summaryrefslogtreecommitdiff
path: root/source4
Commit message (Collapse)AuthorAgeFilesLines
...
* dsdb-acl: Do not apply ACL on special DNs to hide attributes that the user ↵Matthieu Patou2013-01-171-0/+4
| | | | | | | | | | | | | | | | shouldn't see This fix frequent reindexing when using python script with a user that is not system. The reindexing is caused by ACL module hidding (removing) attributes in the search request for all attributes in dn=@ATTRIBUTES and because dsdb_schema_set_indices_and_attributes checks that the list of attributes that it just calculated from the schema is the same as the list written in @ATTRIBUTES, if not the list is replaced and a reindexing is triggered. Signed-off-by: Matthieu Patou <mat@matws.net> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb-acl: talloc_free the private context when we pass to the next moduleStefan Metzmacher2013-01-171-0/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Matthieu Patou <mat@matws.net>
* dsdb-acl: don't call dsdb_user_password_support() if we don't use the resultStefan Metzmacher2013-01-171-2/+8
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Matthieu Patou <mat@matws.net>
* torture: copychunk test suite improvementsDavid Disseldorp2013-01-161-8/+719
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow for large files in test_setup_copy_chunk(): Write test data in 1M IOs, rather than attempting to do the whole thing in one go. Add copychunk bad resume key test: Send a copy chunk request with an intentionally bogus resume key (source key handle). Add copychunk src=dest test: Test copychunk requests where the source and destination handles refer to the same file. Add copychunk src=dest overlap test. Add desired access args to test_setup_copy_chunk(). Add copychunk_bad_access test: Open the copychunk source and destination files with differing desired_access values. Confirm copychunk response matches 2k8 and 2k12 behaviour. Add copy_chunk_src_exceed test: Attempts to copy more data than is present in the copychunk source file. Add copy_chunk_src_exceed_multi test: Test whether the first chunk in a multi-chunk copychunk request is written to disk, where the second chunk is invalid due to src file overrun. Add copy_chunk_sparse_dest test: Issue a request where the target offset exceeds the file size, resulting in a sparse region. Add copy_chunk_max_output_sz test. Reviewed by: Jeremy Allison <jra@samba.org>
* torture: replace ioctl failure returns with helper callsDavid Disseldorp2013-01-161-33/+25
| | | | | | | Also change test_ioctl_get_shadow_copy() to use torture_skip(), and clean up test output. Reviewed by: Jeremy Allison <jra@samba.org>
* torture: add locking tests for copychunkDavid Disseldorp2013-01-161-0/+228
| | | | Reviewed by: Jeremy Allison <jra@samba.org>
* torture: skip FSCTL_SRV_ENUM_SNAPS test when not supportedDavid Disseldorp2013-01-161-0/+6
| | | | | | | | If FSCTL_SRV_ENUM_SNAPS fails with NT_STATUS_NOT_SUPPORTED then skip the test, this means we can run the full ioctl test suite as part of autobuild. Reviewed by: Jeremy Allison <jra@samba.org>
* smb2_ioctl: remove ioctl error response assumptionsDavid Disseldorp2013-01-162-3/+92
| | | | | | | | | | | | MS-SMB2 3.3.4.4 documents cases where a ntstatus indicating an error should not be considered a failure. In such a case the output data buffer should be sent to the client rather than an error response packet. Add a new fsctl copy_chunk test to confirm field limits are sent back in response to an oversize chunk request. Reviewed by: Jeremy Allison <jra@samba.org>
* s4-torture: add ndr64 spoolss openprinterex to ndr test.Günther Deschner2013-01-161-0/+28
| | | | | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jan 16 13:26:53 CET 2013 on sn-devel-104
* s4-torture: allow to do ndr tests with flags, not only ndr_flags.Günther Deschner2013-01-162-3/+14
| | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* spoolss: Make OpenPrinterEx work with NDR64 by using UserInfo Container.Günther Deschner2013-01-165-31/+29
| | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* dsdb: Add test for modification of two attributes, one permitted, one denied ↵Andrew Bartlett2013-01-151-0/+15
| | | | | | | | | | (bug #9554 - CVE-2013-0172) Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 8bafe0871526cd5d5e7fdbe123ab661379f64cb1) Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Jan 15 14:03:47 CET 2013 on sn-devel-104
* dsdb-acl: Run sec_access_check_ds on each attribute proposed to modify (bug ↵Andrew Bartlett2013-01-151-28/+27
