Changeset 274 for branches/samba-3.3.x/source

Timestamp:

Jun 17, 2009, 2:19:52 PM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.3 branch to 3.3.5

Location:

branches/samba-3.3.x/source

Files:

• VERSION (modified) (1 diff)
• auth/auth_util.c (modified) (4 diffs)
• configure (modified) (1 diff)
• configure.in (modified) (1 diff)
• groupdb/mapping_ldb.c (modified) (1 diff)
• include/config.h.in (modified) (1 diff)
• include/ntdomain.h (modified) (1 diff)
• include/smbldap.h (modified) (1 diff)
• include/version.h (modified) (1 diff)
• lib/ctdbd_conn.c (modified) (1 diff)
• lib/netapi/examples/netdomjoin-gui/netdomjoin-gui.c (modified) (1 diff)
• lib/smbldap.c (modified) (1 diff)
• librpc/gen_ndr/ndr_samr.c (modified) (2 diffs)
• librpc/idl/samr.idl (modified) (1 diff)
• libsmb/credentials.c (modified) (1 diff)
• libsmb/passchange.c (modified) (1 diff)
• locking/locking.c (modified) (1 diff)
• param/loadparm.c (modified) (8 diffs)
• passdb/lookup_sid.c (modified) (2 diffs)
• passdb/pdb_interface.c (modified) (1 diff)
• passdb/pdb_ldap.c (modified) (3 diffs)
• rpc_server/srv_netlog_nt.c (modified) (8 diffs)
• rpc_server/srv_samr_nt.c (modified) (11 diffs)
• script/installmo.sh (modified) (1 diff)
• smbd/file_access.c (modified) (3 diffs)
• smbd/filename.c (modified) (6 diffs)
• smbd/msdfs.c (modified) (2 diffs)
• smbd/posix_acls.c (modified) (2 diffs)
• smbd/posix_acls.c# (modified) (1 diff)
• smbd/server.c (modified) (1 diff)
• smbd/service.c (modified) (2 diffs)
• smbd/uid.c (modified) (5 diffs)
• utils/net_dom.c (modified) (1 diff)
• utils/net_groupmap.c (modified) (1 diff)
• utils/net_rap.c (modified) (2 diffs)
• utils/smbget.c (modified) (1 diff)
• winbindd/idmap_ldap.c (modified) (2 diffs)
• winbindd/idmap_tdb.c (modified) (3 diffs)
• winbindd/idmap_tdb2.c (modified) (2 diffs)
• winbindd/winbindd.c (modified) (1 diff)

branches/samba-3.3.x/source/VERSION

@@ -26 +26 @@
 SAMBA_VERSION_MAJOR=3
 SAMBA_VERSION_MINOR=3
-SAMBA_VERSION_RELEASE=4
+SAMBA_VERSION_RELEASE=5
 
 ########################################################

branches/samba-3.3.x/source/auth/auth_util.c

@@ -293 +293 @@
         unsigned char key[16];
         
-        ZERO_STRUCT(key);
-        memcpy(key, dc_sess_key, 8);
+        memcpy(key, dc_sess_key, 16);
         
         if (lm_interactive_pwd)
@@ -885 +884 @@
                                                 pdb_get_username(sam_acct));
 
+                /*
+                 * If the SID from lookup_name() was the guest sid, passdb knows
+                 * about the mapping of guest sid to lp_guestaccount()
+                 * username and will return the unix_pw info for a guest
+                 * user. Use it if it's there, else lookup the *uid details
+                 * using getpwnam_alloc(). See bug #6291 for details. JRA.
+                 */
+
+                /* We must always assign the *uid. */
+                if (sam_acct->unix_pw == NULL) {
+                        struct passwd *pwd = getpwnam_alloc(sam_acct, *found_username );
+                        if (!pwd) {
+                                DEBUG(10, ("getpwnam_alloc failed for %s\n",
+                                        *found_username));
+                                result = NT_STATUS_NO_SUCH_USER;
+                                goto done;
+                        }
+                        result = samu_set_unix(sam_acct, pwd );
+                        if (!NT_STATUS_IS_OK(result)) {
+                                DEBUG(10, ("samu_set_unix failed for %s\n",
+                                        *found_username));
+                                result = NT_STATUS_NO_SUCH_USER;
+                                goto done;
+                        }
+                }
+                *uid = sam_acct->unix_pw->pw_uid;
+
         } else  if (sid_check_is_in_unix_users(&user_sid)) {
 
@@ -901 +927 @@
 
                 if (!sid_to_uid(&user_sid, uid)) {
-                        DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
+                        DEBUG(1, ("unix_user case, sid_to_uid for %s (%s) failed\n",
                                   username, sid_string_dbg(&user_sid)));
+                        result = NT_STATUS_NO_SUCH_USER;
                         goto done;
                 }
@@ -954 +981 @@
 
                 uint32 dummy;
+
+                /* We must always assign the *uid. */
+                if (!sid_to_uid(&user_sid, uid)) {
+                        DEBUG(1, ("winbindd case, sid_to_uid for %s (%s) failed\n",
+                                  username, sid_string_dbg(&user_sid)));
+                        result = NT_STATUS_NO_SUCH_USER;
+                        goto done;
+                }
 
                 num_group_sids = 1;

branches/samba-3.3.x/source/configure

@@ -76541 +76541 @@
 
 
+############################################
+# See if we have the a broken readlink syscall.
+
+{ $as_echo "$as_me:$LINENO: checking for a broken readlink syscall" >&5
+$as_echo_n "checking for a broken readlink syscall... " >&6; }
+if test "${samba_cv_HAVE_BROKEN_READLINK+set}" = set; then
+  $as_echo_n "(cached) " >&6
+else
+
+if test "$cross_compiling" = yes; then
+  samba_cv_HAVE_BROKEN_READLINK=cross
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include "${srcdir-.}/../tests/readlink.c"
+_ACEOF
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
+$as_echo "$ac_try_echo") >&5
+  (eval "$ac_link") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+  { (case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
+$as_echo "$ac_try_echo") >&5
+  (eval "$ac_try") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  samba_cv_HAVE_BROKEN_READLINK=no
+else
+  $as_echo "$as_me: program exited with status $ac_status" >&5
+$as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+samba_cv_HAVE_BROKEN_READLINK=yes
+fi
+rm -rf conftest.dSYM
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+fi
+
+
+
+fi
+{ $as_echo "$as_me:$LINENO: result: $samba_cv_HAVE_BROKEN_READLINK" >&5
+$as_echo "$samba_cv_HAVE_BROKEN_READLINK" >&6; }
+if test x"$samba_cv_HAVE_BROKEN_READLINK" = x"yes"; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_BROKEN_READLINK 1
+_ACEOF
+
+fi
 
