet as we don't allow compound requests after going async. With SMB 3.11 requiring signed TreeConnect requests it's pointless to try to compound requests after a SessionSetup. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12845 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Jun 17 10:55:25 CEST 2017 on sn-devel-144
* s3:smb2_tcon: allow a compound request after a TreeConnectStefan Metzmacher2017-06-171-0/+2
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12844 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s3: libsmb: Correctly save and restore connection tcon in smbclient, ↵Jeremy Allison2017-06-175-13/+69
| | | | | | | | | smbcacls and smbtorture3. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12831 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* s3: libsmb: Correctly do lifecycle management on cli->smb1.tcon and ↵Jeremy Allison2017-06-172-7/+21
| | | | | | | | | | | | cli->smb2.tcon. Treat them identically. Create them on demand after for a tcon call, and delete them on a tdis call. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12831 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* s3: libsmb: Fix cli_state_has_tcon() to cope with SMB2 connections.Jeremy Allison2017-06-171-5/+17
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12831 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* s3: libsmb: Widen cli_state_get_tid() / cli_state_set_tid() to 32-bits.Jeremy Allison2017-06-176-16/+29
| | | | | | | | | Copes with SMB2 connections. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12831 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* s3: smbtorture: Show correct use of cli_state_save_tcon() / ↵Jeremy Allison2017-06-171-3/+5
| | | | | | | | | cli_state_restore_tcon(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=12831 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* s3: libsmb: Add cli_state_save_tcon() / cli_state_restore_tcon().Jeremy Allison2017-06-172-0/+23
| | | | | | | | | Save and restore tcon pointers in smb1 or smb2 structs. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12831 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* libcli: smb: Add smb2cli_tcon_set_id().Jeremy Allison2017-06-172-0/+6
| | | | | | | | | Will be used in test and client code. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12831 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* libcli: smb: Add smbXcli_tcon_copy().Jeremy Allison2017-06-172-0/+34
| | | | | | | | | | Makes a deep copy of a struct smbXcli_tcon *, will be used later. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12831 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* dsdb: Add comment explaining requirements on DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OIDAndrew Bartlett2017-06-161-1/+2
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Jun 16 23:43:46 CEST 2017 on sn-devel-144
* dsdb: Do not prevent searches for @ATTRIBUTES because the DB is not set up yetAndrew Bartlett2017-06-161-0/+5
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: Do not run dsdb_replace() on the calculated difference between old and ↵Andrew Bartlett2017-06-161-2/+12
| | | | | | | | | | | new schema We can set the database @INDEXLIST and @ATTRIBUTES to the full calculated values, not the difference, and let the ldb layer work it out under the transaction lock. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* selftest: confirm that two attributes are also correctly set in the @ recordsAndrew Bartlett2017-06-161-2/+39
| | | | | | | | This shows that the current behaviour in dsdb_schema_set_indices_and_attributes(), while not ideal, is not actually buggy. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* selftest: Fix failure message in dsdb_schema_infoAndrew Bartlett2017-06-161-2/+2
| | | | | | | The rename changes the CN, not the lDAPDisplayName Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* krb5_wrap: handle KRB5_ERR_HOST_REALM_UNKNOWN in ↵Stefan Metzmacher2017-06-161-0/+4
| | | | | | | smb_krb5_get_realm_from_hostname() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec_gssapi: fix CID 1409781: Possible Control flow issues (DEADCODE)Stefan Metzmacher2017-06-161-1/+4
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* selftest: Also wait for winbindd to startAndrew Bartlett2017-06-161-0/+22
| | | | | | | | | | | This ensures that the posixacl.py test does not race against winbindd starting up and so give wrong mappings BUG: https://bugzilla.samba.org/show_bug.cgi?id=12843 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* selftest: Correctly print message when nbt is not up in 20 secondsAndrew Bartlett2017-06-161-1/+1
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12843 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* tevent_threads: Fix a rundown race introduced with 1828011317bVolker Lendecke2017-06-161-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The race is easily reproduced by adding a poll(NULL,0,10) in between the two pthread_mutex_unlock calls in _tevent_threaded_schedule_immediate. Before 1828011317b, the main thread was signalled only after the helper had already unlocked event_ctx_mutex. Full explaination follows: ----------------------------------------------------------------- Inside _tevent_threaded_schedule_immediate() we have: 476 ret = pthread_mutex_unlock(&ev->scheduled_mutex); 477 if (ret != 0) { 478 abort(); 479 } HERE!!!! 481 ret = pthread_mutex_unlock(&tctx->event_ctx_mutex); 482 if (ret != 0) { 483 abort(); 484 } At the HERE!!! point, what happens is tevent_common_threaded_activate_immediate(), which is blocked on ev->scheduled_mutex, get released and does: 514 while (ev->scheduled_immediates != NULL) { 515 struct tevent_immediate *im = ev->scheduled_immediates; 516 DLIST_REMOVE(ev->scheduled_immediates, im); 517 DLIST_ADD_END(ev->immediate_events, im); 518 } - making an immediate event ready to be scheduled. This then returns into epoll_event_loop_once(), which then calls: 910 if (ev->immediate_events && 911 tevent_common_loop_immediate(ev)) { 912 return 0; 913 } which causes the immediate event to fire. This immediate event is the pthread job terminate event, which was previously set up in pthreadpool_tevent_job_signal() by: 198 if (state->tctx != NULL) { 199 /* with HAVE_PTHREAD */ 200 tevent_threaded_schedule_immediate(state->tctx, state->im, 201 pthreadpool_tevent_job_done, 202 state); So we now call pthreadpool_tevent_job_done() - which does: 225 TALLOC_FREE(state->tctx); calling tevent_threaded_context_destructor(): 384 ret = pthread_mutex_destroy(&tctx->event_ctx_mutex); <---------------- BOOM returns an error ! 