summaryrefslogtreecommitdiff
path: root/source4/rpc_server
Commit message (Collapse)AuthorAgeFilesLines
* s4:rpc_server/netlogon: don't treet trusted domains as primary in ↵Stefan Metzmacher2018-09-051-57/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LogonGetDomainInfo() We need to handle trusted domains differently than our primary domain. The most important part is that we don't return NETR_TRUST_FLAG_PRIMARY for them. NETR_TRUST_FLAG_{INBOUND,OUTBOUND,IN_FOREST} are the relavant flags for trusts. This is an example of what Windows returns in a complex trust environment: netr_LogonGetDomainInfo: struct netr_LogonGetDomainInfo out: struct netr_LogonGetDomainInfo return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : f48b51ff12ff8c6c timestamp : Tue Aug 28 22:59:03 2018 CEST info : * info : union netr_DomainInfo(case 1) domain_info : * domain_info: struct netr_DomainInformation primary_domain: struct netr_OneDomainInfo domainname: struct lsa_StringLarge length : 0x0014 (20) size : 0x0016 (22) string : * string : 'W2012R2-L4' dns_domainname: struct lsa_StringLarge length : 0x0020 (32) size : 0x0022 (34) string : * string : 'w2012r2-l4.base.' dns_forestname: struct lsa_StringLarge length : 0x0020 (32) size : 0x0022 (34) string : * string : 'w2012r2-l4.base.' domain_guid : 0a133c91-8eac-4df0-96ac-ede69044a38b domain_sid : * domain_sid : S-1-5-21-2930975464-1937418634-1288008815 trust_extension: struct netr_trust_extension_container length : 0x0000 (0) size : 0x0000 (0) info : NULL dummy_string2: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string3: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string4: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_long1 : 0x00000000 (0) dummy_long2 : 0x00000000 (0) dummy_long3 : 0x00000000 (0) dummy_long4 : 0x00000000 (0) trusted_domain_count : 0x00000006 (6) trusted_domains : * trusted_domains: ARRAY(6) trusted_domains: struct netr_OneDomainInfo domainname: struct lsa_StringLarge length : 0x000e (14) size : 0x0010 (16) string : * string : 'FREEIPA' dns_domainname: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'freeipa.base' dns_forestname: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL domain_guid : 00000000-0000-0000-0000-000000000000 domain_sid : * domain_sid : S-1-5-21-429948374-2562621466-335716826 trust_extension: struct netr_trust_extension_container length : 0x0010 (16) size : 0x0010 (16) info : * info: struct netr_trust_extension length : 0x00000008 (8) dummy : 0x00000000 (0) size : 0x00000008 (8) flags : 0x00000022 (34) 0: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000008 (8) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 1: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION dummy_string2: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string3: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string4: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_long1 : 0x00000000 (0) dummy_long2 : 0x00000000 (0) dummy_long3 : 0x00000000 (0) dummy_long4 : 0x00000000 (0) trusted_domains: struct netr_OneDomainInfo domainname: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'S1-W2012-L4' dns_domainname: struct lsa_StringLarge length : 0x0036 (54) size : 0x0038 (56) string : * string : 's1-w2012-l4.w2012r2-l4.base' dns_forestname: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL domain_guid : afe7fbde-af82-46cf-88a2-2df6920fc33e domain_sid : * domain_sid : S-1-5-21-1368093395-3821428921-3924672915 trust_extension: struct netr_trust_extension_container length : 0x0010 (16) size : 0x0010 (16) info : * info: struct netr_trust_extension length : 0x00000008 (8) dummy : 0x00000000 (0) size : 0x00000008 (8) flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000004 (4) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION dummy_string2: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string3: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string4: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_long1 : 0x00000000 (0) dummy_long2 : 0x00000000 (0) dummy_long3 : 0x00000000 (0) dummy_long4 : 0x00000000 (0) trusted_domains: struct netr_OneDomainInfo domainname: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'BLA' dns_domainname: struct lsa_StringLarge length : 0x0010 (16) size : 0x0012 (18) string : * string : 'bla.base' dns_forestname: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL domain_guid : 00000000-0000-0000-0000-000000000000 domain_sid : * domain_sid : S-1-5-21-4053568372-2049667917-3384589010 trust_extension: struct netr_trust_extension_container length : 0x0010 (16) size : 0x0010 (16) info : * info: struct netr_trust_extension length : 0x00000008 (8) dummy : 0x00000000 (0) size : 0x00000008 (8) flags : 0x00000022 (34) 0: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000008 (8) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 1: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION dummy_string2: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string3: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string4: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_long1 : 0x00000000 (0) dummy_long2 : 0x00000000 (0) dummy_long3 : 0x00000000 (0) dummy_long4 : 0x00000000 (0) trusted_domains: struct netr_OneDomainInfo domainname: struct lsa_StringLarge length : 0x000c (12) size : 0x000e (14) string : * string : 'S4XDOM' dns_domainname: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 's4xdom.base' dns_forestname: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL domain_guid : 00000000-0000-0000-0000-000000000000 domain_sid : * domain_sid : S-1-5-21-313966788-4060240134-2249344781 trust_extension: struct netr_trust_extension_container length : 0x0010 (16) size : 0x0010 (16) info : * info: struct netr_trust_extension length : 0x00000008 (8) dummy : 0x00000000 (0) size : 0x00000008 (8) flags : 0x00000022 (34) 0: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000008 (8) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 1: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION dummy_string2: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string3: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string4: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_long1 : 0x00000000 (0) dummy_long2 : 0x00000000 (0) dummy_long3 : 0x00000000 (0) dummy_long4 : 0x00000000 (0) trusted_domains: struct netr_OneDomainInfo domainname: struct lsa_StringLarge length : 0x0014 (20) size : 0x0016 (22) string : * string : 'W2012R2-L4' dns_domainname: struct lsa_StringLarge length : 0x001e (30) size : 0x0020 (32) string : * string : 'w2012r2-l4.base' dns_forestname: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL domain_guid : 0a133c91-8eac-4df0-96ac-ede69044a38b domain_sid : * domain_sid : S-1-5-21-2930975464-1937418634-1288008815 trust_extension: struct netr_trust_extension_container length : 0x0010 (16) size : 0x0010 (16) info : * info: struct netr_trust_extension length : 0x00000008 (8) dummy : 0x00000000 (0) size : 0x00000008 (8) flags : 0x0000001d (29) 1: NETR_TRUST_FLAG_IN_FOREST 0: NETR_TRUST_FLAG_OUTBOUND 1: NETR_TRUST_FLAG_TREEROOT 1: NETR_TRUST_FLAG_PRIMARY 1: NETR_TRUST_FLAG_NATIVE 0: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000000 (0) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION dummy_string2: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string3: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string4: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_long1 : 0x00000000 (0) dummy_long2 : 0x00000000 (0) dummy_long3 : 0x00000000 (0) dummy_long4 : 0x00000000 (0) trusted_domains: struct netr_OneDomainInfo domainname: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'S2-W2012-L4' dns_domainname: struct lsa_StringLarge length : 0x004e (78) size : 0x0050 (80) string : * string : 's2-w2012-l4.s1-w2012-l4.w2012r2-l4.base' dns_forestname: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL domain_guid : 29daace6-cded-4ce3-a754-7482a4d9127c domain_sid : * domain_sid : S-1-5-21-167342819-981449877-2130266853 trust_extension: struct netr_trust_extension_container length : 0x0010 (16) size : 0x0010 (16) info : * info: struct netr_trust_extension length : 0x00000008 (8) dummy : 0x00000000 (0) size : 0x00000008 (8) flags : 0x00000001 (1) 1: NETR_TRUST_FLAG_IN_FOREST 0: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 0: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000001 (1) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000000 (0) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION dummy_string2: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string3: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string4: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_long1 : 0x00000000 (0) dummy_long2 : 0x00000000 (0) dummy_long3 : 0x00000000 (0) dummy_long4 : 0x00000000 (0) lsa_policy: struct netr_LsaPolicyInformation policy_size : 0x00000000 (0) policy : NULL dns_hostname: struct lsa_StringLarge length : 0x0036 (54) size : 0x0038 (56) string : * string : 'torturetest.w2012r2-l4.base' dummy_string2: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string3: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL dummy_string4: struct lsa_StringLarge length : 0x0000 (0) size : 0x0000 (0) string : NULL workstation_flags : 0x00000003 (3) 1: NETR_WS_FLAG_HANDLES_INBOUND_TRUSTS 1: NETR_WS_FLAG_HANDLES_SPN_UPDATE supported_enc_types : 0x0000001f (31) 1: KERB_ENCTYPE_DES_CBC_CRC 1: KERB_ENCTYPE_DES_CBC_MD5 1: KERB_ENCTYPE_RC4_HMAC_MD5 1: KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 1: KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 0: KERB_ENCTYPE_FAST_SUPPORTED 0: KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED 0: KERB_ENCTYPE_CLAIMS_SUPPORTED 0: KERB_ENCTYPE_RESOURCE_SID_COMPRESSION_DISABLED dummy_long3 : 0x00000000 (0) dummy_long4 : 0x00000000 (0) result : NT_STATUS_OK Best viewed with: git show --histogram -w BUG: https://bugzilla.samba.org/show_bug.cgi?id=11517 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 2099add0657126e4a5427ec2db0fe8025478b355)