 #################################################

branches/samba-3.3.x/source/configure.in

@@ -5928 +5928 @@
 AC_HAVE_DECL(splice, [#include <fcntl.h>])
 
+############################################
+# See if we have the a broken readlink syscall.
+
+AC_CACHE_CHECK([for a broken readlink syscall],samba_cv_HAVE_BROKEN_READLINK,[
+AC_TRY_RUN([#include "${srcdir-.}/../tests/readlink.c"],
+        samba_cv_HAVE_BROKEN_READLINK=no,samba_cv_HAVE_BROKEN_READLINK=yes,samba_cv_HAVE_BROKEN_READLINK=cross)
+])
+if test x"$samba_cv_HAVE_BROKEN_READLINK" = x"yes"; then
+        AC_DEFINE(HAVE_BROKEN_READLINK,1,[Whether the readlink syscall is broken])
+fi
 
 #################################################

branches/samba-3.3.x/source/groupdb/mapping_ldb.c

@@ -532 +532 @@
         if (el == NULL) {
                 talloc_free(dn);
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                return NT_STATUS_OK;
         }
         

branches/samba-3.3.x/source/include/config.h.in

@@ -237 +237 @@
 /* Whether readdir() returns the wrong name offset */
 #undef HAVE_BROKEN_READDIR_NAME
+
+/* Whether the readlink syscall is broken */
+#undef HAVE_BROKEN_READLINK
 
 /* Define to 1 if you have the `bzero' function. */

branches/samba-3.3.x/source/include/ntdomain.h

@@ -140 +140 @@
         struct netr_Credential srv_chal;  /* Server credential */
  
-        unsigned char  sess_key[16]; /* Session key - 8 bytes followed by 8 zero bytes */
+        unsigned char  sess_key[16]; /* Session key */
         unsigned char  mach_pw[16];   /* md4(machine password) */
 

branches/samba-3.3.x/source/include/smbldap.h

@@ -213 +213 @@
                                        const char *attribute,
                                        TALLOC_CTX *mem_ctx);
+char * smbldap_talloc_smallest_attribute(LDAP *ldap_struct, LDAPMessage *entry,
+                                         const char *attribute,
+                                         TALLOC_CTX *mem_ctx);
 void talloc_autofree_ldapmsg(TALLOC_CTX *mem_ctx, LDAPMessage *result);
 void talloc_autofree_ldapmod(TALLOC_CTX *mem_ctx, LDAPMod **mod);

branches/samba-3.3.x/source/include/version.h

@@ -2 +2 @@
 #define SAMBA_VERSION_MAJOR 3
 #define SAMBA_VERSION_MINOR 3
-#define SAMBA_VERSION_RELEASE 4
-#define SAMBA_VERSION_OFFICIAL_STRING "3.3.4"
+#define SAMBA_VERSION_RELEASE 5
+#define SAMBA_VERSION_OFFICIAL_STRING "3.3.5"
 #define SAMBA_VERSION_STRING samba_version_string()

branches/samba-3.3.x/source/lib/ctdbd_conn.c

@@ -1095 +1095 @@
 
         status = ctdbd_init_connection(NULL, &conn);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("ctdbd_init_connection failed: %s\n",
+                          nt_errstr(status)));
+                return status;
+        }
 
         t.db_id = db_id;

branches/samba-3.3.x/source/lib/netapi/examples/netdomjoin-gui/netdomjoin-gui.c

@@ -656 +656 @@
                 join_creds_required = FALSE;
                 unjoin_flags = NETSETUP_JOIN_DOMAIN |
-                               NETSETUP_ACCT_DELETE;
+                               NETSETUP_ACCT_DELETE |
+                               NETSETUP_IGNORE_UNSUPPORTED_FLAGS;
         }
 

branches/samba-3.3.x/source/lib/smbldap.c

@@ -334 +334 @@
 }
 
+ char * smbldap_talloc_smallest_attribute(LDAP *ldap_struct, LDAPMessage *entry,
+                                          const char *attribute,
+                                          TALLOC_CTX *mem_ctx)
+{
+        char **values;
+        char *result;
+        size_t converted_size;
+        int i, num_values;
+
+        if (attribute == NULL) {
+                return NULL;
+        }
+
+        values = ldap_get_values(ldap_struct, entry, attribute);
+
+        if (values == NULL) {
+                DEBUG(10, ("attribute %s does not exist\n", attribute));
+                return NULL;
+        }
+
+        if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
+                DEBUG(10, ("pull_utf8_talloc failed\n"));
+                ldap_value_free(values);
+                return NULL;
+        }
+
+        num_values = ldap_count_values(values);
+
+        for (i=1; i<num_values; i++) {
+                char *tmp;
+
+                if (!pull_utf8_talloc(mem_ctx, &tmp, values[i],
+                                      &converted_size)) {
+                        DEBUG(10, ("pull_utf8_talloc failed\n"));
+                        TALLOC_FREE(result);
+                        ldap_value_free(values);
+                        return NULL;
+                }
+
+                if (StrCaseCmp(tmp, result) < 0) {
+                        TALLOC_FREE(result);
+                        result = tmp;
+                } else {
+                        TALLOC_FREE(tmp);
+                }
+        }
+
+        ldap_value_free(values);
+
+#ifdef DEBUG_PASSWORDS
+        DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n",
+                     attribute, result));
+#endif
+        return result;
+}
+
+ char * smbldap_talloc_smallest_attribute(LDAP *ldap_struct, LDAPMessage *entry,
+                                          const char *attribute,
+                                          TALLOC_CTX *mem_ctx)
+{
+        char **values;
+        char *result;
+        size_t converted_size;
+        int i, num_values;
+
+        if (attribute == NULL) {
+                return NULL;
+        }
+
+        values = ldap_get_values(ldap_struct, entry, attribute);
+
+        if (values == NULL) {
+                DEBUG(10, ("attribute %s does not exist\n", attribute));
+                return NULL;
+        }
+
+        if (!pull_utf8_talloc(mem_ctx, &result, values[0], &converted_size)) {
+                DEBUG(10, ("pull_utf8_talloc failed\n"));
+                ldap_value_free(values);
+                return NULL;
+        }
+
+        num_values = ldap_count_values(values);
+
+        for (i=1; i<num_values; i++) {
+                char *tmp;
+
+                if (!pull_utf8_talloc(mem_ctx, &tmp, values[i],
+                                      &converted_size)) {
+                        DEBUG(10, ("pull_utf8_talloc failed\n"));
+                        TALLOC_FREE(result);
+                        ldap_value_free(values);
+                        return NULL;
+                }
+
+                if (StrCaseCmp(tmp, result) < 0) {
+                        TALLOC_FREE(result);
+                        result = tmp;
+                } else {
+                        TALLOC_FREE(tmp);
+                }
+        }
+
+        ldap_value_free(values);
+
+#ifdef DEBUG_PASSWORDS
+        DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n",
+                     attribute, result));
+#endif
+        return result;
+}
+
  static int ldapmsg_destructor(LDAPMessage **result) {
         ldap_msgfree(*result);