385 if (ret != 0) { 386 abort(); 387 } as we haven't gotten to line 481 above (the line after HERE!!!!) so the tctx->event_ctx_mutex is still locked when we try to destroy it. So doing an additional: ret = pthread_mutex_lock(&tctx->event_ctx_mutex); ret = pthread_mutex_unlock(&tctx->event_ctx_mutex); (error checking elided) forces tevent_threaded_context_destructor() to wait until tctx->event_ctx_mutex is unlocked before it locks/unlocks and then is guaranteed safe to destroy. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: Remember the last ACL we read during a search and what it expanded toAndrew Bartlett2017-06-161-2/+81
| | | | | | | | | | | It may well be the same as the next one we need to check, so we can avoid parsing it again. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Jun 16 07:39:24 CEST 2017 on sn-devel-144
* dsdb: Cache the result of checking the parent ACLAndrew Bartlett2017-06-161-7/+87
| | | | | | | | This should help a lot for large one-level searches and for subtree searches that are of flat tree structures Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* WHATSNEW: change the default for "map untrusted to domain" to "auto"Stefan Metzmacher2017-06-161-1/+3
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* docs-xml: change the default for "map untrusted to domain" to "auto"Stefan Metzmacher2017-06-163-5/+14
| | | | | | | | | | | | | | This makes the behaviour much more robust, particularly with forest child domains over one-way forest trusts. Sadly we don't support this kind of setup with our current ADDC, so there's no way to have automated tests for this behaviour, but at least we know it doesn't break any existing tests. BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* docs-xml: document "map untrusted to domain = auto"Stefan Metzmacher2017-06-161-1/+22
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* docs-xml: improve documentation of "map untrusted to domain"Stefan Metzmacher2017-06-161-15/+10
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth3: prepare the logic for "map untrusted to domain = auto"Stefan Metzmacher2017-06-161-3/+5
| | | | | | | | | | | | | This implements the same behavior as Windows, we should pass the domain and account names given by the client directly to the auth backends, they can decide if they are able to process the authentication pass it to the next backend. BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth3: call is_trusted_domain() as the last condition make_user_info_map()Stefan Metzmacher2017-06-161-2/+4
| | | | | | | | | | We should avoid contacting winbind if we already know the domain is our local sam or our primary domain. BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* gitignore: ignore .gpg-* generated files (for ubuntu 16.04)Douglas Bagnall2017-06-151-0/+1
| | | | | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Jun 15 21:40:08 CEST 2017 on sn-devel-144
* repl_meta_data: single valued error codes depend on change typeDouglas Bagnall2017-06-151-4/+8
| | | | | | | | | | A replace leads to CONSTRAINT_VIOLATION while an add causes ATTRIBUTE_OR_VALUE_EXISTS. For this we need to check the mod type before the replmd_modify_la_* calls because they change everything into a replace. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: special-case member return value in replmd_add_fix_la()Douglas Bagnall2017-06-151-1/+5
| | | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Pair-programmed-with: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: check duplicate linked attributesDouglas Bagnall2017-06-152-5/+9
| | | | | | | | This is simple enough because we already have the sorted list. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Pair-programmed-with: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: check single values in replmd_add_fix_laGarming Sam2017-06-152-3/+17
| | | | | | | | | repl_meta_data knows whether linked attributes are appropriately [un-]duplicated, and this is how it tells ldb_tdb that. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb: 1.1.31ldb-1.1.31Douglas Bagnall2017-06-154-1/+279
| | | | | | | * Add efficient function to find duplicate values in ldb messages (this makes large multi-valued attributes in ldb_tdb more efficient) Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* ldb: relatively efficient functions for finding duplicate valuesDouglas Bagnall2017-06-156-57/+730
| | | | | | | | | | | | | | | | | | ldb backends need to make sure they are not adding duplicate values to multi-valued attributes in ADD and MODIFY operations. Until now they have done this inefficiently using nested loops. Here we add common functions that deal with large numbers of values in O(n log n) time, but continue to use the simple methods for small numbers of values. These functions take a struct ldb_context pointer and an options flag arguments, although the ldb is not used, and only one bit of the options has meaning. This is to allow further patches to switch on schema-aware comparisons. This entails an ABI jump to add the two new functions. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/tests/ldap: test single valued linked attributesDouglas Bagnall2017-06-152-0/+72
| | | | | | | This fails, so we add it to selftest/knownfail.d/ Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/linked_attribute tests: test duplicate valuesDouglas Bagnall2017-06-151-1/+19
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/tests/ldap: multivalued attributesDouglas Bagnall2017-06-151-0/+72
| | | | | | | Various return codes tested against Windows 2012r2. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python/test: delete_force() passes on command line argsDouglas Bagnall2017-06-151-2/+2
| | | | | | | | | | | This allows you to use e.g.: delete_force(self.ldb, ou, controls=['tree_delete:1']) Only in tests of course. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb.h whitespaceDouglas Bagnall2017-06-151-91/+91
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status