* s4:rpc_server/netlogon: make use of talloc_zero_array() for the ↵Stefan Metzmacher2018-09-051-1/+1
| | | | | | | | | | | | | netr_OneDomainInfo array It's much safer than having uninitialized memory when we hit an error case. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11517 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit ef0b489ad0d93199e08415dd895da5cfe2d1c11a)
* s4:rpc_server/netlogon: use samdb_domain_guid()/dsdb_trust_local_tdo_info() ↵Stefan Metzmacher2018-09-051-18/+91
| | | | | | | | | | | | | | | | | to build our netr_OneDomainInfo values The logic for constructing the values for our own primary domain differs from the values of trusted domains. In order to make the code easier to understand we have a new fill_our_one_domain_info() helper that only takes care of our primary domain. The cleanup for the trust case will follow in a separate commit. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11517 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 61333f7787d78e3ec5c7bd2874d5a0f1f536275a)
* s4:lsa_lookup: remove TALLOC_FREE(state) after all ↵Stefan Metzmacher2018-05-141-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | dcesrv_lsa_Lookup{Names,Sids}_base_map() calls This completes the regression fix of commit 7e091e505156381e385235ab4518b4d133a98497. There might be strings allocated on state, which are part of the result. The reason for the TALLOC_FREE(state) was to cleanup the possible irpc_handle before leaving the function. Now we call TALLOC_FREE(state->wb.irpc_handle) explicitly in dcesrv_lsa_Lookup{Names,Sids}_base_done() instead. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13420 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun May 13 10:27:28 CEST 2018 on sn-devel-144 (cherry picked from commit 9a513304adadd79d1c63d55fcf06b67ed45d43ba)
* s4-lsa: Fix use-after-free in LSA serverAndrew Bartlett2018-05-141-3/+0
| | | | | | | | | | | | | | | | This is a regression introduced in ab7988aa2fd1a43f576a4b73a6893c61c7ef1957. The state variable contains the data to be returned to the client and packed into NDR after the function returned. This memory needs to be kept (on mem_ctx as parent) until that is pushed and freed by the caller. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13420 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> (cherry picked from commit 7e091e505156381e385235ab4518b4d133a98497)
* s4:rpc_server: fix call_id truncation in dcesrv_find_fragmented_call()Stefan Metzmacher2018-02-271-1/+1
| | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13289 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Wed Feb 21 19:02:56 CET 2018 on sn-devel-144 (cherry picked from commit 5d113f80944f2e1d2a7e80f73aea7a4cfdfbd140)
* s4:rpc_server/lsa: implement forwarding lsa_Lookup{Sids,Names}() requests to ↵Stefan Metzmacher2018-02-271-2/+525
| | | | | | | | | | | | | | winbindd This might not be perfect yet, but it's enough to allow names from trusted forests/domain to be resolved, which is very important for samba based domain members. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit e9d5b8b6b41155a8a043275ae497bdb87044d476)
* s4:rpc_server/lsa: rewrite lookup sids/names code to honor the given lookup ↵Stefan Metzmacher2018-02-271-557/+855
| | | | | | | | | | | | | | | | | | | | | | | | | | level [MS-LSAT] 2.2.16 LSAP_LOOKUP_LEVEL defines the which views each level should consult. Up to now we support some wellknown sids, the builtin domain and our account domain, but all levels query all views. This commit implements 3 views (predefined, builtin, account domain) + a dummy winbind view (which will later be used to implement the gc, forest and trust views).. Depending on the level we select the required views. This might not be perfect in all details, but it's enough to pass all existing tests, which already revealed bugs during the development of this patch. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 3801c417db5891ee4a45b09e8841d8f1ff4500f9)
* s4:rpc_server/lsa: prepare dcesrv_lsa_LookupNames* for async processingStefan Metzmacher2018-02-271-142/+250
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 9b6a0b1a63f2ebfbd578047401dfbe38606c8c44)
* s4:rpc_server/lsa: prepare dcesrv_lsa_LookupSids* for async processingStefan Metzmacher2018-02-271-58/+157
