summaryrefslogtreecommitdiff
path: root/source3/rpc_server
AgeCommit message (Collapse)AuthorFilesLines
2002-03-10return the correct SID and domain name for the samr enum_domain andAndrew Tridgell1-8/+30
lookup_domain calls. We were incorrectly returning the PDCs domain nameand SID when we are a domain member. We should only do that when we are the DC (This used to be commit f56d689497eaa670cbfb214486ba88d5972129db)
2002-03-08merge from 2.2Gerald Carter1-3/+3
(This used to be commit 66eb969ade0dfde355df3e308dccbc9522087eef)
2002-03-08merge from 2.2Gerald Carter1-2/+2
(This used to be commit 4960692e958c986ca7f71e091333300310b0e0b2)
2002-03-08Turns out an Admin user shouldn't always have access on a handle.Jeremy Allison1-7/+0
Jeremy. (This used to be commit d31d2dcd22e1be2c26ea315e1b0e8442822a9a0f)
2002-03-07Merge in the change to do per-handle access checks on setdata/setform etc.Jeremy Allison1-70/+138
Should allow the buggy spoolss code on NT to work against us. Jeremy. (This used to be commit 2b3609a7dd55d96f5aafe137fff1ac2da0434867)
2002-03-05Fix the NTSTATUS -> WERROR for srvsvc pipe.Jeremy Allison1-137/+128
Jeremy. (This used to be commit 2b85d3570c2b149049482c3878c50cf8f5bfca61)
2002-03-05Spelling fixes.Tim Potter1-3/+3
(This used to be commit a7fa0733badad66ae610eac5e01569cf264976f3)
2002-03-03Some more fixes to enusre we execute the same code pathes as before thisAndrew Bartlett1-8/+8
change, just in different packets. (This used to be commit ffa6c61f0bb0c413d4bcc46da3bc879c40a40569)
2002-03-03This patch allows NT4 domains to trust Samba.Andrew Bartlett1-84/+81
Simply add an account (smbpasswd -a -i REMOTEDOM) and join with 'user manager' on the remote domain. The only issue (at the auth level at least) that prevented NT4 domains from trusting Samba was that our netlogon code was based on what appear to be invalid assumptions. The netlogon code appears to assume that the 'client name' specified corrosponds to an account of the same form. This doesn't apply in trusted domains, becouse the account is in the form domain$ Now that we use the supplied account name, and no longer make our access control checks at the challange stage (where this info is unavailable) we match the Win2k behaviour for invalid machine logins, and don't need to know the names of PDCs/BDCs in trusting domains. We also kill off the 'you logged on with a machine account, use your user account' error message, becouse the previous NT_STATUS return was compleatly bogus. (The ACCESS_DENIED we now return matches Win2k, and gives snane error messages on the client). TNG doesn't use this and has to do magic password syncs between the various accounts for domain/pdc/bdc. This patch feels like the much more natural way of doing things, and has been mildly tested. Andrew Bartlett (This used to be commit 542673fcd6654a1d0966dddadde177a4c4ce135d)
2002-03-01SECURITY FIXES:Andrew Bartlett1-1/+7
Remove a stray 'unbecome_root()' in the ntdomain an auth failure case. Only allow trust accounts to request a challange in srv_netlogon_nt.c. Currently any user can be the 'machine' for the domain logon. MERGE for 2.2. Andrew Bartlett (This used to be commit 0242d0e17827b05d8cd270f675d2595fa67fd5b9)
2002-02-26Fixup the sending of printer change messages from job changes.Jeremy Allison1-9/+16
Jeremy. (This used to be commit 28d4e7a3e2bd8f15ef807b821e4300a72bbc6904)
2002-02-25Merge of printing performance fixes from appliance.Tim Potter1-40/+61
(This used to be commit c8dc59dfe877f63bea6976b7d7fd448e0c8722ba)
2002-02-21merge from 2.2Gerald Carter1-1/+1
(This used to be commit 505119f0a7c6f10fd7e580edfe1bd0fb6ec36428)
2002-02-21merge from 2.2Gerald Carter1-0/+5
(This used to be commit 63ab947fd9dd17a4c370402e74b389458bbd3a60)
2002-02-20merge from 2.2Gerald Carter1-5/+8
(This used to be commit 25fb4a8d110bcdcbe7822a833cab9cfdec8a1fb2)
2002-02-15merge from APPLIANCE_HEADGerald Carter1-75/+18
(This used to be commit 696d439515016e4c2bc5ad085e443abe43c95136)
2002-02-12merge from 2.2Gerald Carter1-15/+7
(This used to be commit e18a7c26476e05f95850ac2bbeb42c2588115741)