branches/samba-3.3.x/source/librpc/gen_ndr/ndr_samr.c

@@ -4431 +4431 @@
 static enum ndr_err_code ndr_push_samr_ConnectVersion(struct ndr_push *ndr, int ndr_flags, enum samr_ConnectVersion r)
 {
-        NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, r));
+        NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r));
         return NDR_ERR_SUCCESS;
 }
@@ -4437 +4437 @@
 static enum ndr_err_code ndr_pull_samr_ConnectVersion(struct ndr_pull *ndr, int ndr_flags, enum samr_ConnectVersion *r)
 {
-        uint16_t v;
-        NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &v));
+        uint32_t v;
+        NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
         *r = v;
         return NDR_ERR_SUCCESS;

branches/samba-3.3.x/source/librpc/idl/samr.idl

@@ -1371 +1371 @@
         /* Function    0x3e     */
 
-        typedef enum {
+        typedef [v1_enum] enum {
                 SAMR_CONNECT_PRE_W2K    = 1,
                 SAMR_CONNECT_W2K        = 2,

branches/samba-3.3.x/source/libsmb/credentials.c

@@ -256 +256 @@
         struct dcinfo tmp_dc = *dc;
 
+        if (!received_cred || !cred_out) {
+                return false;
+        }
+
         /* Do all operations on a temporary copy of the dc,
            which we throw away if the checks fail. */

branches/samba-3.3.x/source/libsmb/passchange.c

@@ -188 +188 @@
                                  "failed. Error was %s, but LANMAN password "
                                  "changed are disabled\n",
-                                 nt_errstr(result), remote_machine) == -1) {
+                                 remote_machine, nt_errstr(result)) == -1) {
                                 *err_str = NULL;
                         }

branches/samba-3.3.x/source/locking/locking.c

@@ -1365 +1365 @@
         if (fsp->conn->admin_user) {
                 tok_copy = copy_unix_token(lck, tok);
-                tok_copy->uid = (uid_t)0;
                 if (tok_copy == NULL) {
                         TALLOC_FREE(lck);
                         return false;
                 }
+                tok_copy->uid = (uid_t)0;
                 tok = tok_copy;
         }

branches/samba-3.3.x/source/param/loadparm.c

@@ -671 +671 @@
 static void set_allowed_client_auth(void);
 
+static void add_to_file_list(const char *fname, const char *subfname);
+
 static const struct enum_list enum_protocol[] = {
         {PROTOCOL_NT1, "NT1"},
@@ -6615 +6617 @@
                 }
         }
+        if (iServiceIndex >= 0) {
+                return  service_ok(iServiceIndex);
+        }
         return true;
 }
@@ -6632 +6637 @@
                 goto done;
         }
+
+        add_to_file_list(INCLUDE_REGISTRY_NAME, INCLUDE_REGISTRY_NAME);
 
         ret = do_parameter("registry shares", "yes", NULL);
@@ -6701 +6708 @@
         return ret;
 }
+
+#define MAX_INCLUDE_DEPTH 100
+
+static uint8_t include_depth;
 
 static struct file_lists {
@@ -6774 +6785 @@
         DEBUG(6, ("lp_file_list_changed()\n"));
 
-        if (lp_config_backend_is_registry()) {
-                struct smbconf_ctx *conf_ctx = lp_smbconf_ctx();
-
-                if (conf_ctx == NULL) {
-                        return false;
-                }
-                if (smbconf_changed(conf_ctx, &conf_last_csn, NULL, NULL)) {
-                        DEBUGADD(6, ("registry config changed\n"));
-                        return true;
-                }
-        }
-
         while (f) {
                 char *n2 = NULL;
                 time_t mod_time;
 
-                n2 = alloc_sub_basic(get_current_username(),
-                                    current_user_info.domain,
-                                    f->name);
-                if (!n2) {
-                        return false;
+                if (strequal(f->name, INCLUDE_REGISTRY_NAME)) {
+                        struct smbconf_ctx *conf_ctx = lp_smbconf_ctx();
+
+                        if (conf_ctx == NULL) {
+                                return false;
+                        }
+                        if (smbconf_changed(conf_ctx, &conf_last_csn, NULL,
+                                            NULL))
+                        {
+                                DEBUGADD(6, ("registry config changed\n"));
+                                return true;
+                        }
+                } else {
+                        n2 = alloc_sub_basic(get_current_username(),
+                                            current_user_info.domain,
+                                            f->name);
+                        if (!n2) {
+                                return false;
+                        }
+                        DEBUGADD(6, ("file %s -> %s  last mod_time: %s\n",
+                                     f->name, n2, ctime(&f->modtime)));
+
+                        mod_time = file_modtime(n2);
+
+                        if (mod_time &&
+                            ((f->modtime != mod_time) ||
+                             (f->subfname == NULL) ||
+                             (strcmp(n2, f->subfname) != 0)))
+                        {
+                                DEBUGADD(6,
+                                         ("file %s modified: %s\n", n2,
+                                          ctime(&mod_time)));
+                                f->modtime = mod_time;
+                                SAFE_FREE(f->subfname);
+                                f->subfname = n2; /* Passing ownership of
+                                                     return from alloc_sub_basic
+                                                     above. */
+                                return true;
+                        }
+                        SAFE_FREE(n2);
                 }
-                DEBUGADD(6, ("file %s -> %s  last mod_time: %s\n",
-                             f->name, n2, ctime(&f->modtime)));
-
-                mod_time = file_modtime(n2);
-
-                if (mod_time && ((f->modtime != mod_time) || (f->subfname == NULL) || (strcmp(n2, f->subfname) != 0))) {
-                        DEBUGADD(6,
-                                 ("file %s modified: %s\n", n2,
-                                  ctime(&mod_time)));
-                        f->modtime = mod_time;
-                        SAFE_FREE(f->subfname);
-                        f->subfname = n2; /* Passing ownership of
-                                             return from alloc_sub_basic
-                                             above. */
-                        return true;
-                }
-                SAFE_FREE(n2);
                 f = f->next;
         }
@@ -6889 +6906 @@
         char *fname;
 
