diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/Debian/debian-sarge/changelog samba-3.0.23a/packaging/Debian/debian-sarge/changelog --- samba-3.0.23/packaging/Debian/debian-sarge/changelog 2006-02-20 15:27:34.000000000 -0600 +++ samba-3.0.23a/packaging/Debian/debian-sarge/changelog 2006-07-21 11:22:58.000000000 -0500 @@ -1,3 +1,15 @@ +samba (3.0.23-1) stable; urgency=low + + * samba 3.0.23 Samba Team Release + + -- Simo Sorce Sat, 15 Jul 2006 10:01:30 -0400 + +samba (3.0.22-1) stable; urgency=high + + * samba 3.0.22 Samba Team Release + + -- Simo Sorce Fri, 07 Apr 2006 15:45:30 -0400 + samba (3.0.21b-1) stable; urgency=high * samba 3.0.21b Samba Team Release diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/Debian/debian-sarge/patches/fhs.patch samba-3.0.23a/packaging/Debian/debian-sarge/patches/fhs.patch --- samba-3.0.23/packaging/Debian/debian-sarge/patches/fhs.patch 2006-02-20 15:27:33.000000000 -0600 +++ samba-3.0.23a/packaging/Debian/debian-sarge/patches/fhs.patch 2006-07-21 11:22:58.000000000 -0500 @@ -28,11 +28,11 @@ @$(SHELL) $(srcdir)/script/installscripts.sh $(INSTALLPERMS) $(DESTDIR)$(BINDIR) $(SCRIPTS) installdat: installdirs -- @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR)$(LIBDIR) $(srcdir) -+ @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR)$(CODEPAGEDIR) $(srcdir) +- @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR) $(LIBDIR) $(srcdir) ++ @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR) $(CODEPAGEDIR) $(srcdir) installmsg: installdirs - @$(SHELL) $(srcdir)/script/installmsg.sh $(DESTDIR)$(LIBDIR) $(srcdir) + @$(SHELL) $(srcdir)/script/installmsg.sh $(DESTDIR) $(LIBDIR) $(srcdir) diff -uNr samba-3.0.10.orig/source/configure.in samba-3.0.10/source/configure.in --- samba-3.0.10.orig/source/configure.in 2004-12-17 03:50:08.000000000 -0800 +++ samba-3.0.10/source/configure.in 2004-12-17 03:55:29.000000000 -0800 @@ -57,9 +57,9 @@ esac]) @@ -201,6 +205,9 @@ - AC_SUBST(swatdir) - AC_SUBST(bindir) AC_SUBST(sbindir) + AC_SUBST(rootsbindir) + AC_SUBST(pammodulesdir) +AC_SUBST(codepagedir) +AC_SUBST(statedir) +AC_SUBST(cachedir) @@ -85,8 +85,8 @@ * @sa lib_path() to get the path to a file inside the LIBDIR. @@ -70,3 +77,27 @@ - const pstring dyn_SMB_PASSWD_FILE = SMB_PASSWD_FILE; - const pstring dyn_PRIVATE_DIR = PRIVATE_DIR; + pstring dyn_SMB_PASSWD_FILE = SMB_PASSWD_FILE; + pstring dyn_PRIVATE_DIR = PRIVATE_DIR; + + +/* In non-FHS mode, these should be configurable using 'lock dir ='; @@ -114,10 +114,11 @@ diff -uNr samba-3.0.10.orig/source/groupdb/mapping.c samba-3.0.10/source/groupdb/mapping.c --- samba-3.0.10.orig/source/groupdb/mapping.c 2004-12-17 03:50:08.000000000 -0800 +++ samba-3.0.10/source/groupdb/mapping.c 2004-12-17 03:55:29.000000000 -0800 -@@ -140,7 +140,7 @@ +@@ -140,8 +140,8 @@ if (tdb) return True; + - tdb = tdb_open_log(lock_path("group_mapping.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600); + tdb = tdb_open_log(state_path("group_mapping.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600); if (!tdb) { @@ -131,11 +132,11 @@ extern pstring dyn_LOGFILEBASE, dyn_LMHOSTSFILE; extern pstring dyn_LIBDIR; +extern pstring dyn_CODEPAGEDIR; - extern const fstring dyn_SHLIBEXT; - extern const pstring dyn_LOCKDIR; - extern const pstring dyn_PIDDIR; - extern const pstring dyn_SMB_PASSWD_FILE; - extern const pstring dyn_PRIVATE_DIR; + extern fstring dyn_SHLIBEXT; + extern pstring dyn_LOCKDIR; + extern pstring dyn_PIDDIR; + extern pstring dyn_SMB_PASSWD_FILE; + extern pstring dyn_PRIVATE_DIR; + +char *dyn_STATEDIR(void); +char *dyn_CACHEDIR(void); @@ -231,17 +232,20 @@ diff -uNr samba-3.0.10.orig/source/lib/util_unistr.c samba-3.0.10/source/lib/util_unistr.c --- samba-3.0.10.orig/source/lib/util_unistr.c 2004-12-17 03:50:08.000000000 -0800 +++ samba-3.0.10/source/lib/util_unistr.c 2004-12-17 03:55:29.000000000 -0800 -@@ -54,8 +54,8 @@ - if (initialised) return; +@@ -54,11 +54,11 @@ + } initialised = 1; - upcase_table = map_file(lib_path("upcase.dat"), 0x20000); -- lowcase_table = map_file(lib_path("lowcase.dat"), 0x20000); + upcase_table = map_file(data_path("upcase.dat"), 0x20000); + upcase_table_use_unmap = ( upcase_table != NULL ); + +- lowcase_table = map_file(lib_path("lowcase.dat"), 0x20000); + lowcase_table = map_file(data_path("lowcase.dat"), 0x20000); + lowcase_table_use_unmap = ( lowcase_table != NULL ); - /* we would like Samba to limp along even if these tables are - not available */ + #ifdef HAVE_SETLOCALE + /* Get the name of the current locale. */ @@ -161,7 +161,7 @@ return; } @@ -305,18 +309,18 @@ all_string_sub(fname,"//", "/", 0); slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); -diff -uNr samba-3.0.10.orig/source/nsswitch/winbindd_cache.c samba-3.0.10/source/nsswitch/winbindd_cache.c ---- samba-3.0.10.orig/source/nsswitch/winbindd_cache.c 2004-12-17 03:50:09.000000000 -0800 -+++ samba-3.0.10/source/nsswitch/winbindd_cache.c 2004-12-17 03:55:30.000000000 -0800 +diff -uNr samba-3.0.23.orig/source/nsswitch/winbindd_cache.c samba-3.0.23/source/nsswitch/winbindd_cache.c +--- samba-3.0.23.orig/source/nsswitch/winbindd_cache.c 2006-07-15 09:50:09.000000000 -0400 ++++ samba-3.0.23/source/nsswitch/winbindd_cache.c 2006-07-15 09:55:30.000000000 -0400 @@ -57,7 +57,7 @@ - if (opt_nocache) - return; + return True; -- wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), 5000, -+ wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"), 5000, - TDB_CLEAR_IF_FIRST, O_RDWR|O_CREAT, 0600); + /* when working offline we must not clear the cache on restart */ +- wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), ++ wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"), + WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE, + TDB_DEFAULT /*TDB_CLEAR_IF_FIRST*/, O_RDWR|O_CREAT, 0600); - if (!wcache->tdb) { diff -uNr samba-3.0.10.orig/source/nsswitch/winbindd_util.c samba-3.0.10/source/nsswitch/winbindd_util.c --- samba-3.0.10.orig/source/nsswitch/winbindd_util.c 2004-12-17 03:50:09.000000000 -0800 +++ samba-3.0.10/source/nsswitch/winbindd_util.c 2004-12-17 03:55:30.000000000 -0800 @@ -356,21 +360,18 @@ {"pid directory", P_STRING, P_GLOBAL, &Globals.szPidDir, NULL, NULL, FLAG_ADVANCED}, #ifdef WITH_UTMP {"utmp directory", P_STRING, P_GLOBAL, &Globals.szUtmpDir, NULL, NULL, FLAG_ADVANCED}, -diff -uNr samba-3.0.10.orig/source/passdb/pdb_tdb.c samba-3.0.10/source/passdb/pdb_tdb.c ---- samba-3.0.10.orig/source/passdb/pdb_tdb.c 2004-12-17 03:50:09.000000000 -0800 -+++ samba-3.0.10/source/passdb/pdb_tdb.c 2004-12-17 03:55:30.000000000 -0800 -@@ -734,10 +734,7 @@ - if (location) { - tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, location); - } else { -- pstring tdbfile; -- get_private_directory(tdbfile); -- pstrcat(tdbfile, "/"); -- pstrcat(tdbfile, PASSDB_FILE_NAME); -+ char *tdbfile = state_path(PASSDB_FILE_NAME); - tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, tdbfile); +diff -uNr samba-3.0.23.orig/source/passdb/pdb_tdb.c samba-3.0.23/source/passdb/pdb_tdb.c +--- samba-3.0.23.orig/source/passdb/pdb_tdb.c 2006-07-15 09:50:09.000000000 -0400 ++++ samba-3.0.23/source/passdb/pdb_tdb.c 2006-07-15 09:55:30.000000000 -0400 +@@ -1598,7 +1598,7 @@ + /* save the path for later */ + + if ( !location ) { +- pstr_sprintf( tdbfile, "%s/%s", lp_private_dir(), PASSDB_FILE_NAME ); ++ pstr_sprintf( tdbfile, "%s", state_path(PASSDB_FILE_NAME) ); + pfile = tdbfile; } - + pstrcpy( tdbsam_filename, pfile ); diff -uNr samba-3.0.10.orig/source/passdb/secrets.c samba-3.0.10/source/passdb/secrets.c --- samba-3.0.10.orig/source/passdb/secrets.c 2004-12-17 03:50:09.000000000 -0800 +++ samba-3.0.10/source/passdb/secrets.c 2004-12-17 03:55:30.000000000 -0800 @@ -481,13 +482,13 @@ } unbecome_root(); -diff -uNr samba-3.0.10.orig/source/rpc_server/srv_srvsvc_nt.c samba-3.0.10/source/rpc_server/srv_srvsvc_nt.c ---- samba-3.0.10.orig/source/rpc_server/srv_srvsvc_nt.c 2004-12-17 03:50:09.000000000 -0800 -+++ samba-3.0.10/source/rpc_server/srv_srvsvc_nt.c 2004-12-17 03:55:31.000000000 -0800 -@@ -133,10 +133,10 @@ - - if (share_tdb && local_pid == sys_getpid()) +diff -uNr samba-3.0.23.orig/source/lib/sharesec.c samba-3.0.23/source/lib/sharesec.c +--- samba-3.0.23.orig/source/lib/sharesec.c 2006-07-15 09:50:09.000000000 -0400 ++++ samba-3.0.23/source/lib/sharesec.c 2006-07-15 09:55:31.000000000 -0400 +@@ -47,10 +47,10 @@ return True; + } + - share_tdb = tdb_open_log(lock_path("share_info.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600); + share_tdb = tdb_open_log(state_path("share_info.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600); if (!share_tdb) { @@ -509,21 +510,21 @@ if (!tdbfile) { DEBUG(0, ("idmap_init: out of memory!\n")); return NT_STATUS_NO_MEMORY; -diff -uNr samba-3.0.10.orig/source/smbd/lanman.c samba-3.0.10/source/smbd/lanman.c ---- samba-3.0.10.orig/source/smbd/lanman.c 2004-12-17 03:50:10.000000000 -0800 -+++ samba-3.0.10/source/smbd/lanman.c 2004-12-17 03:55:31.000000000 -0800 -@@ -969,9 +969,9 @@ - BOOL local_list_only; - int i; - -- lines = file_lines_load(lock_path(SERVER_LIST), NULL); -+ lines = file_lines_load(cache_path(SERVER_LIST), NULL); - if (!lines) { -- DEBUG(4,("Can't open %s - %s\n",lock_path(SERVER_LIST),strerror(errno))); -+ DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno))); - return(0); - } - +diff -uNr samba-3.0.23.orig/source/smbd/lanman.c samba-3.0.23/source/smbd/lanman.c +--- samba-3.0.23.orig/source/smbd/lanman.c 2006-07-15 09:50:10.000000000 -0400 ++++ samba-3.0.23/source/smbd/lanman.c 2006-07-15 09:55:31.000000000 -0400 +@@ -1052,9 +1052,9 @@ + BOOL local_list_only; + int i; + +- lines = file_lines_load(lock_path(SERVER_LIST), NULL, 0); ++ lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0); + if (!lines) { +- DEBUG(4,("Can't open %s - %s\n",lock_path(SERVER_LIST),strerror(errno))); ++ DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno))); + return 0; + } + diff -uNr samba-3.0.10.orig/source/utils/net_idmap.c samba-3.0.10/source/utils/net_idmap.c --- samba-3.0.10.orig/source/utils/net_idmap.c 2004-12-17 03:50:10.000000000 -0800 +++ samba-3.0.10/source/utils/net_idmap.c 2004-12-17 03:55:32.000000000 -0800 @@ -536,27 +537,6 @@ if (!tdbfile) { DEBUG(0, ("idmap_init: out of memory!\n")); return NT_STATUS_NO_MEMORY; -diff -uNr samba-3.0.10.orig/source/wrepld/process.c samba-3.0.10/source/wrepld/process.c ---- samba-3.0.10.orig/source/wrepld/process.c 2004-12-17 03:50:10.000000000 -0800 -+++ samba-3.0.10/source/wrepld/process.c 2004-12-17 03:55:32.000000000 -0800 -@@ -197,7 +197,7 @@ - { - TDB_CONTEXT *tdb; - -- tdb = tdb_open_log(lock_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600); -+ tdb = tdb_open_log(state_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600); - if (!tdb) { - DEBUG(2,("get_our_last_id: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) )); - return; -@@ -489,7 +489,7 @@ - } - - -- tdb = tdb_open_log(lock_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600); -+ tdb = tdb_open_log(state_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600); - if (!tdb) { - DEBUG(2,("send_entry_request: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) )); - return; diff -uNr samba-3.0.11.orig/source/printing/nt_printing.c samba-3.0.11/source/printing/nt_printing.c --- samba-3.0.11.orig/source/printing/nt_printing.c 2005-03-23 02:51:08.000000000 -0800 +++ samba-3.0.11/source/printing/nt_printing.c 2005-03-23 02:54:33.000000000 -0800 diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/Debian/debian-sarge/patches/make-distclean.patch samba-3.0.23a/packaging/Debian/debian-sarge/patches/make-distclean.patch --- samba-3.0.23/packaging/Debian/debian-sarge/patches/make-distclean.patch 2005-11-09 12:29:05.000000000 -0600 +++ samba-3.0.23a/packaging/Debian/debian-sarge/patches/make-distclean.patch 2006-07-21 11:22:58.000000000 -0500 @@ -9,14 +9,6 @@ # revert to the previously installed version revert: -@@ -1437,6 +1438,7 @@ - @rm -f include/proto.h include/build_env.h include/wrepld_proto.h \ - nsswitch/winbindd_proto.h web/swat_proto.h \ - client/client_proto.h utils/net_proto.h \ -+ utils/ntlm_auth_proto.h \ - smbd/build_options.c - - MKPROTO_SH = $(srcdir)/script/mkproto.sh @@ -1512,6 +1514,7 @@ distclean: realclean diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/Debian/debian-sarge/patches/samba.patch samba-3.0.23a/packaging/Debian/debian-sarge/patches/samba.patch --- samba-3.0.23/packaging/Debian/debian-sarge/patches/samba.patch 2005-11-09 12:29:05.000000000 -0600 +++ samba-3.0.23a/packaging/Debian/debian-sarge/patches/samba.patch 2006-07-21 11:22:58.000000000 -0500 @@ -39,17 +39,18 @@ if (!cli_initialise(&cli)) return False; ---- samba-3.0.1/source/script/installbin.sh.orig 2003-10-10 14:08:36.000000000 -0400 -+++ samba-3.0.1/source/script/installbin.sh 2003-12-17 10:51:45.000000000 -0500 -@@ -24,12 +24,14 @@ - chmod $INSTALLPERMS $BINDIR/$p2 +--- samba-3.0.23/source/script/installbin.sh.in.orig 2006-07-15 09:08:36.000000000 -0400 ++++ samba-3.0.23/source/script/installbin.sh.in 2006-07-15 09:51:45.000000000 -0400 +@@ -21,13 +21,14 @@ + chmod $INSTALLPERMS $DESTDIR/$BINDIR/$p2 # this is a special case, mount needs this in a specific location - if [ $p2 = smbmount ]; then -- if [ ! -d $DESTDIR/sbin ]; then -- mkdir $DESTDIR/sbin -- fi -- ln -sf $BINDIR/$p2 $DESTDIR/sbin/mount.smbfs +- if [ ! -d $DESTDIR/@rootsbindir@ ]; then +- mkdir $DESTDIR/@rootsbindir@ +- fi +- echo "Creating sym link $DESTDIR/@rootsbindir@/mount.smbfs to $BINDIR/$p2 " +- ln -sf $BINDIR/$p2 $DESTDIR/@rootsbindir@/mount.smbfs - fi +# Commented out for the Debian Samba package. We take care of this +# important symlink in debian/rules. (peloy@debian.org) diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/Debian/debian-sarge/rules samba-3.0.23a/packaging/Debian/debian-sarge/rules --- samba-3.0.23/packaging/Debian/debian-sarge/rules 2006-04-19 21:29:48.000000000 -0500 +++ samba-3.0.23a/packaging/Debian/debian-sarge/rules 2006-07-21 11:22:58.000000000 -0500 @@ -76,7 +76,8 @@ conf_args += \ --with-smbmount \ --with-acl-support \ - --with-quotas + --with-quotas \ + --with-cifsmount mount_cifs = yes smbfs = yes else @@ -120,9 +121,6 @@ $(MAKE) -C source headers $(MAKE) -C source all nsswitch/libnss_wins.so python_ext -ifeq ($(mount_cifs),yes) - $(MAKE) -C source client/mount.cifs -endif touch build-stamp @@ -138,7 +136,7 @@ # Delete stuff left after a build that is not deleted by 'make clean' rm -f source/bin/wbinfo source/bin/winbindd source/bin/debug2html \ - source/bin/libsmbclient.a source/client/mount.cifs \ + source/bin/libsmbclient.a source/bin/mount.cifs \ source/include/stamp-h sed -e "s/@libacl@/`type-handling any linux-gnu`/g" \ @@ -179,14 +177,11 @@ install -m 0755 debian/mksmbpasswd.awk $(DESTDIR)/usr/sbin/mksmbpasswd # Install winbind stuff not installed by 'make install' - install -m 0644 source/nsswitch/libnss_winbind.so \ - $(DESTDIR)/lib/libnss_winbind.so.2 - install -m 0644 source/bin/pam_winbind.so \ - $(DESTDIR)/lib/security/ + install -m 0644 source/bin/pam_winbind.so $(DESTDIR)/lib/security/ + install -m 0644 source/nsswitch/libnss_winbind.so $(DESTDIR)/lib/libnss_winbind.so.2 # Install libnss_wins.so, which is not installed by 'make install' either. - install -m 0644 source/nsswitch/libnss_wins.so \ - $(DESTDIR)/lib/libnss_wins.so.2 + install -m 0644 source/nsswitch/libnss_wins.so $(DESTDIR)/lib/libnss_wins.so.2 # pam_smbpass.so isn't being installed by 'make install'. # We'll move it here to $(DESTDIR)/lib/security/ and then @@ -208,7 +203,7 @@ ifeq ($(mount_cifs),yes) # Install mount.cifs and its man page - install -m 04755 source/client/mount.cifs $(DESTDIR)/sbin/ + install -m 04755 source/bin/mount.cifs $(DESTDIR)/sbin/ install -m 0644 docs/manpages/mount.cifs.8 $(DESTDIR)/usr/share/man/man8/ endif diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/Debian/debian-sarge/samba-common.files samba-3.0.23a/packaging/Debian/debian-sarge/samba-common.files --- samba-3.0.23/packaging/Debian/debian-sarge/samba-common.files 2005-11-09 12:29:04.000000000 -0600 +++ samba-3.0.23a/packaging/Debian/debian-sarge/samba-common.files 2006-07-21 11:22:58.000000000 -0500 @@ -5,8 +5,10 @@ usr/bin/nmblookup usr/bin/smbpasswd usr/bin/testparm +usr/bin/profiles usr/share/man/man1/nmblookup.1 usr/share/man/man1/testparm.1 +usr/share/man/man1/profiles.1 usr/share/man/man5/lmhosts.5 usr/share/man/man5/smb.conf.5 usr/share/man/man7/samba.7 diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/RedHat-9/makerpms.sh samba-3.0.23a/packaging/RedHat-9/makerpms.sh --- samba-3.0.23/packaging/RedHat-9/makerpms.sh 2006-07-10 12:58:28.000000000 -0500 +++ samba-3.0.23a/packaging/RedHat-9/makerpms.sh 2006-07-21 11:25:32.000000000 -0500 @@ -20,8 +20,8 @@ USERID=`id -u` GRPID=`id -g` -VERSION='3.0.23' -REVISION='' +VERSION='3.0.23a' +REVISION='a' SPECFILE="samba3.spec" RPMVER=`rpm --version | awk '{print $3}'` RPM="rpm" diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/RedHat-9/samba.spec samba-3.0.23a/packaging/RedHat-9/samba.spec --- samba-3.0.23/packaging/RedHat-9/samba.spec 2006-07-10 12:58:28.000000000 -0500 +++ samba-3.0.23a/packaging/RedHat-9/samba.spec 2006-07-21 11:25:32.000000000 -0500 @@ -4,8 +4,8 @@ Summary: Samba SMB client and server Vendor: Samba Team Name: samba -Version: 3.0.23 -Release: 6 +Version: 3.0.23a +Release: 1.a License: GNU GPL version 2 Group: Networking