From efcd16e61221169f41a531e82a42766133ef2fbd Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Mon, 25 Oct 2004 21:00:00 +0000 Subject: r3222: rough draft of commit log -- still more updates for the release notes to come --- WHATSNEW.txt | 238 ++++++++++++++++++++++- source/VERSION | 2 +- source/sam/idmap_rid.c | 518 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 747 insertions(+), 11 deletions(-) create mode 100644 source/sam/idmap_rid.c diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 1f3f2d729e4..84394e293a0 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,6 +1,6 @@ ================================= - Release Notes for Samba 3.0.8pre1 - Sept 24, 2004 + Release Notes for Samba 3.0.8pre2 + Oct 25, 2004 ================================= This is a preview release of the Samba 3.0.8 code base. @@ -9,6 +9,232 @@ provided to allow people to test the bug fixes and new features in the upcoming 3.0.8 release. Use at your own risk. +Common bugs fixed in 3.0.8pre2 include: + + o + +New features included in the 3.0.8pre1 release are: + + o + + +Change in Username Map +---------------------- + + + + +###################################################################### +Changes +####### + +Changes since 3.0.8pre1 +----------------------- + +smb.conf changes +---------------- + + Parameter Name Action + -------------- ------ + force printername New + +commits +------- + +o Jeremy Allison + * Ensure we set errno = E2BIG when we overflow in the + fast-path character conversion code. + * Fix the roundup problem (returning 1mb roundup) for + non-Windows clients. + * Added 'stat' command to smbclient to exercise the + UNIX_FILE_BASIC info level. + * Fix bug where we could incorrectly set sparse attribute. + * Fix incorrect locks/unlocks in tdb_lockkeys()/tdb_unlockkeys() + (reported by Taj Khattra ). + * Remove locked keys tdb code. + * BUG 1886: Prevent delete on close being set for readonly files + (and return the correct error code). + * Ensure we pass most of the new lock tests except for the cancel + lock which is yet to be addedd (merged from Samba 4 branch). + * BUG 1947: Fix incorrect use of getpwnam() etc. interface. + * BUG 1956: Ensure errno is saved and restored consistently on a normal_close. + + +o Andrew Bartlett + * Fix NTLMv2 for use with pam_winbind. + * Remove conversion to and from UTF8 on the winbind pipe. + * Allow 'require_membership_of' and 'require-membership-of'. + * Fix the error code for 'you didn't specify a domain' in + ntlm_auth. + * Use sys_getgroups() rather than scnanning all groups + when generating SAMR replies. + + +o Gerald Carter + * BUG 1519: Match Windows 2000 behavior when opening a + printer using a servername in the form of an IP address or + DNS name. + * BUG 1907: remove extra slashes from the printer name in + getprinterdriverdir_1(). + * Fix standard_sub_snum() to use the current user's gid. + * Fix background queue update bug (based on Volker's initial work + in 3.1.0). + * Add 'force printername' service parameter for people that want + to enforce printername == sharename for spoolss printing. + * Ensure consistent usage of the username map. Use the fully + qualified DOMAIN\user format for 'security = domain|ads' and + apply after authentication has succeeded. + * Cosmetic fix for getent output -- lowercase the username only + and not the complete domain\username string. + + +o Darren Chew + * Solaris packaging fixes. + + +o Guenther Deschner + * Fix typos in net's usage-output. + * Fix the paranoia-check to ensure the ldap-attribute and the + smb.conf-parameter for samba's "algorithmic rid base" in ldapsam + are identical. + * Fix several bugs in the _samr_query_useraliases() rpc reply. + * Check correct string length when verifying password-policies + and using extended characters (Thanks to Uwe Morgenroth from CC + Compunet and Volker). + * Make 'password history'-behaviour in ldapsam more consistent. + * Adding "Windows x64" as architecture string and driverdir "x64" + for the 64bit AMD platform. + * BUG 1343: Readd WKGUID-binding to match the correct default- + locations of new User-, Group- and Machine-Accounts in Active + Directory (this got lost during the last trunk-merge). + * Fix printer-migration w.r.t. to new naming-convention for + policy-handles. + * Allow to migrate win2k3/xp-drivers as well. + * Add client-side support of triggering ads printer publishing + over msrpc setprinter calls inside the net-tool. + * Add the idmap_rid module (written in conjunction with + Sumit Bose ). + + +o Rob Foehl + + +o Steve French + * Fix ip address override in mount.cifs mount helper and clean + up warning messages from the sparse tool and expand syntax help. + * Strip guest mount option off before sending to kernel mount + routine to avoid logging spurious message. + + +o Satoh Fumiyasu + * BUG 1732: Limit share names returned by RAP based on windows + character width, not unix character width. + + +o Brett Funderburg + * Pass create options parameter to nt_create_andx() function + from the python bindings. + * BUG 1864: Add sd->type field to security descriptor Python + representation. + * Return an error if a Netapp filer returns NT_STATUS_ACCESS_DENIED + when trying to return the security descriptor for a file. + + +o Michael Gravey + * BUG 1776: Fix warnings when building modules caused by + certain versions of GNU ld not using the the default + --allow-shlib-undefined flag. + + +o Chris Hertel + * Fix bug where an invalid MAC address would be printed by + a node status lookup from nmblookup. + + +o Uli Iske + * Update the DNS/eDirectory LDAP schema file. + + +o Björn Jacke + * BUG 1766: Unify charset-handling in Content-Type:-headers to + UTF-8. Reformat msgstr in msg-files to UTF-8. + * Do not use display charset for swat output. + * Convert the share names correctly from unix encoding to web + encoding and vice vera. + * Convert files from statuspage from unix charset to UTF-8. + + +o Tom Lackemann + BUG 1954: Fix memory leak in posix acl code. + + +o Volker Lendecke + * BUG 1545, 1823: Only issue the ldap extended password change + operation if the ldap server supports it. Also ignore object + class violation errors from the extended operation. + * Optimization for 'idmap backend = ldap': When asking sid2id + for the wrong type, don't ask ldap when we have the opposite mapping + in the local tdb. + * Fix ldapsam_compat homeDrive. + * Add usersidlist and allowedusers subcommands to the net tool + in order to support scanning a file server's share and list + all users who have permission to connect there. + * Allow for multiple DC's to be named as #1c names in lmhosts. + + +o Love + * BUG 1955: Inconsistent error return. + + +o Sorin Manolache + * Memory leak fix. + + +o Bill McGonigle + BUG 1926: Type in debug message. + + +o Sean McGrath + * BUG 1822: Add -D_REENTRANT to CPPFLAGS and -lthread to LDFLAGS + for libsmbclient. + + +o Tim Potter + * Fix bug in Python printerdata wrapper. + * BUG 1762: nss_winbind fixes on AIX 5.x (patch from + ). + * Fix parameter confusion in priming of name-to-sid cache + (Found by Qiao Yang). + * BUG 1888: Remove '..' from all pre-processor commands. + * BUG 