| | | | | | | | | | | | | | | | | | #9554 - CVE-2013-0172) This seems inefficient, but is needed for correctness. The alternative might be to have the sec_access_check_ds code confirm that *all* of the nodes in the object tree have been cleared to node->remaining_bits == 0. Otherwise, I fear that write access to one attribute will become write access to all attributes. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit d776fd807e0c9a62f428ce666ff812655f98bc47)
* dsdb: Make linked_attributes module GUID based for renamesAndrew Bartlett2013-01-121-13/+64
| | | | | | | | | | | | | | | This ensures that when we have the backlink out of sync with the forward link (perhaps due to another operation that has put the backlink handling in an end-of-transaction TODO list in repl_meta_data) that we do not error out, we just cope as well as we can. The GUID is the unique identifier, not the DN. Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sat Jan 12 12:52:28 CET 2013 on sn-devel-104
* s4-resolve: Fix parsing of IPv6/AAAA in dns_lookup (bug #9555)Arvid Requate2013-01-121-0/+1
| | | | Reviewed-by: Stefan Metzmacher <metze@samba.org>
* scripting/samba_upgradedns: Only look for IPv4/IPv6 addresses if we actually ↵Andrew Bartlett2013-01-101-21/+22
| | | | | | | | | | | | | | them This allows the script to be used to create/remove the samba-specific dns-SERVER account when we do not need to create the in-directory partition. Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Thu Jan 10 20:56:50 CET 2013 on sn-devel-104
* samba-tool classicupgrade: Do not print the admin password during upgradeAndrew Bartlett2013-01-101-1/+10
| | | | | | | | | | | | This changes the code to only set and show a new password if no admin user is found during the upgrade. Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Thu Jan 10 16:55:23 CET 2013 on sn-devel-104
* s4-idmap: Remove requirement that posixAccount or posixGroup be set for rfc2307Andrew Bartlett2013-01-101-6/+3
| | | | | | | | | | This change matches the source3/idmap/idmap_ad.c code, and allows this feature to work with only the setting of the UID/GID in Active Directory Users and Computers. Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org>
* selftest: Add test for rfc2307 mapping handlingAndrew Bartlett2013-01-101-0/+1
| | | | Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb-acl: give error string if we can not obtain the schemaAndrew Bartlett2013-01-101-2/+3
| | | | Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4-dbcheck: Allow forcing an override of an old @MODULES recordAndrew Bartlett2013-01-102-4/+29
| | | | Reviewed-by: Stefan Metzmacher <metze@samba.org>
* Use the new directory_create_or_exist_strict() function.Andreas Schneider2013-01-094-5/+10
| | | | Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba_dnsupdate: set KRB5_CONFIG for nsupdate commandBjörn Baumbach2013-01-091-4/+5
| | | | | | | | | Let nslookup use krb5.conf, which is set in our KRB5_CONFIG. Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:lib/messaging: terminate the irpc_servers_byname() result with ↵Stefan Metzmacher2013-01-092-4/+4
| | | | | | | | server_id_set_disconnected() (bug #9540) Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libnet-vampire: reports Exops as they rather than sync on some partitionsMatthieu Patou2013-01-091-6/+27
| | | | | | | | | | | | | | | Instead of showing: Partition[CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com] objects[1] linked_values[8] Report a exop based on CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com as Exop on CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com, ... Signed-off-by: Matthieu Patou <mat@matws.net> Reviewed-By: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Matthieu Patou <mat@samba.org> Autobuild-Date(master): Wed Jan 9 09:01:30 CET 2013 on sn-devel-104
* libnet: set the invocation_id earlier in order to avoid annoying messagesMatthieu Patou2013-01-091-13/+13
| | | | | | | | | At that moment we have all the information to set the invocation id so let's set it, it will avoid useless messages about missing invocation id. Signed-off-by: Matthieu Patou <mat@matws.net> Reviewed-By: Andrew Bartlett <abartlet@samba.org>
* samba-tool Add --service argument to samba-tool ntacl get/setAndrew Bartlett2013-01-081-6/+10
| | | | | | | | | | | This also ensures a VFS connect is done to the correct service. Andrew Bartlett Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Jan 8 03:39:21 CET 2013 on sn-devel-104
* pysmbd: Change to keyword based argumentsAndrew Bartlett2013-01-071-4/+4
| | | | Reviewed-by: Jeremy Allison <jra@samba.org>
* scripting-provision: Set sysvol ACLs on the sysvol shareAndrew Bartlett2013-01-071-14/+23
| | | | | | | | | | This allows us to correctly load any modules that have been specified by the smb.conf for [sysvol] and issue a VFS connect operation which may be required by some VFS modules. Andrew Bartlett Reviewed-by: Jeremy Allison <jra@samba.org>
