[PATCHES BUG 13903] Fix overlapping idmap ranges
Christof Schmitt
cs at samba.org
Tue Apr 23 03:38:33 UTC 2019
This is a patch from Volker to fix overlapping idmap ranges. I extended
the idmap_ad test environment to include a trusted domain to test this
case; this is probably the most common scenario for overlapping idmap
ranges.
Gitlab pipeline passed at
https://gitlab.com/samba-team/devel/samba/pipelines/57885661
Christof
-------------- next part --------------
From 072623899a14cfcfdeaac9ae7a8a2b3be8b54eae Mon Sep 17 00:00:00 2001
From: Christof Schmitt <cs at samba.org>
Date: Mon, 22 Apr 2019 16:15:20 -0700
Subject: [PATCH 1/7] selftest: Add gid-to-sid lookup to idmap_ad test
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13903
Signed-off-by: Christof Schmitt <cs at samba.org>
---
nsswitch/tests/test_idmap_ad.sh | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/nsswitch/tests/test_idmap_ad.sh b/nsswitch/tests/test_idmap_ad.sh
index 7450ae06059..3e36498efcb 100755
--- a/nsswitch/tests/test_idmap_ad.sh
+++ b/nsswitch/tests/test_idmap_ad.sh
@@ -49,6 +49,13 @@ add: gidNumber
gidNumber: 2000001
EOF
+cat <<EOF | $ldbmodify -H ldap://$DC_SERVER -U "$DOMAIN\Administrator%$DC_PASSWORD"
+dn: CN=Domain Admins,CN=Users,$BASE_DN
+changetype: modify
+add: gidNumber
+gidNumber: 2000002
+EOF
+
#
# Test 1: Test uid of Administrator, should be 2000000
#
@@ -79,6 +86,16 @@ test "$out" = "$DOMAIN/administrator:*:2000000:2000001::/home/$DOMAIN/administra
ret=$?
testit "Test get userinfo for Administrator works" test $ret -eq 0 || failed=$(expr $failed + 1)
+#
+# Test 4: Test lookup from gid to sid
+#
+
+out="$($wbinfo -G 2000002)"
+echo "wbinfo returned: \"$out\", expecting \"$DOMAIN_SID-512\""
+test "$out" = "$DOMAIN_SID-512"
+ret=$?
+testit "Test gid lookup of Domain Admins" test $ret -eq 0 || failed=$(expr $failed + 1)
+
#
# Remove POSIX ids from AD
#
@@ -96,4 +113,11 @@ delete: gidNumber
gidNumber: 2000001
EOF
+cat <<EOF | $ldbmodify -H ldap://$DC_SERVER -U "$DOMAIN\Administrator%$DC_PASSWORD"
+dn: CN=Domain Admins,CN=Users,$BASE_DN
+changetype: modify
+delete: gidNumber
+gidNumber: 2000002
+EOF
+
exit $failed
--
2.17.0
From 40c91f33f350bed71dbc77fb43d7bf7fe1adbbff Mon Sep 17 00:00:00 2001
From: Christof Schmitt <cs at samba.org>
Date: Wed, 17 Apr 2019 16:12:27 -0700
Subject: [PATCH 2/7] selftest: Use fl2008r2dc for ad_member_idmap_ad
fl2008r2dc already has a trusted domain. That will be used to use
idmap_ad for querying idmap attributes from the trusted domain.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13903
Signed-off-by: Christof Schmitt <cs at samba.org>
---
selftest/target/Samba3.pm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index b8a734adbe8..49ff23c212a 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -184,7 +184,7 @@ sub check_env($$)
ad_member => ["ad_dc"],
ad_member_rfc2307 => ["ad_dc_ntvfs"],
ad_member_idmap_rid => ["ad_dc"],
- ad_member_idmap_ad => ["ad_dc"],
+ ad_member_idmap_ad => ["fl2008r2dc"],
);
%Samba3::ENV_DEPS_POST = ();
--
2.17.0
From 82efc6ef9c8a451e83c9f9429be737bbb269565e Mon Sep 17 00:00:00 2001
From: Christof Schmitt <cs at samba.org>
Date: Thu, 18 Apr 2019 13:04:09 -0700
Subject: [PATCH 3/7] selftest: Make trusted domain information available for
idmap_ad environment
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13903
Signed-off-by: Christof Schmitt <cs at samba.org>
---
