The branch, master has been updated via b73a05e s4 net: rename to samba-tool in order to not clash with s3 net from 5634f55 build: remove warnings about redifinition of boolean use -KPIC on suncc
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit b73a05e4e184238614d73c1519f2880cd946908d Author: Kai Blin <k...@samba.org> Date: Sat Oct 23 19:27:26 2010 -0700 s4 net: rename to samba-tool in order to not clash with s3 net Autobuild-User: Kai Blin <k...@samba.org> Autobuild-Date: Thu Oct 28 07:25:16 UTC 2010 on sn-devel-104 ----------------------------------------------------------------------- Summary of changes: selftest/target/Samba4.pm | 22 +- source4/samba_tool/drs/drs.c | 361 ++++++++++++++++ source4/samba_tool/drs/drs.h | 87 ++++ source4/samba_tool/drs/drs_bind.c | 136 ++++++ source4/samba_tool/drs/drs_kcc.c | 170 ++++++++ source4/samba_tool/drs/drs_replicate.c | 252 +++++++++++ source4/samba_tool/drs/drs_showrepl.c | 605 ++++++++++++++++++++++++++ source4/samba_tool/gpo.c | 618 +++++++++++++++++++++++++++ source4/samba_tool/password.c | 171 ++++++++ source4/samba_tool/samba_tool.c | 387 +++++++++++++++++ source4/samba_tool/samba_tool.h | 39 ++ source4/samba_tool/vampire.c | 130 ++++++ source4/samba_tool/wscript_build | 17 + source4/selftest/skip | 2 +- source4/selftest/tests.py | 2 +- source4/setup/tests/blackbox_group.sh | 78 ++-- source4/setup/tests/blackbox_newuser.sh | 22 +- source4/setup/tests/blackbox_setpassword.sh | 10 +- source4/setup/tests/blackbox_spn.sh | 24 +- source4/torture/drs/python/delete_object.py | 8 +- source4/torture/drs/python/fsmo.py | 6 +- source4/utils/net/config.mk | 50 --- source4/utils/net/drs/net_drs.c | 361 ---------------- source4/utils/net/drs/net_drs.h | 87 ---- source4/utils/net/drs/net_drs_bind.c | 136 ------ source4/utils/net/drs/net_drs_kcc.c | 170 -------- source4/utils/net/drs/net_drs_replicate.c | 252 ----------- source4/utils/net/drs/net_drs_showrepl.c | 605 -------------------------- source4/utils/net/net.c | 387 ----------------- source4/utils/net/net.h | 39 -- source4/utils/net/net_gpo.c | 618 --------------------------- source4/utils/net/net_password.c | 171 -------- source4/utils/net/net_vampire.c | 130 ------ source4/utils/net/wscript_build | 18 - source4/utils/tests/test_net.sh | 40 -- source4/utils/tests/test_samba_tool.sh | 40 ++ source4/wscript_build | 2 +- testprogs/blackbox/test_export_keytab.sh | 10 +- testprogs/blackbox/test_kinit.sh | 18 +- testprogs/blackbox/test_ktpass.sh | 4 +- testprogs/blackbox/test_passwords.sh | 36 +- testprogs/blackbox/test_pkinit.sh | 4 +- 42 files changed, 3137 insertions(+), 3188 deletions(-) create mode 100644 source4/samba_tool/drs/drs.c create mode 100644 source4/samba_tool/drs/drs.h create mode 100644 source4/samba_tool/drs/drs_bind.c create mode 100644 source4/samba_tool/drs/drs_kcc.c create mode 100644 source4/samba_tool/drs/drs_replicate.c create mode 100644 source4/samba_tool/drs/drs_showrepl.c create mode 100644 source4/samba_tool/gpo.c create mode 100644 source4/samba_tool/password.c create mode 100644 source4/samba_tool/samba_tool.c create mode 100644 source4/samba_tool/samba_tool.h create mode 100644 source4/samba_tool/vampire.c create mode 100644 source4/samba_tool/wscript_build delete mode 100644 source4/utils/net/config.mk delete mode 100644 source4/utils/net/drs/net_drs.c delete mode 100644 source4/utils/net/drs/net_drs.h delete mode 100644 source4/utils/net/drs/net_drs_bind.c delete mode 100644 source4/utils/net/drs/net_drs_kcc.c delete