David Disseldorp [Tue, 15 Jan 2013 16:23:10 +0000 (17:23 +0100)]
smb2_ioctl: copychunk CHECK_READ and CHECK_WRITE
[MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request, specifies
that the copychunk destination file handle be granted FILE_WRITE_DATA
and FILE_READ_DATA access.
FILE_READ_DATA access must also be granted on the copychunk source file,
which may be done implicitly with execute permission.
David Disseldorp [Tue, 15 Jan 2013 16:23:09 +0000 (17:23 +0100)]
torture: copychunk test suite improvements
Allow for large files in test_setup_copy_chunk():
Write test data in 1M IOs, rather than attempting to do the whole
thing in one go.
Add copychunk bad resume key test:
Send a copy chunk request with an intentionally bogus resume key
(source key handle).
Add copychunk src=dest test:
Test copychunk requests where the source and destination handles refer
to the same file.
Add copychunk src=dest overlap test.
Add desired access args to test_setup_copy_chunk().
Add copychunk_bad_access test:
Open the copychunk source and destination files with differing
desired_access values. Confirm copychunk response matches 2k8 and 2k12
behaviour.
Add copy_chunk_src_exceed test:
Attempts to copy more data than is present in the copychunk source
file.
Add copy_chunk_src_exceed_multi test:
Test whether the first chunk in a multi-chunk copychunk request is
written to disk, where the second chunk is invalid due to src file
overrun.
Add copy_chunk_sparse_dest test:
Issue a request where the target offset exceeds the file size, resulting
in a sparse region.
MS-SMB2 3.3.4.4 documents cases where a ntstatus indicating an error
should not be considered a failure. In such a case the output data
buffer should be sent to the client rather than an error response
packet.
Add a new fsctl copy_chunk test to confirm field limits are sent back
in response to an oversize chunk request.
David Disseldorp [Tue, 15 Jan 2013 16:23:00 +0000 (17:23 +0100)]
smb2_ioctl: add support for FSCTL_SRV_COPYCHUNK
SMB2 clients can issue FSCTL_SRV_COPYCHUNK requests in order to copy
data between files on the server side only, rather than reading data
then writing back from the client. FSCTL_SRV_COPYCHUNK is used by
default for Explorer SMB2 file copies on Windows Server 2012.
2.2.32.1 SRV_COPYCHUNK_RESPONSE in [MS-SMB2] describes the requirement
for the server to provide maximum copychunk request size limits in ioctl
responses carrying STATUS_INVALID_PARAMETER.
David Disseldorp [Tue, 15 Jan 2013 16:22:59 +0000 (17:22 +0100)]
s3-vfs: add copy_chunk vfs hooks
copy_chunk copies n bytes from a source file at a specific offset to a
destination file at a given offset. This interface will be used in
handling smb2 FSCTL_SRV_COPYCHUNK ioctl requests.
Use a pread/pwrite loop in vfs_default, so that requests referring to
the same src and dest file are possible.
Provide send and receive hooks for copy chunk VFS interface, allowing
asynchronous behaviour.
Check whether the request source offset + length exceeds the current
size. Return STATUS_INVALID_VIEW_SIZE under such a condition, matching
Windows server behaviour.
David Disseldorp [Tue, 15 Jan 2013 16:22:58 +0000 (17:22 +0100)]
smb2_ioctl: add FSCTL_SRV_REQUEST_RESUME_KEY support
Use existing ioctl IDL infrastructure for marshalling. Support for this
ioctl is a prerequisite for FSCTL_SRV_COPYCHUNK handling.
The client-opaque resume key is constructed using the server side
dev/inode file identifier.
Michael Adam [Tue, 15 Jan 2013 14:35:09 +0000 (15:35 +0100)]
build(waf): fix the abi_match for the pdb library
The global wildcard match is automatically added by the parsing code
if the global match list is empty. Specifying an explicit '*' as the only
global match lets the parsing code add a second '*' to the local list,
which is an error tolerated on my linux by ld (the GNU linker), but
not by the stricter GNU ELF linker "gold".
Pair-Programmed-With: Gregor Beck <gbeck@sernet.de>
Signed-off-by: Gregor Beck <gbeck@sernet.de> Signed-off-by: Michael Adam <obnox@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Wed Jan 16 21:31:00 CET 2013 on sn-devel-104
Günther Deschner [Tue, 15 Jan 2013 16:05:10 +0000 (17:05 +0100)]
s4-torture: add ndr64 spoolss openprinterex to ndr test.
Guenther
Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jan 16 13:26:53 CET 2013 on sn-devel-104
Volker Lendecke [Tue, 15 Jan 2013 10:22:49 +0000 (11:22 +0100)]
test: dbwrap_tool requires --persistent for the registry now
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Jan 15 16:31:35 CET 2013 on sn-devel-104
Michael Adam [Mon, 14 Jan 2013 16:08:30 +0000 (17:08 +0100)]
docs: add popt.common.samba.server and popt.common.samba.client entities
These are comprised by the popt.common.samba entity and the stdarg.server.debug
or the stdarg.client.debut entity, respectively.
