summaryrefslogtreecommitdiff
path: root/source4/rpc_server
Commit message (Collapse)AuthorAgeFilesLines
* auth: For NTLM and KDC authentication, log the authentication durationAndrew Bartlett2018-06-252-0/+2
| | | | | | | | | | | | | | This is not a general purpose profiling solution, but these JSON logs are already being generated and stored, so this is worth adding. Some administrators are very keen to know how long authentication takes, particularly due to long replication transactions in other processes. This complements a similar patch set to log the transaction duration. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dsdb: add defines for sessionInfo and networkSessionInfoGary Lockyer2018-06-091-1/+2
| | | | | | | | | Replace uses of the string "sessionInfo" with the constant DSDB_SESSION_INFO, and "networkSessionInfo" with the constant DSDB_NETWORK_SESSION_INFO. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* rpc_server backupkey: pass remote connection dataGary Lockyer2018-05-313-14/+15
| | | | | | | | | | | Ensure that the requesting session data is passed to the audit logging module for BackupKey requests. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu May 31 12:35:15 CEST 2018 on sn-devel-144
* rpc_server lsa: pass remote connection dataGary Lockyer2018-05-311-20/+22
| | | | | | | | Ensure that the session details of the requesting user are available to the audit logging module for the CreateSecret and OpenSecret operations. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* rpc_server: common routine to open ldb in system sessionGary Lockyer2018-05-311-0/+26
| | | | | | | | | | Add a function to open an ldb connection under the system session and save the remote users session details in a ldb_opaque. This will allow the audit logging to log the original session for operations performed in the system session. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* rpc/samr: Fix PSO support in SAMR password_change RPCTim Beale2018-05-231-0/+2
| | | | | | | | | | | To get the SAMR password_lockout test passing, we now just need to query the msDS-ResultantPSO attribute for the user in the SAMR code. The common code will then determine that a PSO applies to the user, and use the PSO's lockout settings. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dsdb/rpc: Update effective badPwdCount to use PSO settingsTim Beale2018-05-231-0/+2
| | | | | | | | | | | | | The lockOutObservationWindow is used to calculate the badPwdCount. When a PSO applies to a user, we want to use the PSO's lockout-observation window rather the the default domain setting. This is finally enough to get some of the PSO password_lockout tests to pass. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s4-drsuapi: Call security_token_debug() with DBGC_DRS_REPL and a proper log ↵Andrew Bartlett2018-05-212-3/+4
| | | | | | | | | | | | | level Selftest logs are full of calls to security_token_debug() with no context and this is never a log level 0 event, so tidy it up. The RODC would trigger this each time there is an attempted preload of a user in the Denied RODC replication group. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:lsa_lookup: remove TALLOC_FREE(state) after all ↵Stefan Metzmacher2018-05-131-6/+2
| | | | | | | | | | | | | | | | | | | | | | dcesrv_lsa_Lookup{Names,Sids}_base_map() calls This completes the regression fix of commit 7e091e505156381e385235ab4518b4d133a98497. There might be strings allocated on state, which are part of the result. The reason for the TALLOC_FREE(state) was to cleanup the possible irpc_handle before leaving the function. Now we call TALLOC_FREE(state->wb.irpc_handle) explicitly in dcesrv_lsa_Lookup{Names,Sids}_base_done() instead. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13420 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun May 13 10:27:28 CEST 2018 on sn-devel-144
* Fix spelling s/woks/worksGarming Sam2018-05-121-1/+1
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samdb: Add remote address to connectGary Lockyer2018-05-1010-59/+188
| | | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon: Allow zero-GUID to act the same as NULL in GetDCNameEx2Garming Sam2018-05-041-0/+8
| | | | | | | | | | | | | | | This matches Windows behaviour and allows rpcclient to work against Samba without knowing the GUID ahead of time. Errors related to this don't appear to occur within selftest. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13365 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Garming Sam <garming@samba.org> Autobuild-Date(master): Fri May 4 09:11:19 CEST 2018 on sn-devel-144
* netlogon: Store the client site to clobber any plausibly returned via winbindGarming Sam2018-05-041-0/+21