selftest/target/Samba3.pm | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 49ff23c212a..2a21087d4b9 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -769,6 +769,13 @@ sub setup_ad_member_idmap_ad
$ret->{DC_USERNAME} = $dcvars->{USERNAME};
$ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
+ $ret->{TRUST_SERVER} = $dcvars->{TRUST_SERVER};
+ $ret->{TRUST_USERNAME} = $dcvars->{TRUST_USERNAME};
+ $ret->{TRUST_PASSWORD} = $dcvars->{TRUST_PASSWORD};
+ $ret->{TRUST_DOMAIN} = $dcvars->{TRUST_DOMAIN};
+ $ret->{TRUST_REALM} = $dcvars->{TRUST_REALM};
+ $ret->{TRUST_DOMSID} = $dcvars->{TRUST_DOMSID};
+
return $ret;
}
--
2.17.0
From 4b068f7e29329f94ffb400cf251ceb5a988b0dc7 Mon Sep 17 00:00:00 2001
From: Christof Schmitt <cs at samba.org>
Date: Mon, 22 Apr 2019 16:07:02 -0700
Subject: [PATCH 4/7] selftest: Add idmap configuration for trusted domain for
idmap_ad
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13903
Signed-off-by: Christof Schmitt <cs at samba.org>
---
selftest/target/Samba3.pm | 2 ++
1 file changed, 2 insertions(+)
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 2a21087d4b9..a9c554fc50e 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -703,6 +703,8 @@ sub setup_ad_member_idmap_ad
idmap config * : range = 1000000-1999999
idmap config $dcvars->{DOMAIN} : backend = ad
idmap config $dcvars->{DOMAIN} : range = 2000000-2999999
+ idmap config $dcvars->{TRUST_DOMAIN} : backend = ad
+ idmap config $dcvars->{TRUST_DOMAIN} : range = 2000000-2999999
";
my $ret = $self->provision($prefix, $dcvars->{DOMAIN},
--
2.17.0
From 56ed30135701db2aa10e83f0d81195e7e65baff8 Mon Sep 17 00:00:00 2001
From: Christof Schmitt <cs at samba.org>
Date: Mon, 22 Apr 2019 16:38:11 -0700
Subject: [PATCH 5/7] selftest: Pass trusted domain information to idmap_ad
test
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13903
Signed-off-by: Christof Schmitt <cs at samba.org>
---
nsswitch/tests/test_idmap_ad.sh | 7 +++++--
source3/selftest/tests.py | 2 +-
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/nsswitch/tests/test_idmap_ad.sh b/nsswitch/tests/test_idmap_ad.sh
index 3e36498efcb..d89ed20a799 100755
--- a/nsswitch/tests/test_idmap_ad.sh
+++ b/nsswitch/tests/test_idmap_ad.sh
@@ -3,14 +3,17 @@
# Basic testing of id mapping with idmap_ad
#
-if [ $# -ne 3 ]; then
- echo Usage: $0 DOMAIN DC_SERVER DC_PASSWORD
+if [ $# -ne 6 ]; then
+ echo Usage: $0 DOMAIN DC_SERVER DC_PASSWORD TRUST_DOMAIN TRUST_SERVER TRUST_PASSWORD
exit 1
fi
DOMAIN="$1"
DC_SERVER="$2"
DC_PASSWORD="$3"
+TRUST_DOMAIN="$4"
+TRUST_SERVER="$5"
+TRUST_PASSWORD="$6"
wbinfo="$VALGRIND $BINDIR/wbinfo"
ldbmodify="$VALGRIND $BINDIR/ldbmodify"
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 147e53da558..c856f28ddb1 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -564,7 +564,7 @@ for t in tests:
elif t == "idmap.rid":
plantestsuite(t, "ad_member_idmap_rid", [os.path.join(samba3srcdir, "../nsswitch/tests/test_idmap_rid.sh"), '$DOMAIN', '2000000'])
elif t == "idmap.ad":
- plantestsuite(t, "ad_member_idmap_ad", [os.path.join(samba3srcdir, "../nsswitch/tests/test_idmap_ad.sh"), '$DOMAIN', '$DC_SERVER', '$DC_PASSWORD'])
+ plantestsuite(t, "ad_member_idmap_ad", [os.path.join(samba3srcdir, "../nsswitch/tests/test_idmap_ad.sh"), '$DOMAIN', '$DC_SERVER', '$DC_PASSWORD', '$TRUST_DOMAIN', '$TRUST_SERVER', '$TRUST_PASSWORD'])
elif t == "raw.acls":
plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/nfs4acl_simple_40 -U$USERNAME%$PASSWORD', description='nfs4acl_xattr-simple-40')