Source: http://download.samba.org/samba/ftp/samba-%{version}.tar.bz2 diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/RHEL/makerpms.sh samba-3.0.23a/packaging/RHEL/makerpms.sh --- samba-3.0.23/packaging/RHEL/makerpms.sh 2006-07-10 12:58:28.000000000 -0500 +++ samba-3.0.23a/packaging/RHEL/makerpms.sh 2006-07-21 11:25:32.000000000 -0500 @@ -20,8 +20,8 @@ USERID=`id -u` GRPID=`id -g` -VERSION='3.0.23' -REVISION='' +VERSION='3.0.23a' +REVISION='a' SPECFILE="samba.spec" RPMVER=`rpm --version | awk '{print $3}'` RPM="rpmbuild" diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/packaging/RHEL/samba.spec samba-3.0.23a/packaging/RHEL/samba.spec --- samba-3.0.23/packaging/RHEL/samba.spec 2006-07-10 12:58:28.000000000 -0500 +++ samba-3.0.23a/packaging/RHEL/samba.spec 2006-07-21 11:25:32.000000000 -0500 @@ -5,8 +5,8 @@ Vendor: Samba Team Packager: Samba Team Name: samba -Version: 3.0.23 -Release: 6 +Version: 3.0.23a +Release: 1.a Epoch: 0 License: GNU GPL version 2 Group: System Environment/Daemons diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/REVISION samba-3.0.23a/REVISION --- samba-3.0.23/REVISION 2006-07-10 12:58:35.000000000 -0500 +++ samba-3.0.23a/REVISION 2006-07-21 11:25:52.000000000 -0500 @@ -1,11 +1,11 @@ Path: . URL: svn+ssh://svn.samba.org/home/svn/samba/branches/SAMBA_3_0_RELEASE Repository UUID: 0c0555d6-39d7-0310-84fc-f1cc0bd64818 -Revision: 16921 +Revision: 17179 Node Kind: directory Schedule: normal Last Changed Author: jerry -Last Changed Rev: 16915 -Last Changed Date: 2006-07-10 07:35:27 -0500 (Mon, 10 Jul 2006) +Last Changed Rev: 17166 +Last Changed Date: 2006-07-20 17:27:03 -0500 (Thu, 20 Jul 2006) Properties Last Updated: 2006-06-23 08:16:54 -0500 (Fri, 23 Jun 2006) diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/auth/auth_util.c samba-3.0.23a/source/auth/auth_util.c --- samba-3.0.23/source/auth/auth_util.c 2006-07-10 11:27:51.000000000 -0500 +++ samba-3.0.23a/source/auth/auth_util.c 2006-07-21 11:22:56.000000000 -0500 @@ -955,7 +955,8 @@ return NT_STATUS_NO_MEMORY; } - if (server_info->was_mapped) { + if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) || + server_info->was_mapped) { status = create_token_from_username(server_info, server_info->unix_name, server_info->guest, diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/configure samba-3.0.23a/source/configure --- samba-3.0.23/source/configure 2006-07-10 12:59:51.000000000 -0500 +++ samba-3.0.23a/source/configure 2006-07-21 11:26:55.000000000 -0500 @@ -900,6 +900,7 @@ --with-libsmbclient Build the libsmbclient shared library (default=yes if shared libs supported) --with-libsmbsharemodes Build the libsmbsharemodes shared library (default=yes if shared libs supported) --with-spinlocks Use spin locks instead of fcntl locks (default=no) + --with-cluster-support Enable cluster extensions (default=no) --with-acl-support Include ACL support (default=no) --with-aio-support Include asynchronous io support (default=no) --with-sendfile-support Check for sendfile support (default=yes) @@ -45391,6 +45392,31 @@ fi ################################################# +# check for cluster extensions + +echo "$as_me:$LINENO: checking whether to include cluster support" >&5 +echo $ECHO_N "checking whether to include cluster support... $ECHO_C" >&6 + +# Check whether --with-cluster-support or --without-cluster-support was given. +if test "${with_cluster_support+set}" = set; then + withval="$with_cluster_support" + +fi; +if test "x$with_cluster_support" = "xyes"; then + +cat >>confdefs.h <<\_ACEOF +#define CLUSTER_SUPPORT 1 +_ACEOF + + echo "$as_me:$LINENO: result: yes" >&5 +echo "${ECHO_T}yes" >&6 +else + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 +fi + + +################################################# # check for ACL support echo "$as_me:$LINENO: checking whether to support ACLs" >&5 diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/configure.in samba-3.0.23a/source/configure.in --- samba-3.0.23/source/configure.in 2006-06-23 08:16:53.000000000 -0500 +++ samba-3.0.23a/source/configure.in 2006-07-21 11:22:57.000000000 -0500 @@ -4752,6 +4752,20 @@ fi ################################################# +# check for cluster extensions + +AC_MSG_CHECKING(whether to include cluster support) +AC_ARG_WITH(cluster-support, +[ --with-cluster-support Enable cluster extensions (default=no)]) +if test "x$with_cluster_support" = "xyes"; then + AC_DEFINE(CLUSTER_SUPPORT,1,[Whether to enable cluster extensions]) + AC_MSG_RESULT(yes) +else + AC_MSG_RESULT(no) +fi + + +################################################# # check for ACL support AC_MSG_CHECKING(whether to support ACLs) diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/include/config.h.in samba-3.0.23a/source/include/config.h.in --- samba-3.0.23/source/include/config.h.in 2006-07-10 12:59:49.000000000 -0500 +++ samba-3.0.23a/source/include/config.h.in 2006-07-21 11:26:52.000000000 -0500 @@ -27,6 +27,9 @@ /* Does this system use unicode compose characters */ #undef BROKEN_UNICODE_COMPOSE_CHARACTERS +/* Whether to enable cluster extensions */ +#undef CLUSTER_SUPPORT + /* Whether the compiler supports the LL prefix on long long integers */ #undef COMPILER_SUPPORTS_LL diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/include/rpc_ds.h samba-3.0.23a/source/include/rpc_ds.h --- samba-3.0.23/source/include/rpc_ds.h 2005-10-17 21:45:05.000000000 -0500 +++ samba-3.0.23a/source/include/rpc_ds.h 2006-07-21 11:22:57.000000000 -0500 @@ -49,6 +49,13 @@ #define DSROLE_BDC 4 #define DSROLE_PDC 5 +/* Settings for the domainFunctionality attribteu in the rootDSE */ + +#define DS_DOMAIN_FUNCTION_2000 0 +#define DS_DOMAIN_FUCNTION_2003_MIXED 1 +#define DS_DOMAIN_FUNCTION_2003 2 + + typedef struct { diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/include/version.h samba-3.0.23a/source/include/version.h --- samba-3.0.23/source/include/version.h 2006-07-10 12:59:40.000000000 -0500 +++ samba-3.0.23a/source/include/version.h 2006-07-21 11:26:42.000000000 -0500 @@ -2,5 +2,6 @@ #define SAMBA_VERSION_MAJOR 3 #define SAMBA_VERSION_MINOR 0 #define SAMBA_VERSION_RELEASE 23 -#define SAMBA_VERSION_OFFICIAL_STRING "3.0.23" +#define SAMBA_VERSION_REVISION "a" +#define SAMBA_VERSION_OFFICIAL_STRING "3.0.23a" #define SAMBA_VERSION_STRING samba_version_string() diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libads/cldap.c samba-3.0.23a/source/libads/cldap.c --- samba-3.0.23/source/libads/cldap.c 2006-07-10 11:27:53.000000000 -0500 +++ samba-3.0.23a/source/libads/cldap.c 2006-07-21 11:22:57.000000000 -0500 @@ -191,6 +191,11 @@ char *p; blob = data_blob(NULL, 8192); + if (blob.data == NULL) { + DEBUG(1, ("data_blob failed\n")); + errno = ENOMEM; + return -1; + } /* Setup timeout */ gotalarm = 0; @@ -206,6 +211,7 @@ if (ret <= 0) { DEBUG(1,("no reply received to cldap netlogon\n")); + data_blob_free(&blob); return -1; } blob.length = ret; @@ -227,6 +233,7 @@ asn1_end_tag(&data); if (data.has_error) { + data_blob_free(&blob); asn1_free(&data); DEBUG(1,("Failed to parse cldap reply\n")); return -1; diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libads/dns.c samba-3.0.23a/source/libads/dns.c --- samba-3.0.23/source/libads/dns.c 2006-05-23 13:54:35.000000000 -0500 +++ samba-3.0.23a/source/libads/dns.c 2006-07-21 11:22:57.000000000 -0500 @@ -39,8 +39,12 @@ #define MAX_DNS_PACKET_SIZE 0xffff #ifdef NS_HFIXEDSZ /* Bind 8/9 interface */ +#if !defined(C_IN) /* AIX 5.3 already defines C_IN */ # define C_IN ns_c_in +#endif +#if !defined(T_A) /* AIX 5.3 already defines T_A */ # define T_A ns_t_a +#endif # define T_SRV ns_t_srv #else # ifdef HFIXEDSZ diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libads/kerberos.c samba-3.0.23a/source/libads/kerberos.c --- samba-3.0.23/source/libads/kerberos.c 2006-06-23 08:16:52.000000000 -0500 +++ samba-3.0.23a/source/libads/kerberos.c 2006-07-21 11:22:57.000000000 -0500 @@ -5,6 +5,7 @@ Copyright (C) Remus Koos 2001 Copyright (C) Nalin Dahyabhai 2004. Copyright (C) Jeremy Allison 2004. + Copyright (C) Gerald Carter 2006. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -268,11 +269,85 @@ } /************************************************************************ - Routine to get the salting principal for this service. Active - Directory may use a non-obvious principal name to generate the salt - when it determines the key to use for encrypting tickets for a service, - and hopefully we detected that when we joined the domain. - Caller must free if return is not null. + Return the standard DES salt key +************************************************************************/ + +char* kerberos_standard_des_salt( void ) +{ + fstring salt; + + fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() ); + strlower_m( salt ); + fstrcat( salt, lp_realm() ); + + return SMB_STRDUP( salt ); +} + +/************************************************************************ +************************************************************************/ + +static char* des_salt_key( void ) +{ + char *key; + + asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL, lp_realm()); + + return key; +} + +/************************************************************************ +************************************************************************/ + +BOOL kerberos_secrets_store_des_salt( const char* salt ) +{ + char* key; + BOOL ret; + + if ( (key = des_salt_key()) == NULL ) { + DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n")); + return False; + } + + if ( !salt ) { + DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n")); + secrets_delete( key ); + return True; + } + + DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt)); + + ret = secrets_store( key, salt, strlen(salt)+1 ); + + SAFE_FREE( key ); + + return ret; +} + +/************************************************************************ +************************************************************************/ + +char* kerberos_secrets_fetch_des_salt( void ) +{ + char *salt, *key; + + if ( (key = des_salt_key()) == NULL ) { + DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n")); + return False; + } + + salt = (char*)secrets_fetch( key, NULL ); + + SAFE_FREE( key ); + + return salt; +} + + +/************************************************************************ + Routine to get the salting principal for this service. This is + maintained for backwards compatibilty with releases prior to 3.0.24. + Since we store the salting principal string only at join, we may have + to look for the older tdb keys. Caller must free if return is not null. ************************************************************************/ krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context, @@ -281,23 +356,29 @@ { char *unparsed_name = NULL, *salt_princ_s = NULL; krb5_principal ret_princ = NULL; + + /* lookup new key first */ - if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) { - return (krb5_principal)NULL; - } + if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) { + + /* look under the old key. If this fails, just use the standard key */ - if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) { - SAFE_FREE(unparsed_name); - return (krb5_principal)NULL; + if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) { + return (krb5_principal)NULL; + } + if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) { + /* fall back to host/machine.realm@REALM */ + salt_princ_s = kerberos_standard_des_salt(); + } } if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) { - SAFE_FREE(unparsed_name); - SAFE_FREE(salt_princ_s); - return (krb5_principal)NULL; + ret_princ = NULL; } + SAFE_FREE(unparsed_name); SAFE_FREE(salt_princ_s); + return ret_princ; } @@ -362,465 +443,9 @@ return ret; } -/************************************************************************ - Routine to get initial credentials as a service ticket for the local machine. - Returns a buffer initialized with krb5_mk_req_extended. - ************************************************************************/ - -static krb5_error_code get_service_ticket(krb5_context ctx, - krb5_ccache ccache, - const char *service_principal, - int enctype, - krb5_data *p_outbuf) -{ - krb5_creds creds, *new_creds = NULL; - char *service_s = NULL; - char *machine_account = NULL, *password = NULL; - krb5_data in_data; - krb5_auth_context auth_context = NULL; - krb5_error_code err = 0; - - ZERO_STRUCT(creds); - - asprintf(&machine_account, "%s$@%s", global_myname(), lp_realm()); - if (machine_account == NULL) { - goto out; - } - password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); - if (password == NULL) { - goto out; - } - if ((err = kerberos_kinit_password(machine_account, password, - 0, LIBADS_CCACHE_NAME)) != 0) { - DEBUG(0,("get_service_ticket: kerberos_kinit_password %s failed: %s\n", - machine_account, - error_message(err))); - goto out; - } - - /* Ok - the above call has gotten a TGT. Now we need to get a service - ticket to ourselves. */ - - /* Set up the enctype and client and server principal fields for krb5_get_credentials. */ - kerberos_set_creds_enctype(&creds, enctype); - - if ((err = krb5_cc_get_principal(ctx, ccache, &creds.client))) { - DEBUG(3, ("get_service_ticket: krb5_cc_get_principal failed: %s\n", - error_message(err))); - goto out; - } - - if (strchr_m(service_principal, '@')) { - asprintf(&service_s, "%s", service_principal); - } else { - asprintf(&service_s, "%s@%s", service_principal, lp_realm()); - } - - if ((err = smb_krb5_parse_name(ctx, service_s, &creds.server))) { - DEBUG(0,("get_service_ticket: smb_krb5_parse_name %s failed: %s\n", - service_s, error_message(err))); - goto out; - } - - if ((err = krb5_get_credentials(ctx, 0, ccache, &creds, &new_creds))) { - DEBUG(5,("get_service_ticket: krb5_get_credentials for %s enctype %d failed: %s\n", - service_s, enctype, error_message(err))); - goto out; - } - - memset(&in_data, '\0', sizeof(in_data)); - if ((err = krb5_mk_req_extended(ctx, &auth_context, 0, &in_data, - new_creds, p_outbuf)) != 0) { - DEBUG(0,("get_service_ticket: krb5_mk_req_extended failed: %s\n", - error_message(err))); - goto out; - } - - out: - - if (auth_context) { - krb5_auth_con_free(ctx, auth_context); - } - if (new_creds) { - krb5_free_creds(ctx, new_creds); - } - if (creds.server) { - krb5_free_principal(ctx, creds.server); - } - if (creds.client) { - krb5_free_principal(ctx, creds.client); - } - - SAFE_FREE(service_s); - SAFE_FREE(password); - SAFE_FREE(machine_account); - return err; -} /************************************************************************ - Check if the machine password can be used in conjunction with the salting_principal - to generate a key which will successfully decrypt the AP_REQ already - gotten as a message to the local machine. - ************************************************************************/ - -static BOOL verify_service_password(krb5_context ctx, - int enctype, - const char *salting_principal, - krb5_data *in_data) -{ - BOOL ret = False; - krb5_principal salting_kprinc = NULL; - krb5_ticket *ticket = NULL; - krb5_keyblock key; - krb5_data passdata; - char *salting_s = NULL; - char *machine_account = NULL, *password = NULL; - krb5_auth_context auth_context = NULL; - krb5_error_code err; - - memset(&passdata, '\0', sizeof(passdata)); - memset(&key, '\0', sizeof(key)); - - asprintf(&machine_account, "%s$@%s", global_myname(), lp_realm()); - if (machine_account == NULL) { - goto out; - } - password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); - if (password == NULL) { - goto out; - } - - if (strchr_m(salting_principal, '@')) { - asprintf(&salting_s, "%s", salting_principal); - } else { - asprintf(&salting_s, "%s@%s", salting_principal, lp_realm()); - } - - if ((err = smb_krb5_parse_name(ctx, salting_s, &salting_kprinc))) { - DEBUG(0,("verify_service_password: smb_krb5_parse_name %s failed: %s\n", - salting_s, error_message(err))); - goto out; - } - - passdata.length = strlen(password); - passdata.data = (char*)password; - if ((err = create_kerberos_key_from_string_direct(ctx, salting_kprinc, &passdata, &key, enctype))) { - DEBUG(0,("verify_service_password: create_kerberos_key_from_string %d failed: %s\n", - enctype, error_message(err))); - goto out; - } - - if ((err = krb5_auth_con_init(ctx, &auth_context)) != 0) { - DEBUG(0,("verify_service_password: krb5_auth_con_init failed %s\n", error_message(err))); - goto out; - } - - if ((err = krb5_auth_con_setuseruserkey(ctx, auth_context, &key)) != 0) { - DEBUG(0,("verify_service_password: krb5_auth_con_setuseruserkey failed %s\n", error_message(err))); - goto out; - } - - if (!(err = krb5_rd_req(ctx, &auth_context, in_data, NULL, NULL, NULL, &ticket))) { - DEBUG(10,("verify_service_password: decrypted message with enctype %u salt %s!