[SCM] Samba Shared Repository - branch v4-3-test updated
Karolin Seeger
kseeger at samba.org
Tue Feb 2 14:34:04 UTC 2016
The branch, v4-3-test has been updated
via 3e600d6 s3: smbd: Fix timestamp rounding inside SMB2 create.
via 830f003 smbd: show correct disk size for different quota and dfree block sizes
via 67db303 s3:utils/smbget fix recursive download
via 155d821 waf: Only build smb_krb5_wrapper if we have CUPS
via 2b218c3 s3-client: Add a KRB5 wrapper for smbspool
from 756b452 s3-parm: clean up defaults when removing global parameters
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-3-test
- Log -----------------------------------------------------------------
commit 3e600d61134ddfdcc3db9807b2b7e191a0b29805
Author: Jeremy Allison <jra at samba.org>
Date: Thu Jan 28 16:35:13 2016 -0800
s3: smbd: Fix timestamp rounding inside SMB2 create.
Setting "dos filetime resolution = yes" should round
to 2 second increments. Fix missing path inside smbd.
Fix confirmed by reporter Hubert Gilch <hg at sepag.de>.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11703
Signed-off-by: Jeremy Allison <jra at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Fri Jan 29 10:41:01 CET 2016 on sn-devel-144
(cherry picked from commit 8024f532e6bcb6cbd8179817fafdd0f12929d629)
Autobuild-User(v4-3-test): Karolin Seeger <kseeger at samba.org>
Autobuild-Date(v4-3-test): Tue Feb 2 15:33:08 CET 2016 on sn-devel-104
commit 830f003c866f319249f5c6e06936201b13f085b0
Author: Uri Simchoni <uri at samba.org>
Date: Tue Jan 19 14:57:16 2016 +0200
smbd: show correct disk size for different quota and dfree block sizes
When file system stats (VFS disk_free_fn) and quota (VFS get_quota_fn)
return different block sizes, normalize values before comparing.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11681
Signed-off-by: Uri Simchoni <uri at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 67c89715d00abc588239d8220f09cf51a58db05a)
commit 67db3036a0518b52ad97fc480b5cc4157dd90740
Author: Christian Ambach <ambi at samba.org>
Date: Wed Dec 30 21:25:13 2015 +0100
s3:utils/smbget fix recursive download
get_auth_data is called multiple times (once for the directory listing and then
for every file to be downloaded). Save the obtained values across multiple calls
to make smbclient use the correct username for each download.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=6482
Signed-off-by: Christian Ambach <ambi at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
(cherry picked from commit ec802d27ce4dc6dd9b5e5ebd6992f90364d855a2)
commit 155d821b7baa511bb723f1ecc61cf0736b1762d0
Author: Andreas Schneider <asn at samba.org>
Date: Tue Jan 26 11:28:50 2016 +0100
waf: Only build smb_krb5_wrapper if we have CUPS
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Michael Adam <obnox at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 192f1516c378ae942d14921bfcc1e11173da36e6)
commit 2b218c3b9707ff98114762ad1dc81da0984050ec
Author: Andreas Schneider <asn at cryptomilk.org>
Date: Tue Jan 12 15:17:22 2016 +0100
s3-client: Add a KRB5 wrapper for smbspool
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11690
We need a wrapper for smbspool to be able to authenticate with Kerberos.
This needs to replace the cups smb backend. The permission need to be
0700 and the owner root.
Note that Kerberos support is broken in CUPS 2.1.2 maybe earlier
versions. It works with 1.6.3.
Signed-off-by: Andreas Schneider <asn at cryptomilk.org>
Reviewed-by: Michael Adam <obnox at samba.org>
Reviewed-by: Guenther Deschner <gd at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
Autobuild-User(master): Andreas Schneider <asn at cryptomilk.org>
Autobuild-Date(master): Mon Jan 25 19:58:46 CET 2016 on sn-devel-144
(cherry picked from commit 62c68bd8c8f7a7e057e38a461707f1c195e62df0)
-----------------------------------------------------------------------
Summary of changes:
source3/client/README.smbspool | 17 +++
source3/client/smbspool_krb5_wrapper.c | 210 +++++++++++++++++++++++++++++++++
source3/smbd/dfree.c | 9 +-
source3/smbd/smb2_create.c | 8 ++
source3/utils/smbget.c | 15 ++-
source3/wscript_build | 8 ++
6 files changed, 265 insertions(+), 2 deletions(-)
create mode 100644 source3/client/README.smbspool
create mode 100644 source3/client/smbspool_krb5_wrapper.c
Changeset truncated at 500 lines:
diff --git a/source3/client/README.smbspool b/source3/client/README.smbspool
new file mode 100644
index 0000000..f73167a6
--- /dev/null
+++ b/source3/client/README.smbspool
@@ -0,0 +1,17 @@
+smbspool
+=========
+
+smbspool is a very small print spooling program that sends a print file to an
+SMB printer. The command-line arguments are position-dependent for
+compatibility with the CUPS.
