summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* addns: Async ads_dns_lookup_srvVolker Lendecke2019-01-153-207/+151
| | | | | | | | Use dns_lookup_send/recv to get SRV records. This avoids synchronous libresolv calls and provides the infrastructure to get dsgetdcname async. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* samba_dnsupdate: With dns_hub, we don't need resolv_wrapVolker Lendecke2019-01-151-25/+12
| | | | | | | Best viewed with git show -b Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* selftest: Use dns_hub's resolv.confVolker Lendecke2019-01-152-8/+27
| | | | | | | Pass it as RESOLV_CONF envvar everywhere Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* selftest: Add dns_hub depsVolker Lendecke2019-01-151-9/+10
| | | | | | | All the DCs want the dns forwarder Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* selftest: setup_dns_hubStefan Metzmacher2019-01-152-0/+111
| | | | | | | Start the central dns forwarder on interface 64 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* selftest: add central dns forwarderVolker Lendecke2019-01-151-0/+156
| | | | | | | | | This is a small DNS server that has hard redirects to the different domain controllers based on domain names. This is required because future commits will avoid calling into libresolv's code which resolv_wrapper takes care of. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli/dns: Add dns_res_rec_get_sockaddrVolker Lendecke2019-01-152-0/+40
| | | | | | | Pull the address from a res_rec if it's there Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli/dns: clidns must depend on ndr_standard, not on NDR_DNSVolker Lendecke2019-01-151-1/+1
| | | | | | | Otherwise we can't link this into other libraries Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli/dns: Make "clidns" a libraryVolker Lendecke2019-01-151-2/+3
| | | | | | | | | This will be linked into the SAMBA_LIBRARY "addns" in the next step. Because the other user, "dnsserver_common", is also a library, we can't link this as a subsystem anymore. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dns_lookup: Let make test override the resolv.conf locationVolker Lendecke2019-01-151-1/+12
| | | | | | | | Make this a separate commit: That is the feature that libc unfortunately does not give us. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli/dns: Add dns_lookupVolker Lendecke2019-01-154-0/+435
| | | | | | | | | | | Wrapper function to parse resolv.conf and talk to multiple nameservers. This is the code where we might want to add a "working nameserver" cache. glibc always looks at the first configured nameserver. If that's dead, glibc runs into a timeout and only then asks the second one that might succeed. When more than one dns query is to be performed, these timeouts add up. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli/dns: Add resolv.conf parsingVolker Lendecke2019-01-156-1/+272
| | | | | | | | | | | Right now this only looks at the nameserver setting. It is initally made for asynchronous AD DC lookup routines, where we don't need the "search", "domain" and other settings. When we convert general "net", "smbclient" and others to use this, we might either add "domain" handling to this code or look at something like c-ares which already does it. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dns_update: samba_dnsupdate's exit code is not an errnoVolker Lendecke2019-01-151-2/+2
| | | | | | | | This avoids confusing messages, samba_dnsupdate returns the number of failed updates Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* addns: Centralize siteless lookup fallbackVolker Lendecke2019-01-151-60/+29
| | | | | | | We had the same logic 3 times, coalesce into one Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* vfs_fileid: fix get_connectpath_inoRalph Wuerthner2019-01-151-1/+3
| | | | | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13741 Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Jan 15 04:13:15 CET 2019 on sn-devel-144
* s3:smbd: perform impersonation in smb2_query_directory_fetch_write_time_done()Ralph Boehme2019-01-141-0/+7
| | | | | | | | | | | | This is not strictly required, as we ne never trigger additional VFS requests via this codepath. But for safety reasons ensure we're running in the correct impersonation state. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Jan 14 22:30:24 CET 2019 on sn-devel-144
* s3:smbd: perform impersonation in smb2_query_directory_dos_mode_done()Ralph Boehme2019-01-141-0/+7
| | | | | | | | This is needed as the callback might be called in an arbitrary impersonation state. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s3:smbd: perform impersonation in dos_mode_at_vfs_get_dosmode_done()Ralph Boehme2019-01-141-0/+7