+        if (include_depth >= MAX_INCLUDE_DEPTH) {
+                DEBUG(0, ("Error: Maximum include depth (%u) exceeded!\n",
+                          include_depth));
+                return false;
+        }
+
         if (strequal(pszParmValue, INCLUDE_REGISTRY_NAME)) {
                 if (!bAllowIncludeRegistry) {
@@ -6894 +6917 @@
                 }
                 if (bInGlobalSection) {
-                        return process_registry_globals();
+                        bool ret;
+                        include_depth++;
+                        ret = process_registry_globals();
+                        include_depth--;
+                        return ret;
                 } else {
                         DEBUG(1, ("\"include = registry\" only effective "
@@ -6911 +6938 @@
 
         if (file_exist(fname, NULL)) {
-                bool ret = pm_process(fname, do_section, do_parameter, NULL);
+                bool ret;
+                include_depth++;
+                ret = pm_process(fname, do_section, do_parameter, NULL);
+                include_depth--;
                 SAFE_FREE(fname);
                 return ret;

branches/samba-3.3.x/source/passdb/lookup_sid.c

@@ -469 +469 @@
 
         if (num_rids) {
-                *names = TALLOC_ARRAY(mem_ctx, const char *, num_rids);
+                *names = TALLOC_ZERO_ARRAY(mem_ctx, const char *, num_rids);
                 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
 
@@ -475 +475 @@
                         return false;
                 }
+
+                for (i = 0; i < num_rids; i++)
+                        (*types)[i] = SID_NAME_UNKNOWN;
         } else {
                 *names = NULL;

branches/samba-3.3.x/source/passdb/pdb_interface.c

@@ -1075 +1075 @@
                           "without algorithmic RIDs is chosen.\n"));
                 DEBUGADD(0, ("Please map all used groups using 'net groupmap "
-                             "add', set the maximum used RID using\n"));
-                DEBUGADD(0, ("'net setmaxrid' and remove the parameter\n"));
+                             "add', set the maximum used RID\n"));
+                DEBUGADD(0, ("and remove the parameter\n"));
                 return False;
         }

branches/samba-3.3.x/source/passdb/pdb_ldap.c

@@ -560 +560 @@
         }
 
-        if (!(username = smbldap_talloc_single_attribute(priv2ld(ldap_state),
+        if (!(username = smbldap_talloc_smallest_attribute(priv2ld(ldap_state),
                                         entry,
                                         "uid",
@@ -3283 +3283 @@
  
         if ((rc == LDAP_NAMING_VIOLATION) ||
+            (rc == LDAP_NOT_ALLOWED_ON_RDN) ||
             (rc == LDAP_OBJECT_CLASS_VIOLATION)) {
                 const char *attrs[] = { "sambaGroupType", "description",
@@ -3297 +3298 @@
 
         if ((rc == LDAP_NAMING_VIOLATION) ||
+            (rc == LDAP_NOT_ALLOWED_ON_RDN) ||
             (rc == LDAP_OBJECT_CLASS_VIOLATION)) {
                 const char *attrs[] = { "sambaGroupType", "description",

branches/samba-3.3.x/source/rpc_server/srv_netlog_nt.c

@@ -473 +473 @@
         NTSTATUS status;
         uint32_t srv_flgs;
+        /* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
+         * so use a copy to avoid destroying the client values. */
+        uint32_t in_neg_flags = *r->in.negotiate_flags;
         struct netr_Credential srv_chal_out;
 
@@ -478 +481 @@
          * Windows 7 looks at the negotiate_flags
          * returned in this structure *even if the
-         * call fails with access denied ! So in order
+         * call fails with access denied* ! So in order
          * to allow Win7 to connect to a Samba NT style
          * PDC we set the flags before we know if it's
@@ -495 +498 @@
                    NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL;
 
+        /* Ensure we support strong (128-bit) keys. */
+        if (in_neg_flags & NETLOGON_NEG_128BIT) {
+                srv_flgs |= NETLOGON_NEG_128BIT;
+        }
+
         if (lp_server_schannel() != false) {
                 srv_flgs |= NETLOGON_NEG_SCHANNEL;
         }
-
-        *r->out.negotiate_flags = srv_flgs;
 
         /* We use this as the key to store the creds: */
@@ -507 +513 @@
                 DEBUG(0,("_netr_ServerAuthenticate2: no challenge sent to client %s\n",
                         r->in.computer_name));
-                return NT_STATUS_ACCESS_DENIED;
+                status = NT_STATUS_ACCESS_DENIED;
+                goto out;
         }
 
         if ( (lp_server_schannel() == true) &&
-             ((*r->in.negotiate_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
+             ((in_neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 
                 /* schannel must be used, but client did not offer it. */
@@ -517 +524 @@
                         "to offer it. Client was %s\n",
                         r->in.account_name));
-                return NT_STATUS_ACCESS_DENIED;
+                status = NT_STATUS_ACCESS_DENIED;
+                goto out;
         }
 
@@ -528 +536 @@
                         r->in.account_name, nt_errstr(status) ));
                 /* always return NT_STATUS_ACCESS_DENIED */
-                return NT_STATUS_ACCESS_DENIED;
+                status = NT_STATUS_ACCESS_DENIED;
+                goto out;
         }
 
         /* From the client / server challenges and md4 password, generate sess key */
-        creds_server_init(*r->in.negotiate_flags,
+        creds_server_init(in_neg_flags,
                         p->dc,
                         &p->dc->clnt_chal,      /* Stored client chal. */
@@ -545 +554 @@
                         r->in.computer_name,
                         r->in.account_name));
-                return NT_STATUS_ACCESS_DENIED;
+                status = NT_STATUS_ACCESS_DENIED;
+                goto out;
         }
         /* set up the LSA AUTH 2 response */
@@ -563 +573 @@
                                             p->dc);
         unbecome_root();
-
-        return NT_STATUS_OK;
+        status = NT_STATUS_OK;
+
+  out:
+
+        *r->out.negotiate_flags = srv_flgs;
+        return status;
 }
 

branches/samba-3.3.x/source/rpc_server/srv_samr_nt.c

@@ -863 +863 @@
                   sid_string_dbg(&pol_sid)));
 
-        status = access_check_samr_function(acc_granted,
-                                            STD_RIGHT_READ_CONTROL_ACCESS,
-                                            "_samr_QuerySecurity");
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
         /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
 
@@ -1166 +1159 @@
                                   num_groups, groups);
 
+        if (MAX_SAM_ENTRIES <= num_groups) {
+                status = STATUS_MORE_ENTRIES;
+        } else {
+                status = NT_STATUS_OK;
+        }
+
         samr_array->count = num_groups;
         samr_array->entries = samr_entries;
@@ -1234 +1233 @@
         DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
 
