summaryrefslogtreecommitdiff
path: root/selftest
Commit message (Collapse)AuthorAgeFilesLines
...
* winbindd: Route predefined domains through the BUILTIN domain childRalph Boehme2018-12-101-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without this eg "NT Authority" didn't work: $ bin/wbinfo -n "NT Authority/Authenticated Users" failed to call wbcLookupName: WBC_ERR_DOMAIN_NOT_FOUND Could not lookup name NT Authority/Authenticated Users $ bin/wbinfo --group-info="NT Authority/Authenticated Users" failed to call wbcGetgrnam: WBC_ERR_DOMAIN_NOT_FOUND Could not get info for group NT Authority/Authenticated Users With the patch: $ bin/wbinfo -n "NT Authority/Authenticated Users" S-1-5-11 SID_WKN_GROUP (5) $ bin/wbinfo --group-info="NT Authority/Authenticated Users" NT AUTHORITY\authenticated users:x:10002: BUG: https://bugzilla.samba.org/show_bug.cgi?id=12164 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: David Mulder <dmulder@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Wed Dec 5 11:27:22 CET 2018 on sn-devel-144 (cherry picked from commit 8b8d9fdad4a4e2c479141b3d40e9a7320a49c0dd) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Mon Dec 10 13:43:15 CET 2018 on sn-devel-144
* selftest: test wbinfo -n and --gid-info with "NT Authority"Ralph Boehme2018-12-101-0/+2
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12164 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: David Mulder <dmulder@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org> (cherry picked from commit c46b6b111e8adcd7cf029e5c3293cbdc471793db)
* CVE-2018-14629 dns: fix CNAME loop prevention using counter regressionStefan Metzmacher2018-12-101-6/+0
| | | | | | | | | | | | | | | | | The loop prevention should only be done for CNAME records! Otherwise we truncate the answer records for A, AAAA or SRV queries, which is a bad idea if you have more than 20 DCs. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13600 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Dec 4 08:52:29 CET 2018 on sn-devel-144 (cherry picked from commit 34f4491d79b47b2fe2457b8882f11644cf773bc4)
* CVE-2018-14629: Tests to expose regression from dns cname loop fixAaron Haslett2018-12-101-2/+18
| | | | | | | | | | | These tests expose the regression described by Stefan Metzmacher in discussion on the bugzilla paged linked below. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13600 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 14399fd818b130a6347eec860460929c292d5996)
* libcli/smb: don't overwrite status codeRalph Boehme2018-12-041-2/+0
| | | | | | | | | | | | | | | | The original commit c5cd22b5bbce724dcd68fe94320382b3f772cabf from bug 9175 never worked, as the preceeding signing check overwrote the status variable. Bug: https://bugzilla.samba.org/show_bug.cgi?id=9175 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Tue Nov 13 17:28:45 CET 2018 on sn-devel-144 (cherry picked from commit 5a8583ed701be97c33a20b2a20f6bbb8ac2f8e99)
* s4:torture/smb2/session: test smbXcli_session_set_disconnect_expired() worksRalph Boehme2018-12-041-0/+2
| | | | | | | | | | | | This adds a simple test that verifies that after having set smbXcli_session_set_disconnect_expired() a session gets disconnected when it expires. Bug: https://bugzilla.samba.org/show_bug.cgi?id=9175 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit a5d1bb5c5b5a57a2d7710dc5ab962683fe5c8e68)
* CVE-2018-16857 dsdb/util: Fix lockOutObservationWindow for PSOsTim Beale2018-11-251-2/+0
| | | | | | | | | | Fix a remaining place where we were trying to read the msDS-LockoutObservationWindow as an int instead of an int64. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16857 dsdb/util: Correctly treat lockOutObservationWindow as 64-bit intTim Beale2018-11-251-2/+0
| | | | | | | | | | | | | | | | | Commit 442a38c918ae1666b35 refactored some code into a new get_lockout_observation_window() function. However, in moving the code, an ldb_msg_find_attr_as_int64() inadvertently got converted to a ldb_msg_find_attr_as_int(). ldb_msg_find_attr_as_int() will only work for values up to -2147483648 (about 3.5 minutes in MS timestamp form). Unfortunately, the automated tests used a low enough timeout that they still worked, however, password lockout would not work with the Samba default settings. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16857 tests: Sanity-check password lockout works with default valuesTim Beale2018-11-251-0/+4
| | | | | | | | | | | | | | | | Sanity-check that when we use the default lockOutObservationWindow that user lockout actually works. The easiest way to do this is to reuse the _test_login_lockout() test-case, but stop at the point where we wait for the lockout duration to expire (because we don't want the test to wait 30 mins). This highlights a problem currently where the default values don't work. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16852 dcerpc dnsserver: Ensure properties are handled correctlyGary Lockyer2018-11-251-4/+0