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit ab7988aa2fd1a43f576a4b73a6893c61c7ef1957)
* s4:rpc_server/lsa: base dcesrv_lsa_LookupNames2() on ↵Stefan Metzmacher2018-02-271-56/+58
| | | | | | | | | | dcesrv_lsa_LookupNames_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit e6c9984bd563525dc312b67fe69ea7e4be04ee4e)
* s4:rpc_server/lsa: base dcesrv_lsa_LookupNames() on ↵Stefan Metzmacher2018-02-271-7/+36
| | | | | | | | | | dcesrv_lsa_LookupNames_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 37cb34d16406d27831be74e952ee744e58b79fb4)
* s4:rpc_server/lsa: rename 'state' variable to 'policy_state' in ↵Stefan Metzmacher2018-02-271-9/+12
| | | | | | | | | | dcesrv_lsa_LookupNames2() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit ec55c18ceda5c430eaec97c5d7e594941e3a31fc)
* s4:rpc_server/lsa: rename 'state' variable to 'policy_state' in ↵Stefan Metzmacher2018-02-271-5/+5
| | | | | | | | | | dcesrv_lsa_LookupSids2() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit c78c17dc2fbaf523d1957bb748aa75ecd81e793b)
* s4:rpc_server/lsa: rename 'state' variable to 'policy_state' in ↵Stefan Metzmacher2018-02-271-4/+4
| | | | | | | | | | dcesrv_lsa_LookupSids_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit c0f6103ddea9a825f0f0dcf169e70a5f6a55c2e2)
* s4:rpc_server/lsa: simplify [ref] pointer handling in dcesrv_lsa_LookupNames()Stefan Metzmacher2018-02-271-14/+10
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 7c1c9bf53ffc24a25038326767e33f008c7a5552)
* s4:rpc_server/lsa: simplify [ref] pointer handling in dcesrv_lsa_LookupSids()Stefan Metzmacher2018-02-271-17/+10
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 5d868fd875803e361653ccca4e61c5c25dc114aa)
* s4:rpc_server/lsa: remove unused 'status' variable in ↵Stefan Metzmacher2018-02-271-4/+1
| | | | | | | | | | dcesrv_lsa_LookupSids_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit e8a0223633fd2e6ebb3d864570b76932bc3e293a)
* s4:rpc_server/lsa: make sure dcesrv_lsa_LookupNames2() gets prepared [ref] ↵Stefan Metzmacher2018-02-271-11/+19
| | | | | | | | | | pointers Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit fe43dd8678e4f598e0ae802e3d93ad9b28988783)
* s4:rpc_server/lsa: expect prepared [ref] pointers in ↵Stefan Metzmacher2018-02-271-10/+11
| | | | | | | | | | dcesrv_lsa_LookupNames_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 3339a1c57266181570d5ca5e389719951f26b41d)
* s4:rpc_server/lsa: make sure dcesrv_lsa_LookupSids_common() gets prepared ↵Stefan Metzmacher2018-02-271-11/+23
| | | | | | | | | | [ref] pointers Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit f6e60d2c2e1f0a4eb6426c7da683abaa11babd05)
* s4:rpc_server/lsa: use ↵Stefan Metzmacher2018-02-271-4/+4
| | | | | | | | | | LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES/LSA_CLIENT_REVISION_1 in compat code Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 3909f8fcfe6b82575ad8974acacde3270ce849fe)
* s4/rpc_server: trigger trusts reload in winbindd after successfull trust ↵Ralph Boehme2018-02-111-0/+17
| | | | | | | | | | info acquisition Bug: https://bugzilla.samba.org/show_bug.cgi?id=13237 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 6151909c823016417f863c22e77c8a136f3fbb95)
* winbindd: rename MSG_WINBIND_NEW_TRUSTED_DOMAIN to ↵Ralph Boehme2018-02-111-1/+1
| | | | | | | | | | | | MSG_WINBIND_RELOAD_TRUSTED_DOMAINS This reflects the new implementation in winbindd. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13237 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 9f96ede6f500cc1a7c76e67ee785b44a99244d0d)
* s4/rpc_server: remove unused data argument from MSG_WINBIND_NEW_TRUSTED_DOMAINRalph Boehme2018-02-111-9/+2
| | | | | | | | | | winbindd doesn't use that data anymore. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13237 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit ffa9eb7d6453eb6c6f3a50ad72288d3891361752)
* s2-rpc-server: fix enum type in assignmentUri Simchoni2017-11-221-1/+1
| | | | | Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* gpo: Apply kerberos settingsDavid Mulder2017-11-201-5/+4
| | | | | | | | | Add kdc kerberos settings to gpo.tdb, then retrieve those settings in lpcfg_default_kdc_policy. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4/smbd: refactor the process model for preforkGary Lockyer2017-10-193-21/+53
| | | | | | | | | | | | | | | | | | Refactor the process model code to allow the addition of a prefork process model. - Add a process context to contain process model specific state - Add a service details structure to allow service to indicate which process model options they can support. In the new code the services advertise the features they support to the process model. The process model context is plumbed through to allow the process model to keep track of the supported options, and any state the process model may require. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s4-dnsserver: Check for too many DNS resultsAndrew Bartlett2017-09-201-0/+3
