summaryrefslogtreecommitdiff
path: root/source4/dsdb
Commit message (Collapse)AuthorAgeFilesLines
* librpc/idl: change from samr_GroupAttrs in samr.idl to security_GroupAttrs ↵Stefan Metzmacher2019-09-201-1/+1
| | | | | | | in security.idl Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
* messaging4: Pass fds to messaging handlersVolker Lendecke2019-09-181-2/+10
| | | | | | | Boiler-plate replacement moving the (num_fds!=0) check down Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dsdb: Fix CID 1453464: Error handling issues (CHECKED_RETURN)Volker Lendecke2019-09-041-1/+7
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dsdb: Fix CID 1453465: Null pointer dereferences (NULL_RETURNS)Volker Lendecke2019-09-041-0/+8
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dsdb: Remove unused local_password moduleAndrew Bartlett2019-09-012-1112/+0
| | | | | | | | | | | | | | This was an idea about how Samba might have worked if passwords were not safe to be stored in a remote DB (get some kind of LDAP backend). Nothing ever used this, but it was a nice idea. But git master is not the place to preserve history, even interesting ideas like splitting passwords from the non-password data (possible because, in the same way we are allowed to encrypt them, we do not allow a search on password values). Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dsdb: Remove unused simple_dn moduleAndrew Bartlett2019-09-012-88/+0
| | | | | | | | This became unused with 2b0fc74a0916a6ab0d5ac007cc5e100d4682b2ea that removed the last of the support for the LDAP Backend Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* util: Remove unused NS_GUID_string() and NS_GUID_from_string()Andrew Bartlett2019-09-012-55/+0
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14063 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dsdb: Remove unused entryuuid and nsuniqueid modulesAndrew Bartlett2019-09-012-975/+0
| | | | | | | | These were for the now removed OpenLDAP backend. Any future work in this area will not involve this kind of translation, it will be done much more cleanly. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* Spelling fixes s/preceeding/preceding/Mathieu Parent2019-09-011-1/+1
| | | | | | Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* Spelling fixes s/withing/within/Mathieu Parent2019-09-011-1/+1
| | | | | | Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* Spelling fixes s/recieved/received/Mathieu Parent2019-09-011-3/+3
| | | | | | Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* Spelling fixes s/overriden/overridden/Mathieu Parent2019-09-011-1/+1
| | | | | | Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dsdb: Remove OpenLDAP backend complexity from samba_dsdb moduleAndrew Bartlett2019-08-301-154/+4
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Aug 30 09:50:25 UTC 2019 on sn-devel-184
* dsdb: Remove OpenLDAP backend complexity from partitions moduleAndrew Bartlett2019-08-302-38/+25
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
* dsdb: Remove LDAP backend specific modules from extended_dn_outAndrew Bartlett2019-08-301-339/+3
| | | | | | | | This simplifies the code considerably. A real attempt at an LDAP backend would need to implement this module in a similar way to LDB. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
* paged results: tests without server_sort ctrlAaron Haslett2019-08-301-14/+40
| | | | | | | | | | | | | On windows, adding or modifying a record during a paged results search behaves differently depending on whether or not you supply server_sort control. This patch adds tests and documentation. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Aug 30 08:26:21 UTC 2019 on sn-devel-184
* s4-dns: Deprecate BIND9_FLATFILE and remove "rndc command"Andrew Bartlett2019-08-221-259/+0
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Aug 22 21:24:00 UTC 2019 on sn-devel-184
* s4-samdb: Remove duplicate encrypted_secrets code using internal Samba AESAndrew Bartlett2019-08-212-542/+2
| | | | | | | We now rely on GnuTLS 3.4.7 or later. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:samdb: Only include necessary header files in encrypted_secretsAndreas Schneider2019-08-211-1/+2