| | | | | | | | | | | | | | | Fixes for Bug 13669 - (CVE-2018-16852) NULL pointer de-reference in Samba AD DC DNS management The presence of the ZONE_MASTER_SERVERS property or the ZONE_SCAVENGING_SERVERS property in a zone record causes the server to follow a null pointer and terminate. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13669 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16852 dcerpc dnsserver: Verification testsGary Lockyer2018-11-251-0/+4
| | | | | | | | | | | | | | | Tests to verify Bug 13669 - (CVE-2018-16852) NULL pointer de-reference in Samba AD DC DNS management The presence of the ZONE_MASTER_SERVERS property or the ZONE_SCAVENGING_SERVERS property in a zone record causes the server to follow a null pointer and terminate. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13669 Reviewed-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2018-14629 dns: CNAME loop prevention using counterAaron Haslett2018-11-251-0/+6
| | | | | | | | | | | Count number of answers generated by internal DNS query routine and stop at 20 to match Microsoft's loop prevention mechanism. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13600 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* selftest: Add share to test "delete readonly" optionChristof Schmitt2018-11-071-0/+4
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13673 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit a8e79decbcfbae1b1a53ec81b942ee06db26bf8f)
* smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attributeChristof Schmitt2018-11-071-2/+0
| | | | | | | | | | | | | | | MS-FSA states that a CREATE with FILE_DELETE_ON_CLOSE on an existing file with READ_ONLY attribute has to return STATUS_CANNOT_DELETE. This was missing in smbd as the check used the DOS attributes from the CREATE instead of the DOS attributes on the existing file. We need to handle the new file and existing file cases separately. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13673 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 162a5257c48f20d3752f644e86c9e626b46436c0)
* smbtorture: Add test for DELETE_ON_CLOSE on files with READ_ONLY attributeChristof Schmitt2018-11-071-0/+2
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13673 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit dc9bbbe4141d8425e66fe9290ff611845f4bd1ce)
* vfs_fruit: let fruit_open_meta() with O_CREAT return a fake-fdRalph Boehme2018-11-061-3/+0
| | | | | | | | | | | | | | | | | This is the final step in implementing the needed macOS semantics on the FinderInfo stream: as long as the client hasn't written a non-zero FinderInfo blob to the stream, there mustn't be a visible filesystem entry for other openers. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13646 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Nov 1 01:14:23 CET 2018 on sn-devel-144 (cherry picked from commit 1b2de44ea8114cf2025e8b8c843131e2f2dbed27)
* s4:torture/vfs/fruit: add test "empty_stream"Ralph Boehme2018-11-061-0/+3
| | | | | | | | | | | | | One to rule them all: consistently test critical operations on all streams relevant to macOS clients: the FinderInfo stream, the Resource Fork stream and an arbitrary stream that macOS maps to xattrs when written to on a macOS SMB server. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13646 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 9d8751db64de75a0de442365b317c1b9ce194170)
* vfs_fruit: filter empty streamsRalph Boehme2018-11-061-3/+0
| | | | | | | | | | | | | | | | | | | | | | | First step in achieving macOS compliant behaviour wrt to empty streams: - hide empty streams in streaminfo - prevent opens of empty streams This means that we may carry 0-byte sized streams in our streams backend, but this shouldn't really hurt. The previous attempt of deleting the streams when an SMB setinfo eof to 0 request came in, turned out be a road into desaster. We could set delete-on-close on the stream, but that means we'd have to check for it for every write on a stream and checking the delete-on-close bits requires fetching the locking.tdb record, so this is expensive and I'd like to avoid that overhead. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13646 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit ebfcf75e993b1a792db76b94aa898532e1c81eeb)
* s4:torture/vfs/fruit: expand test "setinfo eof stream"Ralph Boehme2018-11-061-0/+3
| | | | | | | | | | | | | | | o Adds checks verifying that after setting eof to 0 on a stream, a subsequent open gets ENOENT, before and after closing the handle that had been used to set eof to 0. o Verify that a write to a handle succeeds after that handle has been used to set eof to 0 on a stream. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13646 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit b35d9e74028727da24f349242cb0bc62403a9b09)
* vfs_fruit: update handling of read-only creation of resource forkRalph Boehme2018-11-061-3/+0