\n", - (unsigned int)enctype, salting_s)); - ret = True; - } - - out: - - memset(&passdata, 0, sizeof(passdata)); - krb5_free_keyblock_contents(ctx, &key); - if (ticket != NULL) { - krb5_free_ticket(ctx, ticket); - } - if (salting_kprinc) { - krb5_free_principal(ctx, salting_kprinc); - } - SAFE_FREE(salting_s); - SAFE_FREE(password); - SAFE_FREE(machine_account); - return ret; -} - -/************************************************************************ - * - * From the current draft of kerberos-clarifications: - * - * It is not possible to reliably generate a user's key given a pass - * phrase without contacting the KDC, since it will not be known - * whether alternate salt or parameter values are required. - * - * And because our server has a password, we have this exact problem. We - * make multiple guesses as to which principal name provides the salt which - * the KDC is using. - * - ************************************************************************/ - -static void kerberos_derive_salting_principal_for_enctype(const char *service_principal, - krb5_context ctx, - krb5_ccache ccache, - krb5_enctype enctype, - krb5_enctype *enctypes) -{ - char *salting_principals[3] = {NULL, NULL, NULL}, *second_principal = NULL; - krb5_error_code err = 0; - krb5_data outbuf; - int i, j; - - memset(&outbuf, '\0', sizeof(outbuf)); - - /* Check that the service_principal is useful. */ - if ((service_principal == NULL) || (strlen(service_principal) == 0)) { - return; - } - - /* Generate our first guess -- the principal as-given. */ - asprintf(&salting_principals[0], "%s", service_principal); - if ((salting_principals[0] == NULL) || (strlen(salting_principals[0]) == 0)) { - return; - } - - /* Generate our second guess -- the computer's principal, as Win2k3. */ - asprintf(&second_principal, "host/%s.%s", global_myname(), lp_realm()); - if (second_principal != NULL) { - strlower_m(second_principal); - asprintf(&salting_principals[1], "%s@%s", second_principal, lp_realm()); - SAFE_FREE(second_principal); - } - if ((salting_principals[1] == NULL) || (strlen(salting_principals[1]) == 0)) { - goto out; - } - - /* Generate our third guess -- the computer's principal, as Win2k. */ - asprintf(&second_principal, "HOST/%s", global_myname()); - if (second_principal != NULL) { - strlower_m(second_principal + 5); - asprintf(&salting_principals[2], "%s@%s", - second_principal, lp_realm()); - SAFE_FREE(second_principal); - } - if ((salting_principals[2] == NULL) || (strlen(salting_principals[2]) == 0)) { - goto out; - } - - /* Get a service ticket for ourselves into our memory ccache. */ - /* This will commonly fail if there is no principal by that name (and we're trying - many names). So don't print a debug 0 error. */ - - if ((err = get_service_ticket(ctx, ccache, service_principal, enctype, &outbuf)) != 0) { - DEBUG(3, ("verify_service_password: get_service_ticket failed: %s\n", - error_message(err))); - goto out; - } - - /* At this point we have a message to ourselves, salted only the KDC knows how. We - have to work out what that salting is. */ - - /* Try and find the correct salting principal. */ - for (i = 0; i < sizeof(salting_principals) / sizeof(salting_principals[i]); i++) { - if (verify_service_password(ctx, enctype, salting_principals[i], &outbuf)) { - break; - } - } - - /* If we failed to get a match, return. */ - if (i >= sizeof(salting_principals) / sizeof(salting_principals[i])) { - goto out; - } - - /* If we succeeded, store the principal for use for all enctypes which - * share the same cipher and string-to-key function. Doing this here - * allows servers which just pass a keytab to krb5_rd_req() to work - * correctly. */ - for (j = 0; enctypes[j] != 0; j++) { - if (enctype != enctypes[j]) { - /* If this enctype isn't compatible with the one which - * we used, skip it. */ - - if (!kerberos_compatible_enctypes(ctx, enctypes[j], enctype)) - continue; - } - /* If the principal which gives us the proper salt is the one - * which we would normally guess, don't bother noting anything - * in the secrets tdb. */ - if (strcmp(service_principal, salting_principals[i]) != 0) { - kerberos_secrets_store_salting_principal(service_principal, - enctypes[j], - salting_principals[i]); - } - } - - out : - - kerberos_free_data_contents(ctx, &outbuf); - SAFE_FREE(salting_principals[0]); - SAFE_FREE(salting_principals[1]); - SAFE_FREE(salting_principals[2]); - SAFE_FREE(second_principal); -} - -/************************************************************************ - Go through all the possible enctypes for this principal. - ************************************************************************/ - -static void kerberos_derive_salting_principal_direct(krb5_context context, - krb5_ccache ccache, - krb5_enctype *enctypes, - char *service_principal) -{ - int i; - - /* Try for each enctype separately, because the rules are - * different for different enctypes. */ - for (i = 0; enctypes[i] != 0; i++) { - /* Delete secrets entry first. */ - kerberos_secrets_store_salting_principal(service_principal, 0, NULL); -#ifdef ENCTYPE_ARCFOUR_HMAC - if (enctypes[i] == ENCTYPE_ARCFOUR_HMAC) { - /* Of course this'll always work, so just save - * ourselves the effort. */ - continue; - } -#endif - /* Try to figure out what's going on with this - * principal. */ - kerberos_derive_salting_principal_for_enctype(service_principal, - context, - ccache, - enctypes[i], - enctypes); - } -} - -/************************************************************************ - Wrapper function for the above. - ************************************************************************/ - -BOOL kerberos_derive_salting_principal(char *service_principal) -{ - krb5_context context = NULL; - krb5_enctype *enctypes = NULL; - krb5_ccache ccache = NULL; - krb5_error_code ret = 0; - - initialize_krb5_error_table(); - if ((ret = krb5_init_context(&context)) != 0) { - DEBUG(1,("kerberos_derive_cifs_salting_principals: krb5_init_context failed. %s\n", - error_message(ret))); - return False; - } - if ((ret = get_kerberos_allowed_etypes(context, &enctypes)) != 0) { - DEBUG(1,("kerberos_derive_cifs_salting_principals: get_kerberos_allowed_etypes failed. %s\n", - error_message(ret))); - goto out; - } - - if ((ret = krb5_cc_resolve(context, LIBADS_CCACHE_NAME, &ccache)) != 0) { - DEBUG(3, ("get_service_ticket: krb5_cc_resolve for %s failed: %s\n", - LIBADS_CCACHE_NAME, error_message(ret))); - goto out; - } - - kerberos_derive_salting_principal_direct(context, ccache, enctypes, service_principal); - - out: - if (enctypes) { - free_kerberos_etypes(context, enctypes); - } - if (ccache) { - krb5_cc_destroy(context, ccache); - } - if (context) { - krb5_free_context(context); - } - - return ret ? False : True; -} - -/************************************************************************ - Core function to try and determine what salt is being used for any keytab - keys. - ************************************************************************/ - -BOOL kerberos_derive_cifs_salting_principals(void) -{ - fstring my_fqdn; - char *service = NULL; - krb5_context context = NULL; - krb5_enctype *enctypes = NULL; - krb5_ccache ccache = NULL; - krb5_error_code ret = 0; - BOOL retval = False; - - initialize_krb5_error_table(); - if ((ret = krb5_init_context(&context)) != 0) { - DEBUG(1,("kerberos_derive_cifs_salting_principals: krb5_init_context failed. %s\n", - error_message(ret))); - return False; - } - if ((ret = get_kerberos_allowed_etypes(context, &enctypes)) != 0) { - DEBUG(1,("kerberos_derive_cifs_salting_principals: get_kerberos_allowed_etypes failed. %s\n", - error_message(ret))); - goto out; - } - - if ((ret = krb5_cc_resolve(context, LIBADS_CCACHE_NAME, &ccache)) != 0) { - DEBUG(3, ("get_service_ticket: krb5_cc_resolve for %s failed: %s\n", - LIBADS_CCACHE_NAME, error_message(ret))); - goto out; - } - - if (asprintf(&service, "%s$", global_myname()) != -1) { - strlower_m(service); - kerberos_derive_salting_principal_direct(context, ccache, enctypes, service); - SAFE_FREE(service); - } - if (asprintf(&service, "cifs/%s", global_myname()) != -1) { - strlower_m(service); - kerberos_derive_salting_principal_direct(context, ccache, enctypes, service); - SAFE_FREE(service); - } - if (asprintf(&service, "host/%s", global_myname()) != -1) { - strlower_m(service); - kerberos_derive_salting_principal_direct(context, ccache, enctypes, service); - SAFE_FREE(service); - } - if (asprintf(&service, "cifs/%s.%s", global_myname(), lp_realm()) != -1) { - strlower_m(service); - kerberos_derive_salting_principal_direct(context, ccache, enctypes, service); - SAFE_FREE(service); - } - if (asprintf(&service, "host/%s.%s", global_myname(), lp_realm()) != -1) { - strlower_m(service); - kerberos_derive_salting_principal_direct(context, ccache, enctypes, service); - SAFE_FREE(service); - } - name_to_fqdn(my_fqdn, global_myname()); - if (asprintf(&service, "cifs/%s", my_fqdn) != -1) { - strlower_m(service); - kerberos_derive_salting_principal_direct(context, ccache, enctypes, service); - SAFE_FREE(service); - } - if (asprintf(&service, "host/%s", my_fqdn) != -1) { - strlower_m(service); - kerberos_derive_salting_principal_direct(context, ccache, enctypes, service); - SAFE_FREE(service); - } - - retval = True; - - out: - if (enctypes) { - free_kerberos_etypes(context, enctypes); - } - if (ccache) { - krb5_cc_destroy(context, ccache); - } - if (context) { - krb5_free_context(context); - } - return retval; -} +************************************************************************/ int kerberos_kinit_password(const char *principal, const char *password, diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libads/kerberos_keytab.c samba-3.0.23a/source/libads/kerberos_keytab.c --- samba-3.0.23/source/libads/kerberos_keytab.c 2006-05-23 13:54:35.000000000 -0500 +++ samba-3.0.23a/source/libads/kerberos_keytab.c 2006-07-21 11:22:57.000000000 -0500 @@ -9,6 +9,7 @@ Copyright (C) Rakesh Patel 2004 Copyright (C) Dan Perry 2004 Copyright (C) Jeremy Allison 2004 + Copyright (C) Gerald Carter 2006 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -29,120 +30,35 @@ #ifdef HAVE_KRB5 +/* This MAX_NAME_LEN is a constant defined in krb5.h */ +#ifndef MAX_KEYTAB_NAME_LEN +#define MAX_KEYTAB_NAME_LEN 1100 +#endif + + /********************************************************************** - Adds a single service principal, i.e. 'host' to the system keytab -***********************************************************************/ +**********************************************************************/ -int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc) +static int smb_krb5_kt_add_entry( krb5_context context, krb5_keytab keytab, + krb5_kvno kvno, const char *princ_s, + krb5_enctype *enctypes, krb5_data password ) { krb5_error_code ret = 0; - krb5_context context = NULL; - krb5_keytab keytab = NULL; krb5_kt_cursor cursor; krb5_keytab_entry kt_entry; krb5_principal princ = NULL; - krb5_data password; - krb5_enctype *enctypes = NULL; - krb5_kvno kvno; - - char *principal = NULL; - char *princ_s = NULL; - char *password_s = NULL; -#ifndef MAX_KEYTAB_NAME_LEN -#define MAX_KEYTAB_NAME_LEN 1100 -#endif - char keytab_name[MAX_KEYTAB_NAME_LEN]; /* This MAX_NAME_LEN is a constant defined in krb5.h */ - fstring my_fqdn; int i; char *ktprinc = NULL; ZERO_STRUCT(kt_entry); ZERO_STRUCT(cursor); - - initialize_krb5_error_table(); - ret = krb5_init_context(&context); - if (ret) { - DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret))); - return -1; - } -#ifdef HAVE_WRFILE_KEYTAB /* MIT */ - keytab_name[0] = 'W'; - keytab_name[1] = 'R'; - ret = krb5_kt_default_name(context, (char *) &keytab_name[2], MAX_KEYTAB_NAME_LEN - 4); -#else /* Heimdal */ - ret = krb5_kt_default_name(context, (char *) &keytab_name[0], MAX_KEYTAB_NAME_LEN - 2); -#endif - if (ret) { - DEBUG(1,("ads_keytab_add_entry: krb5_kt_default_name failed (%s)\n", error_message(ret))); - goto out; - } - DEBUG(2,("ads_keytab_add_entry: Using default system keytab: %s\n", (char *) &keytab_name)); - ret = krb5_kt_resolve(context, (char *) &keytab_name, &keytab); - if (ret) { - DEBUG(1,("ads_keytab_add_entry: krb5_kt_resolve failed (%s)\n", error_message(ret))); - goto out; - } - - /* retrieve the password */ - if (!secrets_init()) { - DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n")); - ret = -1; - goto out; - } - password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); - if (!password_s) { - DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n")); - ret = -1; - goto out; - } - password.data = password_s; - password.length = strlen(password_s); - - /* Construct our principal */ - name_to_fqdn(my_fqdn, global_myname()); - strlower_m(my_fqdn); - - if (strchr_m(srvPrinc, '@')) { - /* It's a fully-named principal. */ - asprintf(&princ_s, "%s", srvPrinc); - } else if (srvPrinc[strlen(srvPrinc)-1] == '$') { - /* It's the machine account, as used by smbclient clients. */ - asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm()); - } else { - /* It's a normal service principal. Add the SPN now so that we - * can obtain credentials for it and double-check the salt value - * used to generate the service's keys. */ - asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm()); - /* Update the directory with the SPN */ - DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s)); - if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), srvPrinc))) { - DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n")); - goto out; - } - } - - ret = get_kerberos_allowed_etypes(context,&enctypes); - if (ret) { - DEBUG(1,("ads_keytab_add_entry: get_kerberos_allowed_etypes failed (%s)\n",error_message(ret))); - goto out; - } - - /* Guess at how the KDC is salting keys for this principal. */ - kerberos_derive_salting_principal(princ_s); - + ret = smb_krb5_parse_name(context, princ_s, &princ); if (ret) { DEBUG(1,("ads_keytab_add_entry: smb_krb5_parse_name(%s) failed (%s)\n", princ_s, error_message(ret))); goto out; } - kvno = (krb5_kvno) ads_get_kvno(ads, global_myname()); - if (kvno == -1) { /* -1 indicates failure, everything else is OK */ - DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n")); - ret = -1; - goto out; - } - /* Seek and delete old keytab entries */ ret = krb5_kt_start_seq_get(context, keytab, &cursor); if (ret != KRB5_KT_END && ret != ENOENT ) { @@ -275,15 +191,8 @@ } } - krb5_kt_close(context, keytab); - keytab = NULL; /* Done with keytab now. No double free. */ out: - - SAFE_FREE(principal); - SAFE_FREE(password_s); - SAFE_FREE(princ_s); - { krb5_keytab_entry zero_kt_entry; ZERO_STRUCT(zero_kt_entry); @@ -294,10 +203,7 @@ if (princ) { krb5_free_principal(context, princ); } - if (enctypes) { - free_kerberos_etypes(context, enctypes); - } - + { krb5_kt_cursor zero_csr; ZERO_STRUCT(zero_csr); @@ -305,6 +211,157 @@ krb5_kt_end_seq_get(context, keytab, &cursor); } } + + return (int)ret; +} + + +/********************************************************************** + Adds a single service principal, i.e. 'host' to the system keytab +***********************************************************************/ + +int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc) +{ + krb5_error_code ret = 0; + krb5_context context = NULL; + krb5_keytab keytab = NULL; + krb5_data password; + krb5_kvno kvno; + krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 }; + char *princ_s = NULL, *short_princ_s = NULL; + char *password_s = NULL; + char *my_fqdn; + char keytab_name[MAX_KEYTAB_NAME_LEN]; + TALLOC_CTX *ctx = NULL; + char *machine_name; + +#if defined(ENCTYPE_ARCFOUR_HMAC) + enctypes[2] = ENCTYPE_ARCFOUR_HMAC; +#endif + + initialize_krb5_error_table(); + ret = krb5_init_context(&context); + if (ret) { + DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret))); + return -1; + } + +#ifdef HAVE_WRFILE_KEYTAB /* MIT */ + keytab_name[0] = 'W'; + keytab_name[1] = 'R'; + ret = krb5_kt_default_name(context, (char *) &keytab_name[2], MAX_KEYTAB_NAME_LEN - 4); +#else /* Heimdal */ + ret = krb5_kt_default_name(context, (char *) &keytab_name[0], MAX_KEYTAB_NAME_LEN - 2); +#endif + if (ret) { + DEBUG(1,("ads_keytab_add_entry: krb5_kt_default_name failed (%s)\n", error_message(ret))); + goto out; + } + DEBUG(2,("ads_keytab_add_entry: Using default system keytab: %s\n", (char *) &keytab_name)); + ret = krb5_kt_resolve(context, (char *) &keytab_name, &keytab); + if (ret) { + DEBUG(1,("ads_keytab_add_entry: krb5_kt_resolve failed (%s)\n", error_message(ret))); + goto out; + } + + /* retrieve the password */ + if (!secrets_init()) { + DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n")); + ret = -1; + goto out; + } + password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); + if (!password_s) { + DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n")); + ret = -1; + goto out; + } + password.data = password_s; + password.length = strlen(password_s); + + /* we need the dNSHostName value here */ + + if ( (ctx = talloc_init("ads_keytab_add_entry")) == NULL ) { + DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n")); + ret = -1; + goto out; + } + + if ( (my_fqdn = ads_get_dnshostname( ads, ctx, global_myname())) == NULL ) { + DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n")); + ret = -1; + goto out; + } + + if ( (machine_name = ads_get_samaccountname( ads, ctx, global_myname())) == NULL ) { + DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n")); + ret = -1; + goto out; + } + /*strip the trailing '$' */ + machine_name[strlen(machine_name)-1] = '\0'; + + /* Construct our principal */ + + if (strchr_m(srvPrinc, '@')) { + /* It's a fully-named principal. */ + asprintf(&princ_s, "%s", srvPrinc); + } else if (srvPrinc[strlen(srvPrinc)-1] == '$') { + /* It's the machine account, as used by smbclient clients. */ + asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm()); + } else { + /* It's a normal service principal. Add the SPN now so that we + * can obtain