+
+For printing support with Kerberos, CUPS 1.5+ needs a wrapper for the backend
+which sets the correct location of the Kerberos credential cache.
+
+smbspool_krb5_wrapper
+======================
+
+This tool can be used to print using Kerberos credentials. To get this working
+smbspool_krb5_wrapper needs to be the smb backend of CUPS. It needs to be owned
+by root and the permissions for the binary need to be 0700. Once
+smbspool_krb5_wrapper switched to the user trying to print it executes smbspool.
diff --git a/source3/client/smbspool_krb5_wrapper.c b/source3/client/smbspool_krb5_wrapper.c
new file mode 100644
index 0000000..e19fd92
--- /dev/null
+++ b/source3/client/smbspool_krb5_wrapper.c
@@ -0,0 +1,210 @@
+/*
+ * Unix SMB/CIFS implementation.
+ *
+ * CUPS printing backend helper to execute smbspool
+ *
+ * Copyright (C) 2010-2011 Andreas Schneider <asn at samba.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+#include "system/filesys.h"
+#include "system/passwd.h"
+
+#include <errno.h>
+#include <string.h>
+
+#include <cups/backend.h>
+
+#include "dynconfig/dynconfig.h"
+
+enum cups_smb_dbglvl_e {
+ CUPS_SMB_LOG_DEBUG = 0,
+ CUPS_SMB_LOG_ERROR,
+};
+static void cups_smb_debug(enum cups_smb_dbglvl_e lvl, const char *format, ...);
+
+#define CUPS_SMB_DEBUG(...) cups_smb_debug(CUPS_SMB_LOG_DEBUG, __VA_ARGS__)
+#define CUPS_SMB_ERROR(...) cups_smb_debug(CUPS_SMB_LOG_DEBUG, __VA_ARGS__)
+
+static void cups_smb_debug(enum cups_smb_dbglvl_e lvl, const char *format, ...)
+{
+ const char *prefix = "DEBUG";
+ char buffer[1024];
+ va_list va;
+
+ va_start(va, format);
+ vsnprintf(buffer, sizeof(buffer), format, va);
+ va_end(va);
+
+ switch (lvl) {
+ case CUPS_SMB_LOG_DEBUG:
+ prefix = "DEBUG";
+ break;
+ case CUPS_SMB_LOG_ERROR:
+ prefix = "ERROR";
+ break;
+ }
+
+ fprintf(stderr,
+ "%s: SMBSPOOL_KRB5 - %s\n",
+ prefix,
+ buffer);
+}
+
+/*
+ * This is a helper binary to execute smbspool.
+ *
+ * It needs to be installed or symlinked as:
+ * /usr/lib/cups/backend/smb
+ *
+ * The permissions of the binary need to be set to 0700 so that it is executed
+ * as root. The binary switches to the user which is passed via the environment
+ * variable AUTH_UID, so we can access the kerberos ticket.