| | | | | | | | | | | macOS SMB server versions supports this since 10.12, so we adapt our behaviour. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13646 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 055ca448f1a2bd995291af1810c9ec94f90f32dd)
* s4:torture/vfs/fruit: update test "creating rsrc with read-only access" for ↵Ralph Boehme2018-11-061-0/+3
| | | | | | | | | | | | | | newer macOS versions While this operation failed against older macOS versions, it passes against versions 10.12 and newer. Update the test accordingly, a subsequent commit will then update our implementation. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13646 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit c3cf09a0791ed4dfb7ca18d175396ac1aca5d2ed)
* s3:smbd: fix SMB2 aio cancellingRalph Boehme2018-11-061-1/+0
| | | | | | | | | | | | | | | | | As we currently don't attempt to cancel the internal aio request, we must ignore the SMB2 cancel request and continue to process the SMB2 request, cf MS-SM2 3.3.5.16: If the target request is not successfully canceled, processing of the target request MUST continue and no response is sent to the cancel request. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13667 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 07eb805cde4db6ac74740e3cfbc56ab6f8e2118a)
* s4:torture/smb2/read: add test for cancelling SMB aioRalph Boehme2018-11-062-0/+7
| | | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13667 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit e37ff8c5fe18d400e378bf2591e209b30473d9f9)
* dsdb group audit: align dn_compare with memcmpGary Lockyer2018-11-051-1/+0
| | | | | | | | | | | | | | | | | Rename the parameter names and adjust the return codes from dn_compare so that: dn_compare(a, b) => LESS_THAN means a is less than b. GREATER_THAN means a is greater than b. Thanks to metze for suggesting the correct semantics for dn_compare BUG: https://bugzilla.samba.org/show_bug.cgi?id=13664 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 8420a4d0fddd71af608635a707ef20f37fa9b627)
* dsdb group_audit: Test to replicate BUG 13664Gary Lockyer2018-11-051-0/+1
| | | | | | | | | | | | | The group audit code incorrectly logs member additions and deletions. Thanks to metze for the debugging that isolated the issue, and for suggesting the fix to dn_compare. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13664 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit eeb4089dafc45277d8af19073ef9348451c1836a)
* dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file pathGary Lockyer2018-11-051-14/+0
| | | | | | | | | | | | | | | | | | | | | Correctly handle "ldb://" and "mdb://" schemes in the file path when determining the path for the encrypted secrets key file. When creating a new user and specifying the local file path of the sam.ldb DB, it was possible to create an account that you could not login with. The path for the key file was incorrectly calculated for the "ldb://" and "mdb://" schemes, the scheme was not stripped from the path and the subsequent open of the key file failed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13653 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Oct 19 09:34:46 CEST 2018 on sn-devel-144 (cherry picked from commit 7b59cd74f9f75d85b91c6ca517d0243e7f6bd2e1)
* dsdb encrypted_secrets tests: Allow "ldb://" in file pathGary Lockyer2018-11-052-0/+20
| | | | | | | | | | | | | | When creating a new user and specifying the local file path of the sam.ldb DB, it's possible to create an account that you can't actually login with. This commit contains tests to verify the bug. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13653 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit e1eee614ca8a3f0f5609a3d9d8ce7ae926de1f9e)
* lib/ldb: Ensure ldb.Dn can accept utf8 encoded unicodeNoel Power2018-11-051-2/+0
| | | | | | | | | Additionally remove the associated known fail. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13616 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit cddd54e8654c94dedd57c08af1987ce03212ce20)
* lib/ldb/tests: add test for ldb.Dn passed utf8 unicodeNoel Power2018-11-051-0/+2
| | | | | | | | | | | | | | object dn format should be a utf8 encoded string Note: Currently this fails in python2 as the c python binding for the dn string param uses PyArg_ParseTupleAndKeywords() with 's' format, this will accept str *or* unicode in the default encoding. The default encoding in python2 is... ascii. Also adding here a knownfail to squash the error produced by the test. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit d1492ab919b19d1ca72f1d7c97ac0ca3bee13a2a)
* s4:samldb: internally use extended dns while changing the primaryGroupID fieldStefan Metzmacher2018-11-051-2/+0
| | | | | | | | | | | This is important, otherwise we'll loose the <SID=> component of the linked attribute. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 7a36cb30b716d56b84e894851c1a18e9eb3a0964)