+        if (MAX_SAM_ENTRIES <= num_aliases) {
+                status = STATUS_MORE_ENTRIES;
+        } else {
+                status = NT_STATUS_OK;
+        }
+
         samr_array->count = num_aliases;
         samr_array->entries = samr_entries;
@@ -1475 +1480 @@
                 DEBUG(5,("_samr_QueryDisplayInfo: Nothing in BUILTIN\n"));
                 return NT_STATUS_OK;
-        }
-
-        status = access_check_samr_function(info->acc_granted,
-                                            SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
-                                            "_samr_QueryDisplayInfo");
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
         }
 
@@ -2066 +2064 @@
                 return NT_STATUS_INVALID_HANDLE;
 
-        status = access_check_samr_function(acc_granted,
-                                            0, /* Don't know the acc_bits yet */
-                                            "_samr_LookupRids");
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
         if (num_rids > 1000) {
                 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
@@ -2623 +2614 @@
                 return NT_STATUS_INVALID_HANDLE;
 
-        status = access_check_samr_function(info->acc_granted,
-                                            SAMR_USER_ACCESS_GET_ATTRIBUTES,
-                                            "_samr_QueryUserInfo");
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
         domain_sid = info->sid;
 
@@ -2890 +2874 @@
         }
 
-        status = access_check_samr_function(info->acc_granted,
-                                            SAMR_ACCESS_LOOKUP_DOMAIN,
-                                            "_samr_QueryDomainInfo" );
-
-        if ( !NT_STATUS_IS_OK(status) )
-                return status;
-
         switch (r->in.level) {
                 case 0x01:
@@ -5638 +5615 @@
         time_t u_logout;
         time_t u_lock_duration, u_reset_time;
-        NTSTATUS result;
 
         DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
@@ -5645 +5621 @@
         if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
                 return NT_STATUS_INVALID_HANDLE;
-
-        /* We do have different access bits for info
-         * levels here, but we're really just looking for
-         * GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
-         * this maps to different specific bits. So
-         * assume if we have SAMR_DOMAIN_ACCESS_SET_INFO_1
-         * set we are ok. */
-
-        result = access_check_samr_function(info->acc_granted,
-                                            SAMR_DOMAIN_ACCESS_SET_INFO_1,
-                                            "_samr_SetDomainInfo");
-
-        if (!NT_STATUS_IS_OK(result))
-                return result;
 
         DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
@@ -5717 +5679 @@
         uint32_t num_account = 0;
         struct samr_displayentry *entries = NULL;
-        NTSTATUS status;
 
         DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
@@ -5724 +5685 @@
         if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
                 return NT_STATUS_INVALID_HANDLE;
-        }
-
-        status = access_check_samr_function(info->acc_granted,
-                                            SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
-                                            "_samr_GetDisplayEnumerationIndex");
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
         }
 

branches/samba-3.3.x/source/script/installmo.sh

@@ -36 +36 @@
                         echo "Installing $f as $FNAME"
                         touch "$FNAME"
-                        $MSGFMT "$f" -f -o "$FNAME"
+                        $MSGFMT -f -o "$FNAME" "$f"
                         if test ! -f "$FNAME"; then
                                 echo "Cannot install $FNAME. Does $USER have privileges?"

branches/samba-3.3.x/source/smbd/file_access.c

@@ -93 +93 @@
 
 #ifdef S_ISVTX
-        /* sticky bit means delete only by owner or root. */
+        /* sticky bit means delete only by owner of file or by root or
+         * by owner of directory. */
         if (sbuf.st_mode & S_ISVTX) {
                 SMB_STRUCT_STAT sbuf_file;
@@ -102 +103 @@
                                 return True;
                         }
+                        DEBUG(10,("can_delete_file_in_directory: can't "
+                                "stat file %s (%s)",
+                                fname, strerror(errno) ));
                         return False;
                 }
@@ -108 +112 @@
                  * for bug #3348. Don't assume owning sticky bit
                  * directory means write access allowed.
+                 * Fail to delete if we're not the owner of the file,
+                 * or the owner of the directory as we have no possible
+                 * chance of deleting. Otherwise, go on and check the ACL.
                  */
-                if (conn->server_info->utok.uid != sbuf_file.st_uid) {
+                if ((conn->server_info->utok.uid != sbuf.st_uid) &&
+                                (conn->server_info->utok.uid != sbuf_file.st_uid)) {
+                        DEBUG(10,("can_delete_file_in_directory: not "
+                                "owner of file %s or directory %s",
+                                fname, dname));
                         return False;
                 }

branches/samba-3.3.x/source/smbd/filename.c

@@ -37 +37 @@
                                      const char *name, TALLOC_CTX *mem_ctx,
                                      char **found_name);
+static int get_real_filename_internal(connection_struct *conn,
+                                      const char *path, const char *name,
+                                      bool mangled,
+                                      TALLOC_CTX *mem_ctx, char **found_name);
 
 /****************************************************************************
@@ -494 +498 @@
                                 }
 
-                                /* ENOENT is the only valid error here. */
-                                if ((errno != 0) && (errno != ENOENT)) {
+                                /*
+                                 * ENOENT/EACCESS are the only valid errors
+                                 * here. EACCESS needs handling here for
+                                 * "dropboxes", i.e. directories where users
+                                 * can only put stuff with permission -wx.
+                                 */
+                                if ((errno != 0) && (errno != ENOENT)
+                                    && (errno != EACCES)) {
                                         /*
                                          * ENOTDIR and ELOOP both map to
@@ -505 +515 @@
                                                 result =
                                                 NT_STATUS_OBJECT_PATH_NOT_FOUND;
-                                        }
-                                        else {
+                                        } else {
                                                 result =
                                                 map_nt_error_from_unix(errno);
@@ -838 +847 @@
                         /* Name is now unmangled. */
                         name = unmangled_name;
-                }
-                return get_real_filename(conn, path, name, mem_ctx,
-                                         found_name);
+                } else {
+                        /*
+                         * If we have mangled names, do not ask the VFS'es
+                         * GET_REAL_FILENAME. The Unix file system below does
+                         * not know about Samba's style of mangling.
+                         *
+                         * Boolean flags passed down are evil, the alternative
+                         * would be to pass a comparison function down into
+                         * the loop in get_real_filename_internal(). For now,
+                         * do the quick&dirty boolean flag approach.
+                         */
+                        return get_real_filename_internal(conn, path, name,
+                                                          true,
+                                                          mem_ctx, found_name);
+                }
         }
 