| | | | | | | | | | If we had this check in when the wildcard DNS tests were written, we would have noticed that the name needed to be escaped (see previous commit). BUG: https://bugzilla.samba.org/show_bug.cgi?id=12994 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s4-dnsserver: Always encode user-supplied names when looking up DNS recordsAndrew Bartlett2017-09-202-7/+23
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12994 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* getncchanges.c: max_links calculation didn't work well in some casesTim Beale2017-09-181-15/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The max_links calculation didn't work particularly well if max_links was set to a value lower than max_objects. As soon as repl_chunk->object_count exceeded repl_chunk->max_links, the chunk would be deemed full, even if there was only one link to send (or even worse, no links to send). For example, if max_objects=100 and max_links=10, then it would send back chunks of 10 objects (or 9 objects and 1 link). I believe the historic reason this logic exists is to avoid overfilling the response message. It's hard to tell what the appropriate limit would be because the total message size would depend on how many attributes each object has. I couldn't think of logic that would be suitable for all cases. I toyed with the idea of working out a percentage of how full the message is. However, adjusting the max_links doesn't really make sense when the settings are small enough, e.g. max_objects=100 and max_links=100 is never going to overfill the message, so there's no reason to alter the values. In the end I went with: - If the user is using non-default values, just use those. - In the default value case, just use the historic calculation Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972 Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* getncchanges.c: Support GET_TGT better with large numbers of linksTim Beale2017-09-181-8/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | A source object can potentially link to thousands of target objects. We have to be careful not to overfill the GetNCChanges response message with more data than it's possible to send. We also don't want the client to timeout while we're busy checking the linked attributes. The GET_TGT support added so far is fairly dumb - this patch extends it to better handle larger numbers of links. To do so, this extends the repl_chunk usage so that it also works out if the current chunk is full of links. Now as soon as the chunk is full of either links or objects, we stop and send it back. These changes now mean that we need to also check: - that all the links for the last source object in the previous chunk have been sent, before we move on and send the next object. This only takes effect when immediate_link_sync is configured. It also means that a chunk in the middle of the replication cycle can now contain only links, and no objects. - when GET_TGT is used, we only send back the links that we've verified the target object for. i.e. if we stop checking links because we timed out, we only send back the links whose targets were checked. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* getncchanges.c: Refactor to track more state using repl_chunkGarming Sam2017-09-181-73/+161
| | | | | | | | | | | | | | | | | To prepare GET_TGT to deal with a large number of links better, there is now a 'repl_chunk' struct to help keep track of all the factors relating to the current chunk of replication data (i.e. how many objects/links we can send and how many we've already processed). This means we can have a consistent way of working out whether the current chunk is full (whether that be due to objects, links, or just too much time taken). This patch should not alter functionality. This is just a refactor to add the basic framework, which will be used in the next patch. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* drs: Add basic GET_TGT supportTim Beale2017-09-181-5/+184
