[SCM] Samba Shared Repository - branch v4-13-stable updated
Stefan Metzmacher
metze at samba.org
Fri Sep 18 08:28:31 UTC 2020
The branch, v4-13-stable has been updated
via f5fd34cced9 VERSION: Disable GIT_SNAPSHOT for the 4.13.0rc5 release.
via a0074cacc4a WHATSNEW: Add release notes for Samba 4.13.0rc5.
via 47e446f3f7c waf: Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14
via 8bd284a5b36 s3:smbd: Fix %U substitutions if it contains a domain name
via 90835ba1c35 s3:tests: Add test for 'valid users = DOMAIN\%U'
via 7a9537a3ad8 Revert "Add vfs_ring."
via d61eb49180f Revert "vfs_ring: Adapt to 4.13 VFS"
via b3845522bec WHATSNEW: Announce the end of Python 2.6/2.7 support to build Samba
via a0c9e2e4907 s3:libads: Also add a realm entry for the domain name
via 41f9aef217f s3:libads: Only add RC4 if weak crypto is allowed
via 3e145fef4f9 s3:libads: Remove DES legacy types for Kerberos
via 88a31703a2d lib/replace: move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE
via 191c2cd7b93 vfs_ring: Adapt to 4.13 VFS
via b29103ef46a Add vfs_ring.
via 99d555f772a VERSION: Bump version up to 4.13.0rc5...
via caa4cf52000 VERSION: Disable GIT_SNAPSHOT for the 4.13.0rc4 release.
via 29e15b80541 WHATSNEW: Add release notes for Samba 4.13.0rc4.
via be07e26807b build: toggle vfs_snapper using --with-shared-modules
via df1ff55deb9 s3:share_mode_lock: remove unused reproducer for bug #14428
via 0a682a18986 s3:share_mode_lock: make sure share_mode_cleanup_disconnected() removes the record
via b83efaec198 s3:share_mode_lock: add missing 'goto done' in share_mode_cleanup_disconnected()
via 8a8b90eba76 s3:share_mode_lock: consistently debug share_mode_entry records
via 4aa4f12f533 s3:share_mode_lock: let share_mode_forall_entries/share_entry_forall evaluate e.stale first
via e62a37e9748 s3:share_mode_lock: reproduce problem with stale disconnected share mode entries
via 431192896a2 s3:selftest: also run durable_v2_reconnect_delay_msec in samba3.blackbox.durable_v2_delay
via 1549dc56280 tldap: Receiving "msgid == 0" means the connection is dead
via c785fc601de test: Test winbind idmap_ad ticket expiry behaviour
via 725dda2b809 idmap_ad: Pass tldap debug messages on to DEBUG()
via 4a4af2c2534 tldap: Add PRINTF_ATTRIBUTE declaration to tldap_debug()
via 4f695a62055 tldap: Make sure all requests are cancelled on rundown
via 468286f4c8a tldap: Centralize connection rundown on error
via 4b02185ecc1 tldap: Maintain the ldap read request in tldap_context
via a3758fa56ec tldap: Always remove ourselves from ld->pending at cleanup time
via 73deb8332a5 tldap: Fix tldap_msg_received()
via 67676bc4f5e tldap: Only free() ld->pending if "req" is part of it
via 3824ce0de3b ldap_server: Terminate LDAP connections on krb ticket expiry
via caf9cfa8653 ldap_server: Add the krb5 expiry to conn->limits
via 6179ac98e6f torture: Test ldap session expiry
via fa74a0a2f66 build: Wrap a long line
via 04630942058 VERSION: Bump version up to 4.13.0rc4...