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:samdb: Remove dual-stack mode from (test_)encrypted_secretsAndreas Schneider2019-08-212-55/+10
| | | | | | | | | | | | | | | | Now we either build with GnuTLS or Samba crypto. If a modern GnuTLS version is detected that will be used and Samba crypto wont be available. This removes the dual-stack mode that encrypted with one and decrypted with the other in the testsuite. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Commit message clarified by Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* encrypted_secrets: Add known and expected value testAndrew Bartlett2019-08-211-0/+51
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:samdb: Add test_gnutls_value_decryption()Andreas Schneider2019-08-211-0/+65
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:samdb: Use generate_nonce_buffer() for AEC GCM nonceAndreas Schneider2019-08-141-1/+1
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
* dsdb: Fix the FreeBSD buildVolker Lendecke2019-08-061-2/+2
| | | | | | | | My FreeBSD install does not have __compar_fn_t. libreplace has the QSORT_CAST for systems that do. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dsdb: Quiet CID 1452117 1452119 1452114 (STRAY_SEMICOLON)Andrew Bartlett2019-08-011-3/+12
| | | | | | | | Try to make clear what is being done here, we are trying to count the partitions so that we can then walk them in reverse. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* CID 1452121: dsdb/mod/partition: protect whole function with NULL checkDouglas Bagnall2019-07-311-1/+6
| | | | | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Jul 31 04:08:48 UTC 2019 on sn-devel-184
* CID 1452109: dsdb/util: do not check for NULL after derefDouglas Bagnall2019-07-311-7/+1
| | | | | | | | This is all strictly unnecessary, as ret is always != LDB_SUCCESS when res is NULL, but we want to make peace between clang and converity. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/dsdb/replmd: use incoming_dn_should_be_renamed() 2/2Douglas Bagnall2019-07-241-87/+3
| | | | | | | | | | | | | | In replmd_replicated_handle_rename(). The helper function was introduced two commits ago and consists of a large common stretch of this and the function modified in the previous commit. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Jul 24 11:21:50 UTC 2019 on sn-devel-184
* s4/dsdb/replmd: use incoming_dn_should_be_renamed() 1/2Douglas Bagnall2019-07-241-82/+3
| | | | | | | | | | In replmd_op_possible_conflict_callback(). The helper function was introduced in the previous commit and consists of a large common stretch of this and replmd_replicated_handle_rename(). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/dsdb/replmd: add a helper for common calculationsDouglas Bagnall2019-07-241-0/+124
| | | | | | | | | | | We currently do exactly this work, in exactly these words (ignoring formatting) in two different places. The next two commits will make those places use this helper function. We do this over three commits so that we can more easily compare the next two and be sure they are doing the same thing. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/dsdb/replmd: replicated_handle_rename free temp_ctxDouglas Bagnall2019-07-241-0/+3
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* partition: reversing partition unlockingAaron Haslett2019-07-241-53/+72
| | | | | | | | | | | | Unlock partition databases in the reverse order from which they were acquired. This is separated from the previous commit for future bisecting purposes, since the last commit was made to fix specific CI failures, while this one is a speculative fix made based on code inspection. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* partition: correcting lock orderingAaron Haslett2019-07-241-51/+84