mode 100644 source4/utils/net/drs/net_drs_replicate.c delete mode 100644 source4/utils/net/drs/net_drs_showrepl.c delete mode 100644 source4/utils/net/net.c delete mode 100644 source4/utils/net/net.h delete mode 100644 source4/utils/net/net_gpo.c delete mode 100644 source4/utils/net/net_password.c delete mode 100644 source4/utils/net/net_vampire.c delete mode 100644 source4/utils/net/wscript_build delete mode 100755 source4/utils/tests/test_net.sh create mode 100755 source4/utils/tests/test_samba_tool.sh Changeset truncated at 500 lines: diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm index ba96f08..168fe42 100644 --- a/selftest/target/Samba4.pm +++ b/selftest/target/Samba4.pm @@ -880,11 +880,11 @@ sub provision_member($$$) return undef; } - my $net = $self->bindir_path("net"); + my $samba_tool = $self->bindir_path("samba-tool"); my $cmd = ""; $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" "; $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; - $cmd .= "$net join $ret->{CONFIGURATION} $dcvars->{REALM} member"; + $cmd .= "$samba_tool join $ret->{CONFIGURATION} $dcvars->{REALM} member"; $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}"; unless (system($cmd) == 0) { @@ -935,11 +935,11 @@ sub provision_rpc_proxy($$$) return undef; } - my $net = $self->bindir_path("net"); + my $samba_tool = $self->bindir_path("samba-tool"); my $cmd = ""; $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" "; $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; - $cmd .= "$net join $ret->{CONFIGURATION} $dcvars->{REALM} member"; + $cmd .= "$samba_tool join $ret->{CONFIGURATION} $dcvars->{REALM} member"; $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}"; unless (system($cmd) == 0) { @@ -991,11 +991,11 @@ sub provision_vampire_dc($$$) return undef; } - my $net = $self->bindir_path("net"); + my $samba_tool = $self->bindir_path("samba-tool"); my $cmd = ""; $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" "; $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; - $cmd .= "$net vampire $ret->{CONFIGURATION} $dcvars->{REALM} --realm=$dcvars->{REALM}"; + $cmd .= "$samba_tool vampire $ret->{CONFIGURATION} $dcvars->{REALM} --realm=$dcvars->{REALM}"; $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}"; unless (system($cmd) == 0) { @@ -1169,11 +1169,11 @@ sub provision_rodc($$$) return undef; } - my $net = $self->bindir_path("net"); + my $samba_tool = $self->bindir_path("samba-tool"); my $cmd = ""; $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" "; $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; - $cmd .= "$net join $ret->{CONFIGURATION} $dcvars->{REALM} RODC"; + $cmd .= "$samba_tool join $ret->{CONFIGURATION} $dcvars->{REALM} RODC"; $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}"; $cmd .= " --server=$dcvars->{DC_SERVER}"; @@ -1461,11 +1461,11 @@ sub setup_vampire_dc($$$) # force replicated DC to update repsTo/repsFrom # for vampired partitions - my $net = $self->bindir_path("net"); + my $samba_tool = $self->bindir_path("samba-tool"); my $cmd = ""; $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\""; $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\""; - $cmd .= " $net drs kcc $env->{DC_SERVER}"; + $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}"; $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}"; unless (system($cmd) == 0) { warn("Failed to exec kcc\n$cmd"); @@ -1477,7 +1477,7 @@ sub setup_vampire_dc($$$) my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM})); $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\""; $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\""; - $cmd .