credentials for it and double-check the salt value + * used to generate the service's keys. */ + + asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm()); + asprintf(&short_princ_s, "%s/%s@%s", srvPrinc, machine_name, lp_realm()); + + /* According to http://support.microsoft.com/kb/326985/en-us, + certain principal names are automatically mapped to the host/... + principal in the AD account. So only create these in the + keytab, not in AD. --jerry */ + + if ( !strequal( srvPrinc, "cifs" ) && !strequal(srvPrinc, "host" ) ) { + DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s)); + + if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), my_fqdn, srvPrinc))) { + DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n")); + goto out; + } + } + } + + kvno = (krb5_kvno) ads_get_kvno(ads, global_myname()); + if (kvno == -1) { /* -1 indicates failure, everything else is OK */ + DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n")); + ret = -1; + goto out; + } + + /* add the fqdn principal to the keytab */ + + ret = smb_krb5_kt_add_entry( context, keytab, kvno, princ_s, enctypes, password ); + if ( ret ) { + DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n")); + goto out; + } + + /* add the short principal name if we have one */ + + if ( short_princ_s ) { + ret = smb_krb5_kt_add_entry( context, keytab, kvno, short_princ_s, enctypes, password ); + if ( ret ) { + DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n")); + goto out; + } + } + +out: + SAFE_FREE( princ_s ); + SAFE_FREE( short_princ_s ); + TALLOC_FREE( ctx ); + if (keytab) { krb5_kt_close(context, keytab); } @@ -440,94 +497,76 @@ krb5_kt_cursor cursor; krb5_keytab_entry kt_entry; krb5_kvno kvno; - fstring my_fqdn, my_Fqdn, my_name, my_NAME, my_host_realm; - char *p_fqdn; int i, found = 0; + char *sam_account_name, *upn; char **oldEntries = NULL, *princ_s[26]; + TALLOC_CTX *ctx = NULL; + fstring machine_name; memset(princ_s, '\0', sizeof(princ_s)); - ret = ads_keytab_add_entry(ads, "host"); - if (ret) { + fstrcpy( machine_name, global_myname() ); + + /* these are the main ones we need */ + + if ( (ret = ads_keytab_add_entry(ads, "host") ) != 0 ) { DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n")); return ret; } - ret = ads_keytab_add_entry(ads, "cifs"); - if (ret) { + + +#if 0 /* don't create the CIFS/... keytab entries since no one except smbd + really needs them and we will fall back to verifying against secrets.tdb */ + + if ( (ret = ads_keytab_add_entry(ads, "cifs")) != 0 ) { DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n")); return ret; } +#endif - fstrcpy(my_name, global_myname()); - strlower_m(my_name); + if ( (ctx = talloc_init("ads_keytab_create_default")) == NULL ) { + DEBUG(0,("ads_keytab_create_default: talloc() failed!\n")); + return -1; + } - fstrcpy(my_NAME, global_myname()); - strupper_m(my_NAME); + /* now add the userPrincipalName and sAMAccountName entries */ + + if ( (sam_account_name = ads_get_samaccountname( ads, ctx, machine_name)) == NULL ) { + DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n")); + TALLOC_FREE( ctx ); + return -1; + } - my_fqdn[0] = '\0'; - name_to_fqdn(my_fqdn, global_myname()); - strlower_m(my_fqdn); - - p_fqdn = strchr_m(my_fqdn, '.'); - fstrcpy(my_Fqdn, my_NAME); - if (p_fqdn) { - fstrcat(my_Fqdn, p_fqdn); - } - - fstrcpy(my_host_realm, my_name); - fstrcat(my_host_realm, "."); - fstrcat(my_host_realm, lp_realm()); - strlower_m(my_host_realm); - - asprintf(&princ_s[0], "%s$@%s", my_name, lp_realm()); - asprintf(&princ_s[1], "%s$@%s", my_NAME, lp_realm()); - asprintf(&princ_s[2], "host/%s@%s", my_name, lp_realm()); - asprintf(&princ_s[3], "host/%s@%s", my_NAME, lp_realm()); - asprintf(&princ_s[4], "host/%s@%s", my_fqdn, lp_realm()); - asprintf(&princ_s[5], "host/%s@%s", my_Fqdn, lp_realm()); - asprintf(&princ_s[6], "HOST/%s@%s", my_name, lp_realm()); - asprintf(&princ_s[7], "HOST/%s@%s", my_NAME, lp_realm()); - asprintf(&princ_s[8], "HOST/%s@%s", my_fqdn, lp_realm()); - asprintf(&princ_s[9], "HOST/%s@%s", my_Fqdn, lp_realm()); - asprintf(&princ_s[10], "cifs/%s@%s", my_name, lp_realm()); - asprintf(&princ_s[11], "cifs/%s@%s", my_NAME, lp_realm()); - asprintf(&princ_s[12], "cifs/%s@%s", my_fqdn, lp_realm()); - asprintf(&princ_s[13], "cifs/%s@%s", my_Fqdn, lp_realm()); - asprintf(&princ_s[14], "CIFS/%s@%s", my_name, lp_realm()); - asprintf(&princ_s[15], "CIFS/%s@%s", my_NAME, lp_realm()); - asprintf(&princ_s[16], "CIFS/%s@%s", my_fqdn, lp_realm()); - asprintf(&princ_s[17], "CIFS/%s@%s", my_Fqdn, lp_realm()); - asprintf(&princ_s[18], "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm()); - asprintf(&princ_s[19], "CIFS/%s.%s@%s", my_name, lp_realm(), lp_realm()); - asprintf(&princ_s[20], "host/%s.%s@%s", my_name, lp_realm(), lp_realm()); - asprintf(&princ_s[21], "HOST/%s.%s@%s", my_name, lp_realm(), lp_realm()); - - /* when dnsdomain == realm, don't add duplicate principal */ - if (!strequal(my_host_realm, my_fqdn)) { - asprintf(&princ_s[22], "cifs/%s@%s", my_host_realm, lp_realm()); - asprintf(&princ_s[23], "CIFS/%s@%s", my_host_realm, lp_realm()); - asprintf(&princ_s[24], "host/%s@%s", my_host_realm, lp_realm()); - asprintf(&princ_s[25], "HOST/%s@%s", my_host_realm, lp_realm()); - } - - for (i = 0; i < sizeof(princ_s) / sizeof(princ_s[0]); i++) { - if (princ_s[i] != NULL) { - ret = ads_keytab_add_entry(ads, princ_s[i]); - if (ret != 0) { - DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding '%s'.\n", princ_s[i])); - } - SAFE_FREE(princ_s[i]); + if ( (ret = ads_keytab_add_entry(ads, sam_account_name )) != 0 ) { + DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n", + sam_account_name)); + return ret; + } + + /* remember that not every machine account will have a upn */ + + upn = ads_get_upn( ads, ctx, machine_name); + if ( upn ) { + if ( (ret = ads_keytab_add_entry(ads, upn)) != 0 ) { + DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n", + upn)); + TALLOC_FREE( ctx ); + return ret; } } - kvno = (krb5_kvno) ads_get_kvno(ads, global_myname()); + TALLOC_FREE( ctx ); + + /* Now loop through the keytab and update any other existing entries... */ + + kvno = (krb5_kvno) ads_get_kvno(ads, machine_name); if (kvno == -1) { DEBUG(1,("ads_keytab_create_default: ads_get_kvno failed to determine the system's kvno.\n")); return -1; } - - DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to preserve and update.\n")); - /* Now loop through the keytab and update any other existing entries... */ + + DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to " + "preserve and update.\n")); ZERO_STRUCT(kt_entry); ZERO_STRUCT(cursor); diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libads/kerberos_verify.c samba-3.0.23a/source/libads/kerberos_verify.c --- samba-3.0.23/source/libads/kerberos_verify.c 2006-05-23 13:54:34.000000000 -0500 +++ samba-3.0.23a/source/libads/kerberos_verify.c 2006-07-21 11:22:57.000000000 -0500 @@ -202,9 +202,13 @@ BOOL auth_ok = False; char *password_s = NULL; krb5_data password; - krb5_enctype *enctypes = NULL; + krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 }; int i; +#if defined(ENCTYPE_ARCFOUR_HMAC) + enctypes[2] = ENCTYPE_ARCFOUR_HMAC; +#endif + ZERO_STRUCTP(keyblock); if (!secrets_init()) { @@ -223,12 +227,6 @@ /* CIFS doesn't use addresses in tickets. This would break NAT. JRA */ - if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) { - DEBUG(1,("ads_secrets_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n", - error_message(ret))); - goto out; - } - p_packet->length = ticket->length; p_packet->data = (krb5_pointer)ticket->data; @@ -273,8 +271,6 @@ } out: - - free_kerberos_etypes(context, enctypes); SAFE_FREE(password_s); return auth_ok; diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libads/ldap.c samba-3.0.23a/source/libads/ldap.c --- samba-3.0.23/source/libads/ldap.c 2006-07-10 11:27:53.000000000 -0500 +++ samba-3.0.23a/source/libads/ldap.c 2006-07-21 11:22:57.000000000 -0500 @@ -5,6 +5,7 @@ Copyright (C) Remus Koos 2001 Copyright (C) Jim McDonough 2002 Copyright (C) Guenther Deschner 2005 + Copyright (C) Gerald Carter 2006 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -286,15 +287,8 @@ DEBUG(3,("Connected to LDAP server %s\n", inet_ntoa(ads->ldap_ip))); if (!ads->auth.user_name) { - /* have to use the userPrincipalName value here and - not servicePrincipalName; found by Guenther Deschner @ Sernet. - - Is this still correct? The comment does not match - the code. --jerry - - Yes it is :) - - Guenther - */ + /* Must use the userPrincipalName value here or sAMAccountName + and not servicePrincipalName; found by Guenther Deschner */ asprintf(&ads->auth.user_name, "%s$", global_myname() ); } @@ -1402,20 +1396,21 @@ * (found by hostname) in AD. * @param ads An initialized ADS_STRUCT * @param machine_name the NetBIOS name of the computer, which is used to identify the computer account. + * @param my_fqdn The fully qualified DNS name of the machine * @param spn A string of the service principal to add, i.e. 'host' * @return 0 upon sucess, or non-zero if a failure occurs **/ -ADS_STATUS ads_add_service_principal_name(ADS_STRUCT *ads, const char *machine_name, const char *spn) +ADS_STATUS ads_add_service_principal_name(ADS_STRUCT *ads, const char *machine_name, + const char *my_fqdn, const char *spn) { ADS_STATUS ret; TALLOC_CTX *ctx; LDAPMessage *res = NULL; - char *host_spn, *psp1, *psp2, *psp3; + char *psp1, *psp2; ADS_MODLIST mods; - fstring my_fqdn; char *dn_string = NULL; - const char *servicePrincipalName[4] = {NULL, NULL, NULL, NULL}; + const char *servicePrincipalName[3] = {NULL, NULL, NULL}; ret = ads_find_machine_acct(ads, (void **)(void *)&res, machine_name); if (!ADS_ERR_OK(ret) || ads_count_replies(ads, res) != 1) { @@ -1433,84 +1428,59 @@ return ADS_ERROR(LDAP_NO_MEMORY); } - name_to_fqdn(my_fqdn, machine_name); - strlower_m(my_fqdn); - - if (!(host_spn = talloc_asprintf(ctx, "HOST/%s", my_fqdn))) { - talloc_destroy(ctx); - ads_msgfree(ads, res); - return ADS_ERROR(LDAP_NO_MEMORY); - } - - /* Add the extra principal */ - psp1 = talloc_asprintf(ctx, "%s/%s", spn, machine_name); - if (!psp1) { + /* add short name spn */ + + if ( (psp1 = talloc_asprintf(ctx, "%s/%s", spn, machine_name)) == NULL ) { talloc_destroy(ctx); ads_msgfree(ads, res); return ADS_ERROR(LDAP_NO_MEMORY); } - strupper_m(psp1); strlower_m(&psp1[strlen(spn)]); - DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp1, machine_name)); servicePrincipalName[0] = psp1; - psp2 = talloc_asprintf(ctx, "%s/%s.%s", spn, machine_name, ads->config.realm); - if (!psp2) { - talloc_destroy(ctx); - ads_msgfree(ads, res); - return ADS_ERROR(LDAP_NO_MEMORY); - } + + DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", + psp1, machine_name)); + + /* add fully qualified spn */ + + if ( (psp2 = talloc_asprintf(ctx, "%s/%s", spn, my_fqdn)) == NULL ) { + ret = ADS_ERROR(LDAP_NO_MEMORY); + goto out; + } strupper_m(psp2); strlower_m(&psp2[strlen(spn)]); - DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp2, machine_name)); servicePrincipalName[1] = psp2; - /* Add another principal in case the realm != the DNS domain, so that - * the KDC doesn't send "server principal unknown" errors to clients - * which use the DNS name in determining service principal names. */ - psp3 = talloc_asprintf(ctx, "%s/%s", spn, my_fqdn); - if (!psp3) { - talloc_destroy(ctx); - ads_msgfree(ads, res); - return ADS_ERROR(LDAP_NO_MEMORY); - } + DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", + psp2, machine_name)); - strupper_m(psp3); - strlower_m(&psp3[strlen(spn)]); - if (strcmp(psp2, psp3) != 0) { - DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp3, machine_name)); - servicePrincipalName[2] = psp3; - } - - if (!(mods = ads_init_mods(ctx))) { - talloc_destroy(ctx); - ads_msgfree(ads, res); - return ADS_ERROR(LDAP_NO_MEMORY); + if ( (mods = ads_init_mods(ctx)) == NULL ) { + ret = ADS_ERROR(LDAP_NO_MEMORY); + goto out; } + ret = ads_add_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName); if (!ADS_ERR_OK(ret)) { DEBUG(1,("ads_add_service_principal_name: Error: Updating Service Principals in LDAP\n")); - talloc_destroy(ctx); - ads_msgfree(ads, res); - return ret; + goto out; } - dn_string = ads_get_dn(ads, res); - if (!dn_string) { - talloc_destroy(ctx); - ads_msgfree(ads, res); - return ADS_ERROR(LDAP_NO_MEMORY); + + if ( (dn_string = ads_get_dn(ads, res)) == NULL ) { + ret = ADS_ERROR(LDAP_NO_MEMORY); + goto out; } + ret = ads_gen_mod(ads, dn_string, mods); ads_memfree(ads,dn_string); if (!ADS_ERR_OK(ret)) { DEBUG(1,("ads_add_service_principal_name: Error: Updating Service Principals in LDAP\n")); - talloc_destroy(ctx); - ads_msgfree(ads, res); - return ret; + goto out; } - talloc_destroy(ctx); + out: + TALLOC_FREE( ctx ); ads_msgfree(ads, res); return ret; } @@ -2241,13 +2211,9 @@ return timegm(&tm); } -/** - * Find the servers name and realm - this can be done before authentication - * The ldapServiceName field on w2k looks like this: - * vnet3.home.samba.org:win2000-vnet3$@VNET3.HOME.SAMBA.ORG - * @param ads connection to ads server - * @return status of search - **/ +/******************************************************************** +********************************************************************/ + ADS_STATUS ads_current_time(ADS_STRUCT *ads) { const char *attrs[] = {"currentTime", NULL}; @@ -2257,7 +2223,7 @@ TALLOC_CTX *ctx; ADS_STRUCT *ads_s = ads; - if (!(ctx = talloc_init("ads_server_info"))) { + if (!(ctx = talloc_init("ads_current_time"))) { return ADS_ERROR(LDAP_NO_MEMORY); } @@ -2277,14 +2243,12 @@ status = ads_do_search(ads_s, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res); if (!ADS_ERR_OK(status)) { - talloc_destroy(ctx); goto done; } timestr = ads_pull_string(ads_s, ctx, res, "currentTime"); if (!timestr) { ads_msgfree(ads, res); - talloc_destroy(ctx); status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED); goto done; } @@ -2312,6 +2276,60 @@ return status; } +/******************************************************************** +********************************************************************/ + +ADS_STATUS ads_domain_func_level(ADS_STRUCT *ads, uint32 *val) +{ + const char *attrs[] = {"domainFunctionality", NULL}; + ADS_STATUS status; + void *res; + ADS_STRUCT *ads_s = ads; + + *val = DS_DOMAIN_FUNCTION_2000; + + /* establish a new ldap tcp session if necessary */ + + if ( !ads->ld ) { + if ( (ads_s = ads_init( ads->server.realm, ads->server.workgroup, + ads->server.ldap_server )) == NULL ) + { + goto done; + } + ads_s->auth.flags = ADS_AUTH_ANON_BIND; + status = ads_connect( ads_s ); + if ( !ADS_ERR_OK(status)) + goto done; + } + + /* If the attribute does not exist assume it is a Windows 2000 + functional domain */ + + status = ads_do_search(ads_s, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res); + if (!ADS_ERR_OK(status)) { + if ( status.err.rc == LDAP_NO_SUCH_ATTRIBUTE ) { + status = ADS_SUCCESS; + } + goto done; + } + + if ( !ads_pull_uint32(ads_s, res, "domainFunctionality", val) ) { + DEBUG(5,("ads_domain_func_level: Failed to pull the domainFunctionality attribute.\n")); + } + DEBUG(3,("ads_domain_func_level: %d\n", *val)); + + + ads_msgfree(ads, res); + +done: + /* free any temporary ads connections */ + if ( ads_s != ads ) { + ads_destroy( &ads_s ); + } + + return status; +} + /** * find the domain sid for our domain * @param ads connection to ads server @@ -2622,4 +2640,100 @@ return dn_count; } +/******************************************************************** +********************************************************************/ + +char* ads_get_dnshostname( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name ) +{ + LDAPMessage *res = NULL; + ADS_STATUS status; + int count = 0; + char *name = NULL; + + status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname()); + if (!ADS_ERR_OK(status)) { + DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n", + global_myname())); + goto out; + } + + if ( (count = ads_count_replies(ads, res)) != 1 ) { + DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count)); + goto out; + } + + if ( (name = ads_pull_string(ads, ctx, res, "dNSHostName")) == NULL ) { + DEBUG(0,("ads_get_dnshostname: No dNSHostName attribute!\n")); + } + +out: + ads_msgfree(ads, res); + + return name; +} + +/******************************************************************** +********************************************************************/ + +char* ads_get_upn( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name ) +{ + LDAPMessage *res = NULL; + ADS_STATUS status; + int count = 0; + char *name = NULL; + + status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname()); + if (!ADS_ERR_OK(status)) { + DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n", + global_myname())); + goto out; + } + + if ( (count = ads_count_replies(ads, res)) != 1 ) { + DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count)); + goto out; + } + + if ( (name = ads_pull_string(ads, ctx, res, "userPrincipalName")) == NULL ) { + DEBUG(0,("ads_get_dnshostname: No userPrincipalName attribute!