[SCM] Samba Shared Repository - branch master updated
Andrew Bartlett
abartlet at samba.org
Wed Jun 20 02:15:04 MDT 2012
The branch, master has been updated
via f0072d3 VERSION: Move on to beta3!
via 59fdc48 VERSION: Mark as the beta2 release
via ce81780 WHATNEW: Update for the beta2 release
via 352dbdd s4-idmap: Add parameter 'idmap_ldb:use rfc2307' and correct implementation errors
via 2b50e8c s4-provision: Remove --slapd-path option
via 706a998 s4-provision: Remove last unused remenants of the 'sid generator' configuration
via 7f498f8 Revert "s4-libcli: Remove unused finddcs_nbt"
from 671f610 Fix unused variable warnings.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit f0072d32b62e99890e6dbe371593601be443c007
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jun 20 13:25:02 2012 +1000
VERSION: Move on to beta3!
Autobuild-User(master): Andrew Bartlett <abartlet at samba.org>
Autobuild-Date(master): Wed Jun 20 10:14:37 CEST 2012 on sn-devel-104
commit 59fdc4821fb64eec0daa7965d978e37c0f8d2d4f
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jun 20 13:24:30 2012 +1000
VERSION: Mark as the beta2 release
commit ce817803f670da6cdad5e957d9c49152e1e0857f
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jun 20 13:23:56 2012 +1000
WHATNEW: Update for the beta2 release
commit 352dbddb6d3c1324862409dcfa8a8bee5c111b7c
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jun 20 12:51:43 2012 +1000
s4-idmap: Add parameter 'idmap_ldb:use rfc2307' and correct implementation errors
commit 2b50e8c534872117e7687d643dd8a849e8c044d7
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jun 20 12:41:06 2012 +1000
s4-provision: Remove --slapd-path option
This just leaves a default enough for the test code to still check the start
of the provision. This may well be removed in future, and we wish to reduce
the extra options to provision.
Andrew Bartlett
commit 706a998c1fd0f384a51901e2d0a179e54d48f169
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jun 20 11:48:11 2012 +1000
s4-provision: Remove last unused remenants of the 'sid generator' configuration
This was part of the now-abandoned S4 AD LDAP backend project.
Andrew Bartlett
commit 7f498f8987434b942718c139ec660fc2924238b0
Author: Andrew Bartlett <abartlet at samba.org>
Date: Fri Jun 8 20:43:18 2012 +1000
Revert "s4-libcli: Remove unused finddcs_nbt"
This reverts commit 06c90cb6f55701effa4cbafaf189a4de8471949b.
There is genuine interest in using this currently unused code, so put
it back into the tree to avoid folks having to rewrite it.
It should be carefully hooked back into libnet at some point, and
possibly told how to talk to the s3 nmbd socket if nbt_server isn't
running.
The wscript patches are skipped, due to the way the extra
dep interacted with the build system. When used, this will be resolved.
Andrew Bartlett
-----------------------------------------------------------------------
Summary of changes:
VERSION | 2 +-
WHATSNEW.txt | 17 +
selftest/target/Samba4.pm | 9 -
source4/libcli/finddcs_nbt.c | 311 ++++++++++++++++++++
.../scripting/python/samba/provision/__init__.py | 21 +-
source4/scripting/python/samba/upgrade.py | 2 +-
source4/setup/provision | 3 -
source4/setup/tests/blackbox_provision-backend.sh | 10 +-
source4/winbind/idmap.c | 65 +++--
9 files changed, 389 insertions(+), 51 deletions(-)
create mode 100644 source4/libcli/finddcs_nbt.c
Changeset truncated at 500 lines:
diff --git a/VERSION b/VERSION
index b2ed8e6..d44c3a8 100644
--- a/VERSION
+++ b/VERSION
@@ -67,7 +67,7 @@ SAMBA_VERSION_ALPHA_RELEASE=
# e.g. SAMBA_VERSION_BETA_RELEASE=1 #
# -> "4.0.0beta1" #
########################################################
-SAMBA_VERSION_BETA_RELEASE=2
+SAMBA_VERSION_BETA_RELEASE=3
########################################################
# For 'pre' releases the version will be #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 6e1e98a..c4ba7f3 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -114,6 +114,23 @@ continue to use ntvfs, you must set in your smb.conf:
samba-tool dbcheck will now upgrade older databases that are missing
GUIDs in the schema partition.
+The 'samba-tool domain samba3upgrade' command is now called
+'samba-tool domain classicupgrade' and now creates users and groups
+with the posixAccount objectClass and uidNumber and gidNumber values.