| | | | | | | | | | | | | | | | | | | | | | This adds basic DRS_GET_TGT support. If the GET_TGT flag is specified then the server will use the object cache to store the objects it sends back. If the target object for a linked attribute is not in the cache (i.e. it has not been sent already), then it is added to the response message. Note that large numbers of linked attributes will not be handled well yet - the server could potentially try to send more than will fit in a single repsonse message. Also note that the client can sometimes set the GET_TGT flag even if the server is still sending the links last. In this case, we know the client supports GET_TGT so it's safe to send the links interleaved with the source objects (the alternative of fetching the target objects but not sending the links until last doesn't really make any sense). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* getncchanges.c: Send linked attributes in each chunkTim Beale2017-09-151-27/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of sending all the linked attributes at the end, add a configurable option to send the links in each replication chunk. The benefits of this approach are: - it can reduce memory overhead, as we don't have to keep all the links in memory over the entire replication cycle. - the client should never end up knowing about objects but not their links. (Although we're not sure that this has actually resulted in replication problems, i.e. missing links). Note that until we support GET_TGT, this approach can mean we now send a link where the client doesn't know about the target object, causing the client to siliently drop that linked attribute. Hence, this option is switched off by default. Implementation-wise, this code works fairly the same as before. Instead of sorting the entire getnc_state->la_sorted array at the end and then splitting it up over chunks, we now split the links up over chunks and then sort them when we copy them into the message. This should be OK, as I believe the MS-DRSR Doc says the links in the message should be sorted (rather than sorting *all* the links overall). Windows behaviour seems to chunk the links based on USN and then sort them. getnc_state->la_idx now tracks which links in getnc_state->la_list[] have already been sent (instead of tracking getnc_state->la_sorted). This means the la_sorted array no longer needs to be stored in getnc_state and we can free the array's memory once we've copied the links into the message. Unfortunately, the link_given/link_total debug no longer reports the correct information, so I've moved these into getncchanges_state struct (and now free the struct a bit later so it's safe to reference in the debug). The vampire_dc testenv has been updated to use this new behaviour. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Fri Sep 15 10:07:33 CEST 2017 on sn-devel-144
* getnchanges.c: Avoid unnecessary continueTim Beale2017-09-151-15/+12
| | | | | | | | | There's not really much after the continue that we're skipping now. We can just flip the logic and avoid the continue. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Split out code to get an object for a responseTim Beale2017-09-151-50/+97
| | | | | | | | | | | | | | | | | | | | | | Basically, everytime we try to add an object to the response, we want to: - Build it (i.e. pack it into an RPC message format) - Add it to our object-cache if we're keeping one - Add any ancestors needed for the client to resolve it (if GET_ANC) GET_TGT is going to use the exact same code, so split this out into a separate function, rather than duplicating it. The GET_ANC case also uses almost identical code, but it differs in a couple of minor aspects. I've left this as is for now, as I'm not sure if this is by accident or by design. Because all the memory was talloc'd off the 'obj' variable, we now need to replace it with a tmp TALLOC_CTX. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Reduce the parameters to get_nc_changes_build_object()Tim Beale2017-09-151-18/+15
| | | | | | | | | Fifteen parameters seems a bit excessive. Instead, pass it the structs containing the information it cares about. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Remove unused ncRoot_dn parameterTim Beale2017-09-151-6/+1
| | | | | | Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Remove a really old TODOTim Beale2017-09-151-1/+1
| | | | | | | | | This TODO was added in 2009 (before Samba supported linked_attributes in getNCChanges()) Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Replace hard-coded numbers with a defineTim Beale2017-09-151-4/+6
| | | | | | Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Refactor how objects get added to the responseTim Beale2017-09-151-12/+55
| | | | | | | | | | | | | | | | | | | Adding GET_TGT support is going to make things more complicated, and I think we are going to struggle to do this without refactoring things a bit. This patch adds a helper struct to store state related to a single GetNCChanges chunk. I plan to add to this with things like max_links, max_objects, etc, which will cutdown on the number of variables/ parameters we pass around. I found the double-pointer logic where we add objects to the response confusing - hopefully this refactor simplifies things slightly, and it allows us to reuse the code for the GET_TGT case. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Refactor how we add ancestor linksTim Beale2017-09-151-41/+29