| | | | | | | | | | | | So far, I have never observed the case where the winbind call ever bothered to return a proper site, but in case it ever does so, we clobber it here. This has implications for returning a non-local domain site name, but for now, we ignore them. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13365 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon: Forward GetDCNameEx2 to winbind via IRPCGarming Sam2018-05-041-3/+168
| | | | | | | | | | | | | | | | Here we simply forward everything without alteration (the same struct is returned). This helps us to fix the case where the DC does not exist in the target site, furthermore, this is supposed to work for trusted domains. In calling out to winbind, we now also notice if you provide a site which exists in multiple domains and provide the correct domain (instead of accidentally returning ourselves). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13365 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon: Allow return of error code in future asynchronous winbind forwardsGarming Sam2018-05-041-37/+80
| | | | | | | | | | | | We change the naming conventions to match dcesrv_netr_*_base_call used elsewhere. This is important when we make the underlying Ex2 call asynchronous. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13365 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: Allow the disable of the Windows server site fallbackGarming Sam2018-05-041-1/+2
| | | | | | | | | | | A usage in GetDCNameEx2 could return the wrong result. This may need to be fixed in other places. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13365 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon: Add a comment regarding one of the DC location callsGarming Sam2018-05-041-3/+7
| | | | | | | | | | | It appears to be basically deprecated, as it was superceded by other calls. Presumably it is also unused. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13365 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-lsa: Fix use-after-free in LSA serverAndrew Bartlett2018-05-031-3/+0
| | | | | | | | | | | | | | | This is a regression introduced in ab7988aa2fd1a43f576a4b73a6893c61c7ef1957. The state variable contains the data to be returned to the client and packed into NDR after the function returned. This memory needs to be kept (on mem_ctx as parent) until that is pushed and freed by the caller. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13420 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* dnsrpc: Use TALLOC_FREE instead of an explicit if-statementVolker Lendecke2018-04-111-3/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* lsasrv: Fix CID 241332 Self assignmentVolker Lendecke2018-04-041-1/+0
| | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* lsasrv: Fix CID 241331 Self assignmentVolker Lendecke2018-04-041-1/+0
| | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* lsa_server: Fix CID 1433608 Dereference after null checkVolker Lendecke2018-03-291-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:rpc_server: Fix size typesAndreas Schneider2018-03-201-2/+2
| | | | | | | This fixes compilation with -Wstrict-overflow=2 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:rpc_server: Fix size types in dcerpc dnsserverAndreas Schneider2018-03-202-3/+3
| | | | | | | This fixes compilation with -Wstrict-overflow=2 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:rpc_server/lsa: make use of dom_sid_is_valid_account_domain()Stefan Metzmacher2018-03-191-31/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:rpc_server: Add FALL_THROUGH statements in dcesrv_srvsvc.cAndreas Schneider2018-03-011-0/+4
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:rpc_server: fix call_id truncation in dcesrv_find_fragmented_call()Stefan Metzmacher2018-02-211-1/+1
| | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13289 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Wed Feb 21 19:02:56 CET 2018 on sn-devel-144
* s4:rpc_server/lsa: implement forwarding lsa_Lookup{Sids,Names}() requests to ↵Stefan Metzmacher2018-02-211-2/+525
| | | | | | | | | | | | | winbindd This might not be perfect yet, but it's enough to allow names from trusted forests/domain to be resolved, which is very important for samba based domain members. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: rewrite lookup sids/names code to honor the given lookup ↵Stefan Metzmacher2018-02-211-557/+855
| | | | | | | | | | | | | | | | | | | | | | | | | level [MS-LSAT] 2.2.16 LSAP_LOOKUP_LEVEL defines the which views each level should consult. Up to now we support some wellknown sids, the builtin domain and our account domain, but all levels query all views. This commit implements 3 views (predefined, builtin, account domain) + a dummy winbind view (which will later be used to implement the gc, forest and trust views).. Depending on the level we select the required views. This might not be perfect in all details, but it's enough to pass all existing tests, which already revealed bugs during the development of this patch. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: prepare dcesrv_lsa_LookupNames* for async processingStefan Metzmacher2018-02-211-142/+250