+
+The new 'idmap_ldb:use rfc2307' parameter allows these values to be
+used instead of the idmap.ldb, where found in the directory.
+
+Work has continued to make Samba more portable to a wide variety of
+Unix-like systems, and to support --without-ad-dc on systems lacking a
+modern MIT krb5.
+
+Less visible, but very importantly, the work has continued in restructuring
+the smbd file server to implement SMB3.
+
+The TDB2 database library has been changed to ntdb, but will not be
+the default db layer for the 4.0 release. We will continue to use tdb1.
+
KNOWN ISSUES
============
diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 2c26ffc..af39517 100644
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -461,7 +461,6 @@ sub provision_raw_prepare($$$$$$$$$)
$ctx->{domain} = $domain;
$ctx->{realm} = uc($realm);
$ctx->{dnsname} = lc($realm);
- $ctx->{sid_generator} = "internal";
$ctx->{functional_level} = $functional_level;
@@ -602,11 +601,6 @@ sub provision_raw_step1($$)
server signing = on
";
- if (defined($ctx->{sid_generator}) && $ctx->{sid_generator} ne "internal") {
- print CONFFILE "
- sid generator = $ctx->{sid_generator}";
- }
-
print CONFFILE "
# Begin extra options
@@ -806,9 +800,6 @@ $extra_smbconf_shares
$ldap_uri =~ s|/|%2F|g;
$ldap_uri = "ldapi://$ldap_uri";
$ctx->{ldap_uri} = $ldap_uri;
- if ($self->{ldap} eq "fedora-ds") {
- $ctx->{sid_generator} = "backend";
- }
$ctx->{ldap_instance} = lc($ctx->{netbiosname});
}
diff --git a/source4/libcli/finddcs_nbt.c b/source4/libcli/finddcs_nbt.c
new file mode 100644
index 0000000..6a5d1fd
--- /dev/null
+++ b/source4/libcli/finddcs_nbt.c
@@ -0,0 +1,311 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ a composite API for finding a DC and its name
+
+ Copyright (C) Volker Lendecke 2005
+ Copyright (C) Andrew Bartlett <abartlet at samba.org> 2006
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "include/includes.h"
+#include <tevent.h>
+#include "lib/messaging/irpc.h"
+#include "librpc/gen_ndr/ndr_irpc_c.h"
+#include "libcli/composite/composite.h"
+#include "libcli/libcli.h"
+#include "libcli/resolve/resolve.h"
+#include "lib/util/tevent_ntstatus.h"
+#include "libcli/finddc.h"
+
+struct finddcs_nbt_state {
+ struct tevent_context *ev;
+ struct tevent_req *req;
+ struct imessaging_context *msg_ctx;
+
+ const char *my_netbios_name;
+ const char *domain_name;
+ struct dom_sid *domain_sid;
+
+ struct nbtd_getdcname r;
+ struct nbt_name_status node_status;
+
+ int num_dcs;
+ struct nbt_dc_name *dcs;
+ uint16_t nbt_port;
+};
+
+static void finddcs_nbt_name_resolved(struct composite_context *ctx);
+static void finddcs_nbt_getdc_replied(struct tevent_req *subreq);
+static void fallback_node_status(struct finddcs_nbt_state *state);
+static void fallback_node_status_replied(struct nbt_name_request *name_req);
+
+/*
+ * Setup and send off the a normal name resolution for the target name.
+ *
+ * The domain_sid parameter is optional, and is used in the subsequent getdc request.
+ *
+ * This will try a GetDC request, but this may not work. It will try
+ * a node status as a fallback, then return no name (but still include
+ * the IP)
+ */
+
+struct tevent_req *finddcs_nbt_send(TALLOC_CTX *mem_ctx,
+ const char *my_netbios_name,
+ uint16_t nbt_port,
+ const char *domain_name,
+ int name_type,
+ struct dom_sid *domain_sid,
+ struct resolve_context *resolve_ctx,
+ struct tevent_context *event_ctx,
+ struct imessaging_context *msg_ctx)
+{
+ struct finddcs_nbt_state *state;
+ struct nbt_name name;
+ struct tevent_req *req;
+ struct composite_context *creq;
+
+ req = tevent_req_create(mem_ctx, &state, struct finddcs_nbt_state);
+ if (req == NULL) {
+ return NULL;
+ }
+
+ state->req = req;
+ state->ev = event_ctx;
+ state->nbt_port = nbt_port;
+ state->my_netbios_name = talloc_strdup(state, my_netbios_name);
+ if (tevent_req_nomem(state->my_netbios_name, req)) {
+ return tevent_req_post(req, event_ctx);
+ }
+ state->domain_name = talloc_strdup(state, domain_name);
+ if (tevent_req_nomem(state->domain_name, req)) {
+ return tevent_req_post(req, event_ctx);
+ }
+
+ if (domain_sid) {
+ state->domain_sid = talloc_reference(state, domain_sid);
+ if (tevent_req_nomem(state->domain_sid, req)) {
+ return tevent_req_post(req, event_ctx);
+ }
+ } else {
+ state->domain_sid = NULL;
+ }
+
+ state->msg_ctx = msg_ctx;
+
+ make_nbt_name(&name, state->domain_name, name_type);
+ creq = resolve_name_send(resolve_ctx, state, &name, event_ctx);
+ if (tevent_req_nomem(creq, req)) {
+ return tevent_req_post(req, event_ctx);
+ }
+ creq->async.fn = finddcs_nbt_name_resolved;
+ creq->async.private_data = state;
+
+ return req;
+}
+
+/* Having got an name query answer, fire off a GetDC request, so we
+ * can find the target's all-important name. (Kerberos and some
+ * netlogon operations are quite picky about names)
+ *
+ * The name is a courtesy, if we don't find it, don't completely fail.