1903: Change some #if DEBUG_PASSWORD's to #ifdef + DEBUG_PASSWORD. + + +o Richard Sharpe + * Ensure cli_write() can support writes >= 65536 bytes. + + +o Simo Sorce + * Fix memory corruption bug caused in freeing static memory. + + +o Andrew Tridgell + * Reduces the number of tdb locking calls made on file IO. + + +o Jelmer Vernooij + * Complain if 'password chat' doesn't contain the %u variable + (based on a patch by Ronan Waide). + + +Changes for older versions follow below: + + -------------------------------------------------- + ================================= + Release Notes for Samba 3.0.8pre1 + Sept 24, 2004 + ================================= + Common bugs fixed in 3.0.8pre1 include: o Compile fixes for HP-UX @@ -33,12 +259,6 @@ case (e.g. mv $name `echo $name | tr '[A-Z]' '[a-z]'`). This may include mail spool files, home directories, valid user lines in smb.conf, etc.... - - -###################################################################### -Changes -####### - Changes since 3.0.7 ------------------- @@ -225,8 +445,6 @@ o Igor Zhbanov option. -Changes for older versions follow below: - -------------------------------------------------- ============================= Release Notes for Samba 3.0.7 diff --git a/source/VERSION b/source/VERSION index 0f2d88c66ff..2a22988fd9d 100644 --- a/source/VERSION +++ b/source/VERSION @@ -51,7 +51,7 @@ SAMBA_VERSION_RC_RELEASE= # e.g. SAMBA_VERSION_IS_SVN_SNAPSHOT=yes # # -> "3.0.0-SVN-build-199" # ######################################################## -SAMBA_VERSION_IS_SVN_SNAPSHOT=yes +SAMBA_VERSION_IS_SVN_SNAPSHOT=no ######################################################## # This can be set by vendors if they want... # diff --git a/source/sam/idmap_rid.c b/source/sam/idmap_rid.c new file mode 100644 index 00000000000..16784da12e5 --- /dev/null +++ b/source/sam/idmap_rid.c @@ -0,0 +1,518 @@ +/* + * idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts + * Copyright (C) Guenther Deschner, 2004 + * Copyright (C) Sumit Bose, 2004 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * + */ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_IDMAP + +#define IDMAP_RID_SUPPORT_TRUSTED_DOMAINS 0 + +NTSTATUS init_module(void); + +struct dom_entry { + fstring name; + fstring sid; + uint32 min_id; + uint32 max_id; +}; + +typedef struct trust_dom_array { + int number; + struct dom_entry *dom; +} trust_dom_array; + +static trust_dom_array trust; + +static NTSTATUS rid_idmap_parse(const char *init_param, + uint32 num_domains, + fstring *domain_names, + DOM_SID *domain_sids, + uid_t u_low, + uid_t u_high) +{ + const char *p; + int i; + trust.number = 0; + fstring sid_str; + BOOL known_domain = False; + p = init_param; + fstring tok; + + /* falling back to automatic mapping when there were no options given */ + if (!*init_param) { + + DEBUG(3,("rid_idmap_parse: no domain list given or trusted domain-support deactivated, falling back to automatic mapping for own domain:\n")); + + sid_to_string(sid_str, &domain_sids[0]); + + fstrcpy(trust.dom[0].name, domain_names[0]); + fstrcpy(trust.dom[0].sid, sid_str); + trust.dom[0].min_id = u_low; + trust.dom[0].max_id = u_high; + trust.number = 1; + + DEBUGADD(3,("rid_idmap_parse:\tdomain: [%s], sid: [%s], range=[%d-%d]\n", + trust.dom[0].name, trust.dom[0].sid, trust.dom[0].min_id, trust.dom[0].max_id)); + return NT_STATUS_OK; + } + + /* scan through the init_param-list */ + while (next_token(&init_param, tok, LIST_SEP, sizeof(tok))) { + + p = tok; + DEBUG(3,("rid_idmap_parse: parsing entry: %d\n", trust.number)); + + /* reinit sizes */ + trust.dom = (struct dom_entry *) realloc(trust.dom, sizeof(struct dom_entry)*(trust.number+1)); + + if ( trust.dom == NULL ) { + return NT_STATUS_NO_MEMORY; + } + + if (!next_token(&p, tok, "=", sizeof(tok))) { + DEBUG(0, ("rid_idmap_parse: no '=' sign found in domain list [%s]\n", init_param)); + return NT_STATUS_UNSUCCESSFUL; + } + + /* add the name */ + fstrcpy(trust.dom[trust.number].name, tok); + DEBUGADD(3,("rid_idmap_parse:\tentry %d has name: [%s]\n", trust.number, trust.dom[trust.number].name)); + + /* add the domain-sid */ + for (i=0; i trust.dom[i].max_id) { + DEBUG(0, ("rid_idmap_init: min_id (%d) has to be smaller than max_id (%d) for domain [%s]\n", + trust.dom[i].min_id, trust.dom[i].max_id, trust.dom[i].name)); + goto out; + } + + if (trust.dom[i].min_id < u_low || trust.dom[i].max_id > u_high) { + DEBUG(0, ("rid_idmap_init: mapping of domain [%s] (%d-%d) has to fit into global idmap range (%d-%d).\n", + trust.dom[i].name, trust.dom[i].min_id, trust.dom[i].max_id, u_low, u_high)); + goto out; + } + } + + /* check for overlaps */ + for (i=0; i= unid.uid ) + break; + } + + if (i == trust.number) { + DEBUG(0,("rid_idmap_get_sid_from_id: no suitable range available for id: %d\n", unid.uid)); + return NT_STATUS_INVALID_PARAMETER; + } + + /* use lower-end of idmap-range as offset for users and groups*/ + unid.uid -= trust.dom[i].min_id; + + if (!trust.dom[i].sid) + return NT_STATUS_INVALID_PARAMETER; + + string_to_sid(&sidstr, trust.dom[i].sid); + sid_copy(sid, &sidstr); + if (!sid_append_rid( sid, (unsigned long)unid.uid )) { + DEBUG(0,("rid_idmap_get_sid_from_id: could not append rid to domain sid\n")); + return NT_STATUS_NO_MEMORY; + } + + DEBUG(3, ("rid_idmap_get_sid_from_id: mapped POSIX %s %d to SID [%s]\n", + (id_type == ID_GROUPID) ? "GID" : "UID", unid.uid, + sid_to_string(sid_string, sid))); + + return NT_STATUS_OK; +} + +static NTSTATUS rid_idmap_get_id_from_sid(unid_t *unid, int *id_type, const DOM_SID *sid) +{ + fstring sid_string; + int i; + uint32 rid; + DOM_SID sidstr; + + /* check if we have a mapping for the sid */ + for (i=0; iuid = rid + trust.dom[i].min_id; + + if (unid->uid > trust.dom[i].max_id) { + DEBUG(0,("rid_idmap_get_id_from_sid: rid: %d too high for mapping of domain: %s\n", rid, trust.dom[i].name)); + return NT_STATUS_INVALID_PARAMETER; + } + if (unid->uid < trust.dom[i].min_id) { + DEBUG(0,("rid_idmap_get_id_from_sid: rid: %d too low for mapping of domain: %s\n", rid, trust.dom[i].name)); + return NT_STATUS_INVALID_PARAMETER; + } + + DEBUG(3,("rid_idmap_get_id_from_sid: mapped SID [%s] to POSIX %s %d\n", + sid_to_string(sid_string, sid), + (*id_type == ID_GROUPID) ? "GID" : "UID", unid->uid)); + + return NT_STATUS_OK; + +} + +static NTSTATUS rid_idmap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +static NTSTATUS rid_idmap_close(void) +{ + SAFE_FREE(trust.dom); + + return NT_STATUS_OK; +} + +static NTSTATUS rid_idmap_allocate_rid(uint32 *rid, int rid_type) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +static NTSTATUS rid_idmap_allocate_id(unid_t *id, int id_type) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +static void rid_idmap_status(void) +{ + DEBUG(0, ("RID IDMAP Status not available\n")); +} + +static struct idmap_methods rid_methods = { + rid_idmap_init, + rid_idmap_allocate_rid, + rid_idmap_allocate_id, + rid_idmap_get_sid_from_id, + rid_idmap_get_id_from_sid, + rid_idmap_set_mapping, + rid_idmap_close, + rid_idmap_status +}; + +NTSTATUS init_module(void) +{ + return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "idmap_rid", &rid_methods); +} + -- cgit v1.2.1