* s4:repl_meta_data: add support for DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SIDStefan Metzmacher2018-11-051-6/+0
| | | | | | | | | | This will be used by dbcheck in the next commits. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 0386307e34097f5d9233c970983c7306d1705a87)
* blackbox/dbcheck-links: Test broken links with missing <SID=...> on linked ↵Stefan Metzmacher2018-11-051-0/+6
| | | | | | | | | | attributes BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit f81771c8593327e058b9cb4330d7e77083df3ea9)
* testprogs/blackbox: add samba4.blackbox.test_primary_group testStefan Metzmacher2018-11-051-0/+2
| | | | | | | | | | | This demonstrates the bug, that happens when the primaryGroupID of a user is changed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 364ed537e0bcb3a97cae0f2d1ff72de9423ce0e6)
* vfs_fruit: optionally delete AppleDouble files without Resourcefork dataRalph Boehme2018-11-051-1/+0
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13642 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 3649f1a41a299b14609318ef52b44e2d53cba4b5)
* vfs_fruit: detect empty resource forks in ad_convert()Ralph Boehme2018-11-051-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For some reason the macOS client often writes AppleDouble files with a non-zero sized resource fork, but the resource fork data is just boilerplate data with the following string close to the start This resource fork intentionally left blank A dump with apple_dump looks like this: Entry ID : 00000002 : Resource Fork Offset : 00000052 : 82 Length : 0000011E : 286 -RAW DUMP--: 0 1 2 3 4 5 6 7 8 9 A B C D E F : (ASCII) 00000000 : 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 1E : ................ 00000010 : 54 68 69 73 20 72 65 73 6F 75 72 63 65 20 66 6F : This resource fo 00000020 : 72 6B 20 69 6E 74 65 6E 74 69 6F 6E 61 6C 6C 79 : rk intentionally 00000030 : 20 6C 65 66 74 20 62 6C 61 6E 6B 20 20 20 00 00 : left blank .. 00000040 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 00000050 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 00000060 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 00000070 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 00000080 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 00000090 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 000000A0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 000000B0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 000000C0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 000000D0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 000000E0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 000000F0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : ................ 00000100 : 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 1E : ................ 00000110 : 00 00 00 00 00 00 00 00 00 1C 00 1E FF FF : .............. We can safely discard this Resource Fork data. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13642 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 7be979f958295474f0c0df6a4db0b5bca9a6676d)
* s4:torture: add test for AppleDouble ResourceFork conversionRalph Boehme2018-11-052-0/+20
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13642 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 6f022e61597994bc032e61876f24150d7acb3fc2)
* dsdb: Ensure that a DN (now) pointing at a deleted object counts for ↵Andrew Bartlett2018-11-051-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | objectclass-based MUST Add the 'reveal_internals' controls when performing objectclass-based checks of mandatory attributes. This prevents the extended_dn DSDB module from suppressing attributes that point to deleted (i.e. non-existent/expunged) objects. This ensures that, when modifying an object (and often not even touching the mandatory attribute) that the fact that an attribute is a DN, and the DN target is deleted, that the schema check will still pass. Otherwise a fromServer pointing at a dead server can cause failures, i.e. you can't modify the affected object at all, because the DSDB thinks a mandatory attribute is missing. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13621 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> (cherry picked from commit 4092b369aeeb7058d78b8d6f41dbbc6d69203ecc)
* tests: Add corner-case test: fromServer points to dead serverTim Beale2018-11-051-0/+5
| | | | | | | | | | | | | | | | | | | | The fromServer attribute is slightly unique, in that it's a DN (similar to a one-way link), but it is also a mandatory attribute. Currently, if fromServer gets a bad value (i.e. a dead server that has been expunged), the DSDB rejects any attempts to modify the associated nTDSConnection object (regardless of whether or not you're actually changing the fromServer attribute). This patch adds a test-case that demonstrates how the DB can get into such a state. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13621 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> (cherry picked from commit dec3eda1f74f5bf7ea91c1be3d5dfd832e9672b9)