| | | | | | | | This is needed as the callback might be called in an arbitrary impersonation state. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* vfs_default: use change_to_user_by_fsp() instead of change_to_user()Ralph Boehme2019-01-141-6/+2
| | | | | | | Cosmetic change. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* vfs: perform impersonation in smb_vfs_call_getxattrat_done()Ralph Boehme2019-01-141-0/+9
| | | | | | | | This is needed as the callback might be called in an arbitrary impersonation state. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* vfs: use struct initializer in smb_vfs_call_getxattrat_send()Ralph Boehme2019-01-141-1/+4
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* vfs: perform impersonation in smb_vfs_call_get_dos_attributes_done()Ralph Boehme2019-01-141-0/+9
| | | | | | | | This is needed as the callback might be called in an arbitrary impersonation state. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* vfs: use struct initializer in smb_vfs_call_get_dos_attributes_sendRalph Boehme2019-01-141-1/+4
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* netcmd: Change domain backup commands to use s3 SMB Py bindingsTim Beale2019-01-142-14/+6
| | | | | | | | | | | | This means we can now backup a DC that has SMBv1 disabled. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Tim Beale <timbeale@samba.org> Autobuild-Date(master): Mon Jan 14 06:49:09 CET 2019 on sn-devel-144
* tests: Change ntaclsbackup tests over to use s3 Py bindingsTim Beale2019-01-141-2/+2
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* s3:pylibsmb: Add .get_acl() API to SMB py bindingsTim Beale2019-01-141-0/+53
| | | | | | | | | | | | There is no obvious async-equivalent of cli_query_security_descriptor(), so it will throw an error if anyone tries to use it in multi-threaded mode. Currently only samba-tool and tests use the (s4) .get_acl() API, both of which will be fine using the synchronous API. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* lib/ldb: Use new PYARG_ES format for parseTupleNoel Power2019-01-132-4/+5
| | | | | | | | | | | | | | | | | | | | | | While 'es' format works great for unicode (in python2) and str (in python3) The behaviour with str (in python2) is unexpected. In python2 the str type is (re-encoded) with the specified encoding. In python2 the 'et' type would be a better match, that ensures 'str' type is treated like it was with 's' (no reencoding) and unicode is encoded with the specified encoding. However in python3 'et' allows byte (or bytearray) params to be accepted (with no reencoding), we don't want this. This patch adds a new PYARG_STR_UNI format code which is a hybrid, in python2 it evaluates to 'et' and in python3 'es' and so gives the desired behaviour for each python version. Additionally remove the associated known fail. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13616 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Sun Jan 13 03:53:00 CET 2019 on sn-devel-144
* selftest: Enable ldb.python for PY3Noel Power2019-01-131-1/+1
| | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* lib/ldb/tests/python: Add test to pass utf8 encoded bytes to ldb.DnNoel Power2019-01-132-0/+18
| | | | | | | | | | | | This test should demonstrate an error with the 'es' format in python where a 'str' byte-string is passed (containing utf8 encoded bytes) with some characters that cannot be decoded as ascii. The same code if run in python3 should generate an error (needs string not bytes) Also Add knownfail for ldb.Dn passed utf8 encoded byte string Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* s4/libnet: use 'et' as format for ParseTuple with python2Noel Power2019-01-131-1/+2
| | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* python: use 'et' as format for ParseTuple with python2Noel Power2019-01-131-2/+6
| | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* auth/credentials: use 'et' as format for ParseTuple with python2Noel Power2019-01-131-1/+1
| | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* python: Add new compat PYARG_STR_UNI formatNoel Power2019-01-131-0/+10
| | | | | | | | | | | In python2 PYARG_STR_UNI evaluates to et which allows str type (e.g bytes) pass through unencoded and accepts unicode objects encoded as utf8 In python3 PYARG_STR_UNI evaluates to es which allows str type encoded as named/specified encoding Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* python: Fix memory leak with ParseTuple (using 'es' format)Noel Power2019-01-131-7/+15
| | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* selftest:Samba4: run fl2003dc without security context multiplexingStefan Metzmacher2019-01-121-0/+1
| | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Jan 12 06:25:37 CET 2019 on sn-devel-144
* selftest:Samba4: run the raw_protocol test with a limit of 8 auth contextsStefan Metzmacher2019-01-122-1/+4
| | | | | | | | | | This is much faster than exploring the limit of 2049 during autobuild. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:rpc_server: implement security context multiplexingStefan Metzmacher2019-01-124-17/+199
| | | | | | | | | | | | | | | | | There're some systems like Cisco ISE use security multiplexing without checking (via bind time feature negotiation) the server supports it. Others like VMWare View, fallback to NT4 style netlogon connections without using netlogon secure channel, which then triggers an error, with "server schannel = yes", see https://bugzilla.samba.org/show_bug.cgi?id=13464. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* py:dcerpc/raw_protocol: add tests to demonstrate how security context ↵Stefan Metzmacher2019-01-122-0/+971
| | | | | | | | | | | | | | | | | | | | | | multiplexing works Important things are this: - It's not required to use the bind time feature negotiation in order to use it, it's only a hint for the client, but nothing is really negotiated, unlike the request multiplexing with the DCERPC_PFC_FLAG_CONC_MPX. - There's special handling related to AUTH_LEVEL_CONNECT and requests without auth trailer - An security context is identified by the unique tuple of auth_type, auth_level and auth_context_id (all together!), not just the auth_context_id. - There's a limit of 2049 explicit authentication contexts. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* py:dcerpc/raw_testcase: add assertEqualsStrLower()Stefan Metzmacher2019-01-121-0/+3
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* pidl/Python: use py_dcerpc_ndr_pointer_wrap/deref if multiple pointer levels ↵Stefan Metzmacher2019-01-121-4/+31
| | | | | | | | | | | | are used This will help the raw_protocol test to explore lsa_GetUserName. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:pyrpc: add py_dcerpc_ndr_pointer_deref/wrap() infrastructureStefan Metzmacher2019-01-123-0/+133
| | | | | | | | | | | | | | | | | | | | Some idl files use more than one layer of unique pointers. e.g. NTSTATUS lsa_GetUserName( [in,unique] [string,charset(UTF16)] uint16 *system_name, [in,out,ref] lsa_String **account_name, [in,out,unique] lsa_String **authority_name ); In order to specify *io.in.authority_name = NULL, we need to wrap the pointer value (lsa_String or None) into an base.ndr_pointer() object. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:pyrpc: make use of pytalloc_get_type() in py_dcerpc_syntax_init_helper()Stefan Metzmacher2019-01-121-1/+1
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:rpc_server/lsa: specify \\pipe\lsass as ncacn_np_secondary_endpointStefan Metzmacher2019-01-122-3/+6
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:rpc_server: make it possible to specify ncacn_np_secondary_endpointStefan Metzmacher2019-01-126-4/+47
| | | | | | | | | | | Even a connect to \\pipe\lsarpc should return a secondary_address of '\\pipe\\lsass'. But that will be implemented in a following commit. BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* py:dcerpc/raw_protocol: demonstrate that \\pipe\lsarpc returns \\pipe\lsass ↵Stefan Metzmacher2019-01-122-2/+5
| | | | | | | | | | as secondary_address BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:rpc_server: only share assoc group ids on the same transportStefan Metzmacher2019-01-123-15/+34
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* py:dcerpc/raw_protocol: add test_assoc_group_fail3()Stefan Metzmacher2019-01-122-0/+46
| | | | | | | | | | | This demonstrates that assoc groups are only shared on the same transport (endpoint). BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:rpc_server: don't replace '\\pipe\\' with '\\PIPE\\'Stefan Metzmacher2019-01-122-18/+1
| | | | | | | | | | This is not what Windows returns (at least for \\pipe\lsass). BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* py:dcerpc/raw_protocol: add test_assoc_group_ok2 to check assoc groups over ↵Stefan Metzmacher2019-01-122-0/+32
| | | | | | | | | | ncacn_np BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* selftest:Samba4: allow dcerpc auth level connect:lsarpc = yes in chgdcpassStefan Metzmacher2019-01-121-2/+6
| | | | | | | | | | | This is required to explore the details of security context multiplexing using lsa_GetUserName(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
View Lorry Controller Status