--
2.17.0
From 874cd60b83726462715071d9efb2d8238f307e6c Mon Sep 17 00:00:00 2001
From: Christof Schmitt <cs at samba.org>
Date: Mon, 22 Apr 2019 16:41:42 -0700
Subject: [PATCH 6/7] selftest: Add trusted domain tests for idmap_ad
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13903
Signed-off-by: Christof Schmitt <cs at samba.org>
---
nsswitch/tests/test_idmap_ad.sh | 106 ++++++++++++++++++++++++++++++++
selftest/knownfail | 1 +
2 files changed, 107 insertions(+)
diff --git a/nsswitch/tests/test_idmap_ad.sh b/nsswitch/tests/test_idmap_ad.sh
index d89ed20a799..d919dcd09e2 100755
--- a/nsswitch/tests/test_idmap_ad.sh
+++ b/nsswitch/tests/test_idmap_ad.sh
@@ -29,12 +29,24 @@ if [ $? -ne 0 ] ; then
exit 1
fi
+TRUST_DOMAIN_SID=$($wbinfo -n "$TRUST_DOMAIN/" | cut -f 1 -d " ")
+if [ $? -ne 0 ] ; then
+ echo "Could not find trusted domain SID" | subunit_fail_test "test_idmap_ad"
+ exit 1
+fi
+
BASE_DN=$($ldbsearch -H ldap://$DC_SERVER -b "" -s base defaultNamingContext | awk '/^defaultNamingContext/ {print $2}')
if [ $? -ne 0 ] ; then
echo "Could not find base DB" | subunit_fail_test "test_idmap_ad"
exit 1
fi
+TRUST_BASE_DN=$($ldbsearch -H ldap://$TRUST_SERVER -b "" -s base defaultNamingContext | awk '/^defaultNamingContext/ {print $2}')
+if [ $? -ne 0 ] ; then
+ echo "Could not find trusted base DB" | subunit_fail_test "test_idmap_ad"
+ exit 1
+fi
+
#
# Add POSIX ids to AD
#
@@ -59,6 +71,33 @@ add: gidNumber
gidNumber: 2000002
EOF
+#
+# Add POSIX ids to trusted domain
+#
+cat <<EOF | $ldbmodify -H ldap://$TRUST_SERVER \
+ -U "$TRUST_DOMAIN\Administrator%$TRUST_PASSWORD"
+dn: CN=Administrator,CN=Users,$TRUST_BASE_DN
+changetype: modify
+add: uidNumber
+uidNumber: 2500000
+EOF
+
+cat <<EOF | $ldbmodify -H ldap://$TRUST_SERVER \
+ -U "$TRUST_DOMAIN\Administrator%$TRUST_PASSWORD"
+dn: CN=Domain Users,CN=Users,$TRUST_BASE_DN
+changetype: modify
+add: gidNumber
+gidNumber: 2500001
+EOF
+
+cat <<EOF | $ldbmodify -H ldap://$TRUST_SERVER \
+ -U "$TRUST_DOMAIN\Administrator%$TRUST_PASSWORD"
+dn: CN=Domain Admins,CN=Users,$TRUST_BASE_DN
+changetype: modify
+add: gidNumber
+gidNumber: 2500002
+EOF
+
#
# Test 1: Test uid of Administrator, should be 2000000
#
@@ -99,6 +138,46 @@ test "$out" = "$DOMAIN_SID-512"
ret=$?
testit "Test gid lookup of Domain Admins" test $ret -eq 0 || failed=$(expr $failed + 1)
+#
+# Trusted domain test 1: Test uid of Administrator, should be 2500000
+#
+
+out="$($wbinfo -S $TRUST_DOMAIN_SID-500)"
+echo "wbinfo returned: \"$out\", expecting \"2500000\""
+test "$out" = "2500000"
+ret=$?
+testit "Test uid of Administrator in trusted domain is 2500000" test $ret -eq 0 || failed=$(expr $failed + 1)
+
+#
+# Trusted domain test 2: Test gid of Domain Users, should be 2500001
+#
+
+out="$($wbinfo -Y $TRUST_DOMAIN_SID-513)"
+echo "wbinfo returned: \"$out\", expecting \"2500001\""
+test "$out" = "2500001"
+ret=$?
+testit "Test uid of Domain Users in trusted domain is 2500001" test $ret -eq 0 || failed=$(expr $failed + 1)
+
+#
+# Trusted domain test 3: Test get userinfo for Administrator works
+#
+
+out="$($wbinfo -i $TRUST_DOMAIN/Administrator)"
+echo "wbinfo returned: \"$out\", expecting \"$TRUST_DOMAIN/administrator:*:2500000:2500001::/home/$TRUST_DOMAIN/administrator:/bin/false\""
+test "$out" = "$TRUST_DOMAIN/administrator:*:2500000:2500001::/home/$TRUST_DOMAIN/administrator:/bin/false"
+ret=$?