| | | | | | | | | | | | | A schema reading bug was traced to a lock ordering issue in partition.c. This patch fixes the problem by: 1. Releasing locks/transactions in the order they were acquired. 2. Always lock/start_trans on metadata.tdb first, before any other databases, and release it last, after all others. This is so that we are never exposed to MDB's lock semantics, which we don't support. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/source4/common: clang: Fix 'Dereference of undefined pointer value'Noel Power2019-07-241-9/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: source4/dsdb/common/util.c:3131:6: warning: Dereference of undefined pointer value <--[clang] if (res->count < 1) { ^ /source4/dsdb/common/util.c:3207:6: warning: Dereference of undefined pointer value <--[clang] if (res->count < 1) { ^~~~~~~~~~ source4/dsdb/common/util.c:4004:39: warning: Dereference of undefined pointer value <--[clang] (*wkguid_dn) = talloc_steal(mem_ctx, res->msgs[0]->dn); ^ source4/dsdb/common/util.c:4191:35: warning: Dereference of undefined pointer value <--[clang] ouv_value = ldb_msg_find_ldb_val(r->msgs[0], "replUpToDateVector"); source4/dsdb/common/util.c:5757:13: warning: 1st function call argument is an uninitialized value <--[clang] same_nc = (ldb_dn_compare(source_nc, target_nc) == 0); ^ This fix also fixes the associated 'Access to field 'xyx' results in a dereference of a null pointer' warnings that also will happen when this is fixed Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Wed Jul 24 05:49:14 UTC 2019 on sn-devel-184
* s4/dsdb/common: clang: Fix 'Value stored to 'cps_stdin' is never read'Noel Power2019-07-241-2/+0
| | | | | | | | | | | | | | Fixes: source4/dsdb/common/util.c:2125:4: warning: Value stored to 'cps_stdin' is never read <--[clang] cps_stdin = -1; ^ ~~ source4/dsdb/common/util.c:2132:3: warning: Value stored to 'cps_stdin' is never read <--[clang] cps_stdin = -1; Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/dsdb/common: clang: Fix 'Access results in a deref of a null pointer'Noel Power2019-07-241-0/+15
| | | | | | | | | | | | | | | | | | Fixes: source4/dsdb/common/util.c:2000:6: warning: Access to field 'count' results in a dereference of a null pointer (loaded from variable 'res') <--[clang] if (res->count != 1) { ^~~ source4/dsdb/common/util.c:3281:28: warning: Access to field 'msgs' results in a dereference of a null pointer (loaded from variable 'res') <--[clang] el = ldb_msg_find_element(res->msgs[0], attr); ^~~ source4/dsdb/common/util.c:3568:6: warning: Access to field 'count' results in a dereference of a null pointer (loaded from variable 'res') <--[clang] if (res->count != 1 || ret != LDB_SUCCESS) { ^~~ Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/dsdb/common: clang: Fix 'The left operand of '&' is a garbage value'Noel Power2019-07-241-1/+1
| | | | | | | | | | | Fixes: source4/dsdb/common/util.c:1964:18: warning: The left operand of '&' is a garbage value <--[clang] return (options & DS_NTDSDSA_OPT_IS_GC) != 0; ~~~~~~~ ^ Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/dsdb/common: clang: Fix 'function call argument is an uninitialized value'Noel Power2019-07-241-1/+1
| | | | | | | | | | Fixes: source4/dsdb/common/util.c:1804:8: warning: 3rd function call argument is an uninitialized value <--[clang] ret = samdb_reference_dn(ldb, mem_ctx, server_ref_dn, "rIDSetReferences", dn); Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/py_dsdb: avoid NULL deref in set_domain_sid()Douglas Bagnall2019-07-221-3/+10
| | | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* drepl: memory leak fixAaron Haslett2019-07-171-6/+24
| | | | | | | | | | | | | | | Fixes a memory leak where schema reference attached to ldb instance is lost before it can be freed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14042 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Autobuild-User(master): Garming Sam <garming@samba.org> Autobuild-Date(master): Wed Jul 17 06:17:10 UTC 2019 on sn-devel-184
* s4/dsdb/common: clang: Fix access results in null pointer deref.Noel Power2019-07-111-0/+8
| | | | | | | | | | | | Fixes: source4/dsdb/common/util_trusts.c:2915:21: warning: Access to field 'sid' results in a dereference of a null pointer (loaded from field 'tdo') <--[clang] d->di.domain_sid = d->tdo->sid; ^ ~~~ 1 warning generated. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* pyldb: rename pyldb_Dn_AsDn() to pyldb_Dn_AS_DN()Douglas Bagnall2019-07-101-1/+1
| | | | | | | | Following the python/C convention for checking vs non-checking convertors. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* pyldb: fork pyldb_Ldb_AsLdbContext macro to reflect unsafenessDouglas Bagnall2019-07-101-1/+1