+ *
+ * However, if the nbt server is down, fall back to a node status
+ * request
+ */
+static void finddcs_nbt_name_resolved(struct composite_context *ctx)
+{
+ struct finddcs_nbt_state *state =
+ talloc_get_type(ctx->async.private_data, struct finddcs_nbt_state);
+ struct tevent_req *subreq;
+ struct dcerpc_binding_handle *irpc_handle;
+ const char *address;
+ NTSTATUS status;
+
+ status = resolve_name_recv(ctx, state, &address);
+ if (tevent_req_nterror(state->req, status)) {
+ return;
+ }
+
+ /* TODO: This should try and find all the DCs, and give the
+ * caller them in the order they responded */
+
+ state->num_dcs = 1;
+ state->dcs = talloc_array(state, struct nbt_dc_name, state->num_dcs);
+ if (tevent_req_nomem(state->dcs, state->req)) {
+ return;
+ }
+
+ state->dcs[0].address = talloc_steal(state->dcs, address);
+
+ /* Try and find the nbt server. Fallback to a node status
+ * request if we can't make this happen The nbt server just
+ * might not be running, or we may not have a messaging
+ * context (not root etc) */
+ if (!state->msg_ctx) {
+ fallback_node_status(state);
+ return;
+ }
+
+ irpc_handle = irpc_binding_handle_by_name(state, state->msg_ctx,
+ "nbt_server", &ndr_table_irpc);
+ if (irpc_handle == NULL) {
+ fallback_node_status(state);
+ return;
+ }
+
+ state->r.in.domainname = state->domain_name;
+ state->r.in.ip_address = state->dcs[0].address;
+ state->r.in.my_computername = state->my_netbios_name;
+ state->r.in.my_accountname = talloc_asprintf(state, "%s$", state->my_netbios_name);
+ if (tevent_req_nomem(state->r.in.my_accountname, state->req)) {
+ return;
+ }
+ state->r.in.account_control = ACB_WSTRUST;
+ state->r.in.domain_sid = state->domain_sid;
+ if (state->r.in.domain_sid == NULL) {
+ state->r.in.domain_sid = talloc_zero(state, struct dom_sid);
+ }
+
+ subreq = dcerpc_nbtd_getdcname_r_send(state, state->ev,
+ irpc_handle, &state->r);
+ if (tevent_req_nomem(subreq, state->req)) {
+ return;
+ }
+ tevent_req_set_callback(subreq, finddcs_nbt_getdc_replied, state);
+}
+
+/* Called when the GetDC request returns */
+static void finddcs_nbt_getdc_replied(struct tevent_req *subreq)
+{
+ struct finddcs_nbt_state *state =
+ tevent_req_callback_data(subreq,
+ struct finddcs_nbt_state);
+ NTSTATUS status;
+
+ status = dcerpc_nbtd_getdcname_r_recv(subreq, state);
+ TALLOC_FREE(subreq);
+ if (!NT_STATUS_IS_OK(status)) {
+ fallback_node_status(state);
+ return;
+ }
+
+ state->dcs[0].name = talloc_steal(state->dcs, state->r.out.dcname);
+ tevent_req_done(state->req);
+}
+
+/* The GetDC request might not be available (such as occours when the
+ * NBT server is down). Fallback to a node status. It is the best
+ * hope we have... */
+static void fallback_node_status(struct finddcs_nbt_state *state)
+{
+ struct nbt_name_socket *nbtsock;
+ struct nbt_name_request *name_req;
+
+ state->node_status.in.name.name = "*";
+ state->node_status.in.name.type = NBT_NAME_CLIENT;
+ state->node_status.in.name.scope = NULL;
+ state->node_status.in.dest_addr = state->dcs[0].address;
+ state->node_status.in.dest_port = state->nbt_port;