* selftest: Change backup testenvs to use non-default siteTim Beale2018-11-051-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | Previously (i.e. up until the last patch) the backup/restore commands only worked if the Default-First-Site-Name site was present. If this site didn't exist, then the various restore testenvs would fail to start. This is now fixed, but this patch changes the backupfrom testenv so that it uses a non-default site. This will detect the problem if it is ever re-introduced. To do this we need to change provision_ad_dc() so the extra_provision_options can be specified as an argument. (Note that Perl treats undef the same as an empty array). By default, the restore will add the new DC into the Default-First-Site-Name site. This means the backupfromdc and restored testenvs will now have different sites, so we need to update the ldapcmp filters to exclude site-specific attributes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13621 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 696fa6a1e6c615a992a3016ff32405b864b62eec)
* vfs_fruit: move check in ad_convert() to ad_convert_*() subfunctionsRalph Boehme2018-10-181-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently the whole conversion is skipped if the FinderInfo entry in the AppleDouble file is of the default size (ie not containing xattrs). That also means we never converted FinderInfo from the AppleDouble file to stream format. This change finally fixes this. Note that this keeps failing with streams_depot, much like the existing known-fail of "samba3.vfs.fruit streams_depot.OS X AppleDouble file conversion". Fixing the conversion to work with vfs_streams_depot is a task for another day. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13649 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Thu Oct 11 01:30:13 CEST 2018 on sn-devel-144 (cherry picked from commit 31daab88e6a415e72ead69844e3eccf5dc02e53c) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Thu Oct 18 16:16:16 CEST 2018 on sn-devel-144
* s4:torture: FinderInfo conversion test with AppleDouble without xattr dataRalph Boehme2018-10-181-0/+3
| | | | | | | | | | | | This testcase demonstrates that the AppleDouble conversion in vfs_fruit doesn't correctly convert the FinderInfo data from the AppleDouble file to a stream. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13649 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 8b9728480f6ab22da0831400796f3c39ec543df8)
* smb2_server: set req->do_encryption = true earlierStefan Metzmacher2018-10-101-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The STATUS_SESSION_EXPIRED error was returned unencrypted, if the request was encrypted. If clients use SMB3 encryption and the kerberos authenticated session expires, clients disconnect the connection instead of doing a reauthentication. From https://blogs.msdn.microsoft.com/openspecification/2012/10/05/encryption-in-smb-3-0-a-protocol-perspective/ The sender encrypts the message if any of the following conditions is satisfied: - If the sender is sending a response to an encrypted request. - If Session.EncryptData is TRUE and the request or response being sent is not NEGOTIATE. - If Session.EncryptData is FALSE, the request or response being sent is not NEGOTIATE or SESSION_SETUP or TREE_CONNECT, and <TreeConnect|Share>.EncryptData is TRUE. [MS-SMB2] 3.3.4.1.4 Encrypting the Message If Connection.Dialect belongs to the SMB 3.x dialect family and Connection.ClientCapabilities includes the SMB2_GLOBAL_CAP_ENCRYPTION bit, the server MUST encrypt the message before sending, if any of the following conditions are satisfied: - If the message being sent is any response to a client request for which Request.IsEncrypted is TRUE. - If Session.EncryptData is TRUE and the response being sent is not SMB2_NEGOTIATE or SMB2 SESSION_SETUP. - If Session.EncryptData is FALSE, the response being sent is not SMB2_NEGOTIATE or SMB2 SESSION_SETUP or SMB2 TREE_CONNECT, and Share.EncryptData for the share associated with the TreeId in the SMB2 header of the response is TRUE. The server MUST encrypt the message as specified in section 3.1.4.3, before sending it to the client. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13624 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Tue Oct 2 14:11:30 CEST 2018 on sn-devel-144 (cherry picked from commit 4ef45e5334d5874f5d0fdc69286b745ebcdc612d)
* s4:torture: split smb2.session.expire{1,2} to run with signing and encryptpionStefan Metzmacher2018-10-101-0/+2
| | | | | | | | | | This reproduces the problem we have with expired encrypted sessions. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13624 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 01b868455c9bae309d1ca7ddad54077fc5d7f4b1)