from f5f22da6b8e VERSION: Disable GIT_SNAPSHOT for the 4.13.0rc3 release.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-13-stable
- Log -----------------------------------------------------------------
-----------------------------------------------------------------------
Summary of changes:
VERSION | 2 +-
WHATSNEW.txt | 46 ++++++-
lib/replace/wscript | 3 +
nsswitch/tests/test_ticket_expiry.sh | 74 +++++++++++
selftest/target/Samba3.pm | 5 +
selftest/target/Samba4.pm | 6 +-
source3/lib/tldap.c | 146 ++++++++++++++-------
source3/libads/kerberos.c | 11 +-
source3/locking/share_mode_lock.c | 104 ++++++++++++---
.../script/tests/test_durable_handle_reconnect.sh | 12 ++
source3/script/tests/test_substitutions.sh | 5 +
source3/selftest/tests.py | 5 +
source3/smbd/share_access.c | 18 ++-
source3/winbindd/idmap_ad.c | 36 +++++
source3/wscript | 27 ++--
source4/heimdal_build/wscript_build | 7 +-
source4/ldap_server/ldap_backend.c | 37 ++++++
source4/ldap_server/ldap_bind.c | 15 +++
source4/ldap_server/ldap_server.c | 66 ++++++++++
source4/ldap_server/ldap_server.h | 2 +
source4/selftest/tests.py | 4 +
source4/torture/ldap/common.c | 2 +
source4/torture/ldap/session_expiry.c | 121 +++++++++++++++++
source4/torture/wscript_build | 13 +-
wscript_configure_system_gnutls | 5 +-
25 files changed, 674 insertions(+), 98 deletions(-)
create mode 100755 nsswitch/tests/test_ticket_expiry.sh
create mode 100644 source4/torture/ldap/session_expiry.c
Changeset truncated at 500 lines:
diff --git a/VERSION b/VERSION
index 2d5192ae9fa..7f954aee9e0 100644
--- a/VERSION
+++ b/VERSION
@@ -87,7 +87,7 @@ SAMBA_VERSION_PRE_RELEASE=
# e.g. SAMBA_VERSION_RC_RELEASE=1 #
# -> "3.0.0rc1" #
########################################################
-SAMBA_VERSION_RC_RELEASE=3
+SAMBA_VERSION_RC_RELEASE=5
########################################################
# To mark SVN snapshots this should be set to 'yes' #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 81d9300df94..467d4c0dfc5 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,7 +1,7 @@
Release Announcements
=====================
-This is the third release condidate of Samba 4.13. This is *not*
+This is the fifth release condidate of Samba 4.13. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.
@@ -16,16 +16,22 @@ UPGRADING
NEW FEATURES/CHANGES
====================
-Python 3.6 Required
--------------------
+Python 3.6 or later required
+----------------------------
Samba's minimum runtime requirement for python was raised to Python
3.5 with samba 4.12. Samba 4.13 raises this minimum version to Python
3.6 both to access new features and because this is the oldest version
we test with in our CI infrastructure.
-(Build time support for the file server with Python 2.6 has not
-changed)
+This is also the last release where it will be possible to build Samba
+(just the file server) with Python versions 2.6 and 2.7.
+
+As Python 2.7 has been End Of Life upstream since April 2020, Samba
+is dropping ALL Python 2.x support in the NEXT release.
+
+Samba 4.14 to be released in March 2021 will require Python 3.6 or
+later to build.
wide links functionality
------------------------
@@ -87,6 +93,36 @@ smb.conf changes
client use spnego Deprecated yes
+CHANGES SINCE 4.13.0rc4
+=======================
+
+o Andreas Schneider <asn at samba.org>
+ * BUG 14399: waf: Only use gnutls_aead_cipher_encryptv2() for GnuTLS >
+ 3.6.14.
+ * BUG 14467: s3:smbd: Fix %U substitutions if it contains a domain name.
+ * BUG 14479: The created krb5.conf for 'net ads join' doesn't have a domain
+ entry.
+
+o Stefan Metzmacher <metze at samba.org>
+ * BUG 14482: Fix build problem if libbsd-dev is not installed.
+
+
+CHANGES SINCE 4.13.0rc3
+=======================
+
+o David Disseldorp <ddiss at samba.org>
+ * BUG 14437: build: Toggle vfs_snapper using "--with-shared-modules".