+ state->node_status.in.timeout = 1;
+ state->node_status.in.retries = 2;
+
+ nbtsock = nbt_name_socket_init(state, state->ev);
+ if (tevent_req_nomem(nbtsock, state->req)) {
+ return;
+ }
+
+ name_req = nbt_name_status_send(nbtsock, &state->node_status);
+ if (tevent_req_nomem(name_req, state->req)) {
+ return;
+ }
+
+ name_req->async.fn = fallback_node_status_replied;
+ name_req->async.private_data = state;
+}
+
+/* We have a node status reply (or perhaps a timeout) */
+static void fallback_node_status_replied(struct nbt_name_request *name_req)
+{
+ int i;
+ struct finddcs_nbt_state *state = talloc_get_type(name_req->async.private_data, struct finddcs_nbt_state);
+ NTSTATUS status;
+
+ status = nbt_name_status_recv(name_req, state, &state->node_status);
+ if (tevent_req_nterror(state->req, status)) {
+ return;
+ }
+
+ for (i=0; i < state->node_status.out.status.num_names; i++) {
+ int j;
+ if (state->node_status.out.status.names[i].type == NBT_NAME_SERVER) {
+ char *name = talloc_strndup(state->dcs, state->node_status.out.status.names[0].name, 15);
+ /* Strip space padding */
+ if (name) {
+ j = MIN(strlen(name), 15);
+ for (; j > 0 && name[j - 1] == ' '; j--) {
+ name[j - 1] = '\0';
+ }
+ }
+ state->dcs[0].name = name;
+ tevent_req_done(state->req);
+ return;
+ }
+ }
+ tevent_req_nterror(state->req, NT_STATUS_NO_LOGON_SERVERS);
+}
+
+NTSTATUS finddcs_nbt_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
+ int *num_dcs, struct nbt_dc_name **dcs)
+{
+ struct finddcs_nbt_state *state = tevent_req_data(req, struct finddcs_nbt_state);
+ bool ok;
+ NTSTATUS status;
+
+ ok = tevent_req_poll(req, state->ev);
+ if (!ok) {
+ talloc_free(req);
+ return NT_STATUS_INTERNAL_ERROR;
+ }
+ status = tevent_req_simple_recv_ntstatus(req);
+ if (NT_STATUS_IS_OK(status)) {
+ *num_dcs = state->num_dcs;
+ *dcs = talloc_steal(mem_ctx, state->dcs);
+ }
+ return status;
+}
+
+NTSTATUS finddcs_nbt(TALLOC_CTX *mem_ctx,
+ const char *my_netbios_name,
+ uint16_t nbt_port,
+ const char *domain_name, int name_type,
+ struct dom_sid *domain_sid,
+ struct resolve_context *resolve_ctx,
+ struct tevent_context *event_ctx,
+ struct imessaging_context *msg_ctx,
+ int *num_dcs, struct nbt_dc_name **dcs)
+{
+ NTSTATUS status;
+ struct tevent_req *req = finddcs_nbt_send(mem_ctx,
+ my_netbios_name,
+ nbt_port,
+ domain_name, name_type,
+ domain_sid,
+ resolve_ctx,
+ event_ctx, msg_ctx);
+ status = finddcs_nbt_recv(req, mem_ctx, num_dcs, dcs);
+ talloc_free(req);
+ return status;
+}
diff --git a/source4/scripting/python/samba/provision/__init__.py b/source4/scripting/python/samba/provision/__init__.py
index 0ec072c..c95db4e 100644
--- a/source4/scripting/python/samba/provision/__init__.py
+++ b/source4/scripting/python/samba/provision/__init__.py
@@ -591,7 +591,7 @@ def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
def make_smbconf(smbconf, hostname, domain, realm, targetdir,
- serverrole=None, sid_generator=None, eadb=False, use_ntvfs=False, lp=None,
+ serverrole=None, eadb=False, use_ntvfs=False, lp=None,
global_param=None):
"""Create a new smb.conf file based on a couple of basic settings.