| | | | | | | | | | | | | | | | If the current object had already been sent as an ancestor, we were duplicating the code that added its links and updated the HWM mark. We want these to occur when we reach the place where the object's USN naturally occurs. Instead of duplicating this code, we can just skip the call to get_nc_changes_build_object() if the object has already been sent. There is already an existing 'nothing to send'/continue case after we've updated the highwater mark. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Add ancestor links when the object normally gets sentTim Beale2017-09-151-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we add links each time we send an object, but we don't actually send these links until the end of the replication cycle. In subsequent patches we want the links to be sent in the same chunk as their source object, ideally in as close to USN order as possible. Processing ancestors complicates this a bit, as the ancestor will have a higher USN than what we're currently up to, and so potentially will the ancestor's links. This patch moves where the ancestor's links get added to the getnc_state->la_list. The ancestor's links now get added when the object would normally get sent based purely on its USN (we update the highwater mark at this point too). This should not affect functionality, i.e. because we send all the links at the end, it should make no difference at what point they get added to the list. This duplicates a tiny bit of code, but this will be cleaned up in the next patch. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Split GET_ANC block out into its own functionTim Beale2017-09-151-124/+170
| | | | | | | | | | | | | | When we add GET_TGT support, it's going to need to reuse all this code (i.e. to add any ancestors of the link target). This also trims down the rather large dcesrv_drsuapi_DsGetNCChanges() function a bit. Note also fixed a compiler warning in the WERR_DS_DRA_INCONSISTENT_DIT error block which may have caused issues previously (statement was terminated by a ',' rather than a ';'). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Split sorting linked attributes into separate functionTim Beale2017-09-151-53/+84
| | | | | | | | | | | | Longer-term we want to split up the links so that they're sent over multiple GetNCChanges response messages. So it makes sense to split this code out into its own function. In the short-term, this removes some of the complexity from dcesrv_drsuapi_DsGetNCChanges() so that the function is not quite so big. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* getncchanges.c: Rename anc_cache to obj_cacheTim Beale2017-09-151-14/+27
| | | | | | | | | | | | | | | | | When we add GET_TGT support we will reuse the ancestor cache and it should work the same way - if we've already sent an object because it was needed for resolving a child object or a link target, then there's no point sending it again. This just renames anc_cache --> obj_cache. An extra is_get_anc flag has been added to getnc_state - once GET_TGT support is added, we can't assume GET_ANC based solely on the existence of the obj_cache. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* debug: Add new debug class "drs_repl" for DRS replication processingAndrew Bartlett2017-09-076-0/+18
| | | | | | | This is used in the client and in the server Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* s4-drsuapi/selftest: Add extra tests for invalid DNsTim Beale2017-08-291-1/+1
| | | | | | | | | | | | Add some test cases to check for requests for invalid/non-existent DNs. This exercises the first return case added in commit: s4-drsuapi: Refuse to replicate an NC is that not actually an NC I've also updated the error code returned here to match Windows. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s4-drsuapi: Set getnc_state *after* we've checked request is validTim Beale2017-08-291-24/+31
| | | | | | | | | | | | | | | | | | | | | We were creating the getnc_state (and storing it on the connection) before we had done some basic checks that the request was valid. If the request was not valid and we returned early with an error, then the partially-initialized getnc_state was left hanging on the connection. The next request that got sent on the connection would try to use this, rather than creating a new getnc_state from scratch. The main side-effect of this was if you sent an invalid GetNCChanges request twice, then it could be rejected the first time and accepted the second time. Note that although an invalid request was accepted, it would typically not return any objects, so it would not actually leak any secure information. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
View Lorry Controller Status