+
+o Volker Lendecke <vl at samba.org>
+ * BUG 14465: idmap_ad does not deal properly with a RFC4511 section 4.4.1
+ response.
+
+o Stefan Metzmacher <metze at samba.org>
+ * BUG 14428: PANIC: Assert failed in get_lease_type().
+ * BUG 14465: idmap_ad does not deal properly with a RFC4511 section 4.4.1
+ response.
+
+
CHANGES SINCE 4.13.0rc2
=======================
diff --git a/lib/replace/wscript b/lib/replace/wscript
index 55c8903f1c8..64f305d6df0 100644
--- a/lib/replace/wscript
+++ b/lib/replace/wscript
@@ -876,6 +876,9 @@ def build(bld):
if bld.CONFIG_SET('HAVE_LIBRT'): extra_libs += ' rt'
if bld.CONFIG_SET('REPLACE_REQUIRES_LIBSOCKET_LIBNSL'): extra_libs += ' socket nsl'
+ if not bld.CONFIG_SET('HAVE_CLOSEFROM'):
+ REPLACE_HOSTCC_SOURCE += ' closefrom.c'
+
bld.SAMBA_SUBSYSTEM('LIBREPLACE_HOSTCC',
REPLACE_HOSTCC_SOURCE,
use_hostcc=True,
diff --git a/nsswitch/tests/test_ticket_expiry.sh b/nsswitch/tests/test_ticket_expiry.sh
new file mode 100755
index 00000000000..3b98b0fe87a
--- /dev/null
+++ b/nsswitch/tests/test_ticket_expiry.sh
@@ -0,0 +1,74 @@
+#!/bin/sh
+# Test winbind ad backend behaviour when the kerberos ticket expires
+
+if [ $# -ne 1 ]; then
+ echo Usage: $0 DOMAIN
+ exit 1
+fi
+
+DOMAIN="$1"
+
+wbinfo="$VALGRIND $BINDIR/wbinfo"
+net="$VALGRIND $BINDIR/net"
+
+failed=0
+
+. `dirname $0`/../../testprogs/blackbox/subunit.sh
+
+DOMAIN_SID=$($wbinfo -n "$DOMAIN/" | cut -f 1 -d " ")
+if [ $? -ne 0 ] ; then
+ echo "Could not find domain SID" | subunit_fail_test "test_idmap_ad"
+ exit 1
+fi
+ADMINS_SID="$DOMAIN_SID-512"
+
+# Previous tests might have put in a mapping
+$net cache del IDMAP/SID2XID/"$ADMINS_SID"
+
+# Trigger a winbind ad connection with a 5-second ticket lifetime,
+# see the smb.conf for the ad_member_idmap_ad environment we're in
+#
+# We expect failure here because there are no mappings in AD. In this
+# test we are only interested in the winbind LDAP connection as such,
+# we don't really care whether idmap_ad works fine. This is done in
+# different tests. And a negative lookup also triggers the LDAP
+# connection.
+
+testit_expect_failure "Deleting0 IDMAP/SID2XID/$ADMINS_SID" $net cache del IDMAP/SID2XID/"$ADMINS_SID" ||
+ failed=$(expr $failed + 1)
+
+testit_expect_failure "Expecting failure1, no mapping in AD" $wbinfo --sid-to-gid "$ADMINS_SID" ||
+ failed=$(expr $failed + 1)
+
+testit "Deleting1 IDMAP/SID2XID/$ADMINS_SID" $net cache del IDMAP/SID2XID/"$ADMINS_SID" ||
+ failed=$(expr $failed + 1)
+
+# allow our kerberos ticket to expire
+testit "Sleeping for 6 seconds" sleep 6 || failed=$(expr $failed + 1)
+
+# Try again, check how long it took to recover from ticket expiry
+#
+# On the LDAP connection two things happen: First we get an
+# unsolicited exop response telling us the network session was
+# abandoned, and secondly the LDAP server will kill the TCP
+# connection. Our ldap server is configured to defer the TCP
+# disconnect by 10 seconds. We need to make sure that winbind already
+# reacts to the unsolicited exop reply, discarding the connection. The
+# only way is to make sure the following wbinfo does not take too
+# long.