\n")); + } + +out: + ads_msgfree(ads, res); + + return name; +} + +/******************************************************************** +********************************************************************/ + +char* ads_get_samaccountname( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name ) +{ + LDAPMessage *res = NULL; + ADS_STATUS status; + int count = 0; + char *name = NULL; + + status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname()); + if (!ADS_ERR_OK(status)) { + DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n", + global_myname())); + goto out; + } + + if ( (count = ads_count_replies(ads, res)) != 1 ) { + DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count)); + goto out; + } + + if ( (name = ads_pull_string(ads, ctx, res, "sAMAccountName")) == NULL ) { + DEBUG(0,("ads_get_dnshostname: No sAMAccountName attribute!\n")); + } + +out: + ads_msgfree(ads, res); + + return name; +} + #endif diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libads/ldap_schema.c samba-3.0.23a/source/libads/ldap_schema.c --- samba-3.0.23/source/libads/ldap_schema.c 2006-06-09 14:30:32.000000000 -0500 +++ samba-3.0.23a/source/libads/ldap_schema.c 2006-07-21 11:22:57.000000000 -0500 @@ -283,22 +283,27 @@ if (strequal(ADS_ATTR_RFC2307_UIDNUMBER_OID, oids_out[i]) || strequal(ADS_ATTR_SFU_UIDNUMBER_OID, oids_out[i])) { + SAFE_FREE(ads->schema.posix_uidnumber_attr); ads->schema.posix_uidnumber_attr = SMB_STRDUP(names_out[i]); } if (strequal(ADS_ATTR_RFC2307_GIDNUMBER_OID, oids_out[i]) || strequal(ADS_ATTR_SFU_GIDNUMBER_OID, oids_out[i])) { + SAFE_FREE(ads->schema.posix_gidnumber_attr); ads->schema.posix_gidnumber_attr = SMB_STRDUP(names_out[i]); } if (strequal(ADS_ATTR_RFC2307_HOMEDIR_OID, oids_out[i]) || strequal(ADS_ATTR_SFU_HOMEDIR_OID, oids_out[i])) { + SAFE_FREE(ads->schema.posix_homedir_attr); ads->schema.posix_homedir_attr = SMB_STRDUP(names_out[i]); } if (strequal(ADS_ATTR_RFC2307_SHELL_OID, oids_out[i]) || strequal(ADS_ATTR_SFU_SHELL_OID, oids_out[i])) { + SAFE_FREE(ads->schema.posix_shell_attr); ads->schema.posix_shell_attr = SMB_STRDUP(names_out[i]); } if (strequal(ADS_ATTR_RFC2307_GECOS_OID, oids_out[i]) || strequal(ADS_ATTR_SFU_GECOS_OID, oids_out[i])) { + SAFE_FREE(ads->schema.posix_gecos_attr); ads->schema.posix_gecos_attr = SMB_STRDUP(names_out[i]); } } diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libads/util.c samba-3.0.23a/source/libads/util.c --- samba-3.0.23/source/libads/util.c 2006-06-09 14:30:32.000000000 -0500 +++ samba-3.0.23a/source/libads/util.c 2006-07-21 11:22:57.000000000 -0500 @@ -48,14 +48,6 @@ goto failed; } - /* Determine if the KDC is salting keys for this principal in a - * non-obvious way. */ - if (!kerberos_derive_salting_principal(host_principal)) { - DEBUG(1,("Failed to determine correct salting principal for %s\n", host_principal)); - ret = ADS_ERROR_SYSTEM(EACCES); - goto failed; - } - failed: SAFE_FREE(password); return ret; diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libsmb/clikrb5.c samba-3.0.23a/source/libsmb/clikrb5.c --- samba-3.0.23/source/libsmb/clikrb5.c 2006-06-23 08:16:51.000000000 -0500 +++ samba-3.0.23a/source/libsmb/clikrb5.c 2006-07-21 11:22:56.000000000 -0500 @@ -682,7 +682,7 @@ else err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey); if (err == 0 && skey != NULL) { - DEBUG(10, ("Got KRB5 session key of length %d\n", KRB5_KEY_LENGTH(skey))); + DEBUG(10, ("Got KRB5 session key of length %d\n", (int)KRB5_KEY_LENGTH(skey))); *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey)); dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length); diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/libsmb/namequery.c samba-3.0.23a/source/libsmb/namequery.c --- samba-3.0.23/source/libsmb/namequery.c 2006-05-23 13:54:32.000000000 -0500 +++ samba-3.0.23a/source/libsmb/namequery.c 2006-07-21 11:22:56.000000000 -0500 @@ -1051,16 +1051,18 @@ return False; } - i = 0; - while ( i < numdcs ) { + *return_count = 0; + + for (i=0;iip = *interpret_addr2(dcs[i].hostname); else - (*return_iplist)[i].ip = dcs[i].ip; + r->ip = dcs[i].ip; - (*return_iplist)[i].port = dcs[i].port; + r->port = dcs[i].port; /* make sure it is a valid IP. I considered checking the negative connection cache, but this is the wrong place for it. Maybe only @@ -1069,15 +1071,11 @@ The standard reason for falling back to netbios lookups is that our DNS server doesn't know anything about the DC's -- jerry */ - if ( is_zero_ip((*return_iplist)[i].ip) ) - continue; - - i++; + if ( ! is_zero_ip(r->ip) ) + (*return_count)++; } TALLOC_FREE( dcs ); - - *return_count = i; return True; } diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/locking/brlock.c samba-3.0.23a/source/locking/brlock.c --- samba-3.0.23/source/locking/brlock.c 2006-05-23 13:54:34.000000000 -0500 +++ samba-3.0.23a/source/locking/brlock.c 2006-07-21 11:22:57.000000000 -0500 @@ -666,6 +666,7 @@ return NT_STATUS_NO_MEMORY; } br_lck->num_locks = count; + SAFE_FREE(br_lck->lock_data); br_lck->lock_data = (void *)tp; br_lck->modified = True; return NT_STATUS_OK; @@ -722,7 +723,7 @@ Check if an unlock overlaps a pending lock. ****************************************************************************/ -static BOOL brl_pending_overlap(struct lock_struct *lock, struct lock_struct *pend_lock) +static BOOL brl_pending_overlap(const struct lock_struct *lock, const struct lock_struct *pend_lock) { if ((lock->start <= pend_lock->start) && (lock->start + lock->size > pend_lock->start)) return True; @@ -738,12 +739,11 @@ static BOOL brl_unlock_windows(struct byte_range_lock *br_lck, const struct lock_struct *plock) { unsigned int i, j; - struct lock_struct *lock = NULL; struct lock_struct *locks = (struct lock_struct *)br_lck->lock_data; #if ZERO_ZERO for (i = 0; i < br_lck->num_locks; i++) { - lock = &locks[i]; + struct lock_struct *lock = &locks[i]; if (lock->lock_type == WRITE_LOCK && brl_same_context(&lock->context, &plock->context) && @@ -766,7 +766,7 @@ #endif for (i = 0; i < br_lck->num_locks; i++) { - lock = &locks[i]; + struct lock_struct *lock = &locks[i]; /* Only remove our own locks that match in start, size, and flavour. */ if (brl_same_context(&lock->context, &plock->context) && @@ -798,7 +798,7 @@ } /* We could send specific lock info here... */ - if (brl_pending_overlap(lock, pend_lock)) { + if (brl_pending_overlap(plock, pend_lock)) { DEBUG(10,("brl_unlock: sending unlock message to pid %s\n", procid_str_static(&pend_lock->context.pid ))); @@ -828,7 +828,6 @@ static BOOL brl_unlock_posix(struct byte_range_lock *br_lck, const struct lock_struct *plock) { unsigned int i, j, count; - struct lock_struct *lock = NULL; struct lock_struct *tp; struct lock_struct *locks = (struct lock_struct *)br_lck->lock_data; BOOL overlap_found = False; @@ -857,11 +856,11 @@ count = 0; for (i = 0; i < br_lck->num_locks; i++) { + struct lock_struct *lock = &locks[i]; struct lock_struct tmp_lock[3]; BOOL lock_was_added = False; unsigned int tmp_count; - lock = &locks[i]; /* Only remove our own locks - ignore fnum. */ if (lock->lock_type == PENDING_LOCK || @@ -956,11 +955,11 @@ } br_lck->num_locks = count; - br_lck->lock_data = (void *)tp; + SAFE_FREE(br_lck->lock_data); + locks = br_lck->lock_data = (void *)tp; br_lck->modified = True; /* Send unlock messages to any pending waiters that overlap. */ - locks = tp; for (j=0; j < br_lck->num_locks; j++) { struct lock_struct *pend_lock = &locks[j]; @@ -971,7 +970,7 @@ } /* We could send specific lock info here... */ - if (brl_pending_overlap(lock, pend_lock)) { + if (brl_pending_overlap(plock, pend_lock)) { DEBUG(10,("brl_unlock: sending unlock message to pid %s\n", procid_str_static(&pend_lock->context.pid ))); diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/nsswitch/pam_winbind.c samba-3.0.23a/source/nsswitch/pam_winbind.c --- samba-3.0.23/source/nsswitch/pam_winbind.c 2006-06-09 14:30:30.000000000 -0500 +++ samba-3.0.23a/source/nsswitch/pam_winbind.c 2006-07-21 11:22:56.000000000 -0500 @@ -47,15 +47,17 @@ { int ctrl = 0; const char *config_file = NULL; + int i; + const char **v; if (d == NULL) { goto config_from_pam; } - for (; argc-- > 0; ++argv) { - if (!strncasecmp(*argv, "config", strlen("config"))) { + for (i=argc,v=argv; i-- > 0; ++v) { + if (!strncasecmp(*v, "config", strlen("config"))) { ctrl |= WINBIND_CONFIG_FILE; - config_file = argv[argc]; + config_file = v[i]; break; } } @@ -92,31 +94,31 @@ config_from_pam: /* step through arguments */ - for (; argc-- > 0; ++argv) { + for (i=argc,v=argv; i-- > 0; ++v) { /* generic options */ - if (!strcmp(*argv,"debug")) + if (!strcmp(*v,"debug")) ctrl |= WINBIND_DEBUG_ARG; - else if (!strcasecmp(*argv, "use_authtok")) + else if (!strcasecmp(*v, "use_authtok")) ctrl |= WINBIND_USE_AUTHTOK_ARG; - else if (!strcasecmp(*argv, "use_first_pass")) + else if (!strcasecmp(*v, "use_first_pass")) ctrl |= WINBIND_USE_FIRST_PASS_ARG; - else if (!strcasecmp(*argv, "try_first_pass")) + else if (!strcasecmp(*v, "try_first_pass")) ctrl |= WINBIND_TRY_FIRST_PASS_ARG; - else if (!strcasecmp(*argv, "unknown_ok")) + else if (!strcasecmp(*v, "unknown_ok")) ctrl |= WINBIND_UNKNOWN_OK_ARG; - else if (!strncasecmp(*argv, "require_membership_of", strlen("require_membership_of"))) + else if (!strncasecmp(*v, "require_membership_of", strlen("require_membership_of"))) ctrl |= WINBIND_REQUIRED_MEMBERSHIP; - else if (!strncasecmp(*argv, "require-membership-of", strlen("require-membership-of"))) + else if (!strncasecmp(*v, "require-membership-of", strlen("require-membership-of"))) ctrl |= WINBIND_REQUIRED_MEMBERSHIP; - else if (!strcasecmp(*argv, "krb5_auth")) + else if (!strcasecmp(*v, "krb5_auth")) ctrl |= WINBIND_KRB5_AUTH; - else if (!strncasecmp(*argv, "krb5_ccache_type", strlen("krb5_ccache_type"))) + else if (!strncasecmp(*v, "krb5_ccache_type", strlen("krb5_ccache_type"))) ctrl |= WINBIND_KRB5_CCACHE_TYPE; - else if (!strcasecmp(*argv, "cached_login")) + else if (!strcasecmp(*v, "cached_login")) ctrl |= WINBIND_CACHED_LOGIN; else { - _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv); + _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *v); } } @@ -748,8 +750,8 @@ } } } else { - _pam_log(LOG_NOTICE - ,"could not recover authentication token"); + _pam_log(LOG_NOTICE, "could not recover authentication token"); + retval = PAM_AUTHTOK_RECOVER_ERR; } } diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/nsswitch/winbindd_cache.c samba-3.0.23a/source/nsswitch/winbindd_cache.c --- samba-3.0.23/source/nsswitch/winbindd_cache.c 2006-07-10 11:27:51.000000000 -0500 +++ samba-3.0.23a/source/nsswitch/winbindd_cache.c 2006-07-21 11:22:56.000000000 -0500 @@ -1891,7 +1891,8 @@ /* when working offline we must not clear the cache on restart */ wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE, - TDB_DEFAULT /*TDB_CLEAR_IF_FIRST*/, O_RDWR|O_CREAT, 0600); + lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST), + O_RDWR|O_CREAT, 0600); if (wcache->tdb == NULL) { DEBUG(0,("Failed to open winbindd_cache.tdb!\n")); @@ -2133,7 +2134,8 @@ /* when working offline we must not clear the cache on restart */ wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE, - TDB_DEFAULT /* TDB_CLEAR_IF_FIRST */, O_RDWR|O_CREAT, 0600); + lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST), + O_RDWR|O_CREAT, 0600); if (!wcache->tdb) { DEBUG(0,("Failed to open winbindd_cache.tdb!\n")); diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/nsswitch/winbindd_group.c samba-3.0.23a/source/nsswitch/winbindd_group.c --- samba-3.0.23/source/nsswitch/winbindd_group.c 2006-06-23 08:16:50.000000000 -0500 +++ samba-3.0.23a/source/nsswitch/winbindd_group.c 2006-07-21 11:22:56.000000000 -0500 @@ -42,7 +42,7 @@ { fstring full_group_name; - fill_domain_username( full_group_name, dom_name, gr_name, False); + fill_domain_username( full_group_name, dom_name, gr_name, True ); gr->gr_gid = unix_gid; @@ -146,7 +146,7 @@ /* Append domain name */ - fill_domain_username(name, domain->name, the_name, False); + fill_domain_username(name, domain->name, the_name, True); len = strlen(name); @@ -752,7 +752,7 @@ /* Fill in group entry */ fill_domain_username(domain_group_name, ent->domain_name, - name_list[ent->sam_entry_index].acct_name, False); + name_list[ent->sam_entry_index].acct_name, True); result = fill_grent(&group_list[group_list_ndx], ent->domain_name, @@ -929,7 +929,7 @@ groups.sam_entries)[i].acct_name; fstring name; - fill_domain_username(name, domain->name, group_name, False); + fill_domain_username(name, domain->name, group_name, True); /* Append to extra data */ memcpy(&extra_data[extra_data_len], name, strlen(name)); diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/nsswitch/winbindd_nss.h samba-3.0.23a/source/nsswitch/winbindd_nss.h --- samba-3.0.23/source/nsswitch/winbindd_nss.h 2006-06-23 08:16:50.000000000 -0500 +++ samba-3.0.23a/source/nsswitch/winbindd_nss.h 2006-07-21 11:22:56.000000000 -0500 @@ -4,6 +4,7 @@ Winbind daemon for ntdom nss module Copyright (C) Tim Potter 2000 + Copyright (C) Gerald Carter 2006 You are free to use this interface definition in any way you see fit, including without restriction, using this header in your own @@ -36,6 +37,17 @@ #define WINBIND_INTERFACE_VERSION 14 +/* Have to deal with time_t being 4 or 8 bytes due to structure alignment. + On a 64bit Linux box, we have to support a constant structure size + between /lib/libnss_winbind.so.2 and /li64/libnss_winbind.so.2. + The easiest way to do this is to always use 8byte values for time_t. */ + +#if defined(uint64) +# define SMB_TIME_T uint64 +#else +# define SMB_TIME_T time_t +#endif + /* Socket commands */ enum winbindd_cmd { @@ -184,6 +196,14 @@ /* Winbind request structure */ +/******************************************************************************* + * This structure MUST be the same size in the 32bit and 64bit builds + * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so + * + * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST + * A 64BIT WINBINDD --jerry + ******************************************************************************/ + struct winbindd_request { uint32 length; enum winbindd_cmd cmd; /* Winbindd command to execute */ @@ -213,9 +233,9 @@ fstring user; fstring domain; fstring lm_resp; - uint16 lm_resp_len; + uint32 lm_resp_len; fstring nt_resp; - uint16 nt_resp_len; + uint32 nt_resp_len; fstring workstation; fstring require_membership_of_sid; } auth_crap; @@ -255,11 +275,15 @@ fstring sid; } dual_idmapset; BOOL list_all_domains; + + /* padding -- needed to fix alignment between 32bit and 64bit libs. + The size if the sizeof the union without the padding aligned on + an 8 byte boundary. --jerry */ + + char padding[1560]; } data; union { -#if defined(uint64) - uint64 z; -#endif + SMB_TIME_T padding; char *data; } extra_data; uint32 extra_len; @@ -276,6 +300,14 @@ /* Winbind response structure */ +/******************************************************************************* + * This structure MUST be the same size in the 32bit and 64bit builds + * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so + * + * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST + * A 64BIT WINBINDD --jerry + ******************************************************************************/ + struct winbindd_response { /* Header information */ @@ -326,30 +358,32 @@ char user_session_key[16]; char first_8_lm_hash[8]; fstring krb5ccname; + uint32 reject_reason; + uint32 padding; struct policy_settings { - uint16 min_length_password; - uint16 password_history; + uint32 min_length_password; + uint32 password_history; uint32 password_properties; - time_t expire; - time_t min_passwordage; + uint32 padding; + SMB_TIME_T expire; + SMB_TIME_T min_passwordage; } policy; - uint32 reject_reason; struct info3_text { - time_t logon_time; - time_t logoff_time; - time_t kickoff_time; - time_t pass_last_set_time; - time_t pass_can_change_time; - time_t pass_must_change_time; - uint16 logon_count; - uint16 bad_pw_count; + SMB_TIME_T logon_time; + SMB_TIME_T logoff_time; + SMB_TIME_T kickoff_time; + SMB_TIME_T pass_last_set_time; + SMB_TIME_T pass_can_change_time; + SMB_TIME_T pass_must_change_time; + uint32 logon_count; + uint32 bad_pw_count; uint32 user_rid; uint32 group_rid; - fstring dom_sid; uint32 num_groups; uint32 user_flgs; uint32 acct_flags; uint32 num_other_sids; + fstring dom_sid; fstring user_name; fstring full_name; fstring logon_script; @@ -381,9 +415,7 @@ /* Variable length return data */ union { -#if defined(uint64) - uint64 z; -#endif + SMB_TIME_T padding; void *data; } extra_data; }; diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/nsswitch/winbindd_util.c samba-3.0.23a/source/nsswitch/winbindd_util.c --- samba-3.0.23/source/nsswitch/winbindd_util.c 2006-06-23 08:16:50.000000000 -0500 +++ samba-3.0.23a/source/nsswitch/winbindd_util.c 2006-07-21 11:22:56.000000000 -0500 @@ -812,14 +812,28 @@ /* Is this a domain which we may assume no DOMAIN\ prefix? */ -static BOOL assume_domain(const char *domain) { - if ((lp_winbind_use_default_domain() - || lp_winbind_trusted_domains_only()) && - strequal(lp_workgroup(), domain)) - return True; +static BOOL assume_domain(const char *domain) +{ + /* never assume the domain on a standalone server */ + + if ( lp_server_role() == ROLE_STANDALONE ) + return False; + + /* domain member servers may possibly assume for the domain name */ + + if ( lp_server_role() == ROLE_DOMAIN_MEMBER ) { + if ( !strequal(lp_workgroup(), domain) ) + return False; + + if ( lp_winbind_use_default_domain() || lp_winbind_trusted_domains_only() ) + return True; + } + + /* only left with a domain controller */ - if (strequal(get_global_sam_name(), domain)) + if ( strequal(get_global_sam_name(), domain) ) { return True; + } return False; } @@ -832,7 +846,7 @@ if ( !p ) { fstrcpy(user, domuser); - + if ( assume_domain(lp_workgroup())) { fstrcpy(domain, lp_workgroup()); } else { @@ -1211,13 +1225,13 @@ int ret = nscd_flush_cache("passwd"); if (ret) { DEBUG(5,("failed to flush nscd cache for 'passwd' service: %s\n", - strerror(ret))); + strerror(errno))); } ret = nscd_flush_cache("group"); if (ret) { DEBUG(5,("failed to flush nscd cache for 'group' service: %s\n", - strerror(ret))); + strerror(errno))); } #else return; diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/nsswitch/wins.c samba-3.0.23a/source/nsswitch/wins.c --- samba-3.0.23/source/nsswitch/wins.c 2006-04-19 21:29:21.000000000 -0500 +++ samba-3.0.23a/source/nsswitch/wins.c 2006-07-21 11:22:56.000000000 -0500 @@ -80,6 +80,7 @@ TimeInit(); setup_logging("nss_wins",False); + load_case_tables(); lp_load(dyn_CONFIGFILE,True,False,False,True); load_interfaces(); } diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/passdb/pdb_interface.c samba-3.0.23a/source/passdb/pdb_interface.c --- samba-3.0.23/source/passdb/pdb_interface.c 2006-06-23 08:16:51.000000000 -0500 +++ samba-3.0.23a/source/passdb/pdb_interface.c 2006-07-21 11:22:57.000000000 -0500 @@ -344,6 +344,7 @@ if ( !