2002-02-12merge from 2.2Gerald Carter1-4/+18
(This used to be commit 09fc979172327d6396642e824f6d482c6f986850)
2002-02-09Bring printing in HEAD inline with 2.2.x and app-head.Jeremy Allison1-171/+320
Jeremy. (This used to be commit 771ef92fc6e43725b7cc351079998a8acb74abef)
2002-02-08merge from APPLIANCE_HEADGerald Carter1-1/+1
(This used to be commit e734c1971d2841b2cfe37414fe4893f4a66b22a9)
2002-01-31Added administrator access check for server side add, delete and setformTim Potter1-10/+34
rpcs. The only one I have been able to verify is addform - can't get the client side routines working properly yet. )-: (This used to be commit 3cd97d65dea428382104ebde63eaf660aa3942fb)
2002-01-31this fixes the problem of not being able to add a SD to a file on aAndrew Tridgell1-2/+1
non-domain Samba server from a NT4 client. Note that this exactly reverses a change by Jeremy on the 18th of December 2001, reverting the code back to what JF originally wrote. I have looked carefully with a sniffer and JFs original NULL sid is correct (ie. it matches what NT4 does) and also fixes the problem. Sending a blank sid (which is what jeremy's patch did) causes NT4 to give a classic "parameter is incorrect error" and prevents the addition of new ACLs. (This used to be commit 9930cf97330dd93985c5558cec6b24406e90c228)
2002-01-30Removed version number from file header.Tim Potter20-40/+20
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-26merge from APPLIANCE_HEADGerald Carter1-3/+3
(This used to be commit e3b87ffc8c26f9fd4c3e8181897b8812b7dc4ab6)
2002-01-26Add the become_root()/unbecome_root() wrapper around the lookup_name() call,Andrew Bartlett1-1/+9
and its new args. (This used to be commit e7b3d64f6055b5d3b036f525f0ece3c9479d4f7a)
2002-01-26Move the lsa code across to the changed args for lookup_name, and surround itAndrew Bartlett1-2/+11
in become_root()/unbecome_root(). Also only allocate the memory the client reqests - and don't allow the client to trigger an SMB_ASSERT if they ask for 'more'. Up the maximum number of sids allowed, and note that this is an arbiary guess, and can be raised without consequence. Andrew Bartlett (This used to be commit 6e7667125d142670db7393ed7a48386f3821d896)
2002-01-26Try to move towards slightly sane linking for Samba by removing some pdb_...()Andrew Bartlett1-12/+30
calls from rpc_parse/parse_net.c - instead these values are passed as a paramater. Unfortunetly some there is still some samr work to be done before this is actually useful. Andrew Bartlett (This used to be commit 4fc9e16ad7a77cf2e37b27640c0dec2052e9cda0)
2002-01-26Fixed ADDPRINTEREX to take a devmode and a security descriptor...Jeremy Allison1-6/+4
Jeremy. (This used to be commit 27f65b3aad13ecd33bbb84048d70e3dde212f278)
2002-01-25Make systemtime work for spooling on bigendian systems. Fix fromJeremy Allison1-3/+20
Benjamin (Bj) Kuit bj@it.uts.edu.au. Jeremy. (This used to be commit 5f4de275a3a63a95e76d077ffc94321a078833bf)
2002-01-25Return correct RPC fault PDU on bad handle incoming.Jeremy Allison2-0/+9
Jeremy. (This used to be commit 0db93d8752197e213f0974edae53e2dafdd77b51)
2002-01-23Sync up startpageprinter with appliance.Tim Potter1-5/+5
(This used to be commit 6025ab201aa34bbf4a7e897149ef6ba370a89703)
2002-01-22Merge of fixes from 2.2.Jeremy Allison3-15/+15
Jeremy. (This used to be commit 6406a42d012184f5289d4a2b1c07a55556635fe4)
2002-01-22merge from appliance_headGerald Carter1-2/+5
(This used to be commit 38d2d26af9ef4d90dcb57fa940267f7136876191)
2002-01-20Fix the negation of the extra parinoia check on machine password changes.Andrew Bartlett1-1/+1
I *love* automated testing - this one got picked up by the build farm. Andew Bartlett (This used to be commit b19296172a75449a27eb9f674c74c462b146e717)
2002-01-20This is another *BIG* change...Andrew Bartlett2-45/+78