+
+# We need to do the test command in this funny way as on gitlab we're
+# using the bash builtin
+
+START=$(date +%s)
+testit_expect_failure "Expecting failure2, no mapping in AD" $wbinfo --sid-to-gid "$ADMINS_SID" ||
+ failed=$(expr $failed + 1)
+END=$(date +%s)
+DURATION=$(expr $END - $START)
+testit "timeout DURATION[$DURATION] < 8" test "$DURATION" -le 8 ||
+ failed=$(expr $failed + 1)
+
+testit "Deleting2 IDMAP/SID2XID/$ADMINS_SID" $net cache del IDMAP/SID2XID/"$ADMINS_SID" ||
+ failed=$(expr $failed + 1)
+
+exit $failed
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 79feaa188ed..0a8cefa811d 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -714,6 +714,10 @@ sub provision_ad_member
path = $share_dir/D_%D/u_%u/g_%g
writeable = yes
+[sub_valid_users]
+ path = $share_dir
+ valid users = ADDOMAIN/%U
+
";
my $ret = $self->provision(
@@ -1057,6 +1061,7 @@ sub setup_ad_member_idmap_ad
idmap config $dcvars->{DOMAIN} : range = 2000000-2999999
idmap config $dcvars->{TRUST_DOMAIN} : backend = ad
idmap config $dcvars->{TRUST_DOMAIN} : range = 2000000-2999999
+ gensec_gssapi:requested_life_time = 5
";
my $ret = $self->provision(
diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 88c95c3a078..649e923ff9a 100755
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -1728,7 +1728,11 @@ sub provision_fl2008r2dc($$$)
my ($self, $prefix, $dcvars) = @_;
print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
- my $extra_conf_options = "ldap server require strong auth = no";
+ my $extra_conf_options = "
+ ldap server require strong auth = no
+ # delay by 10 seconds, 10^7 usecs
+ ldap_server:delay_expire_disconnect = 10000
+";
my $extra_provision_options = ["--base-schema=2008_R2"];
my $ret = $self->provision($prefix,
"domain controller",
diff --git a/source3/lib/tldap.c b/source3/lib/tldap.c
index bf5fc05d785..0e39a307728 100644
--- a/source3/lib/tldap.c
+++ b/source3/lib/tldap.c
@@ -29,6 +29,7 @@
#include "../lib/util/tevent_unix.h"
static TLDAPRC tldap_simple_recv(struct tevent_req *req);
+static bool tldap_msg_set_pending(struct tevent_req *req);
#define TEVENT_TLDAP_RC_MAGIC (0x87bcd26e)
@@ -83,10 +84,10 @@ struct tldap_ctx_attribute {
struct tldap_context {
int ld_version;
struct tstream_context *conn;
- bool server_down;
int msgid;
struct tevent_queue *outgoing;
struct tevent_req **pending;
+ struct tevent_req *read_req;
/* For the sync wrappers we need something like get_last_error... */
struct tldap_message *last_msg;
@@ -132,6 +133,11 @@ void tldap_set_debug(struct tldap_context *ld,
ld->log_private = log_private;
}
+static void tldap_debug(
+ struct tldap_context *ld,
+ enum tldap_debug_level level,
+ const char *fmt, ...) PRINTF_ATTRIBUTE(3,4);
+
static void tldap_debug(struct tldap_context *ld,
enum tldap_debug_level level,
const char *fmt, ...)