The difference is only in the default value of the debug level setting.
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
Andrew Bartlett [Wed, 9 Jan 2013 05:59:18 +0000 (16:59 +1100)]
dsdb-acl: Run sec_access_check_ds on each attribute proposed to modify (bug #9554 - CVE-2013-0172)
This seems inefficient, but is needed for correctness. The
alternative might be to have the sec_access_check_ds code confirm that
*all* of the nodes in the object tree have been cleared to
node->remaining_bits == 0.
Otherwise, I fear that write access to one attribute will become write
access to all attributes.
Andrew Bartlett
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit d776fd807e0c9a62f428ce666ff812655f98bc47)
Jeremy Allison [Mon, 14 Jan 2013 23:22:11 +0000 (15:22 -0800)]
tevent: Fix bug 9550 - sigprocmask does not work on FreeBSD to stop further signals in a signal handler
Mask off signals the correct way from the signal handler.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan 15 12:13:43 CET 2013 on sn-devel-104
ldb: Move doxygen comments for ldb_connect to the right place
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jan 14 16:21:02 CET 2013 on sn-devel-104
Andrew Bartlett [Fri, 11 Jan 2013 05:42:41 +0000 (16:42 +1100)]
dsdb: Make linked_attributes module GUID based for renames
This ensures that when we have the backlink out of sync with the forward link (perhaps due
to another operation that has put the backlink handling in an end-of-transaction
TODO list in repl_meta_data) that we do not error out, we just cope as well as we can.
The GUID is the unique identifier, not the DN.
Andrew Bartlett
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sat Jan 12 12:52:28 CET 2013 on sn-devel-104
Volker Lendecke [Fri, 11 Jan 2013 13:51:42 +0000 (14:51 +0100)]
winbind: Fix some missing NULL checks
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jan 11 18:55:41 CET 2013 on sn-devel-104
Andrew Bartlett [Thu, 27 Dec 2012 23:05:40 +0000 (10:05 +1100)]
scripting/samba_upgradedns: Only look for IPv4/IPv6 addresses if we actually them
This allows the script to be used to create/remove the samba-specific dns-SERVER account
when we do not need to create the in-directory partition.
Andrew Bartlett
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 10 20:56:50 CET 2013 on sn-devel-104
Andrew Bartlett [Fri, 21 Dec 2012 22:28:05 +0000 (09:28 +1100)]
samba-tool classicupgrade: Do not print the admin password during upgrade
This changes the code to only set and show a new password if no admin
user is found during the upgrade.
Andrew Bartlett
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 10 16:55:23 CET 2013 on sn-devel-104
Andrew Bartlett [Wed, 26 Dec 2012 09:48:12 +0000 (20:48 +1100)]
s4-idmap: Remove requirement that posixAccount or posixGroup be set for rfc2307
This change matches the source3/idmap/idmap_ad.c code, and allows this
feature to work with only the setting of the UID/GID in Active
Directory Users and Computers.
Andrew Bartlett [Thu, 10 Jan 2013 01:00:03 +0000 (12:00 +1100)]
build: Set LD_LIBRARY_PATH in install_with_python.sh
This ensures that the python install finishes correctly.
Andrew Bartlett
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 10 14:00:13 CET 2013 on sn-devel-104
s3-lib: Use new strict directory create function in create_pipe_sock().
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jan 9 10:55:23 CET 2013 on sn-devel-104
Matthieu Patou [Mon, 31 Dec 2012 23:38:50 +0000 (15:38 -0800)]
libnet-vampire: reports Exops as they rather than sync on some partitions
Instead of showing:
Partition[CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com]
objects[1] linked_values[8]
Report a exop based on CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com
as
Exop on CN=RODC,OU=Domain Controllers,DC=samba,DC=example,DC=com, ...
Signed-off-by: Matthieu Patou <mat@matws.net> Reviewed-By: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Matthieu Patou <mat@samba.org>
Autobuild-Date(master): Wed Jan 9 09:01:30 CET 2013 on sn-devel-104
Jesper Larsen [Fri, 4 Jan 2013 12:03:58 +0000 (13:03 +0100)]
replace: Fix compilation of rep_mkstemp
Commit 1fbc185 removed the variable 'p'.
Use the equivalent variable 'template' instead.
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jan 9 07:18:33 CET 2013 on sn-devel-104
Jeremy Allison [Fri, 4 Jan 2013 22:25:55 +0000 (14:25 -0800)]
Correctly setup the conn->share_access based on the current user token.
Also use this to set conn->read_only. Cache the share_access in the
struct vuid_cache_entry struct so we only evaluate this once per new
user access on this share.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>