Samba now features a pluggable passdb interface, along the same lines as the one in use in the auth subsystem. In this case, only one backend may be active at a time by the 'normal' interface, and only one backend per passdb_context is permitted outside that. This pluggable interface is designed to allow any number of passdb backends to be compiled in, with the selection at runtime. The 'passdb backend' paramater has been created (and documented!) to support this. As such, configure has been modfied to allow (for example) --with-ldap and the old smbpasswd to be selected at the same time. This patch also introduces two new backends: smbpasswd_nua and tdbsam_nua. These two backends accept 'non unix accounts', where the user does *not* exist in /etc/passwd. These accounts' don't have UIDs in the unix sense, but to avoid conflicts in the algroitmic mapping of RIDs, they use the values specified in the 'non unix account range' paramter - in the same way as the winbind ranges are specifed. While I was at it, I cleaned up some of the code in pdb_tdb (code copied directly from smbpasswd and not really considered properly). Most of this was to do with % macro expansion on stored data. It isn't easy to get the macros into the tdb, and the first password change will 'expand' them. tdbsam needs to use a similar system to pdb_ldap in this regard. This patch only makes minor adjustments to pdb_nisplus and pdb_ldap, becouse I don't have the test facilities for these. I plan to incoroprate at least pdb_ldap into this scheme after consultation with Jerry. Each (converted) passdb module now no longer has any 'static' variables, and only exports 1 init function outside its .c file. The non-unix-account support in this patch has been proven! It is now possible to join a win2k machine to a Samba PDC without an account in /etc/passwd! Other changes: Minor interface adjustments: pdb_delete_sam_account() now takes a SAM_ACCOUNT, not a char*. pdb_update_sam_account() no longer takes the 'override' argument that was being ignored so often (every other passdb backend). Extra checks have been added in some places. Minor code changes: smbpasswd no longer attempts to initialise the passdb at startup, this is now done on first use. pdbedit has lost some of its 'machine account' logic, as this behaviour is now controlled by the passdb subsystem directly. The samr subsystem no longer calls 'local password change', but does the pdb interactions directly. This allow the ACB_ flags specifed to be transferred direct to the backend, without interference. Doco: I've updated the doco to reflect some of the changes, and removed some paramters no longer applicable to HEAD. (This used to be commit ff354c99c585068af6dc1ff35a1f109a806b326b)
2002-01-20Kill off another ugly wart from the side of the passdb subsystem.Andrew Bartlett3-36/+16
This time its the pdb_getsampwuid() function - which was only being used by the SAMR rpc subsystem to gain a 'user session key'. This 'user session key' is actually generated at login time, and the other changes here simply move that data around. This also means that (when I check some details) we will be able to use the user session key, even when we are not actually the DC, becouse its one of the components of the info3 struct returned on logon. Andrew Bartlett (This used to be commit 799ac01fe08a338e4e94289f5d6767ebf905c1fa)
2002-01-20This is the current patch from Luke Leighton <lckl@samba-tng.org> to add aAndrew Bartlett3-60/+210
degree of seperation betwen reading/writing the raw NamedPipe SMB packets and the matching operations inside smbd's RPC components. This patch is designed for no change in behaviour, and my tests hold that to be true. This patch does however allow for the future loadable modules interface to specify function pointers in replacement of the fixed state. The pipes_struct has been split into two peices, with smb_np_struct taking the information that should be generic to where the data ends up. Some other minor changes are made: we get another small helper function in util_sock.c and some of the original code has better failure debugs and variable use. (As per on-list comments). Andrew Bartlett (This used to be commit 8ef13cabdddf58b741886782297fb64b2fb7e489)
2002-01-20This patch makes the 'winbind use default domain' code interact better withAndrew Bartlett2-8/+8