@@ -847 +868 @@
 }
 
-int get_real_filename(connection_struct *conn, const char *path,
-                      const char *name, TALLOC_CTX *mem_ctx,
-                      char **found_name)
+static int get_real_filename_internal(connection_struct *conn,
+                                      const char *path, const char *name,
+                                      bool mangled,
+                                      TALLOC_CTX *mem_ctx, char **found_name)
 {
         struct smb_Dir *cur_dir;
         const char *dname;
-        bool mangled;
         char *unmangled_name = NULL;
         long curpos;
@@ -902 +923 @@
         errno = ENOENT;
         return -1;
+}
+
+
+
+int get_real_filename(connection_struct *conn,
+                      const char *path, const char *name,
+                      TALLOC_CTX *mem_ctx, char **found_name)
+{
+        /*
+         * This is the default VFS function. If we end up here, we know we
+         * don't have mangled names around.
+         */
+        return get_real_filename_internal(conn, path, name, false,
+                                          mem_ctx, found_name);
 }
 

branches/samba-3.3.x/source/smbd/msdfs.c

@@ -264 +264 @@
         }
 
+        conn->fs_capabilities = SMB_VFS_FS_CAPABILITIES(conn);
+
         /*
          * Windows seems to insist on doing trans2getdfsreferral() calls on
@@ -403 +405 @@
         SMB_STRUCT_STAT st;
         int referral_len = 0;
+#if defined(HAVE_BROKEN_READLINK)
+        char link_target_buf[PATH_MAX];
+#else
         char link_target_buf[7];
+#endif
         size_t bufsize = 0;
         char *link_target = NULL;

branches/samba-3.3.x/source/smbd/posix_acls.c

@@ -1118 +1118 @@
                 return True;
 
-        /* Assume that the current user is in the current group (force group) */
-
-        if (uid_ace->unix_ug.uid == current_user.ut.uid && group_ace->unix_ug.gid == current_user.ut.gid)
-                return True;
+        /*
+         * if it's the current user, we already have the unix token
+         * and don't need to do the complex user_in_group_sid() call
+         */
+        if (uid_ace->unix_ug.uid == current_user.ut.uid) {
+                size_t i;
+
+                if (group_ace->unix_ug.gid == current_user.ut.gid) {
+                        return True;
+                }
+
+                for (i=0; i < current_user.ut.ngroups; i++) {
+                        if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
+                                return True;
+                        }
+                }
+        }
 
         /* u_name talloc'ed off tos. */
@@ -1128 +1141 @@
                 return False;
         }
+
+        /* notice that this is not reliable for users exported by winbindd! */
         return user_in_group_sid(u_name, &group_ace->trustee);
 }

branches/samba-3.3.x/source/smbd/posix_acls.c#

@@ -1 +1 @@
 ***************
-*** 4289,4298 ****
-        if (!S_ISDIR(sbuf.st_mode)) {
+*** 1117,1132 ****
+        if (sid_equal(&group_ace->trustee, &global_sid_World))
+                return True;
+  
+-       /* Assume that the current user is in the current group (force group) */
+  
+-       if (uid_ace->unix_ug.uid == current_user.ut.uid && group_ace->unix_ug.gid == current_user.ut.gid)
+-               return True;
+  
+        /* u_name talloc'ed off tos. */
+        u_name = uidtoname(uid_ace->unix_ug.uid);
+        if (!u_name) {
                 return False;
         }
-        if (current_user.ut.uid == 0 || conn->admin_user) {
-                /* I'm sorry sir, I didn't know you were root... */
+        return user_in_group_sid(u_name, &group_ace->trustee);
+  }
+  
+--- 1117,1147 ----
+        if (sid_equal(&group_ace->trustee, &global_sid_World))
                 return True;
-        }
   
-        /* Check primary owner write access. */
-        if (current_user.ut.uid == sbuf.st_uid) {
---- 4289,4301 ----
-        if (!S_ISDIR(sbuf.st_mode)) {
++       /*
++        * if it's the current user, we already have the unix token
++        * and don't need to do the complex user_in_group_sid() call
++        */
++       if (uid_ace->unix_ug.uid == current_user.ut.uid) {
++               size_t i;
+  
++               if (group_ace->unix_ug.gid == current_user.ut.gid) {
++                       return True;
++               }
++ 
++               for (i=0; i < current_user.ut.ngroups; i++) {
++                       if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
++                               return True;
++                       }
++               }
++       }
+  
+        /* u_name talloc'ed off tos. */
+        u_name = uidtoname(uid_ace->unix_ug.uid);
+        if (!u_name) {
                 return False;
         }
-+ #ifndef __OS2__
-+       /* Samba always runs as root on OS/2 */
-        if (current_user.ut.uid == 0 || conn->admin_user) {
-                /* I'm sorry sir, I didn't know you were root... */
-                return True;
-        }
-+ #endif
++ 
++       /* notice that this is not reliable for users exported by winbindd! */
+        return user_in_group_sid(u_name, &group_ace->trustee);
+  }
   
-        /* Check primary owner write access. */
-        if (current_user.ut.uid == sbuf.st_uid) {

branches/samba-3.3.x/source/smbd/server.c

@@ -591 +591 @@
         /* Kick off our mDNS registration. */
         if (dns_port != 0) {
-#ifdef WITH_DNSSD_SUPPORT
-                dns_register_smbd(&dns_reg, dns_port, &maxfd,
-                                  &r_fds, &idle_timeout);
-#endif
 #ifdef WITH_AVAHI_SUPPORT
                 void *avahi_conn;

branches/samba-3.3.x/source/smbd/service.c

@@ -291 +291 @@
         }
 
+        if (!service_ok(res)) {
+                res = -1;
+        }
+
  error:
 
@@ -741 +745 @@
 
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("create_connection_server_info failed: %s\n",
+                DEBUG(1, ("create_connection_server_info failed: %s\n",
                           nt_errstr(status)));
                 *pstatus = status;

branches/samba-3.3.x/source/smbd/uid.c

@@ -55 +55 @@
 }
 
+/****************************************************************************
+ talloc free the conn->server_info if not used in the vuid cache.
+****************************************************************************/
+
+static void free_conn_server_info_if_unused(connection_struct *conn)
+{
+        unsigned int i;
+
+        for (i = 0; i < VUID_CACHE_SIZE; i++) {
+                struct vuid_cache_entry *ent;
+                ent = &conn->vuid_cache.array[i];
+                if (ent->vuid != UID_FIELD_INVALID &&
+                                conn->server_info == ent->server_info) {
+                        return;
+                }
+        }
+        /* Not used, safe to free. */
+        TALLOC_FREE(conn->server_info);
+}
+
 /*******************************************************************
  Check if a username is OK.
@@ -78 +98 @@
                         ent = &conn->vuid_cache.array[i];
                         if (ent->vuid == vuid) {
+                                free_conn_server_info_if_unused(conn);
                                 conn->server_info = ent->server_info;
                                 conn->read_only = ent->read_only;
@@ -143 +164 @@
                 ent->read_only = readonly_share;
                 ent->admin_user = admin_user;
+                free_conn_server_info_if_unused(conn);
                 conn->server_info = ent->server_info;
         }
@@ -154 +176 @@
 /****************************************************************************
  Clear a vuid out of the connection's vuid cache
+ This is only called on SMBulogoff.
 ****************************************************************************/
 