(pwd = Get_Pwnam_alloc(tmp_ctx, name)) ) { pstring add_script; int add_ret; + fstring name2; if ((acb_info & ACB_NORMAL) && name[strlen(name)-1] != '$') { pstrcpy(add_script, lp_adduser_script()); @@ -357,7 +358,11 @@ return NT_STATUS_NO_SUCH_USER; } - all_string_sub(add_script, "%u", name, sizeof(add_script)); + /* lowercase the username before creating the Unix account for + compatibility with previous Samba releases */ + fstrcpy( name2, name ); + strlower_m( name2 ); + all_string_sub(add_script, "%u", name2, sizeof(add_script)); add_ret = smbrun(add_script,NULL); DEBUG(add_ret ? 0 : 3, ("_samr_create_user: Running the command `%s' gave %d\n", add_script, add_ret)); @@ -383,6 +388,10 @@ return NT_STATUS_INTERNAL_ERROR; } + /* Use the username case specified in the original request */ + + pdb_set_username( sam_pass, name, PDB_SET ); + /* Disable the account on creation, it does not have a reasonable password yet. */ acb_info |= ACB_DISABLED; @@ -435,6 +444,7 @@ struct samu *sam_acct) { NTSTATUS status; + fstring username; status = pdb_delete_sam_account(sam_acct); if (!NT_STATUS_IS_OK(status)) { @@ -447,7 +457,14 @@ * not necessary present and maybe the sysadmin doesn't want to delete * the unix side */ - smb_delete_user( pdb_get_username(sam_acct) ); + + /* always lower case the username before handing it off to + external scripts */ + + fstrcpy( username, pdb_get_username(sam_acct) ); + strlower_m( username ); + + smb_delete_user( username ); return status; } @@ -504,6 +521,7 @@ { struct pdb_methods *pdb = pdb_get_methods(); uid_t uid; + NTSTATUS status; if (csamuser != NULL) { TALLOC_FREE(csamuser); @@ -520,7 +538,12 @@ return NT_STATUS_ACCESS_DENIED; } - return pdb->rename_sam_account(pdb, oldname, newname); + status = pdb->rename_sam_account(pdb, oldname, newname); + + /* always flush the cache here just to be safe */ + flush_pwnam_cache(); + + return status; } NTSTATUS pdb_update_login_attempts(struct samu *sam_acct, BOOL success) diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/passdb/pdb_ldap.c samba-3.0.23a/source/passdb/pdb_ldap.c --- samba-3.0.23/source/passdb/pdb_ldap.c 2006-06-23 08:16:51.000000000 -0500 +++ samba-3.0.23a/source/passdb/pdb_ldap.c 2006-07-21 11:22:56.000000000 -0500 @@ -1830,6 +1830,7 @@ const char *oldname; int rc; pstring rename_script; + fstring oldname_lower, newname_lower; if (!old_acct) { DEBUG(0, ("ldapsam_rename_sam_account: old_acct was NULL!\n")); @@ -1851,10 +1852,17 @@ DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n", oldname, newname)); - /* we have to allow the account name to end with a '$' */ - string_sub2(rename_script, "%unew", newname, sizeof(pstring), + /* We have to allow the account name to end with a '$'. + Also, follow the semantics in _samr_create_user() and lower case the + posix name but preserve the case in passdb */ + + fstrcpy( oldname_lower, oldname ); + strlower_m( oldname_lower ); + fstrcpy( newname_lower, newname ); + strlower_m( newname_lower ); + string_sub2(rename_script, "%unew", newname_lower, sizeof(pstring), True, False, True); - string_sub2(rename_script, "%uold", oldname, sizeof(pstring), + string_sub2(rename_script, "%uold", oldname_lower, sizeof(pstring), True, False, True); rc = smbrun(rename_script, NULL); diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/passdb/pdb_tdb.c samba-3.0.23a/source/passdb/pdb_tdb.c --- samba-3.0.23/source/passdb/pdb_tdb.c 2006-07-10 11:27:52.000000000 -0500 +++ samba-3.0.23a/source/passdb/pdb_tdb.c 2006-07-21 11:22:56.000000000 -0500 @@ -1388,6 +1388,8 @@ pstring rename_script; BOOL interim_account = False; int rename_ret; + fstring oldname_lower; + fstring newname_lower; /* can't do anything without an external script */ @@ -1431,11 +1433,19 @@ goto done; } - /* rename the posix user */ - string_sub2(rename_script, "%unew", newname, sizeof(pstring), - True, False, True); - string_sub2(rename_script, "%uold", pdb_get_username(old_acct), - sizeof(pstring), True, False, True); + /* Rename the posix user. Follow the semantics of _samr_create_user() + so that we lower case the posix name but preserve the case in passdb */ + + fstrcpy( oldname_lower, pdb_get_username(old_acct) ); + strlower_m( oldname_lower ); + + fstrcpy( newname_lower, newname ); + strlower_m( newname_lower ); + + string_sub2(rename_script, "%unew", newname_lower, sizeof(pstring), + True, False, True); + string_sub2(rename_script, "%uold", oldname_lower, sizeof(pstring), + True, False, True); rename_ret = smbrun(rename_script, NULL); DEBUG(rename_ret ? 0 : 3,("Running the command `%s' gave %d\n", rename_script, rename_ret)); diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/rpc_parse/parse_lsa.c samba-3.0.23a/source/rpc_parse/parse_lsa.c --- samba-3.0.23/source/rpc_parse/parse_lsa.c 2006-06-23 08:16:52.000000000 -0500 +++ samba-3.0.23a/source/rpc_parse/parse_lsa.c 2006-07-21 11:22:57.000000000 -0500 @@ -986,6 +986,9 @@ if(!prs_uint16("info_class", ps, depth, &ctr->info_class)) return False; + if(!prs_align(ps)) + return False; + switch (ctr->info_class) { case 1: if(!lsa_io_dom_query_1("", &ctr->info.id1, ps, depth)) diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/rpc_server/srv_samr_nt.c samba-3.0.23a/source/rpc_server/srv_samr_nt.c --- samba-3.0.23/source/rpc_server/srv_samr_nt.c 2006-07-10 11:27:51.000000000 -0500 +++ samba-3.0.23a/source/rpc_server/srv_samr_nt.c 2006-07-21 11:22:56.000000000 -0500 @@ -2463,8 +2463,6 @@ return NT_STATUS_NO_MEMORY; } - strlower_m(account); - nt_status = can_create(p->mem_ctx, account); if (!NT_STATUS_IS_OK(nt_status)) { return nt_status; @@ -3203,7 +3201,7 @@ if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) || ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) || ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) { - DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n")); + DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n")); } else { /* update the UNIX password */ if (lp_unix_password_sync() ) { @@ -3385,10 +3383,25 @@ if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info)) return NT_STATUS_INVALID_HANDLE; - /* observed when joining an XP client to a Samba domain */ + /* This is tricky. A WinXP domain join sets + (SA_RIGHT_USER_SET_PASSWORD|SA_RIGHT_USER_SET_ATTRIBUTES|SA_RIGHT_USER_ACCT_FLAGS_EXPIRY) + The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the + standard Win32 API calls just ask for SA_RIGHT_USER_SET_PASSWORD in the SamrOpenUser(). + This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so + we'll use the set from the WinXP join as the basis. */ + + switch (switch_value) { + case 18: + case 24: + case 25: + case 26: + acc_required = SA_RIGHT_USER_SET_PASSWORD; + break; + default: + acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY; + break; + } - acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY; - if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) { return r_u->status; } @@ -4027,6 +4040,7 @@ BOOL can_add_accounts; uint32 acb_info; DISP_INFO *disp_info = NULL; + BOOL ret; DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__)); @@ -4046,7 +4060,11 @@ return NT_STATUS_NO_MEMORY; } - if(!pdb_getsampwsid(sam_pass, &user_sid)) { + become_root(); + ret = pdb_getsampwsid(sam_pass, &user_sid); + unbecome_root(); + + if( !ret ) { DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n", sid_string_static(&user_sid))); TALLOC_FREE(sam_pass); diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/sam/idmap_ad.c samba-3.0.23a/source/sam/idmap_ad.c --- samba-3.0.23/source/sam/idmap_ad.c 2006-05-23 13:54:34.000000000 -0500 +++ samba-3.0.23a/source/sam/idmap_ad.c 2006-07-21 11:22:57.000000000 -0500 @@ -35,7 +35,6 @@ NTSTATUS init_module(void); static ADS_STRUCT *ad_idmap_ads = NULL; -static char *ad_idmap_uri = NULL; static char *attr_uidnumber = NULL; static char *attr_gidnumber = NULL; @@ -139,17 +138,13 @@ return ads; } -static NTSTATUS ad_idmap_init(char *uri) +/* no op */ +static NTSTATUS ad_idmap_init(const char *uri) { - ad_idmap_uri = SMB_STRDUP(uri); - if (ad_idmap_uri == NULL) { - return NT_STATUS_NO_MEMORY; - } - return NT_STATUS_OK; } -static NTSTATUS ad_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, int id_type) +static NTSTATUS ad_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, int id_type, int flags) { ADS_STATUS rc; NTSTATUS status = NT_STATUS_NONE_MAPPED; diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/smbd/open.c samba-3.0.23a/source/smbd/open.c --- samba-3.0.23/source/smbd/open.c 2006-06-23 08:16:49.000000000 -0500 +++ samba-3.0.23a/source/smbd/open.c 2006-07-21 11:22:56.000000000 -0500 @@ -185,7 +185,8 @@ SMB_STRUCT_STAT *psbuf, int flags, mode_t unx_mode, - uint32 access_mask) + uint32 access_mask, /* client requested access mask. */ + uint32 open_access_mask) /* what we're actually using in the open. */ { int accmode = (flags & O_ACCMODE); int local_flags = flags; @@ -239,8 +240,8 @@ local_flags = (flags & ~O_ACCMODE)|O_RDWR; } - if ((access_mask & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_EXECUTE)) || - (local_flags & O_CREAT) || + if ((open_access_mask & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_EXECUTE)) || + (!file_existed && (local_flags & O_CREAT)) || ((local_flags & O_TRUNC) == O_TRUNC) ) { /* @@ -619,8 +620,11 @@ BOOL delay_it = False; BOOL have_level2 = False; - if ((oplock_request & INTERNAL_OPEN_ONLY) || is_stat_open(fsp->access_mask)) { + if (oplock_request & INTERNAL_OPEN_ONLY) { fsp->oplock_type = NO_OPLOCK; + } + + if ((oplock_request & INTERNAL_OPEN_ONLY) || is_stat_open(fsp->access_mask)) { return False; } @@ -1109,6 +1113,7 @@ uint16 mid = get_current_mid(); struct timeval request_time = timeval_zero(); struct share_mode_lock *lck = NULL; + uint32 open_access_mask = access_mask; NTSTATUS status; if (conn->printer) { @@ -1199,12 +1204,14 @@ /* If file exists replace/overwrite. If file doesn't * exist create. */ flags2 |= (O_CREAT | O_TRUNC); + open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */ break; case FILE_OVERWRITE_IF: /* If file exists replace/overwrite. If file doesn't * exist create. */ flags2 |= (O_CREAT | O_TRUNC); + open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */ break; case FILE_OPEN: @@ -1231,6 +1238,7 @@ return NULL; } flags2 |= O_TRUNC; + open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */ break; case FILE_CREATE: @@ -1283,7 +1291,10 @@ /* This is a nasty hack - must fix... JRA. */ if (access_mask == MAXIMUM_ALLOWED_ACCESS) { - access_mask = FILE_GENERIC_ALL; + open_access_mask = access_mask = FILE_GENERIC_ALL; + if (flags2 & O_TRUNC) { + open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */ + } } /* @@ -1348,7 +1359,7 @@ fsp->inode = psbuf->st_ino; fsp->share_access = share_access; fsp->fh->private_options = create_options; - fsp->access_mask = access_mask; + fsp->access_mask = open_access_mask; /* We change this to the requested access_mask after the open is done. */ /* Ensure no SAMBA_PRIVATE bits can be set. */ fsp->oplock_type = (oplock_request & ~SAMBA_PRIVATE_OPLOCK_MASK); @@ -1379,6 +1390,7 @@ return NULL; } + /* Use the client requested access mask here, not the one we open with. */ status = open_mode_check(conn, fname, lck, access_mask, share_access, create_options, &file_existed); @@ -1403,6 +1415,8 @@ } if (!NT_STATUS_IS_OK(status)) { + uint32 can_access_mask; + BOOL can_access = True; SMB_ASSERT(NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)); @@ -1412,6 +1426,8 @@ (NTCREATEX_OPTIONS_PRIVATE_DENY_DOS| NTCREATEX_OPTIONS_PRIVATE_DENY_FCB)) { files_struct *fsp_dup; + + /* Use the client requested access mask here, not the one we open with. */ fsp_dup = fcb_or_dos_open(conn, fname, dev, inode, access_mask, share_access, @@ -1433,31 +1449,22 @@ * MS-Access. If a file open will fail due to share * permissions and also for security (access) reasons, * we need to return the access failed error, not the - * share error. This means we must attempt to open the - * file anyway in order to get the UNIX access error - - * even if we're going to fail the open for share - * reasons. This is bad, as we're burning another fd - * if there are existing locks but there's nothing - * else we can do. We also ensure we're not going to - * create or tuncate the file as we only want an - * access decision at this stage. JRA. + * share error. We can't open the file due to kernel + * oplock deadlock (it's possible we failed above on + * the open_mode_check()) so use a userspace check. */ - errno = 0; - fsp_open = open_file(fsp,conn,fname,psbuf, - flags|(flags2&~(O_TRUNC|O_CREAT)), - unx_mode,access_mask); - - DEBUG(4,("open_file_ntcreate : share_mode deny - " - "calling open_file with flags=0x%X " - "flags2=0x%X mode=0%o returned %d\n", - flags, (flags2&~(O_TRUNC|O_CREAT)), - (unsigned int)unx_mode, (int)fsp_open )); - if (!fsp_open && errno) { - /* Default error. */ - set_saved_ntstatus(NT_STATUS_ACCESS_DENIED); + if (flags & O_RDWR) { + can_access_mask = FILE_READ_DATA|FILE_WRITE_DATA; + } else { + can_access_mask = FILE_READ_DATA; } + if (((flags & O_RDWR) && !CAN_WRITE(conn)) || + !can_access_file(conn,fname,psbuf,can_access_mask)) { + can_access = False; + } + /* * If we're returning a share violation, ensure we * cope with the braindead 1 second delay. @@ -1502,8 +1509,9 @@ } TALLOC_FREE(lck); - if (fsp_open) { - fd_close(conn, fsp); + if (!can_access) { + set_saved_ntstatus(NT_STATUS_ACCESS_DENIED); + } else { /* * We have detected a sharing violation here * so return the correct error code @@ -1540,7 +1548,7 @@ */ fsp_open = open_file(fsp,conn,fname,psbuf,flags|flags2,unx_mode, - access_mask); + access_mask, open_access_mask); if (!fsp_open) { if (lck != NULL) { @@ -1550,7 +1558,7 @@ return NULL; } - if (!file_existed) { + if (!file_existed) { /* * Deal with the race condition where two smbd's detect the @@ -1612,6 +1620,7 @@ /* * We exit this block with the share entry *locked*..... */ + } SMB_ASSERT(lck != NULL); @@ -1655,6 +1664,11 @@ fsp->access_mask = access_mask; if (file_existed) { + /* stat opens on existing files don't get oplocks. */ + if (is_stat_open(open_access_mask)) { + fsp->oplock_type = NO_OPLOCK; + } + if (!(flags2 & O_TRUNC)) { info = FILE_WAS_OPENED; } else { @@ -1794,7 +1808,7 @@ /* note! we must use a non-zero desired access or we don't get a real file descriptor. Oh what a twisted web we weave. */ - fsp_open = open_file(fsp,conn,fname,psbuf,O_WRONLY,0,FILE_WRITE_DATA); + fsp_open = open_file(fsp,conn,fname,psbuf,O_WRONLY,0,FILE_WRITE_DATA,FILE_WRITE_DATA); /* * This is not a user visible file open. diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/smbd/posix_acls.c samba-3.0.23a/source/smbd/posix_acls.c --- samba-3.0.23/source/smbd/posix_acls.c 2006-07-10 11:27:50.000000000 -0500 +++ samba-3.0.23a/source/smbd/posix_acls.c 2006-07-21 11:22:56.000000000 -0500 @@ -3912,7 +3912,7 @@ Return -1 if no match, 0 if match and denied, 1 if match and allowed. ****************************************************************************/ -static int check_posix_acl_group_write(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf) +static int check_posix_acl_group_access(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf, uint32 access_mask) { SMB_ACL_T posix_acl = NULL; int entry_id = SMB_ACL_FIRST_ENTRY; @@ -3923,17 +3923,21 @@ int ret = -1; gid_t cu_gid; + DEBUG(10,("check_posix_acl_group_access: requesting 0x%x on file %s\n", + (unsigned int)access_mask, fname )); + if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS)) == NULL) { goto check_stat; } - /* First ensure the group mask allows group read. */ + /* First ensure the group mask allows group access. */ /* Also check any user entries (these take preference over group). */ while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) { SMB_ACL_TAG_T tagtype; SMB_ACL_PERMSET_T permset; int have_write = -1; + int have_read = -1; /* get_next... */ if (entry_id == SMB_ACL_FIRST_ENTRY) @@ -3947,6 +3951,11 @@ goto check_stat; } + have_read = SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ); + if (have_read == -1) { + goto check_stat; + } + have_write = SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE); if (have_write == -1) { goto check_stat; @@ -3957,16 +3966,36 @@ * canonicalize to 0 or 1. */ have_write = (have_write ? 