smbd, and also makes it much cleaner inside winbindd. It is mostly my code, with a few changes and testing performed by Alexander Bokovoy <a.bokovoy@sam-solutions.net>. ab has tested it in security=domain and security=ads, but more testing is always appricatiated. The idea is that we no longer cart around a 'domain\user' string, we keep them seperate until the last moment - when we push that string into a pwent on onto the socket. This removes the need to be constantly parsing that string - the domain prefix is almost always already provided, (only a couple of functions actually changed arguments in all this). Some consequential changes to the RPC client code, to stop it concatonating the two strings (it now passes them both back as params). I havn't changed the cache code, however the usernames will no longer have a double domain prefix in the key string. The actual structures are unchanged - but the meaning of 'username' in the 'rid' will have changed. (The cache is invalidated at startup, so on-disk formats are not an issue here). Andrew Bartlett (This used to be commit e870f0e727952aeb8599cf93ad2650ae56eca033)
2002-01-17A nice *big* change to the fundemental way we do things.Andrew Bartlett1-3/+14
Samba (ab)uses the returns from getpwnam() a lot - in particular it keeps them around for a long time - often past the next call... This adds a getpwnam_alloc and a getpwuid_alloc to the collection. These function as expected, returning a malloced structure that can be free()ed with passwd_free(&passwd). This patch also cuts down on the number of calls to getpwnam - mostly by taking advantage of the fact that the passdb interface is already case-insensiteve. With this patch most of the recursive cases have been removed (that I know of) and the problems are reduced further by not using the sys_ interface in the new code. This means that pointers to the cache won't be affected. (This is a tempoary HACK, I intend to kill the password cache entirly). The only change I'm a little worried about is the change to rpc_server/srv_samr_nt.c for private groups. In this case we are getting groups from the new group mapping DB. Do we still need to check for private groups? I've toned down the check to a case sensitve match with the new code, but we might be able to kill it entirly. I've also added a make_modifyable_passwd() function, that copies a passwd struct into the form that the old sys_getpw* code provided. As far as I can tell this is only actually used in the pass_check.c crazies, where I moved the final 'special case' for shadow passwords (out of _Get_Pwnam()). The matching case for getpwent() is dealt with already, in lib/util_getent.c Also included in here is a small change to register the [homes] share at vuid creation rather than just in one varient of the session setup. (This picks up the SPNEGO cases). The home directory is now stored on the vuid, and I am hoping this might provide a saner way to do %H substitions. TODO: Kill off remaining Get_Pwnam_Modify calls (they are not needed), change the remaining sys_getpwnam() callers to use getpwnam_alloc() and move Get_Pwnam to return an allocated struct. Andrew Bartlett (This used to be commit 1d86c7f94230bc53daebd4d2cd829da6292e05da)
2002-01-15Missing assign fix from Bernt Nilsson bkn@ida.liu.se.Jeremy Allison1-1/+1
Jeremy. (This used to be commit adf24a90e8b4d970d71fa8a6854edcf6deff9688)
2002-01-15Change the passdb interface to use allocated strings.Andrew Bartlett1-1/+1
These strings are allocated using talloc(), either using its own memory context stored on the SAM_ACCOUNT or one supplied by the caller. The pdb_init_sam() and pdb_free_sam() function have been modifed so that a call to pdb_free_sam() will either clean up (remove hashes from memory) and destroy the TALLOC_CTX or just clean up depending on who supplied it. The pdb_init_sam and pdb_free_sam functions now also return an NTSTATUS, and I have modified the 3 places that actually checked these returns. The only nasty thing about this patch is the small measure needed to maintin interface compatability - strings set to NULL are actually set to "". This is becouse there are too many places in Samba that do strlen() on these strings without checking if they are NULL pointers. A supp patch will follow to set all strings to "" in pdb_default_sam(). Andrew Bartlett (This used to be commit 144345b41d39a6f68d01f62b7aee64ca0d328085)