| | | | | | | | | | | | | | | | | | | In the Python/C API, conversion functions which check the types of their arguments have names like: double PyFloat_AsDouble(PyObject *pyfloat); while conversion macros that don't check have names like: PyFloat_AS_DOUBLE(pyfloat) The pyldb_Ldb_AsLdbContext() macro looks like one of the checking functions but it actually isn't. This has fooled us more than once. Here we fork the macro into two -- one which performs checks and keeps the camel case, and one with a shouty name that keeps the check-free behaviour. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dsdb repl_meta_data: Don't print ldif on errorGary Lockyer2019-07-091-5/+4
| | | | | | | | | | | | Don't call ldb_ldif_message_redacted_string when linked_attr_modify fails. When joining a large domain this takes way to much time, in excess of 3 hours for a join on a 200k domain. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Tim Beale <timbeale@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Tue Jul 9 03:03:25 UTC 2019 on sn-devel-184
* s4/dsdb/schema: clang: Fix Array access results in null pointer derefNoel Power2019-07-081-1/+3
| | | | | | | | | | | Fixes: source4/dsdb/schema/schema_query.c:223:15: warning: Array access (from variable 'attr_list') results in a null pointer dereference <--[clang] attr_list[i] = NULL; ~~~~~~~~~ ^ 1 warning generated. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/dsdb/schema: Fix 'Value stored to 'ret' is never read'Noel Power2019-07-081-2/+0
| | | | | | | | | | | | | | Fixes: source4/dsdb/schema/schema_set.c:274:3: warning: Value stored to 'ret' is never read <--[clang] ret = LDB_SUCCESS; ^ ~~~~~~~~~~~ source4/dsdb/schema/schema_set.c:327:3: warning: Value stored to 'ret' is never read <--[clang] ret = LDB_SUCCESS; ^ ~~~~~~~~~~~ Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/dsdb/schema: Fix Access to field results in deference of null pointerNoel Power2019-07-081-0/+9
| | | | | | | | | | | | Fixes: source4/dsdb/schema/schema_info_attr.c:207:38: warning: Access to field 'revision' results in a dereference of a null pointer (loaded from variable 'schema_info') <--[clang] if (schema->schema_info->revision > schema_info->revision) { ^~~~~~~~~~~ 1 warning generated. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4 samdb: pass ldb options to ldb_module_connect_backendGary Lockyer2019-07-041-1/+4
| | | | | | | | | Pass the ldb options into ldb_module_connect_backend, to ensure ldb options such as "batch mode" and "transaction index cache size" get passed through to the backend modules. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/tests/dsdb_schema: not usefully executable as scriptDouglas Bagnall2019-07-021-1/+0
| | | | | | | You could run the script, but it wouldn't do anything. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* repl_md: Avoid dropping cross-partition linksTim Beale2019-07-021-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | Cross-partition links could still be dropped if GET_TGT was already previously set for the replication. This was due to a slight error in the order of logic. We never want to ignore cross-partition links (regardless of whether the TARGETS_UPTODATE /GET_TGT flag is set). We should only be returning early in the GET_TGT case if the objects are both in the same partition. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14022 RN: When the AD domain contained a linked attribute that spanned partitions, DRS replication could drop the link. This dropped link could then result in subtle differences in behaviour between DCs, as some DCs would have the link and others wouldn't. When this issue occurred, the dropped link would be logged in a warning message: "<target-dn> is Unknown but up to date. Ignoring link from <source-dn>" This issue would not always occur - it depended a lot on the database contents. Typically, it would only potentially occur when joining a new DC to the domain (doing an ldapcmp after the join would also highlight the problem, if it occurred). This issue has now been resolved. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status