@@ -167 +190 @@
                 if (ent->vuid == vuid) {
                         ent->vuid = UID_FIELD_INVALID;
-                        /* Ensure we're not freeing an active pointer. */
+                        /*
+                         * We need to keep conn->server_info around
+                         * if it's equal to ent->server_info as a SMBulogoff
+                         * is often followed by a SMBtdis (with an invalid
+                         * vuid). The debug code (or regular code in
+                         * vfs_full_audit) wants to refer to the
+                         * conn->server_info pointer to print debug
+                         * statements. Theoretically this is a bug,
+                         * as once the vuid is gone the server_info
+                         * on the conn struct isn't valid any more,
+                         * but there's enough code that assumes
+                         * conn->server_info is never null that
+                         * it's easier to hold onto the old pointer
+                         * until we get a new sessionsetupX.
+                         * As everything is hung off the
+                         * conn pointer as a talloc context we're not
+                         * leaking memory here. See bug #6315. JRA.
+                         */
                         if (conn->server_info == ent->server_info) {
-                                conn->server_info = NULL;
+                                ent->server_info = NULL;
+                        } else {
+                                TALLOC_FREE(ent->server_info);
                         }
-                        TALLOC_FREE(ent->server_info);
                         ent->read_only = False;
                         ent->admin_user = False;

branches/samba-3.3.x/source/utils/net_dom.c

@@ -39 +39 @@
         const char *password = NULL;
         uint32_t unjoin_flags = NETSETUP_ACCT_DELETE |
-                                NETSETUP_JOIN_DOMAIN;
+                                NETSETUP_JOIN_DOMAIN |
+                                NETSETUP_IGNORE_UNSUPPORTED_FLAGS;
         struct cli_state *cli = NULL;
         bool do_reboot = false;

branches/samba-3.3.x/source/utils/net_groupmap.c

@@ -620 +620 @@
         /* The case (opt_domaingroup && opt_localgroup) was tested for above */
 
-        if (strlen(c->opt_comment) > 0)
+        if ((c->opt_comment != NULL) && (strlen(c->opt_comment) > 0)) {
                 fstrcpy(map.comment, c->opt_comment);
-
-        if (strlen(c->opt_newntname) > 0)
+        }
+
+        if ((c->opt_newntname != NULL) && (strlen(c->opt_newntname) > 0)) {
                 fstrcpy(map.nt_name, c->opt_newntname);
+        }
 
         if (grp != NULL)

branches/samba-3.3.x/source/utils/net_rap.c

@@ -823 +823 @@
         userinfo.userflags = c->opt_flags;
         userinfo.reserved1 = '\0';
-        userinfo.comment = smb_xstrdup(c->opt_comment);
+        userinfo.comment = smb_xstrdup(c->opt_comment ? c->opt_comment : "");
         userinfo.priv = 1;
         userinfo.home_dir = NULL;
@@ -963 +963 @@
         safe_strcpy(grinfo.group_name, argv[0], sizeof(grinfo.group_name)-1);
         grinfo.reserved1 = '\0';
-        grinfo.comment = smb_xstrdup(c->opt_comment);
+        grinfo.comment = smb_xstrdup(c->opt_comment ? c->opt_comment : "");
 
         ret = cli_NetGroupAdd(cli, &grinfo);

branches/samba-3.3.x/source/utils/smbget.c

@@ -583 +583 @@
                 {"keep-permissions", 'P', POPT_ARG_NONE, &keep_permissions, 'P', "Keep permissions" },
                 {"blocksize", 'b', POPT_ARG_INT, &blocksize, 'b', "Change number of bytes in a block"},
-                {"rcfile", 'f', POPT_ARG_STRING, NULL, 0, "Use specified rc file"},
+                {"rcfile", 'f', POPT_ARG_STRING, NULL, 'f', "Use specified rc file"},
                 POPT_AUTOHELP
                 POPT_TABLEEND

branches/samba-3.3.x/source/winbindd/idmap_ldap.c

@@ -766 +766 @@
         struct idmap_ldap_context *ctx = NULL;
         char *config_option = NULL;
-        const char *range = NULL;
         const char *tmp = NULL;
 
@@ -780 +779 @@
         }
 
-        config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
-        if ( ! config_option) {
-                DEBUG(0, ("Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        /* load ranges */
-        range = lp_parm_const_string(-1, config_option, "range", NULL);
-        if (range && range[0]) {
-                if ((sscanf(range, "%u - %u", &ctx->filter_low_id,
-                                                &ctx->filter_high_id) != 2) ||
-                    (ctx->filter_low_id > ctx->filter_high_id)) {
-                        DEBUG(1, ("ERROR: invalid filter range [%s]", range));
-                        ctx->filter_low_id = 0;
-                        ctx->filter_high_id = 0;
-                }
+        if (strequal(dom->name, "*")) {
+                uid_t low_uid = 0;
+                uid_t high_uid = 0;
+                gid_t low_gid = 0;
+                gid_t high_gid = 0;
+
+                ctx->filter_low_id = 0;
+                ctx->filter_high_id = 0;
+
+                if (lp_idmap_uid(&low_uid, &high_uid)) {
+                        ctx->filter_low_id = low_uid;
+                        ctx->filter_high_id = high_uid;
+                } else {
+                        DEBUG(3, ("Warning: 'idmap uid' not set!\n"));
+                }
+
+                if (lp_idmap_gid(&low_gid, &high_gid)) {
+                        if ((low_gid != low_uid) || (high_gid != high_uid)) {
+                                DEBUG(1, ("Warning: 'idmap uid' and 'idmap gid'"
+                                      " ranges do not agree -- building "
+                                      "intersection\n"));
+                                ctx->filter_low_id = MAX(ctx->filter_low_id,
+                                                         low_gid);
+                                ctx->filter_high_id = MIN(ctx->filter_high_id,
+                                                          high_gid);
+                        }
+                } else {
+                        DEBUG(3, ("Warning: 'idmap gid' not set!\n"));
+                }
+        } else {
+                const char *range = NULL;
+
+                config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
+                if ( ! config_option) {
+                        DEBUG(0, ("Out of memory!\n"));
+                        ret = NT_STATUS_NO_MEMORY;
+                        goto done;
+                }
+
+                /* load ranges */
+                range = lp_parm_const_string(-1, config_option, "range", NULL);
+                if (range && range[0]) {
+                        if ((sscanf(range, "%u - %u", &ctx->filter_low_id,
+                                                        &ctx->filter_high_id) != 2))
+                        {
+                                DEBUG(1, ("ERROR: invalid filter range [%s]", range));
+                                ctx->filter_low_id = 0;
+                                ctx->filter_high_id = 0;
+                        }
+                }
+        }
+
+        if (ctx->filter_low_id > ctx->filter_high_id) {
+                DEBUG(1, ("ERROR: invalid filter range [%u-%u]",
+                      ctx->filter_low_id, ctx->filter_high_id));
+                ctx->filter_low_id = 0;
+                ctx->filter_high_id = 0;
         }
 