2002-01-12Added PRINTER_INFO_4/PRINTER_INFO_5, we're seeing level 5 requested on the ↵Jeremy Allison1-0/+113
wire... so. Jeremy. (This used to be commit b63b76297835ab8227b98925fa8120ffce1a37d9)
2002-01-11Round and round we go....Jeremy Allison1-1/+2
Jeremy. (This used to be commit 2603ab3c6870f3697751b887e940910713f08985)
2002-01-09Better explanation message for dmalloc.Martin Pool2-3/+3
Also more insertion of parenthesis to handle struct members called 'free'. You can now get useful dmalloc output, as long as it is compatible with your C library. On RH7.1 it looks like you have to rebuild dmalloc to allow free(0) by default, because something in libcrypt does that. (sigh) (This used to be commit 391cbb690196537c8b6292b42c2e27408cc7e249)
2002-01-09When re-writing tdb version numbers as little endian int32, we mustJeremy Allison1-6/+7
change the version number also. Jeremy. (This used to be commit 3dec9cf99a82bd15626eb99e7d937ff00183cc05)
2002-01-09Fixed all uses of tdb_fetch/store/_int to use explicit int32 little endianJeremy Allison1-18/+29
in tdb's. All except winbindd_idmap.... Hmmmmmm. Jeremy. (This used to be commit ec71f1732b6b27bd2d65b250a6f3720a235dc38d)
2002-01-08Added get_called_name() function, which replaces global_myname in printingJeremy Allison1-19/+17
code (one less global, hurrah !) - to allow NetBIOS aliasing to be used with point and print. Jeremy. (This used to be commit 10d72f0b01e5950c667f3f73dff1b4da5b675ea3)
2002-01-05I've decided to move the auth code around a bit more...Andrew Bartlett2-31/+39
The auth_authsupplied_info typedef is now just a plain struct - auth_context, but it has been modified to contain the function pointers to the rest of the auth subsystem's components. (Who needs non-static functions anyway?) In working all this mess out, I fixed a number of memory leaks and moved the entire auth subsystem over to talloc(). Note that the TALLOC_CTX attached to the auth_context can be rather long-lived, it is provided for things that are intended to live as long. (The global_negprot_auth_context lasts the whole life of the smbd). I've also adjusted a few things in auth_domain.c, mainly passing the domain as a paramater to a few functions instead of looking up lp_workgroup(). I'm hopign to make this entire thing a bit more trusted domains (as PDC) freindly in the near future. Other than that, I moved a bit of the code around, hence the rather messy diff. Andrew Bartlett (This used to be commit 12f5515f556cf39fea98134fe3e2ac4540501048)
2002-01-03Fixed nasty cast of tdb_delete in traversals.Jeremy Allison1-1/+1
Jeremy. (This used to be commit a0cdec3acc82d1ce0292fadd4b8dac23638450f3)
2002-01-02Actually enforce the passdb API.Andrew Bartlett1-25/+21
Thou shalt not reference SAM_ACCOUNT members directly - always use pdb_get/pdb_set. This is achived by making the whole of SAM_ACCOUNT have a .private member, where the real members live. This caught a pile of examples, and these have beeen fixed. The pdb_get..() functions are 'const' (have been for some time) and this required a few small changes to constify other functions. I've also added some debugs to the pdb get and set, they can be removed if requested. I've rewritten the copy_id2x_to_sam_pass() functions to use the new passdb interface, but I need the flags info to do it properly. The pdb_free_sam() funciton now blanks out the LM and NT hashes, and as such I have removed many extra 'samr_clear_sam_passwd(smbpass)' calls as a result. Finally, any and all testing is always appriciated - but the basics seem to work. Andrew Bartlett (This used to be commit d3dd28f6c443187b8d820d5a39c7c5b3be2fa95c)
generated by cgit (git 2.34.1) at 2024-12-19 08:38:20 +0000