+ */
+int main(int argc, char *argv[])
+{
+ char smbspool_cmd[PATH_MAX] = {0};
+ struct passwd *pwd;
+ char gen_cc[PATH_MAX] = {0};
+ struct stat sb;
+ char *env;
+ uid_t uid = (uid_t)-1;
+ gid_t gid = (gid_t)-1;
+ unsigned long tmp;
+ int cmp;
+ int rc;
+
+ uid = getuid();
+
+ CUPS_SMB_DEBUG("Started with uid=%d\n", uid);
+ if (uid != 0) {
+ goto smbspool;
+ }
+
+ /* Check if AuthInfoRequired is set to negotiate */
+ env = getenv("AUTH_INFO_REQUIRED");
+ if (env == NULL) {
+ CUPS_SMB_ERROR("AUTH_INFO_REQUIRED is not set");
+ fprintf(stderr, "ATTR: auth-info-required=negotiate\n");
+ return CUPS_BACKEND_AUTH_REQUIRED;
+ }
+
+ CUPS_SMB_DEBUG("AUTH_INFO_REQUIRED=%s", env);
+ cmp = strcmp(env, "negotiate");
+ if (cmp != 0) {
+ CUPS_SMB_ERROR("AUTH_INFO_REQUIRED is not set to negotiate");
+ fprintf(stderr, "ATTR: auth-info-required=negotiate\n");
+ return CUPS_BACKEND_AUTH_REQUIRED;
+ }
+
+ /*
+ * AUTH_UID gets only set if we have an incoming connection over the
+ * CUPS unix domain socket.
+ */
+ env = getenv("AUTH_UID");
+ if (env == NULL) {
+ CUPS_SMB_ERROR("AUTH_UID is not set");
+ fprintf(stderr, "ATTR: auth-info-required=negotiate\n");
+ return CUPS_BACKEND_AUTH_REQUIRED;
+ }
+
+ if (strlen(env) > 10) {
+ CUPS_SMB_ERROR("Invalid AUTH_UID");
+ return CUPS_BACKEND_FAILED;
+ }
+
+ errno = 0;
+ tmp = strtoul(env, NULL, 10);
+ if (errno != 0 || tmp >= UINT32_MAX) {
+ CUPS_SMB_ERROR("Failed to convert AUTH_UID=%s", env);
+ return CUPS_BACKEND_FAILED;
+ }
+ uid = (uid_t)tmp;
+
+ pwd = getpwuid(uid);
+ if (pwd == NULL) {
+ CUPS_SMB_ERROR("Failed to find system user: %u - %s",
+ uid, strerror(errno));
+ return CUPS_BACKEND_FAILED;
+ }
+ gid = pwd->pw_gid;
+
+ rc = setgroups(0, NULL);
+ if (rc != 0) {
+ CUPS_SMB_ERROR("Failed to clear groups - %s",
+ strerror(errno));
+ return CUPS_BACKEND_FAILED;
+ }
+
+ CUPS_SMB_DEBUG("Switching to gid=%d", gid);
+ rc = setgid(gid);
+ if (rc != 0) {
+ CUPS_SMB_ERROR("Failed to switch to gid=%u",
+ gid,
+ strerror(errno));
+ return CUPS_BACKEND_FAILED;
+ }
+
+ CUPS_SMB_DEBUG("Switching to uid=%u", uid);
+ rc = setuid(uid);
+ if (rc != 0) {
+ CUPS_SMB_ERROR("Failed to switch to uid=%u",
+ uid,
+ strerror(errno));
+ return CUPS_BACKEND_FAILED;
+ }
+
+ snprintf(gen_cc, sizeof(gen_cc), "/tmp/krb5cc_%d", uid);
+
+ rc = lstat(gen_cc, &sb);
+ if (rc == 0) {
+ snprintf(gen_cc, sizeof(gen_cc), "FILE:/tmp/krb5cc_%d", uid);
+ } else {
+ snprintf(gen_cc, sizeof(gen_cc), "/run/user/%d/krb5cc", uid);
+
+ rc = lstat(gen_cc, &sb);
+ if (rc == 0 && S_ISDIR(sb.st_mode)) {
+ snprintf(gen_cc,
+ sizeof(gen_cc),
+ "DIR:/run/user/%d/krb5cc",
+ uid);
+ } else {
+#if defined(__linux__)
+ snprintf(gen_cc,
+ sizeof(gen_cc),
+ "KEYRING:persistent:%d",
+ uid);
+#endif
+ }
+ }
+
+ /*
+ * Make sure we do not have LD_PRELOAD or other security relevant
+ * environment variables set.
