Andrew Bartlett [Wed, 17 Feb 2010 23:54:53 +0000 (10:54 +1100)]
s4:param Modify secrets_get_domain_sid to give more useful errors
This also moves the calls to secrets_get_domain_sid back into
winbind_task_init(), so that we can terminate with a much more
detailed error message. (The previous message was simply
NT_STATUS_CANT_ACCESS_DOMAIN_INFO).
That's right. The pad bytes come *before* the footer specifying how many pad
bytes there are. In order to read this you must seek to the end of the packet
and subtract the auth_len (in the packet header) and the auth footer length (a
known value).
The client and server code gets this right (mostly) in 3.0.x -> 3.4.x so long
as the pad alignment is on an 8 byte boundary (there are some special cases in
the code for this).
Tridge discovered there are some (DRS replication) cases where on 64-bit
machines where the pad alignment is on a 16-byte boundary. This breaks the
existing S3 hand-optimized rpc code.
This patch removes all the special cases in client and server code, and allows
the pad alignment for generated packets to be specified by changing a constant
in include/local.h (this doesn't affect received packets, the new code always
handles them correctly whatever pad alignment is used).
This patch also works correctly with rpcclient using sign+seal from
the 3.4.x and 3.3.x builds (testing with 3.0.x and 3.2.x to follow)
so even as a server it should still work with older libsmbclient and
winbindd code.
Jeremy Allison [Wed, 17 Feb 2010 19:13:35 +0000 (11:13 -0800)]
Fix bug #6557 - Do not work VFS full_audit
Re-arrange the operations order so SMB_VFS_CONNECT is done
first as root (to allow modules to correctly initialize themselves).
Reviewed modules to check if they needed CONNECT invoked as
a user (which we previously did) and it turns out any of them
that cared needed root permissions anyway.
Lars Müller [Wed, 17 Feb 2010 18:00:01 +0000 (19:00 +0100)]
s3: go straight to winbindd_dual_pam_auth() in case of !NT_STATUS_OK
At the formerly used process_result statement we have alone one
NT_STATUS_IS_OK() which never could be hit in our case as we only go here
if NT_STATUS_EQUAL is not ok.
Fix the names of the drsuapi_DsReplicaInfoType enum and rebuild the .idl
The get_info_obj_metadata implementation is ported from implementation
i developed and tested at the samba io lab 2009
Jeff Layton [Tue, 16 Feb 2010 14:16:42 +0000 (09:16 -0500)]
cifs.upcall: allocate a talloc context for smb_krb5_unparse_name
cifs.upcall calls smb_krb5_unparse_name with a NULL talloc context.
Older versions of this function though will conditionally use
SMB_REALLOC instead of TALLOC_REALLOC when a NULL context is passed
in. To make it more consistent, just spawn a talloc context that
we can pass into this function.
Andrew Tridgell [Wed, 17 Feb 2010 07:18:05 +0000 (18:18 +1100)]
util: added samba_runcmd()
This allows us to run a child command in an async fashion, with
control over logging of stdout and stderr (which appears in the Samba
log file). This is useful for ensuring we don't miss important
messages from rndc commands (for example).
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Volker Lendecke [Tue, 16 Feb 2010 11:28:53 +0000 (12:28 +0100)]
s3: Avoid starving locks when many processes die at the same time
In g_lock_unlock we have a little race between the process_exists and
messaging_send call: We only send to 5 waiters now, they all might have died
between us checking their existence and sending the message. This change makes
g_lock_lock retry at least once every minute.
Volker Lendecke [Tue, 16 Feb 2010 11:22:08 +0000 (12:22 +0100)]
s3: Avoid a thundering herd in g_lock_unlock
Only notify the first 5 pending lock waiters. This avoids a thundering herd
problem that is really nasty in a cluster. It also makes acquiring a lock a bit
more FIFO, lock waiters are added to the end of the array.
Volker Lendecke [Mon, 15 Feb 2010 15:57:16 +0000 (16:57 +0100)]
s3: Optimize g_lock_lock for a heavily contended case
Only check the existence of the lock owner in g_lock_parse, check the rest of
the records only when we got the lock successfully. This reduces the load on
process_exists which can involve a network roundtrip in the clustered case.
Andrew Tridgell [Tue, 16 Feb 2010 11:18:16 +0000 (22:18 +1100)]
s4-rpc: don't use auth padding in rpc bind requests as it breaks s3
The s3 RPC server returns a bind_nak if it gets a rpc bind with auth
padding. This change forces a padding length of zero to maximimise
compatibility with s3 servers.
I've left the padding code in as a #if 0 to make it easier for us to
test/fix the s3 server code, which should be changed to correctly
handle arbitrary auth padding in all rpc requests with auth trailers.
Andrew Tridgell [Tue, 16 Feb 2010 09:21:29 +0000 (20:21 +1100)]
s4-dcerpc: fixed auth padding to be relative to the stub, not packet
The recent dcerpc padding changes made our padding relative to the
packet header, instead of the start of the stub. Surprisingly, this
broke w2k8r2 doing a dcpromo join to a s4 server. It seems that w2k8r2
is very fussy about the padding it gets in some circumstances.
Andrew Tridgell [Tue, 16 Feb 2010 04:40:44 +0000 (15:40 +1100)]
s4-dsdb: added dsdb_search_one() and cleanup dsdb_find_dn_by_guid()
dsdb_find_dn_by_guid() now takes a struct GUID instead of a
guid_string. All the callers in fact wanted a struct GUID, so we now
avoid the extra conversion.
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
s4-drs: Fixes bugs regarding Urgent Replication on wrong situations
It fixes the bug which causes an urgent replication to be enabled
incorrectly when an object is modified, but it should happen only
when it was created. This patch also fixes the bug that enable an
urgent replication when an object is deleted, but it should happen
only when it was modified and fixes the bug that does not enable
an urgent replication when an object is deleted and it should happen
only when it is deleted (not when it is modified).
s4:provision.c - "provsion_store_self_join" - don't set the realm if it's NULL
The realm can be NULL when this function is called by "libnet_Join_primary_domain".
This seems to be a valid value since "libnet_JoinDomain" is allowed to return an
empty realm if we are not in a ADS domain.