1 : 0); + have_read = (have_read ? 1 : 0); switch(tagtype) { case SMB_ACL_MASK: seen_mask = True; - if (!have_write) { - /* We don't have any group or explicit user write permission. */ - ret = -1; /* Allow caller to check "other" permissions. */ - DEBUG(10,("check_posix_acl_group_write: file %s \ -refusing write due to mask.\n", fname)); - goto done; + switch (access_mask) { + case FILE_READ_DATA: + if (!have_read) { + ret = -1; + DEBUG(10,("check_posix_acl_group_access: file %s " + "refusing read due to mask.\n", fname)); + goto done; + } + break; + case FILE_WRITE_DATA: + if (!have_write) { + ret = -1; + DEBUG(10,("check_posix_acl_group_access: file %s " + "refusing write due to mask.\n", fname)); + goto done; + } + break; + default: /* FILE_READ_DATA|FILE_WRITE_DATA */ + if (!have_write || !have_read) { + ret = -1; + DEBUG(10,("check_posix_acl_group_access: file %s " + "refusing read/write due to mask.\n", fname)); + goto done; + } + break; } break; case SMB_ACL_USER: @@ -3978,9 +4007,21 @@ } if (current_user.ut.uid == *puid) { /* We have a uid match but we must ensure we have seen the acl mask. */ - ret = have_write; - DEBUG(10,("check_posix_acl_group_write: file %s \ -match on user %u -> %s.\n", fname, (unsigned int)*puid, ret ? "can write" : "cannot write")); + switch (access_mask) { + case FILE_READ_DATA: + ret = have_read; + break; + case FILE_WRITE_DATA: + ret = have_write; + break; + default: /* FILE_READ_DATA|FILE_WRITE_DATA */ + ret = (have_write & have_read); + break; + } + DEBUG(10,("check_posix_acl_group_access: file %s " + "match on user %u -> %s.\n", + fname, (unsigned int)*puid, + ret ? "can access" : "cannot access")); if (seen_mask) { goto done; } @@ -4003,6 +4044,7 @@ SMB_ACL_TAG_T tagtype; SMB_ACL_PERMSET_T permset; int have_write = -1; + int have_read = -1; /* get_next... */ if (entry_id == SMB_ACL_FIRST_ENTRY) @@ -4016,6 +4058,11 @@ goto check_stat; } + have_read = SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ); + if (have_read == -1) { + goto check_stat; + } + have_write = SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE); if (have_write == -1) { goto check_stat; @@ -4026,6 +4073,7 @@ * canonicalize to 0 or 1. */ have_write = (have_write ? 1 : 0); + have_read = (have_read ? 1 : 0); switch(tagtype) { case SMB_ACL_GROUP: @@ -4050,13 +4098,25 @@ for (cu_gid = get_current_user_gid_first(&i); cu_gid != (gid_t)-1; cu_gid = get_current_user_gid_next(&i)) { if (cu_gid == *pgid) { - ret = have_write; - DEBUG(10,("check_posix_acl_group_write: file %s \ -match on group %u -> can write.\n", fname, (unsigned int)cu_gid )); + switch (access_mask) { + case FILE_READ_DATA: + ret = have_read; + break; + case FILE_WRITE_DATA: + ret = have_write; + break; + default: /* FILE_READ_DATA|FILE_WRITE_DATA */ + ret = (have_write & have_read); + break; + } + + DEBUG(10,("check_posix_acl_group_access: file %s " + "match on group %u -> can access.\n", + fname, (unsigned int)cu_gid )); - /* If we don't have write permission this entry doesn't + /* If we don't have access permission this entry doesn't terminate the enumeration of the entries. */ - if (have_write) { + if (ret) { goto done; } /* But does terminate the group iteration. */ @@ -4073,12 +4133,12 @@ /* If ret is -1 here we didn't match on the user entry or supplemental group entries. */ - DEBUG(10,("check_posix_acl_group_write: ret = %d before check_stat:\n", ret)); + DEBUG(10,("check_posix_acl_group_access: ret = %d before check_stat:\n", ret)); check_stat: /* - * We only check the S_IWGRP permissions if we haven't already + * We only check the S_I[RW]GRP permissions if we haven't already * seen an owning group SMB_ACL_GROUP_OBJ ace entry. If there is an * SMB_ACL_GROUP_OBJ ace entry then the group bits in st_gid are * the same as the SMB_ACL_MASK bits, not the SMB_ACL_GROUP_OBJ @@ -4095,16 +4155,33 @@ for (cu_gid = get_current_user_gid_first(&i); cu_gid != (gid_t)-1; cu_gid = get_current_user_gid_next(&i)) { if (cu_gid == psbuf->st_gid) { - ret = (psbuf->st_mode & S_IWGRP) ? 1 : 0; - DEBUG(10,("check_posix_acl_group_write: file %s \ -match on owning group %u -> %s.\n", fname, (unsigned int)psbuf->st_gid, ret ? "can write" : "cannot write")); + switch (access_mask) { + case FILE_READ_DATA: + ret = (psbuf->st_mode & S_IRGRP) ? 1 : 0; + break; + case FILE_WRITE_DATA: + ret = (psbuf->st_mode & S_IWGRP) ? 1 : 0; + break; + default: /* FILE_READ_DATA|FILE_WRITE_DATA */ + if ((psbuf->st_mode & (S_IWGRP|S_IRGRP)) == (S_IWGRP|S_IRGRP)) { + ret = 1; + } else { + ret = 0; + } + break; + } + DEBUG(10,("check_posix_acl_group_access: file %s " + "match on owning group %u -> %s.\n", + fname, (unsigned int)psbuf->st_gid, + ret ? "can access" : "cannot access")); break; } } if (cu_gid == (gid_t)-1) { - DEBUG(10,("check_posix_acl_group_write: file %s \ -failed to match on user or group in token (ret = %d).\n", fname, ret )); + DEBUG(10,("check_posix_acl_group_access: file %s " + "failed to match on user or group in token (ret = %d).\n", + fname, ret )); } } @@ -4114,7 +4191,7 @@ SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl); } - DEBUG(10,("check_posix_acl_group_write: file %s returning (ret = %d).\n", fname, ret )); + DEBUG(10,("check_posix_acl_group_access: file %s returning (ret = %d).\n", fname, ret )); return ret; } @@ -4170,7 +4247,7 @@ #endif /* Check group or explicit user acl entry write access. */ - ret = check_posix_acl_group_write(conn, dname, &sbuf); + ret = check_posix_acl_group_access(conn, dname, &sbuf, FILE_WRITE_DATA); if (ret == 0 || ret == 1) { return ret ? True : False; } @@ -4180,15 +4257,23 @@ } /**************************************************************************** - Actually emulate the in-kernel access checking for write access. We need + Actually emulate the in-kernel access checking for read/write access. We need this to successfully check for ability to write for dos filetimes. Note this doesn't take into account share write permissions. ****************************************************************************/ -BOOL can_write_to_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf) +BOOL can_access_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf, uint32 access_mask) { int ret; + if (!(access_mask & (FILE_READ_DATA|FILE_WRITE_DATA))) { + return False; + } + access_mask &= (FILE_READ_DATA|FILE_WRITE_DATA); + + DEBUG(10,("can_access_file: requesting 0x%x on file %s\n", + (unsigned int)access_mask, fname )); + if (current_user.ut.uid == 0 || conn->admin_user) { /* I'm sorry sir, I didn't know you were root... */ return True; @@ -4201,19 +4286,56 @@ } } - /* Check primary owner write access. */ + /* Check primary owner access. */ if (current_user.ut.uid == psbuf->st_uid) { - return (psbuf->st_mode & S_IWUSR) ? True : False; + switch (access_mask) { + case FILE_READ_DATA: + return (psbuf->st_mode & S_IRUSR) ? True : False; + + case FILE_WRITE_DATA: + return (psbuf->st_mode & S_IWUSR) ? True : False; + + default: /* FILE_READ_DATA|FILE_WRITE_DATA */ + + if ((psbuf->st_mode & (S_IWUSR|S_IRUSR)) == (S_IWUSR|S_IRUSR)) { + return True; + } else { + return False; + } + } } - /* Check group or explicit user acl entry write access. */ - ret = check_posix_acl_group_write(conn, fname, psbuf); + /* Check group or explicit user acl entry access. */ + ret = check_posix_acl_group_access(conn, fname, psbuf, access_mask); if (ret == 0 || ret == 1) { return ret ? True : False; } - /* Finally check other write access. */ - return (psbuf->st_mode & S_IWOTH) ? True : False; + /* Finally check other access. */ + switch (access_mask) { + case FILE_READ_DATA: + return (psbuf->st_mode & S_IROTH) ? True : False; + + case FILE_WRITE_DATA: + return (psbuf->st_mode & S_IWOTH) ? True : False; + + default: /* FILE_READ_DATA|FILE_WRITE_DATA */ + + if ((psbuf->st_mode & (S_IWOTH|S_IROTH)) == (S_IWOTH|S_IROTH)) { + return True; + } + } + return False; +} + +/**************************************************************************** + Userspace check for write access. + Note this doesn't take into account share write permissions. +****************************************************************************/ + +BOOL can_write_to_file(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *psbuf) +{ + return can_access_file(conn, fname, psbuf, FILE_WRITE_DATA); } /******************************************************************** diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/utils/net_ads.c samba-3.0.23a/source/utils/net_ads.c --- samba-3.0.23/source/utils/net_ads.c 2006-06-23 08:16:53.000000000 -0500 +++ samba-3.0.23a/source/utils/net_ads.c 2006-07-21 11:22:57.000000000 -0500 @@ -24,22 +24,6 @@ #include "includes.h" #include "utils/net.h" -/* Macro for checking RPC error codes to make things more readable */ - -#if 0 -#define CHECK_RPC_ERR(rpc, msg) \ - if (!NT_STATUS_IS_OK(result = rpc)) { \ - DEBUG(0, (msg ": %s\n", nt_errstr(result))); \ - goto done; \ - } - -#define CHECK_RPC_ERR_DEBUG(rpc, debug_args) \ - if (!NT_STATUS_IS_OK(result = rpc)) { \ - DEBUG(0, debug_args); \ - goto done; \ - } - -#endif #ifdef HAVE_ADS int net_ads_usage(int argc, const char **argv) @@ -80,6 +64,17 @@ return -1; } +/* when we do not have sufficient input parameters to contact a remote domain + * we always fall back to our own realm - Guenther*/ + +static const char *assume_own_realm(void) +{ + if (!opt_host && strequal(lp_workgroup(), opt_target_workgroup)) { + return lp_realm(); + } + + return NULL; +} /* do a cldap netlogon query @@ -161,10 +156,7 @@ { ADS_STRUCT *ads; ADS_STATUS status; - const char *realm = NULL; - - if ( strequal(lp_workgroup(), opt_target_workgroup ) ) - realm = lp_realm(); + const char *realm = assume_own_realm(); ads = ads_init(realm, opt_target_workgroup, opt_host); if (ads) { @@ -190,8 +182,9 @@ static int net_ads_info(int argc, const char **argv) { ADS_STRUCT *ads; + const char *realm = assume_own_realm(); - if ( (ads = ads_init(lp_realm(), opt_target_workgroup, opt_host)) != NULL ) { + if ( (ads = ads_init(realm, opt_target_workgroup, opt_host)) != NULL ) { ads->auth.flags |= ADS_AUTH_NO_BIND; } @@ -228,20 +221,25 @@ setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1); } -static ADS_STRUCT *ads_startup(void) +static ADS_STRUCT *ads_startup(BOOL only_own_domain) { ADS_STRUCT *ads; ADS_STATUS status; BOOL need_password = False; BOOL second_time = False; char *cp; + const char *realm = NULL; /* lp_realm() should be handled by a command line param, However, the join requires that realm be set in smb.conf and compares our realm with the remote server's so this is ok until someone needs more flexibility */ - - ads = ads_init(lp_realm(), opt_target_workgroup, opt_host); + + if (only_own_domain) { + realm = lp_realm(); + } + + ads = ads_init(realm, opt_target_workgroup, opt_host); if (!opt_user_name) { opt_user_name = "administrator"; @@ -299,12 +297,12 @@ ads_startup() stores the password in opt_password if it needs to so that rpc or rap can use it without re-prompting. */ -int net_ads_check(void) +static int net_ads_check_int(const char *realm, const char *workgroup, const char *host) { ADS_STRUCT *ads; ADS_STATUS status; - if ( (ads = ads_init( lp_realm(), lp_workgroup(), NULL )) == NULL ) { + if ( (ads = ads_init( realm, workgroup, host )) == NULL ) { return -1; } @@ -319,6 +317,15 @@ return 0; } +int net_ads_check_our_domain(void) +{ + return net_ads_check_int(lp_realm(), lp_workgroup(), NULL); +} + +int net_ads_check(void) +{ + return net_ads_check_int(NULL, opt_workgroup, opt_host); +} /* determine the netbios workgroup name for a domain */ @@ -326,12 +333,9 @@ { ADS_STRUCT *ads; ADS_STATUS status; - const char *realm = NULL; + const char *realm = assume_own_realm(); struct cldap_netlogon_reply reply; - if ( strequal(lp_workgroup(), opt_target_workgroup ) ) - realm = lp_realm(); - ads = ads_init(realm, opt_target_workgroup, opt_host); if (ads) { ads->auth.flags |= ADS_AUTH_NO_BIND; @@ -405,7 +409,7 @@ if (argc < 1) return net_ads_user_usage(argc, argv); - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -490,7 +494,7 @@ return -1; } - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { SAFE_FREE(escaped_user); return -1; } @@ -506,7 +510,8 @@ return -1; } - grouplist = ldap_get_values(ads->ld, res, "memberOf"); + grouplist = ldap_get_values((LDAP *)ads->ld, + (LDAPMessage *)res, "memberOf"); if (grouplist) { int i; @@ -536,7 +541,7 @@ return net_ads_user_usage(argc, argv); } - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -576,7 +581,7 @@ char *disp_fields[2] = {NULL, NULL}; if (argc == 0) { - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -591,7 +596,7 @@ shortattrs, usergrp_display, disp_fields); ads_destroy(&ads); - return 0; + return ADS_ERR_OK(rc) ? 0 : -1; } return net_run_function(argc, argv, func, net_ads_user_usage); @@ -613,7 +618,7 @@ return net_ads_group_usage(argc, argv); } - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -662,7 +667,7 @@ return net_ads_group_usage(argc, argv); } - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -701,7 +706,7 @@ char *disp_fields[2] = {NULL, NULL}; if (argc == 0) { - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -716,7 +721,7 @@ disp_fields); ads_destroy(&ads); - return 0; + return ADS_ERR_OK(rc) ? 0 : -1; } return net_run_function(argc, argv, func, net_ads_group_usage); } @@ -727,7 +732,7 @@ ADS_STATUS rc; void *res; - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } @@ -776,7 +781,7 @@ /* The finds a DC and takes care of getting the user creds if necessary */ - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } @@ -826,7 +831,7 @@ net_use_machine_password(); - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } @@ -923,7 +928,7 @@ static ADS_STATUS net_set_machine_spn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s ) { ADS_STATUS status = ADS_ERROR(LDAP_SERVER_DOWN); - char *host_upn, *new_dn; + char *new_dn; ADS_MODLIST mods; const char *servicePrincipalName[3] = {NULL, NULL, NULL}; char *psp; @@ -959,9 +964,7 @@ return ADS_ERROR(LDAP_NO_MEMORY); } - /* Windows only creates HOST/shortname & HOST/fqdn. We create - the UPN as well so that 'kinit -k' will work. You can only - request a TGT for entries with a UPN in AD. */ + /* Windows only creates HOST/shortname & HOST/fqdn. */ if ( !(psp = talloc_asprintf(ctx, "HOST/%s", machine_name)) ) goto done; @@ -974,9 +977,63 @@ goto done; servicePrincipalName[1] = psp; - if (!(host_upn = talloc_asprintf(ctx, "%s@%s", servicePrincipalName[0], ads_s->config.realm))) + if (!(mods = ads_init_mods(ctx))) { goto done; + } + + /* fields of primary importance */ + + ads_mod_str(ctx, &mods, "dNSHostName", my_fqdn); + ads_mod_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName); + + status = ads_gen_mod(ads_s, new_dn, mods); + +done: + ads_msgfree(ads_s, res); + + return status; +} +/******************************************************************* + Set a machines dNSHostName and servicePrincipalName attributes + ********************************************************************/ + +static ADS_STATUS net_set_machine_upn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s, const char *upn ) +{ + ADS_STATUS status = ADS_ERROR(LDAP_SERVER_DOWN); + char *new_dn; + ADS_MODLIST mods; + LDAPMessage *res = NULL; + char *dn_string = NULL; + const char *machine_name = global_myname(); + int count; + + if ( !machine_name ) { + return ADS_ERROR(LDAP_NO_MEMORY); + } + + /* Find our DN */ + + status = ads_find_machine_acct(ads_s, (void **)(void *)&res, machine_name); + if (!ADS_ERR_OK(status)) + return status; + + if ( (count = ads_count_replies(ads_s, res)) != 1 ) { + DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count)); + return ADS_ERROR(LDAP_NO_MEMORY); + } + + if ( (dn_string = ads_get_dn(ads_s, res)) == NULL ) { + DEBUG(1, ("ads_add_machine_acct: ads_get_dn returned NULL (malloc failure?)\n")); + goto done; + } + + new_dn = talloc_strdup(ctx, dn_string); + ads_memfree(ads_s, dn_string); + if (!new_dn) { + return ADS_ERROR(LDAP_NO_MEMORY); + } + /* now do the mods */ if (!(mods = ads_init_mods(ctx))) { @@ -985,8 +1042,7 @@ /* fields of primary importance */ - ads_mod_str(ctx, &mods, "dNSHostName", my_fqdn); - ads_mod_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName); + ads_mod_str(ctx, &mods, "userPrincipalName", upn); status = ads_gen_mod(ads_s, new_dn, mods); @@ -996,7 +1052,6 @@ return status; } - /******************************************************************* join a domain using ADS (LDAP mods) ********************************************************************/ @@ -1011,7 +1066,7 @@ asprintf(&dn, "%s,%s", ou_str, ads->config.bind_path); free(ou_str); - rc = ads_search_dn(ads, (void**)&res, dn, NULL); + rc = ads_search_dn(ads, &res, dn, NULL); ads_msgfree(ads, res); if (ADS_ERR_OK(rc)) { @@ -1029,6 +1084,74 @@ return rc; } +/************************************************************************ + ************************************************************************/ + +static BOOL net_derive_salting_principal( TALLOC_CTX *ctx, ADS_STRUCT *ads ) +{ + uint32 domain_func; + ADS_STATUS status; + fstring salt; + char *std_salt; + LDAPMessage *res = NULL; + const char *machine_name = global_myname(); + + status = ads_domain_func_level( ads, &domain_func ); + if ( !ADS_ERR_OK(status) ) { + DEBUG(2,("Failed to determine domain functional level!