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: prepare dcesrv_lsa_LookupSids* for async processingStefan Metzmacher2018-02-211-58/+157
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: base dcesrv_lsa_LookupNames2() on ↵Stefan Metzmacher2018-02-211-56/+58
| | | | | | | | | dcesrv_lsa_LookupNames_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: base dcesrv_lsa_LookupNames() on ↵Stefan Metzmacher2018-02-211-7/+36
| | | | | | | | | dcesrv_lsa_LookupNames_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: rename 'state' variable to 'policy_state' in ↵Stefan Metzmacher2018-02-211-9/+12
| | | | | | | | | dcesrv_lsa_LookupNames2() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: rename 'state' variable to 'policy_state' in ↵Stefan Metzmacher2018-02-211-5/+5
| | | | | | | | | dcesrv_lsa_LookupSids2() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: rename 'state' variable to 'policy_state' in ↵Stefan Metzmacher2018-02-211-4/+4
| | | | | | | | | dcesrv_lsa_LookupSids_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: simplify [ref] pointer handling in dcesrv_lsa_LookupNames()Stefan Metzmacher2018-02-211-14/+10
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: simplify [ref] pointer handling in dcesrv_lsa_LookupSids()Stefan Metzmacher2018-02-211-17/+10
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: remove unused 'status' variable in ↵Stefan Metzmacher2018-02-211-4/+1
| | | | | | | | | dcesrv_lsa_LookupSids_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: make sure dcesrv_lsa_LookupNames2() gets prepared [ref] ↵Stefan Metzmacher2018-02-211-11/+19
| | | | | | | | | pointers Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: expect prepared [ref] pointers in ↵Stefan Metzmacher2018-02-211-10/+11
| | | | | | | | | dcesrv_lsa_LookupNames_common() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: make sure dcesrv_lsa_LookupSids_common() gets prepared ↵Stefan Metzmacher2018-02-211-11/+23
| | | | | | | | | [ref] pointers Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:rpc_server/lsa: use ↵Stefan Metzmacher2018-02-211-4/+4
| | | | | | | | | LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES/LSA_CLIENT_REVISION_1 in compat code Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4/rpc_server: trigger trusts reload in winbindd after successfull trust ↵Ralph Boehme2018-02-101-0/+17
| | | | | | | | | info acquisition Bug: https://bugzilla.samba.org/show_bug.cgi?id=13237 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* winbindd: rename MSG_WINBIND_NEW_TRUSTED_DOMAIN to ↵Ralph Boehme2018-02-101-1/+1
| | | | | | | | | | | MSG_WINBIND_RELOAD_TRUSTED_DOMAINS This reflects the new implementation in winbindd. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13237 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4/rpc_server: remove unused data argument from MSG_WINBIND_NEW_TRUSTED_DOMAINRalph Boehme2018-02-101-9/+2
| | | | | | | | | winbindd doesn't use that data anymore. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13237 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* docs: Remove prog_guide4.txtVolker Lendecke2018-01-211-0/+26
| | | | | | | | | | Move the still relevant parts elsewhere Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Martin Schwenke <martins@samba.org> Autobuild-Date(master): Sun Jan 21 11:48:01 CET 2018 on sn-devel-144
* s2-rpc-server: fix enum type in assignmentUri Simchoni2017-11-221-1/+1
| | | | | Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* gpo: Apply kerberos settingsDavid Mulder2017-11-201-5/+4
| | | | | | | | | Add kdc kerberos settings to gpo.tdb, then retrieve those settings in lpcfg_default_kdc_policy. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4/smbd: refactor the process model for preforkGary Lockyer2017-10-193-21/+53
| | | | | | | | | | | | | | | | | | Refactor the process model code to allow the addition of a prefork process model. - Add a process context to contain process model specific state - Add a service details structure to allow service to indicate which process model options they can support. In the new code the services advertise the features they support to the process model. The process model context is plumbed through to allow the process model to keep track of the supported options, and any state the process model may require. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
View Lorry Controller Status