* samba_dnsupdate: honor 'dns zone scavenging' option, only update if neededBjörn Baumbach2018-09-131-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since scavenging is implemented the samba_dnsupdate command always updates all dns records required by the dc. This is not needed if dns zone scavenging is not enabled. This avoids the repeating TSIG error messages: # samba_dnsupdate --option='dns zone scavenging = yes' 2>&1 | uniq -c 29 ; TSIG error with server: tsig verify failure 1 Failed update of 29 entries # echo ${PIPESTATUS[0]} 29 # samba_dnsupdate --option='dns zone scavenging = no' 2>&1 | uniq -c # echo ${PIPESTATUS[0]} 0 Note that this results in about 60 lines in the log file, which triggered every 10 minutes ("dnsupdate:name interval=600" is the default). This restores the behavior before 8ef42d4dab4dfaf5ad225b33f7748914f14dcd8c, if "dns zone scavenging" is not switched on (which is still the default). Avoiding the message from happening at all is subject for more debugging, most likely they are caused by bugs in 'nsupdate -g' (from the bind package). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13605 Pair-programmed-with: Stefan Metzmacher <metze@samba.org> Signed-off-by: Björn Baumbach <bb@sernet.de> Signed-off-by: Stefan Metzmacher <metze@samba.org>
* krb5-samba: interdomain trust uses different salt principalAlexander Bokovoy2018-09-051-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Salt principal for the interdomain trust is krbtgt/DOMAIN@REALM where DOMAIN is the sAMAccountName without the dollar sign ($) The salt principal for the BLA$ user object was generated wrong. dn: CN=bla.base,CN=System,DC=w4edom-l4,DC=base securityIdentifier: S-1-5-21-4053568372-2049667917-3384589010 trustDirection: 3 trustPartner: bla.base trustPosixOffset: -2147483648 trustType: 2 trustAttributes: 8 flatName: BLA dn: CN=BLA$,CN=Users,DC=w4edom-l4,DC=base userAccountControl: 2080 primaryGroupID: 513 objectSid: S-1-5-21-278041429-3399921908-1452754838-1597 accountExpires: 9223372036854775807 sAMAccountName: BLA$ sAMAccountType: 805306370 pwdLastSet: 131485652467995000 The salt stored by Windows in the package_PrimaryKerberosBlob (within supplementalCredentials) seems to be 'W4EDOM-L4.BASEkrbtgtBLA' for the above trust and Samba stores 'W4EDOM-L4.BASEBLA$'. While the salt used when building the keys from trustAuthOutgoing/trustAuthIncoming is 'W4EDOM-L4.BASEkrbtgtBLA.BASE', which we handle correct. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Sep 5 03:57:22 CEST 2018 on sn-devel-144 (cherry picked from commit f3e349bebc443133fdbe4e14b148ca8db8237060) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Wed Sep 5 15:40:53 CEST 2018 on sn-devel-144
* testprogs/blackbox: let test_trust_user_account.sh check the correct ↵Stefan Metzmacher2018-09-051-0/+1
| | | | | | | | | | | | kerberos salt This demonstrates the bug we currently have. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 1b31fa62567ec549e32c9177b322cfbfb3b6ec1a)
* vfs_fruit: Don't unlink the main fileVolker Lendecke2018-09-041-1/+0
| | | | | | | | | | | | | | | | | | | | | | The original fix for bug 13441 was missing a check that verifies that fruit_ftruncate() is actually called on a stream. Follow-up to Bug: https://bugzilla.samba.org/show_bug.cgi?id=13441 Pair-Programmed-With: Volker Lendecke <vl@samba.org> Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Thu Aug 23 15:28:48 CEST 2018 on sn-devel-144 (cherry picked from commit 8c14234871820eacde46670d722a676fb5f3a46c) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Tue Sep 4 15:59:02 CEST 2018 on sn-devel-144
* torture: Make sure that fruit_ftruncate only unlinks streamsVolker Lendecke2018-09-041-0/+1
| | | | | | | | | | Follow-up to Bug: https://bugzilla.samba.org/show_bug.cgi?id=13441 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit c39ec64231b261fe4ada02f1f1b9aa344cf35bb5)
* s3:smbd: let session logoff close files and tcons before deleting the sessionRalph Boehme2018-09-041-1/+0
| | | | | | | | | | | | | | | | | | | | This avoids a race in durable handle reconnects if the reconnect comes in while the old session is still in the tear-down phase. The new session is supposed to rendezvous with and wait for destruction of the old session, which is internally implemented with dbwrap_watch_send() on the old session record. If the old session deletes the session record before calling file_close_user() which marks all file handles as disconnected, the durable handle reconnect in the new session will fail as the records are not yet marked as disconnected which is a prerequisite. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13549 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 8f6edcc1645e0ed35eaec914bd0b672500ce986c)
* selftest: add a durable handle test with delayed disconnectRalph Boehme2018-09-042-0/+9
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13549 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 5508024a861e7c85e6c837552ad142aa1d5e8eca)
View Lorry Controller Status