\n")); + return False; + } + + /* go ahead and setup the default salt */ + + if ( (std_salt = kerberos_standard_des_salt()) == NULL ) { + DEBUG(0,("net_derive_salting_principal: failed to obtain stanard DES salt\n")); + return False; + } + + fstrcpy( salt, std_salt ); + SAFE_FREE( std_salt ); + + /* if it's a Windows functional domain, we have to look for the UPN */ + + if ( domain_func == DS_DOMAIN_FUNCTION_2000 ) { + char *upn; + int count; + + status = ads_find_machine_acct(ads, (void **)(void *)&res, machine_name); + if (!ADS_ERR_OK(status)) { + return False; + } + + if ( (count = ads_count_replies(ads, res)) != 1 ) { + DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count)); + return False; + } + + upn = ads_pull_string(ads, ctx, res, "userPrincipalName"); + if ( upn ) { + fstrcpy( salt, upn ); + } + + ads_msgfree(ads, res); + } + + return kerberos_secrets_store_des_salt( salt ); +} + +/********************************************************* + utility function to parse an integer parameter from + "parameter = value" +**********************************************************/ +static char* get_string_param( const char* param ) +{ + char *p; + + if ( (p = strchr( param, '=' )) == NULL ) + return NULL; + + return (p+1); +} /******************************************************************* join a domain using ADS (LDAP mods) ********************************************************************/ @@ -1043,13 +1166,17 @@ struct cldap_netlogon_reply cldap_reply; TALLOC_CTX *ctx; DOM_SID *domain_sid = NULL; + BOOL createupn = False; + const char *machineupn = NULL; + const char *create_in_ou = NULL; + int i; if ( check_ads_config() != 0 ) { d_fprintf(stderr, "Invalid configuration. Exiting....\n"); return -1; } - if ( (ads = ads_startup()) == NULL ) { + if ( (ads = ads_startup(True)) == NULL ) { return -1; } @@ -1066,11 +1193,30 @@ return -1; } - /* If we were given an OU, try to create the machine in the OU account - first and then do the normal RPC join */ + /* process additional command line args */ + + for ( i=0; i 0 ) { - status = net_precreate_machine_acct( ads, argv[0] ); + if ( create_in_ou ) { + status = net_precreate_machine_acct( ads, create_in_ou ); if ( !ADS_ERR_OK(status) ) { d_fprintf( stderr, "Failed to pre-create the machine object " "in OU %s.\n", argv[0]); @@ -1132,37 +1278,52 @@ status = net_set_machine_spn( ctx, ads ); if ( !ADS_ERR_OK(status) ) { - d_fprintf(stderr, "Failed to set servicePrincipalNames. Only NTLM authentication will be possible.\n"); - d_fprintf(stderr, "Please ensure that the DNS domain of this server matches the AD domain,\n"); - d_fprintf(stderr, "Or rejoin with using Domain Admin credentials.\n"); - /* don't fail */ - } - -#if defined(HAVE_KRB5) - if (asprintf(&machine_account, "%s$", global_myname()) == -1) { - d_fprintf(stderr, "asprintf failed\n"); - ads_destroy(&ads); + d_fprintf(stderr, "Failed to set servicePrincipalNames. Please ensure that\n"); + d_fprintf(stderr, "the DNS domain of this server matches the AD domain,\n"); + d_fprintf(stderr, "Or rejoin with using Domain Admin credentials.\n"); + + /* Disable the machine account in AD. Better to fail than to leave + a confused admin. */ + + if ( net_ads_leave( 0, NULL ) != 0 ) { + d_fprintf( stderr, "Failed to disable machine account in AD. Please do so manually.\n"); + } + + /* clear out the machine password */ + + netdom_store_machine_account( lp_workgroup(), domain_sid, "" ); + netdom_store_machine_account( short_domain_name, domain_sid, "" ); + return -1; } - if (!kerberos_derive_salting_principal(machine_account)) { + if ( !net_derive_salting_principal( ctx, ads ) ) { DEBUG(1,("Failed to determine salting principal\n")); ads_destroy(&ads); return -1; } - if (!kerberos_derive_cifs_salting_principals()) { - DEBUG(1,("Failed to determine salting principals\n")); - ads_destroy(&ads); - return -1; + if ( createupn ) { + pstring upn; + + /* default to using the short UPN name */ + if ( !machineupn ) { + snprintf( upn, sizeof(upn), "host/%s@%s", global_myname(), + ads->config.realm ); + machineupn = upn; + } + + status = net_set_machine_upn( ctx, ads, machineupn ); + if ( !ADS_ERR_OK(status) ) { + d_fprintf(stderr, "Failed to set userPrincipalName. Are you a Domain Admin?\n"); + } } - + /* Now build the keytab, using the same ADS connection */ if (lp_use_kerberos_keytab() && ads_keytab_create_default(ads)) { DEBUG(1,("Error creating host keytab!\n")); } -#endif d_printf("Joined '%s' to realm '%s'\n", global_myname(), ads->config.realm); @@ -1202,7 +1363,7 @@ ADS_STATUS rc; void *res = NULL; - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -1235,7 +1396,7 @@ const char *servername, *printername; void *res = NULL; - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -1294,7 +1455,7 @@ char *prt_dn, *srv_dn, **srv_cn; void *res = NULL; - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } @@ -1340,7 +1501,7 @@ return -1; } - srv_dn = ldap_get_dn(ads->ld, res); + srv_dn = ldap_get_dn((LDAP *)ads->ld, (LDAPMessage *)res); srv_cn = ldap_explode_dn(srv_dn, 1); asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn[0], printername, srv_dn); @@ -1377,7 +1538,7 @@ char *prt_dn; void *res = NULL; - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } @@ -1473,7 +1634,7 @@ /* use the realm so we can eventually change passwords for users in realms other than default */ - if (!(ads = ads_init(realm, opt_workgroup, NULL))) { + if (!(ads = ads_init(realm, opt_workgroup, opt_host))) { return -1; } @@ -1524,7 +1685,7 @@ use_in_memory_ccache(); - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } @@ -1589,7 +1750,7 @@ return net_ads_search_usage(argc, argv); } - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -1649,7 +1810,7 @@ return net_ads_dn_usage(argc, argv); } - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -1709,7 +1870,7 @@ return net_ads_sid_usage(argc, argv); } - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(False))) { return -1; } @@ -1766,7 +1927,7 @@ int ret; ADS_STRUCT *ads; - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } ret = ads_keytab_flush(ads); @@ -1781,7 +1942,7 @@ ADS_STRUCT *ads; d_printf("Processing principals to add...\n"); - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } for (i = 0; i < argc; i++) { @@ -1796,7 +1957,7 @@ ADS_STRUCT *ads; int ret; - if (!(ads = ads_startup())) { + if (!(ads = ads_startup(True))) { return -1; } ret = ads_keytab_create_default(ads); @@ -1829,15 +1990,12 @@ {"GROUP", net_ads_group_usage}, {"PRINTER", net_ads_printer_usage}, {"SEARCH", net_ads_search_usage}, -#if 0 {"INFO", net_ads_info}, {"JOIN", net_ads_join}, - {"JOIN2", net_ads_join2}, {"LEAVE", net_ads_leave}, {"STATUS", net_ads_status}, {"PASSWORD", net_ads_password}, {"CHANGETRUSTPW", net_ads_changetrustpw}, -#endif {NULL, NULL} }; @@ -1919,9 +2077,14 @@ return -1; } +int net_ads_check_our_domain(void) +{ + return -1; +} + int net_ads(int argc, const char **argv) { return net_ads_usage(argc, argv); } -#endif +#endif /* WITH_ADS */ diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/source/VERSION samba-3.0.23a/source/VERSION --- samba-3.0.23/source/VERSION 2006-07-10 11:27:55.000000000 -0500 +++ samba-3.0.23a/source/VERSION 2006-07-21 11:22:57.000000000 -0500 @@ -37,7 +37,7 @@ # e.g. SAMBA_VERSION_REVISION=a # # -> "2.2.8a" # ######################################################## -SAMBA_VERSION_REVISION= +SAMBA_VERSION_REVISION=a ######################################################## # For 'pre' releases the version will be # diff -u -r --new-file --exclude .svn --exclude CVS samba-3.0.23/WHATSNEW.txt samba-3.0.23a/WHATSNEW.txt --- samba-3.0.23/WHATSNEW.txt 2006-07-10 11:30:12.000000000 -0500 +++ samba-3.0.23a/WHATSNEW.txt 2006-07-21 11:23:17.000000000 -0500 @@ -1,13 +1,110 @@ + =============================== + Release Notes for Samba 3.0.23a + Jul 21, 2006 + =============================== + +This is the latest stable release of Samba. This is the version +that production Samba servers should be running for all current +bug-fixes. Please read the changes in this section and for the +original 3.0.23 release regarding new features and difference +in behavior from previous releases. + +Common bugs fixed in 3.0.23a include: + + o Failure to strip the domain name from groups when 'winbind + use default domain = yes' + o Failure in pam_winbind to correctly parse arguments. + o Bad token creation of local users on member servers not + running winbindd. + o Failure to add users or groups to ACLs using the Windows + object picker. + o Failure in file serving code when 'kernel oplocks = yes'. + +New features in 3.0.23a include: + + o New "createupn" option to "net ads join" + o Rewritten Kerberos keytab generation when 'use kerberos + keytab = yes' + + + +###################################################################### +Changes +####### + +Changes since 3.0.23 +-------------------- + +commits +------- +o Jeremy Allison + * Fix memory leaks in the POSIX locking for for the Linux CIFS fs + client. + * Fix memory leaks in the AD schema parsing code. + * Fixed bug in interaction with Linux kernel oplocks. + + +o Gerald (Jerry) Carter + * Rewrite the detection of the correct DES salting principal name + when joining an Active Directory Domain. + * Rewrite the keytab generation code based on existing SPN, + UPN, and sAMAccountName attributes in the AD machine object. + * Cleanup of dead code from idmap_ad. + * Fix Winbind 32bit/64bit portability issues. + * Fail 'net ads join' and disable the machine account if we cannot + set any SPNs for ourselves. + * Make sure to lower case all usernames before calling the create, + delete, or rename hooks. + * Preserve case for usernames in passdb + * Flush the getpwnam cache after renaming a user + * Add become/unbecome root block in _samr_delete_dom_user() when + trying to verify the account's existence. + * Changed 'net ads join' syntax for specifying an alternate + OU. New syntax is createcomputer=. + * Add createupn=[UPN] option to 'net ads join' for setting the + userPrincipalName attribute. + * Bug 3920: Restore winbind use default domain behavior for domain + groups. This break local users and 'winbind nested groups' on + domain members. + + +o Guenther Deschner + * Don't clear the cache when starting winbindd in off line mode. + * Fix errno reporting in pam_winbind debug messages. + * BUG 3937: Fix segv in libnss_wins.so. + + +o Volker Lendecke + * Fix memory leaks in the in error paths out of the CLDAP + request code. + * AIX portability fixes for DNS client code. + * BUG 3811, 3948: Fix alignment bug in on lsaquery. + * BUG 3949: Fixed authorization issue on domain member + servers not running winbindd. + + +o Andrew Tridgell + * Fixed a bug which caused resolve_ads() to spin forever if + one of the DCs isn't resolvable in DNS. + + +o Simo Sorce + * Debian packaging fixes. + + +o Dietrich Streifert + * BUG 3916: Fix error parsing pam_winbind config arguments. + + +Release Notes for older release follow: + + -------------------------------------------------- + ============================== Release Notes for Samba 3.0.23 Jul 10, 2006 ============================== -This is the latest stable release of Samba. This is the version -that production Samba servers should be running for all current -bug-fixes. Please read the changes in this section for details on -new features and difference in behavior from previous releases. - There has been a substantial amount of cleanup work done during this development cycle. We would like to thank both Coverity (http://www.coverity.com/) and Klocwork (http://www.klocwork.com/) @@ -155,68 +252,12 @@ wins partners Removed -Changes since 3.0.23rc3 ------------------------ +Changes since 3.0.22 +-------------------- commits ------- o Jeremy Allison - * BUG 3858: Ensure that all files are removed by a wildcard - delete when 'hide unreadable = yes'. - * Fix various issues raised by the Klocwork code analyzer. - * Fix nmbd WINS serving bug causing duplicate IPs in the *<1b> - query reply ("enhanced browsing = yes"). - * Fix SMB signing failures in client tools. - * BUG 3909: Avoid EA lookups on MS-DFS links. - - -o Nicholas Brealey - * Compile fix for pam_winbind. - - -o Gerald (Jerry) Carter - * Use system provided killproc() in RedHat init scripts for - more robust shutdown. - * Fix a crash in the printer publishing code when adding a - new printer via the APW. - * Fix broken compile of unsupported smbwrapper utility. - * BUG 3905: Fix smbd startup failure caused by a failure to - create an NT token for the guest account. - * BUG 3908: Fix RPC bind authentication failure which broke - user password changes. - * Ensure that "net ads join" reports failure correctly if - it cannot set the machine account password. - - -o Guenther Deschner - * Fix different extended_dn handling in adssearch.pl - (Thanks to Frederic Brin at Novell). - * Fix a memleak in winbindd's credentials cache. - * Protect against crashes in CLDAP request processing. - * Remove incomplete DfsEnum() info level to avoid an smbd crash. - - -o Volker Lendecke - * Fix a memleak in the server registry code for enumeration - shares. - * Fix an invalid munlock() call in winbindd's credentials cache. - * Fix compile warnings when passing NULL to snprintf(). - * BUG 3915: Fall back to a pure unix user with S-1-22 SIDs in the - token in case anything weird is going on with the 'force user'. - * CVE-2006-3403: Fix minor memory exhaustion DoS in smbd. - - -o Jason Mader - * Compiler warning fixes. - - -o Simo Sorce - * Set the correct sid type when looking up a gid. - - -Changes since 3.0.22 --------------------- -o Jeremy Allison * Fixes for various Klocwork defect reports. * Cleanup pdb_get_XXX() methods and ensure that a failure to allocate memory for a samu user structure is reported @@ -313,6 +354,13 @@ read fails (inspired by Justin Best). * BUG 3668: Workaround Windows bug with LARGE_READX where if you ask for exactly 64k bytes it returns 0. + * BUG 3858: Ensure that all files are removed by a wildcard + delete when 'hide unreadable = yes'. + * Fix various issues raised by the Klocwork code analyzer. + * Fix nmbd WINS serving bug causing duplicate IPs in the *<1b> + query reply ("enhanced browsing = yes"). + * Fix SMB signing failures in client tools. + * BUG 3909: Avoid EA lookups on MS-DFS links. o Andrew Bartlett @@ -334,6 +382,10 @@ * Fix crash bug in perfmon daemon example code. +o Nicholas Brealey + * Compile fix for pam_winbind. + + o Gerald (Jerry) Carter * Fix 'make install' problem when building outside source/. * Fix 'net ads join' when the workgroup is set incorrectly in @@ -415,6 +467,17 @@ * Add defensive checks about create local accounts (i.e. calling 'add user script') on domain member servers when winbindd is running but having problems. + * Use system provided killproc() in RedHat init scripts for + more robust shutdown. + * Fix a crash in the printer publishing code when adding a + new printer via the APW. + * Fix broken compile of unsupported smbwrapper utility. + * BUG 3905: Fix smbd startup failure caused by a failure to + create an NT token for the guest account. + * BUG 3908: Fix RPC bind authentication failure which broke + user password changes. + * Ensure that "net ads join" reports failure correctly if + it cannot set the machine account password. o Mathias Dietz @@ -486,7 +549,7 @@ * Add help text for new 'net rpc audit' utility. * Add net ads search SID. * samrQueryDomainInfo level 5 should return the domain name, not our - netbios name when we are a DC. + NetBIOS name when we are a DC. * Add some more client rpc for the querydominfo calls (from samba4 idl). * Process all the supported info levels in the samr_query_domain_info2 call. @@ -540,6 +603,11 @@ http://ndevilla.free.fr/iniparser/ for use by pam_winbind (rather than linking in loadparm.c). Settings are now stored in /etc/security/pam_winbind.conf. + * Fix different extended_dn handling in adssearch.pl + (Thanks to Frederic Brin at Novell). + * Fix a memleak in winbindd's credentials cache. + * Protect against crashes in CLDAP request processing. + * Remove incomplete DfsEnum() info level to avoid an smbd crash. o Aleksey Fedoseev @@ -638,6 +706,13 @@ dependent routines are called. * Enhance consistency checks on local configuration when joining a domain. + * Fix a memleak in the server registry code for enumeration + shares. + * Fix an invalid munlock() call in winbindd's credentials cache. + * Fix compile warnings when passing NULL to snprintf(). + * BUG 3915: Fall back to a pure unix user with S-1-22 SIDs in the + token in case anything weird is going on with the 'force user'. + * CVE-2006-3403: Fix minor memory exhaustion DoS in smbd. o Derrell Lipman @@ -767,6 +842,7 @@ dn' before setting a password in secrets.tdb (based on work by William Jojo). * New revision of the snprintf replace code. + * Set the correct sid type when looking up a gid. o Todd Stecher @@ -783,8 +859,6 @@ * Fix for machine password time_t overflow. -Release Notes for older release follow: - -------------------------------------------------- ============================== Release Notes for Samba 3.0.22