+testit "Test get userinfo for Administrator works" test $ret -eq 0 || failed=$(expr $failed + 1)
+
+#
+# Trusted domain test 4: Test lookup from gid to sid
+#
+
+out="$($wbinfo -G 2500002)"
+echo "wbinfo returned: \"$out\", expecting \"$TRUST_DOMAIN_SID-512\""
+test "$out" = "$TRUST_DOMAIN_SID-512"
+ret=$?
+testit "Test gid lookup of Domain Admins in trusted domain." test $ret -eq 0 || failed=$(expr $failed + 1)
+
#
# Remove POSIX ids from AD
#
@@ -123,4 +202,31 @@ delete: gidNumber
gidNumber: 2000002
EOF
+#
+# Remove POSIX ids from trusted domain
+#
+cat <<EOF | $ldbmodify -H ldap://$TRUST_SERVER \
+ -U "$TRUST_DOMAIN\Administrator%$TRUST_PASSWORD"
+dn: CN=Administrator,CN=Users,$TRUST_BASE_DN
+changetype: modify
+delete: uidNumber
+uidNumber: 2500000
+EOF
+
+cat <<EOF | $ldbmodify -H ldap://$TRUST_SERVER \
+ -U "$TRUST_DOMAIN\Administrator%$TRUST_PASSWORD"
+dn: CN=Domain Users,CN=Users,$TRUST_BASE_DN
+changetype: modify
+delete: gidNumber
+gidNumber: 2500001
+EOF
+
+cat <<EOF | $ldbmodify -H ldap://$TRUST_SERVER \
+ -U "$TRUST_DOMAIN\Administrator%$TRUST_PASSWORD"
+dn: CN=Domain Admins,CN=Users,$TRUST_BASE_DN
+changetype: modify
+delete: gidNumber
+gidNumber: 2500002
+EOF
+
exit $failed
diff --git a/selftest/knownfail b/selftest/knownfail
index c588f2f5c6b..49822c92d7f 100644
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -368,3 +368,4 @@
^samba.tests.ntlmdisabled.python\(ktest\).python2.ntlmdisabled.NtlmDisabledTests.test_samr_change_password\(ktest\)
^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python3.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python2.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
+^idmap.ad.Test gid lookup of Domain Admins in trusted domain.\(ad_member_idmap_ad\)
--
2.17.0
From a065923f50a73ffdb71d20ccb67f64b37b42cffb Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl at samba.org>
Date: Fri, 12 Apr 2019 16:56:45 +0200
Subject: [PATCH 7/7] winbind: Fix overlapping id ranges
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Christof Schmitt <cs at samba.org>
---
selftest/knownfail | 1 -
source3/winbindd/wb_xids2sids.c | 12 ++++++++++--
2 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/selftest/knownfail b/selftest/knownfail
index 49822c92d7f..c588f2f5c6b 100644
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -368,4 +368,3 @@
^samba.tests.ntlmdisabled.python\(ktest\).python2.ntlmdisabled.NtlmDisabledTests.test_samr_change_password\(ktest\)
^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python3.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python2.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\)
-^idmap.ad.Test gid lookup of Domain Admins in trusted domain.\(ad_member_idmap_ad\)
diff --git a/source3/winbindd/wb_xids2sids.c b/source3/winbindd/wb_xids2sids.c
index 383fc67bc8d..929a3b8e425 100644
--- a/source3/winbindd/wb_xids2sids.c
+++ b/source3/winbindd/wb_xids2sids.c
@@ -302,7 +302,11 @@ static struct tevent_req *wb_xids2sids_dom_send(
continue;
}
if (state->cached[i]) {
- /* already mapped */
+ /* already found in cache */
+ continue;
+ }
+ if (!is_null_sid(&state->all_sids[i])) {
+ /* already mapped in a previously asked domain */
continue;
}
state->dom_xids[state->num_dom_xids++] = id;
@@ -369,7 +373,11 @@ static void wb_xids2sids_dom_done(struct tevent_req *subreq)
continue;
}
if (state->cached[i]) {
- /* already mapped */
+ /* already found in cache */
+ continue;
+ }
+ if (!is_null_sid(&state->all_sids[i])) {
+ /* already mapped in a previously asked domain */
continue;
}
--
2.17.0
More information about the samba-technical
mailing list