@@ -185,10 +191,22 @@ struct tldap_context *tldap_context_create(TALLOC_CTX *mem_ctx, int fd)
bool tldap_connection_ok(struct tldap_context *ld)
{
+ int ret;
+
if (ld == NULL) {
return false;
}
- return !ld->server_down;
+
+ if (ld->conn == NULL) {
+ return false;
+ }
+
+ ret = tstream_pending_bytes(ld->conn);
+ if (ret == -1) {
+ return false;
+ }
+
+ return true;
}
static size_t tldap_pending_reqs(struct tldap_context *ld)
@@ -424,6 +442,43 @@ static bool tldap_push_controls(struct asn1_data *data,
return asn1_pop_tag(data); /* ASN1_CONTEXT(0) */
}
+#define tldap_context_disconnect(ld, status) \
+ _tldap_context_disconnect(ld, status, __location__)
+
+static void _tldap_context_disconnect(struct tldap_context *ld,
+ TLDAPRC status,
+ const char *location)
+{
+ if (ld->conn == NULL) {
+ /*
+ * We don't need to tldap_debug() on
+ * a potential 2nd run.
+ *
+ * The rest of the function would just
+ * be a noop for the 2nd run anyway.
+ */
+ return;
+ }
+
+ tldap_debug(ld, TLDAP_DEBUG_WARNING,
+ "tldap_context_disconnect: %s at %s\n",
+ tldap_rc2string(status),
+ location);
+ tevent_queue_stop(ld->outgoing);
+ TALLOC_FREE(ld->read_req);
+ TALLOC_FREE(ld->conn);
+
+ while (talloc_array_length(ld->pending) > 0) {
+ struct tevent_req *req = NULL;
+ struct tldap_msg_state *state = NULL;
+
+ req = ld->pending[0];
+ state = tevent_req_data(req, struct tldap_msg_state);
+ tevent_req_defer_callback(req, state->ev);
+ tevent_req_ldap_error(req, status);
+ }
+}
+
static void tldap_msg_sent(struct tevent_req *subreq);
static void tldap_msg_received(struct tevent_req *subreq);
@@ -437,6 +492,7 @@ static struct tevent_req *tldap_msg_send(TALLOC_CTX *mem_ctx,
struct tevent_req *req, *subreq;
struct tldap_msg_state *state;
DATA_BLOB blob;
+ bool ok;
tldap_debug(ld, TLDAP_DEBUG_TRACE, "tldap_msg_send: sending msg %d\n",
id);
@@ -449,7 +505,8 @@ static struct tevent_req *tldap_msg_send(TALLOC_CTX *mem_ctx,
state->ev = ev;
state->id = id;
- if (state->ld->server_down) {
+ ok = tldap_connection_ok(ld);
+ if (!ok) {
tevent_req_ldap_error(req, TLDAP_SERVER_DOWN);
return tevent_req_post(req, ev);
}
@@ -470,6 +527,11 @@ static struct tevent_req *tldap_msg_send(TALLOC_CTX *mem_ctx,
return tevent_req_post(req, ev);
}
+ if (!tldap_msg_set_pending(req)) {
+ tevent_req_oom(req);
+ return tevent_req_post(req, ev);;
+ }
+
state->iov.iov_base = (void *)blob.data;
state->iov.iov_len = blob.length;
@@ -492,11 +554,6 @@ static void tldap_msg_unset_pending(struct tevent_req *req)
tevent_req_set_cleanup_fn(req, NULL);
- if (num_pending == 1) {
- TALLOC_FREE(ld->pending);
- return;
- }
-
for (i=0; i<num_pending; i++) {
if (req == ld->pending[i]) {
break;
@@ -511,6 +568,11 @@ static void tldap_msg_unset_pending(struct tevent_req *req)
return;
}
+ if (num_pending == 1) {
+ TALLOC_FREE(ld->pending);
+ return;
+ }
+
/*
* Remove ourselves from the cli->pending array
*/
@@ -529,14 +591,7 @@ static void tldap_msg_unset_pending(struct tevent_req *req)
static void tldap_msg_cleanup(struct tevent_req *req,
enum tevent_req_state req_state)