= " $net drs replicate $env->{DC_SERVER} $env->{VAMPIRE_DC_SERVER}"; + $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{VAMPIRE_DC_SERVER}"; $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}"; # replicate Configuration NC my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\""; diff --git a/source4/samba_tool/drs/drs.c b/source4/samba_tool/drs/drs.c new file mode 100644 index 0000000..78f8c14 --- /dev/null +++ b/source4/samba_tool/drs/drs.c @@ -0,0 +1,361 @@ +/* + Samba Unix/Linux SMB client library + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki <kamen.mazdras...@postpath.com> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "librpc/gen_ndr/ndr_drsuapi_c.h" +#include "samba_tool/drs/drs.h" +#include "lib/ldb/include/ldb.h" +#include "ldb_wrap.h" +#include "system/filesys.h" + + +/** + * 'samba-tool drs' supported sub-commands + */ +static const struct net_functable net_drs_functable[] = { + { "bind", "Display replication features for a domain controller\n", net_drs_bind_cmd, net_drs_bind_usage }, + { "kcc", "Forces the KCC to recalculate replication topology for a specified domain controller\n", + net_drs_kcc_cmd, net_drs_kcc_usage }, + { "replicate", "Triggers replication event for the specified naming context between the source and destination domain controllers.\n", + net_drs_replicate_cmd, net_drs_replicate_usage }, + { "showrepl", "Displays the replication partners for each directory partition on the specified domain controller.\n", + net_drs_showrepl_cmd, net_drs_showrepl_usage }, + { NULL, NULL } +}; + +/** + * 'samba-tool drs' entry point + */ +int net_drs(struct net_context *ctx, int argc, const char **argv) +{ + return net_run_function(ctx, argc, argv, net_drs_functable, net_drs_usage); +} + +/** + * 'samba-tool drs' usage message + */ +int net_drs_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool drs <command> [options]\n"); + d_printf("\n"); + d_printf("Currently implemented commands:\n"); + d_printf(" bind - Display DC replication features\n"); + d_printf(" kcc - Forces the KCC to recalculate replication topology for a specified domain controller\n"); + d_printf(" replicate - Triggers replication event for the specified naming context between the source and destination domain controllers.\n"); + d_printf(" showrepl - Displays the replication partners for each directory partition on the specified domain controller.\n"); + return 0; +} + +/** + * Create drsuapi connection to remote DC + * and fill-in DC capabilities + */ +static bool net_drs_DsBind(struct net_drs_context *drs_ctx, struct net_drs_connection *conn) +{ + NTSTATUS status; + struct GUID bind_guid; + struct drsuapi_DsBind req; + struct drsuapi_DsBindInfoCtr in_bind_ctr; + union drsuapi_DsBindInfo *bind_info; + + SMB_ASSERT(conn->binding != NULL); + + status = dcerpc_pipe_connect_b(conn, + &conn->drs_pipe, + conn->binding, + &ndr_table_drsuapi, + drs_ctx->net_ctx->credentials, + drs_ctx->net_ctx->event_ctx, + drs_ctx->net_ctx->lp_ctx); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Failed to connect to server: %s\n", nt_errstr(status)); + return false; + } + conn->drs_handle = conn->drs_pipe->binding_handle; + + ZERO_STRUCT(in_bind_ctr); + in_bind_ctr.length = 48; + in_bind_ctr.info.info48.pid = (uint32_t)getpid(); + GUID_from_string(DRSUAPI_DS_BIND_GUID, &bind_guid); + req.in.bind_guid = &bind_guid; + req.in.bind_info = &in_bind_ctr; + req.out.bind_handle = &conn->bind_handle; + + status = dcerpc_drsuapi_DsBind_r(conn->drs_handle, conn, &req); + if (!NT_STATUS_IS_OK(status)) { + const char *errstr = nt_errstr(status); + d_printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr); + return false; + } else if (!W_ERROR_IS_OK(req.out.result)) { + d_printf("DsBind failed - %s\n", win_errstr(req.out.result)); + return false; + } + + /* fill-in remote DC capabilities */ + ZERO_STRUCT(conn->info48); + bind_info = &req.out.bind_info->info; + conn->bind_info_len = req.out.bind_info->length; + switch (conn->bind_info_len) { + case 48: + conn->info48.supported_extensions_ext = bind_info->info48.supported_extensions_ext; + conn->info48.config_dn_guid = bind_info->info48.config_dn_guid; + case 28: + conn->info48.repl_epoch = bind_info->info28.repl_epoch; + case 24: + conn->info48.supported_extensions = bind_info->info24.supported_extensions; + conn->info48.site_guid = bind_info->info24.site_guid; + conn->info48.pid = bind_info->info24.pid; + break; + default: + d_printf("Error: server returned BindInfo length %d", req.out.bind_info->length); + return false; + } + + return true; +} + +/** + * Close DRSUAPI connection to remote DC + */ +static bool net_drs_DsUnbind(struct net_drs_connection *conn) +{ + struct drsuapi_DsUnbind r; + struct policy_handle bind_handle; + + SMB_ASSERT(conn->drs_pipe); + + ZERO_STRUCT(r); + r.out.bind_handle = &bind_handle; + + r.in.bind_handle = &conn->bind_handle; + dcerpc_drsuapi_DsUnbind_r(conn->drs_handle, conn, &r); + + /* free dcerpc pipe in case we get called more than once */ + talloc_free(conn->drs_pipe); + conn->drs_pipe = NULL; + conn->drs_handle = NULL; + + return true; +} + +/** + * Destroy drsuapi connection + */ +static int net_drs_connection_destructor(struct net_drs_connection *conn) +{ + if (conn->drs_pipe) { + net_drs_DsUnbind(conn); + } + return 0; +} + +/** + * Create DRSUAPI connection to target DC + * @return ptr to net_drs_connection or NULL on failure + */ +struct net_drs_connection * net_drs_connect_dc(struct net_drs_context *drs_ctx, const char *dc_name) +{ + struct net_drs_connection *conn = NULL; + + conn = talloc_zero(drs_ctx, struct net_drs_connection); + NET_DRS_NOMEM_GOTO(conn, failed); + + /* init binding */ + conn->binding = talloc_zero(conn, struct dcerpc_binding); + conn->binding->transport = NCACN_IP_TCP; + conn->binding->flags = drs_ctx->drs_conn->binding->flags; + conn->binding->host = talloc_strdup(conn, dc_name); + conn->binding->target_hostname = conn->binding->host; + + if (!net_drs_DsBind(drs_ctx, conn)) { + goto failed; + } + + talloc_set_destructor(conn, net_drs_connection_destructor); + + return conn; + +failed: + talloc_free(conn); + return NULL; +} + +/** + * Open secured LDAP connection to remote DC + */ +static bool net_drs_ldap_connect(struct net_drs_context *drs_ctx) +{ + char *url; + bool bret = true; + + url = talloc_asprintf(drs_ctx, "ldap://%s/", drs_ctx->dc_name); + if (!url) { + d_printf(__location__ ": Have no memory"); + return false; + } + + drs_ctx->ldap.ldb = ldb_wrap_connect(drs_ctx, + drs_ctx->net_ctx->event_ctx, drs_ctx->net_ctx->lp_ctx, + url, + NULL, + drs_ctx->net_ctx->credentials, + 0); + if (drs_ctx->ldap.ldb == NULL) { + d_printf("Unable to connect to LDAP %s", url); + bret = false; + } + + talloc_free(url); + + return bret; +} + +/** + * fetch RootDSE record + */ +static bool net_drs_ldap_rootdse(struct net_drs_context *drs_ctx) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "*", + NULL + }; + + SMB_ASSERT(drs_ctx->ldap.ldb != NULL); + + basedn = ldb_dn_new(drs_ctx, drs_ctx->ldap.ldb, NULL); + if (!basedn) { + d_printf(__location__ ": No memory"); + return false; + } + + ret = ldb_search(drs_ctx->ldap.ldb, drs_ctx, &r, + basedn, LDB_SCOPE_BASE, attrs, + "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + d_printf("RootDSE search failed: %s", ldb_errstring(drs_ctx->ldap.ldb)); + talloc_free(r); + return false; + } else if (r->count != 1) { + d_printf("RootDSE search returned more than one record!"); + talloc_free(r); + return false; + } + + drs_ctx->ldap.rootdse = r->msgs[0]; + + return true; +} + +/** + * parses binding from command line + * and gets target DC name + */ +static bool net_drs_parse_binding(struct net_drs_context *drs_ctx, const char *dc_binding) +{ + NTSTATUS status; + struct dcerpc_binding *b; + + status = dcerpc_parse_binding(drs_ctx->drs_conn, dc_binding, &b); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Bad binding supplied %s\n", dc_binding); + return false; + } + + b->transport = NCACN_IP_TCP; + b->flags |= DCERPC_SIGN | DCERPC_SEAL; + + /* cache target DC name */ + drs_ctx->dc_name = b->target_hostname; + + drs_ctx->drs_conn->binding = b; + + return true; +} + +/** + * Free DRSUAPI connection upon net_drs_context + * destruction + */ +static int net_drs_context_destructor(struct net_drs_context *drs_ctx) +{ + if (drs_ctx->drs_conn && drs_ctx->drs_conn->drs_pipe) { + net_drs_DsUnbind(drs_ctx->drs_conn); + } + return 0; +} + +/** + * Create net_drs_context context to be used + * by 'samba-tool drs' sub-commands + */ +bool net_drs_create_context(struct net_context *net_ctx, + const char *dc_binding, + struct net_drs_context **_drs_ctx) +{ + struct net_drs_context *drs_ctx; + + drs_ctx = talloc_zero(net_ctx, struct net_drs_context); + if (!drs_ctx) { + d_printf(__location__ ": No memory"); + return false; + } + + drs_ctx->drs_conn = talloc_zero(drs_ctx, struct net_drs_connection); + if (!drs_ctx->drs_conn) { + d_printf(__location__ ": No memory"); + return false; + } + + drs_ctx->net_ctx = net_ctx; + + if (!net_drs_parse_binding(drs_ctx, dc_binding)) { + goto failed; + } + + /* LDAP connect */ + if (!net_drs_ldap_connect(drs_ctx)) { + goto failed; + } + /* fetch RootDSE */ + if (!net_drs_ldap_rootdse(drs_ctx)) { + goto failed; + } + + /* DRSUAPI connection */ + if (!net_drs_DsBind(drs_ctx, drs_ctx->drs_conn)) { + goto failed; + } + + /* set destructor to free any open connections */ + talloc_set_destructor(drs_ctx, net_drs_context_destructor); + + *_drs_ctx = drs_ctx; + return true; + +failed: + talloc_free(drs_ctx); + return false; +} diff --git a/source4/samba_tool/drs/drs.h b/source4/samba_tool/drs/drs.h new file mode 100644 index 0000000..1e4cccc --- /dev/null +++ b/source4/samba_tool/drs/drs.h @@ -0,0 +1,87 @@ +/* + Unix SMB/CIFS implementation. + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki <kamen.mazdras...@postpath.com> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef SAMBA_TOOL_DRS_H_ +#define SAMBA_TOOL_DRS_H_ + +#include "librpc/gen_ndr/ndr_drsuapi_c.h" + + +/** + * Check for critical error + */ +#define NET_DRS_CHECK_GOTO(_condition,_label,_msg) \ + do { \ + if (!(_condition)) { \ + d_printf(__location__": "#_condition" - %s\n", _msg); \ + goto _label; \ + } \ + } while (0) + +/** + * check allocated memory macro + */ +#define NET_DRS_NOMEM_GOTO(_ptr,_label) \ + NET_DRS_CHECK_GOTO(_ptr, _label, "Not enough memory!") + -- Samba Shared Repository