"""
@@ -605,9 +605,6 @@ def make_smbconf(smbconf, hostname, domain, realm, targetdir,
if serverrole is None:
serverrole = "standalone server"
- if sid_generator is None:
- sid_generator = "internal"
-
assert domain is not None
domain = domain.upper()
@@ -1605,9 +1602,10 @@ def provision(logger, session_info, credentials, smbconf=None,
root=None, nobody=None, users=None, wheel=None, backup=None, aci=None,
serverrole=None, dom_for_fun_level=None,
backend_type=None, sitename=None,
- ol_mmr_urls=None, ol_olc=None, slapd_path=None,
+ ol_mmr_urls=None, ol_olc=None, slapd_path="/bin/false",
useeadb=False, am_rodc=False,
- lp=None, use_ntvfs=False):
+ lp=None, use_ntvfs=False,
+ use_rfc2307=False):
"""Provision samba4
:note: caution, this wipes all existing data!
@@ -1630,10 +1628,6 @@ def provision(logger, session_info, credentials, smbconf=None,
else:
domainsid = security.dom_sid(domainsid)
- sid_generator = "internal"
- if backend_type == "fedora-ds":
- sid_generator = "backend"
-
root_uid = findnss_uid([root or "root"])
nobody_uid = findnss_uid([nobody or "nobody"])
users_gid = findnss_gid([users or "users", 'users', 'other', 'staff'])
@@ -1655,6 +1649,9 @@ def provision(logger, session_info, credentials, smbconf=None,
server_services = []
global_param = {}
+ if use_rfc2307:
+ global_param["idmap_ldb:use rfc2307"] = ["yes"]
+
if dns_backend == "SAMBA_INTERNAL":
server_services.append("+dns")
@@ -1679,11 +1676,11 @@ def provision(logger, session_info, credentials, smbconf=None,
if data is None or data == "":
make_smbconf(smbconf, hostname, domain, realm,
targetdir, serverrole=serverrole,
- sid_generator=sid_generator, eadb=useeadb, use_ntvfs=use_ntvfs,
+ eadb=useeadb, use_ntvfs=use_ntvfs,
lp=lp, global_param=global_param)
else:
make_smbconf(smbconf, hostname, domain, realm, targetdir,
- serverrole=serverrole, sid_generator=sid_generator,
+ serverrole=serverrole,
eadb=useeadb, use_ntvfs=use_ntvfs, lp=lp, global_param=global_param)
if lp is None:
diff --git a/source4/scripting/python/samba/upgrade.py b/source4/scripting/python/samba/upgrade.py
index 09a52c1..3ef79ed 100644
--- a/source4/scripting/python/samba/upgrade.py
+++ b/source4/scripting/python/samba/upgrade.py
@@ -702,7 +702,7 @@ Please fix this account before attempting to upgrade again
dom_for_fun_level=dsdb.DS_DOMAIN_FUNCTION_2003,
hostname=netbiosname.lower(), machinepass=machinepass,
serverrole=serverrole, samdb_fill=FILL_FULL,
- useeadb=useeadb, dns_backend=dns_backend)
+ useeadb=useeadb, dns_backend=dns_backend, use_rfc2307=True)
result.report_logger(logger)
# Import WINS database
diff --git a/source4/setup/provision b/source4/setup/provision
index 32edff3..339b05e 100755
--- a/source4/setup/provision
+++ b/source4/setup/provision
@@ -122,8 +122,6 @@ parser.add_option("--targetdir", type="string", metavar="DIR",
help="Set target directory")
parser.add_option("--ol-mmr-urls", type="string", metavar="LDAPSERVER",
help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/ (where <PORT> has to be different than 389!) ] separated with comma (\",\") for use with OpenLDAP-MMR (Multi-Master-Replication), e.g.: \"ldap://s4dc1:9000,ldap://s4dc2:9000\"")
-parser.add_option("--slapd-path", type="string", metavar="SLAPD-PATH",
- help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
parser.add_option("--use-xattrs", type="choice", choices=["yes", "no", "auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities", default="auto")
parser.add_option("--use-ntvfs", action="store_true", help="Use NTVFS for the fileserver (default = no)")
@@ -259,7 +257,6 @@ try:
serverrole=opts.server_role, dom_for_fun_level=dom_for_fun_level,
backend_type=opts.ldap_backend_type,
ldapadminpass=opts.ldapadminpass, ol_mmr_urls=opts.ol_mmr_urls,
- slapd_path=opts.slapd_path,
useeadb=eadb, next_rid=opts.next_rid, lp=lp, use_ntvfs=(opts.use_ntvfs))
except ProvisioningError, e:
print str(e)
diff --git a/source4/setup/tests/blackbox_provision-backend.sh b/source4/setup/tests/blackbox_provision-backend.sh
index 96ff753..36395c3 100755
--- a/source4/setup/tests/blackbox_provision-backend.sh
--
Samba Shared Repository
More information about the samba-cvs
mailing list