{
- switch (req_state) {
- case TEVENT_REQ_USER_ERROR:
- case TEVENT_REQ_RECEIVED:
- tldap_msg_unset_pending(req);
- return;
- default:
- return;
- }
+ tldap_msg_unset_pending(req);
}
static bool tldap_msg_set_pending(struct tevent_req *req)
@@ -546,7 +601,6 @@ static bool tldap_msg_set_pending(struct tevent_req *req)
struct tldap_context *ld;
struct tevent_req **pending;
int num_pending;
- struct tevent_req *subreq;
ld = state->ld;
num_pending = tldap_pending_reqs(ld);
@@ -560,7 +614,7 @@ static bool tldap_msg_set_pending(struct tevent_req *req)
ld->pending = pending;
tevent_req_set_cleanup_fn(req, tldap_msg_cleanup);
- if (num_pending > 0) {
+ if (ld->read_req != NULL) {
return true;
}
@@ -568,12 +622,12 @@ static bool tldap_msg_set_pending(struct tevent_req *req)
* We're the first one, add the read_ldap request that waits for the
* answer from the server
*/
- subreq = read_ldap_send(ld->pending, state->ev, ld->conn);
- if (subreq == NULL) {
+ ld->read_req = read_ldap_send(ld->pending, state->ev, ld->conn);
+ if (ld->read_req == NULL) {
tldap_msg_unset_pending(req);
return false;
}
- tevent_req_set_callback(subreq, tldap_msg_received, ld);
+ tevent_req_set_callback(ld->read_req, tldap_msg_received, ld);
return true;
}
@@ -589,13 +643,7 @@ static void tldap_msg_sent(struct tevent_req *subreq)
nwritten = tstream_writev_queue_recv(subreq, &err);
TALLOC_FREE(subreq);
if (nwritten == -1) {
- state->ld->server_down = true;
- tevent_req_ldap_error(req, TLDAP_SERVER_DOWN);
- return;
- }
-
- if (!tldap_msg_set_pending(req)) {
- tevent_req_oom(req);
+ tldap_context_disconnect(state->ld, TLDAP_SERVER_DOWN);
return;
}
}
@@ -619,21 +667,25 @@ static void tldap_msg_received(struct tevent_req *subreq)
ssize_t received;
size_t num_pending;
int i, err;
- TLDAPRC status;
+ TLDAPRC status = TLDAP_PROTOCOL_ERROR;
int id;
uint8_t type;
bool ok;
received = read_ldap_recv(subreq, talloc_tos(), &inbuf, &err);
TALLOC_FREE(subreq);
+ ld->read_req = NULL;
if (received == -1) {
- ld->server_down = true;
status = TLDAP_SERVER_DOWN;
goto fail;
}
data = asn1_init(talloc_tos(), ASN1_MAX_TREE_DEPTH);
if (data == NULL) {
+ /*
+ * We have to disconnect all, we can't tell which of
+ * the requests this reply is for.
+ */
status = TLDAP_NO_MEMORY;
goto fail;
}
@@ -652,6 +704,17 @@ static void tldap_msg_received(struct tevent_req *subreq)
tldap_debug(ld, TLDAP_DEBUG_TRACE, "tldap_msg_received: got msg %d "
"type %d\n", id, (int)type);
+ if (id == 0) {
+ tldap_debug(
+ ld,
+ TLDAP_DEBUG_WARNING,
+ "tldap_msg_received: got msgid 0 of "
+ "type %"PRIu8", disconnecting\n",
+ type);
+ tldap_context_disconnect(ld, TLDAP_SERVER_DOWN);
+ return;
+ }
+
num_pending = talloc_array_length(ld->pending);
for (i=0; i<num_pending; i++) {
@@ -677,38 +740,25 @@ static void tldap_msg_received(struct tevent_req *subreq)
tldap_msg_unset_pending(req);
num_pending = talloc_array_length(ld->pending);
+ tevent_req_defer_callback(req, state->ev);
tevent_req_done(req);
done:
--
Samba Shared Repository
More information about the samba-cvs
mailing list