* scripting-ntacls: Optionally allow the service to be specified.Andrew Bartlett2013-01-071-6/+6
| | | | | | | | | | Providing a service allows a VFS connect to be issued on the correct service, and so ensures that the correct modules are loaded rather than just what is specified in [globals]. Andrew Bartlett Reviewed-by: Jeremy Allison <jra@samba.org>
* spoolss: add stubs for new JobNamedProperty dcerpc calls.Günther Deschner2013-01-071-0/+37
| | | | | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Jan 7 19:06:25 CET 2013 on sn-devel-104
* s4:drsuapi: try to behave more like windows for usn order (bug #9508)Stefan Metzmacher2013-01-011-11/+18
| | | | | | | | | | | | | | We don't behave completely like a Windows server, but it's much more identical than before. The partition head is always the first object followed by the rest sorted by uSNChanged. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Jan 1 21:09:42 CET 2013 on sn-devel-104
* s4:drsuapi: make use of LDB_TYPESAFE_QSORT() and pass getnc_stateStefan Metzmacher2013-01-011-10/+14
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:drsuapi: make sure we report the meta data from the cycle start (bug #9508)Stefan Metzmacher2013-01-011-9/+38
| | | | | | | | | | | We should build the final highwatermark and uptodatevector of a replication cycle at the start of the cycle. Before we search for the currently missing objects. Otherwise we risk that some objects get lost. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:drsuapi: check the source_dsa_invocation_id (bug #9508)Stefan Metzmacher2013-01-011-0/+15
| | | | | | | | The given highwatermark is only valid relative to the specified source_dsa_invocation_id. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:drsuapi: make sure we never return the same highwatermark twice in a ↵Stefan Metzmacher2013-01-011-0/+36
| | | | | | | | | | | replication cycle (bug #9508) If the highwatermark given by the client is not the one we expect, we need to start a new replication cycle. Otherwise the destination dsa skips objects and linked attribute values. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:drsuapi: add drsuapi_DsReplicaHighWaterMark_cmp()Stefan Metzmacher2013-01-011-0/+20
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:drsuapi: always use the current uptodateness_vectorStefan Metzmacher2013-01-011-11/+9
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:drsuapi: avoid a ldb_dn_copy() and use talloc_move() insteadStefan Metzmacher2013-01-011-3/+3
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:drsuapi: remove unused 'highest_usn' from drsuapi_getncchanges_stateStefan Metzmacher2013-01-011-4/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:drsuapi: move struct drsuapi_getncchanges_state to the top of getncchanges.cStefan Metzmacher2013-01-011-17/+17
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/drepl: update the source_dsa_obj/invocation_id in repsFromStefan Metzmacher2013-01-011-0/+4
| | | | | | | The highwatermark is relative to the source_dsa_invocation_id. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/common: use 01.01.1970 as last_sync_success for our entry in the ↵Stefan Metzmacher2013-01-011-3/+4
| | | | | | | | | uptodatevector This matches a Windows 2008R2 and 2012 server. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/common: use LDB_SEQ_HIGHEST_SEQ for our entry in the uptodatevectorStefan Metzmacher2013-01-011-2/+2
| | | | | | | | | We should use the global highestCommittedUSN, not the per partition value. This matches a Windows 2008R2 and 2012 server. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/repl_meta_data: don't merge highwatermark and uptodatevector (bug #9508)Stefan Metzmacher2013-01-011-38/+1
| | | | | | | | | We should not do any magic regarding the highwatermark we got from the source dsa. We need to treat it as opaque and not try to be smart and merge it into the uptodatevector. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/repl_meta_data: also update the last_sync_success in replUpToDateVectorStefan Metzmacher2013-01-011-5/+1
| | | | | | | This matches Windows 2008R2 and Windows 2012. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/repl_meta_data: store the last results and timestamps in the repsFromStefan Metzmacher2013-01-011-0/+3
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/repl_meta_data: always treat the highwatermark as opaque (bug #9508)Stefan Metzmacher2013-01-011-1/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:scripting/python: always treat the highwatermark as opaque (bug #9508)Stefan Metzmacher2013-01-013-3/+3
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Happy New Year 2013Stefan Metzmacher2013-01-011-1/+1
| | | | Signed-off-by: Stefan Metzmacher <metze@samba.org>
View Lorry Controller Status