+ */
+ clearenv();
+
+ CUPS_SMB_DEBUG("Setting KRB5CCNAME to '%s'", gen_cc);
+ setenv("KRB5CCNAME", gen_cc, 1);
+
+smbspool:
+ snprintf(smbspool_cmd,
+ sizeof(smbspool_cmd),
+ "%s/smbspool",
+ get_dyn_BINDIR());
+
+ return execv(smbspool_cmd, argv);
+}
diff --git a/source3/smbd/dfree.c b/source3/smbd/dfree.c
index 32a3a69..0c38837 100644
--- a/source3/smbd/dfree.c
+++ b/source3/smbd/dfree.c
@@ -123,7 +123,14 @@ uint64_t sys_disk_free(connection_struct *conn, const char *path,
}
if (disk_quotas(path, &bsize_q, &dfree_q, &dsize_q)) {
- (*bsize) = bsize_q;
+ uint64_t min_bsize = MIN(*bsize, bsize_q);
+
+ (*dfree) = (*dfree) * (*bsize) / min_bsize;
+ (*dsize) = (*dsize) * (*bsize) / min_bsize;
+ dfree_q = dfree_q * bsize_q / min_bsize;
+ dsize_q = dsize_q * bsize_q / min_bsize;
+
+ (*bsize) = min_bsize;
(*dfree) = MIN(*dfree,dfree_q);
(*dsize) = MIN(*dsize,dsize_q);
}
diff --git a/source3/smbd/smb2_create.c b/source3/smbd/smb2_create.c
index ad21533..76d6d69 100644
--- a/source3/smbd/smb2_create.c
+++ b/source3/smbd/smb2_create.c
@@ -1281,6 +1281,14 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
state->out_last_write_ts = result->fsp_name->st.st_ex_mtime;
state->out_change_ts = get_change_timespec(smb1req->conn,
result, result->fsp_name);
+
+ if (lp_dos_filetime_resolution(SNUM(smb2req->tcon->compat))) {
+ dos_filetime_timespec(&state->out_creation_ts);
+ dos_filetime_timespec(&state->out_last_access_ts);
+ dos_filetime_timespec(&state->out_last_write_ts);
+ dos_filetime_timespec(&state->out_change_ts);
+ }
+
state->out_allocation_size =
SMB_VFS_GET_ALLOC_SIZE(smb1req->conn, result,
&(result->fsp_name->st));
diff --git a/source3/utils/smbget.c b/source3/utils/smbget.c
index c3eb471..127d6b1 100644
--- a/source3/utils/smbget.c
+++ b/source3/utils/smbget.c
@@ -91,10 +91,18 @@ static void human_readable(off_t s, char *buffer, int l)
static void get_auth_data(const char *srv, const char *shr, char *wg, int wglen, char *un, int unlen, char *pw, int pwlen)
{
static char hasasked = 0;
+ static char *savedwg;
+ static char *savedun;
+ static char *savedpw;
char *wgtmp, *usertmp;
char tmp[128];
- if(hasasked) return;
+ if (hasasked) {
+ strncpy(wg, savedwg, wglen - 1);
+ strncpy(un, savedun, unlen - 1);
+ strncpy(pw, savedpw, pwlen - 1);
+ return;
+ }
hasasked = 1;
if(!nonprompt && !username) {
@@ -119,6 +127,11 @@ static void get_auth_data(const char *srv, const char *shr, char *wg, int wglen,
if(workgroup)strncpy(wg, workgroup, wglen-1);
+ /* save the values found for later */
+ savedwg = SMB_STRDUP(wg);
+ savedun = SMB_STRDUP(un);
+ savedpw = SMB_STRDUP(pw);
+
wgtmp = SMB_STRNDUP(wg, wglen);
usertmp = SMB_STRNDUP(un, unlen);
if(!quiet)printf("Using workgroup %s, %s%s\n", wgtmp, *usertmp?"user ":"guest user", usertmp);
diff --git a/source3/wscript_build b/source3/wscript_build
index c0296c0..ba670d3 100755
--- a/source3/wscript_build
+++ b/source3/wscript_build
@@ -1186,6 +1186,14 @@ bld.SAMBA3_BINARY('smbspool',
libsmb
samba3core''')
+bld.SAMBA3_BINARY('smbspool_krb5_wrapper',
+ source='client/smbspool_krb5_wrapper.c',
+ deps='''
+ DYNCONFIG
+ cups
+ ''',
+ enabled=bld.CONFIG_SET('HAVE_CUPS'))
+
bld.SAMBA3_BINARY('testparm',
source='utils/testparm.c',
deps='''
--
Samba Shared Repository
More information about the samba-cvs
mailing list