branches/samba-3.3.x/source/winbindd/idmap_tdb.c

@@ -570 +570 @@
         NTSTATUS ret;
         struct idmap_tdb_context *ctx;
-        char *config_option = NULL;
-        const char *range;
 
         ctx = talloc(dom, struct idmap_tdb_context);
@@ -579 +577 @@
         }
 
-        config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
-        if ( ! config_option) {
-                DEBUG(0, ("Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto failed;
-        }
+        if (strequal(dom->name, "*")) {
+                uid_t low_uid = 0;
+                uid_t high_uid = 0;
+                gid_t low_gid = 0;
+                gid_t high_gid = 0;
+
+                ctx->filter_low_id = 0;
+                ctx->filter_high_id = 0;
+
+                if (lp_idmap_uid(&low_uid, &high_uid)) {
+                        ctx->filter_low_id = low_uid;
+                        ctx->filter_high_id = high_uid;
+                } else {
+                        DEBUG(3, ("Warning: 'idmap uid' not set!\n"));
+                }
+
+                if (lp_idmap_gid(&low_gid, &high_gid)) {
+                        if ((low_gid != low_uid) || (high_gid != high_uid)) {
+                                DEBUG(1, ("Warning: 'idmap uid' and 'idmap gid'"
+                                      " ranges do not agree -- building "
+                                      "intersection\n"));
+                                ctx->filter_low_id = MAX(ctx->filter_low_id,
+                                                         low_gid);
+                                ctx->filter_high_id = MIN(ctx->filter_high_id,
+                                                          high_gid);
+                        }
+                } else {
+                        DEBUG(3, ("Warning: 'idmap gid' not set!\n"));
+                }
+        } else {
+                char *config_option = NULL;
+                const char *range;
+
+                config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
+                if ( ! config_option) {
+                        DEBUG(0, ("Out of memory!\n"));
+                        ret = NT_STATUS_NO_MEMORY;
+                        goto failed;
+                }
+
+                range = lp_parm_const_string(-1, config_option, "range", NULL);
+                if (( ! range) ||
+                    (sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2))
+                {
+                        ctx->filter_low_id = 0;
+                        ctx->filter_high_id = 0;
+                }
+
+                talloc_free(config_option);
+        }
+
+        if (ctx->filter_low_id > ctx->filter_high_id) {
+                ctx->filter_low_id = 0;
+                ctx->filter_high_id = 0;
+        }
+
+        DEBUG(10, ("idmap_tdb_db_init: filter range %u-%u loaded for domain "
+              "'%s'\n", ctx->filter_low_id, ctx->filter_high_id, dom->name));
 
         ret = idmap_tdb_open_db(ctx, &ctx->tdb);
@@ -591 +641 @@
         }
 
-        range = lp_parm_const_string(-1, config_option, "range", NULL);
-        if (( ! range) ||
-            (sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
-            (ctx->filter_low_id > ctx->filter_high_id)) {
-                ctx->filter_low_id = 0;
-                ctx->filter_high_id = 0;
-        }
-
         dom->private_data = ctx;
 
-        talloc_free(config_option);
         return NT_STATUS_OK;
 

branches/samba-3.3.x/source/winbindd/idmap_tdb2.c

@@ -343 +343 @@
         NTSTATUS ret;
         struct idmap_tdb2_context *ctx;
-        char *config_option = NULL;
-        const char *range;
         NTSTATUS status;
 
@@ -356 +354 @@
         }
 
-        config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
-        if ( ! config_option) {
-                DEBUG(0, ("Out of memory!\n"));
-                ret = NT_STATUS_NO_MEMORY;
-                goto failed;
-        }
-
-        range = lp_parm_const_string(-1, config_option, "range", NULL);
-        if (( ! range) ||
-            (sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
-            (ctx->filter_low_id > ctx->filter_high_id)) {
+        if (strequal(dom->name, "*")) {
+                uid_t low_uid = 0;
+                uid_t high_uid = 0;
+                gid_t low_gid = 0;
+                gid_t high_gid = 0;
+
                 ctx->filter_low_id = 0;
                 ctx->filter_high_id = 0;
+
+                if (lp_idmap_uid(&low_uid, &high_uid)) {
+                        ctx->filter_low_id = low_uid;
+                        ctx->filter_high_id = high_uid;
+                } else {
+                        DEBUG(3, ("Warning: 'idmap uid' not set!\n"));
+                }
+
+                if (lp_idmap_gid(&low_gid, &high_gid)) {
+                        if ((low_gid != low_uid) || (high_gid != high_uid)) {
+                                DEBUG(1, ("Warning: 'idmap uid' and 'idmap gid'"
+                                      " ranges do not agree -- building "
+                                      "intersection\n"));
+                                ctx->filter_low_id = MAX(ctx->filter_low_id,
+                                                         low_gid);
+                                ctx->filter_high_id = MIN(ctx->filter_high_id,
+                                                          high_gid);
+                        }
+                } else {
+                        DEBUG(3, ("Warning: 'idmap gid' not set!\n"));
+                }
+        } else {
+                char *config_option = NULL;
+                const char *range;
+                config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
+                if ( ! config_option) {
+                        DEBUG(0, ("Out of memory!\n"));
+                        ret = NT_STATUS_NO_MEMORY;
+                        goto failed;
+                }
+
+                range = lp_parm_const_string(-1, config_option, "range", NULL);
+                if (( ! range) ||
+                    (sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2))
+                {
+                        ctx->filter_low_id = 0;
+                        ctx->filter_high_id = 0;
+                }
+
+                talloc_free(config_option);
+        }
+
+        if (ctx->filter_low_id > ctx->filter_high_id) {
+                ctx->filter_low_id = 0;
+                ctx->filter_high_id = 0;
         }
 
         dom->private_data = ctx;
 
-        talloc_free(config_option);
         return NT_STATUS_OK;
 

branches/samba-3.3.x/source/winbindd/winbindd.c

@@ -779 +779 @@
         for (state = winbindd_client_list(); state; state = state->next) {
                 if (state->response.result != WINBINDD_PENDING &&
+                    state->fd_event.flags == EVENT_FD_READ &&
                     !state->getpwent_state && !state->getgrent_state) {
                         nidle++;