The branch, v4-2-stable has been updated via e05a432 VERSION: Set version to 4.2.0rc2... via 8309ab7 WHATSNEW: Add release notes for Samba 4.2.0rc2. via 9164e5f build: do not install texpect binary anymore. via 2cd5450 libcli/smb: fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02 via 066fb45 [PATCH] WHATSNEW: Added information about the VFS WORM module that is via 4cc2dda WHATSNEW: Fix typo. via 721033d WHATSNEW: Fix typos. via 63017ac [PATCH] WHATSNEW: Add more features for Samba 4.2 via 25d26f4 WHATSNEW: Add samba-regedit. via 3430afa idmap_rfc2307: Fix a crash after connection problem to DC via 02e1c6b SO_PROTOCOL is platform-dependent via 13c7b80 regedit: remove an old comment via a38ad98 regedit: print error msg if opening registry fails via 96a5321 regedit: handle pgup/pgdn/home/end keys on lists via 0b70ddd regedit: handle del and backspace in hexeditor via fb01459 regedit: grow hexedit buffer as the user types via 0f548f9 regedit: add a button to resize hexedit buffer via 6c736e2 regedit: add a number input box via cf71665 regedit: don't expand single line text field buffer with cursor movement via 7720184 regedit: handle DEL key in text fields via 27e99f6 regedit: adjust some variable names to make them more distinct via d9b67e6 regedit: find previous items via 05be096 regedit: search values and repeat search from cursor positions via 45afe22 regedit: flesh out search dialog and simplify search opts via 60b6297 regedit: don't use subwindows in hexedit via afafda2 regedit: use pad as a canvas for dialogs via 77d9d4c regedit: clear value list after creating new key via 00ff031 regedit: use the right function to reopen a hive via a226a52 regedit: move cursor to edited value in list and report edit errors via 47caf0b regedit: Introduce a new API to build the dialogs. via ceafd11 regedit: improvements for hexedit via 7e11ecb regedit: add padding to fit REG_MULTI_SZ to the text field via bff6822 regedit: simplify cleanup after loading children via 1fb0690 regedit: add a panic handler to restore terminal via 5e3df48 regedit: make all hives descend from a root node via 8bc4a73 regedit: add a refresh command to clear cache and reload current path via ee89de1 regedit: reopen key after editing or removing values via 894f516 regedit: reopen parent keys when adding or removing subkeys via 6d61540 regedit: set cursor after creating a new key via 36cd9af regedit: set cursor to the parent node when ascending via 92d302f regedit: don't fail loading keys if just a few are unavailable via d4c1b36 regedit: include error description in popups via 544c4ec regedit: notify user if there's a failure loading subkeys via 4867e76 regedit: handle awkward window sizes better via 2b74ee0 regedit: use talloc typesafety features via fe5b9cd regedit: restore list cursor when window is resized via db7aef6 regedit: make value list display data in multiple columns via 1ca1c74 regedit: add multicolumn list widget via ca81665 regedit: add search feature. via f5ac8ec regedit: add a color scheme for path and context help sections via 1ab3b87 regedit: sort keys via 196055d regedit: free value list subwindow via 93aa394 regedit: add borders around key and value lists, and change headings via bb1b0ab regedit: add padding for key labels when there's not a prefix. via c7802fc regedit: add white on blue color scheme via 0288af3 regedit: silence some warnings via c7ebcd6 s3: smb2cli: query info return length check was reversed. via ce0c5f6 registry: Don't leave dangling transactions via ff9dd62 WHATSNEW: Fix typo. via 137c096 VERSION: Re-enable git snapshots. from 3011777 VERSION: Bump version up to 4.2.0rc1...
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v4-2-stable - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: VERSION | 2 +- WHATSNEW.txt | 123 ++- lib/socket_wrapper/socket_wrapper.c | 3 + lib/texpect/wscript | 6 +- libcli/smb/smb2cli_query_info.c | 2 +- libcli/smb/smbXcli_base.c | 6 +- source3/registry/reg_api.c | 2 +- source3/utils/regedit.c | 483 +++++-- source3/utils/regedit.h | 18 +- source3/utils/regedit_dialog.c | 2738 ++++++++++++++++++++++++----------- source3/utils/regedit_dialog.h | 204 +++- source3/utils/regedit_hexedit.c | 243 +++- source3/utils/regedit_hexedit.h | 38 +- source3/utils/regedit_list.c | 591 ++++++++ source3/utils/regedit_list.h | 82 ++ source3/utils/regedit_samba3.c | 4 +- source3/utils/regedit_treeview.c | 552 ++++++-- source3/utils/regedit_treeview.h | 29 +- source3/utils/regedit_valuelist.c | 401 ++++-- source3/utils/regedit_valuelist.h | 35 +- source3/winbindd/idmap_rfc2307.c | 1 + source3/wscript_build | 2 +- 22 files changed, 4258 insertions(+), 1307 deletions(-) create mode 100644 source3/utils/regedit_list.c create mode 100644 source3/utils/regedit_list.h Changeset truncated at 500 lines: diff --git a/VERSION b/VERSION index 5a5e8b8..3d28354 100644 --- a/VERSION +++ b/VERSION @@ -87,7 +87,7 @@ SAMBA_VERSION_PRE_RELEASE= # e.g. SAMBA_VERSION_RC_RELEASE=1 # # -> "3.0.0rc1" # ######################################################## -SAMBA_VERSION_RC_RELEASE=1 +SAMBA_VERSION_RC_RELEASE=2 ######################################################## # To mark SVN snapshots this should be set to 'yes' # diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 78fc777..47f3697 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,7 +1,7 @@ Release Announcements ===================== -This is the first release candidate of Samba 4.2. This is *not* +This is the second release candidate of Samba 4.2. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. @@ -44,6 +44,10 @@ to (other) domain controllers was rewritten in order to maintain global state in a netlogon_creds_cli.tdb. This is the proper fix for a large number of bugs: + + +o Volker Lendecke <v...@samba.org> + * BUG 10860: registry: Don't leave dangling transactions. https://bugzilla.samba.org/show_bug.cgi?id=6563 https://bugzilla.samba.org/show_bug.cgi?id=7944 https://bugzilla.samba.org/show_bug.cgi?id=7945 @@ -93,7 +97,7 @@ is no need to start the winbindd binary manually. Winbind now requires secured connections ======================================== -To improve protection against rouge domain controllers we now require +To improve protection against rogue domain controllers we now require that when we connect to an AD DC in our forest, that the connection be signed using SMB Signing. Set 'client signing = off' in the smb.conf to disable. @@ -170,6 +174,88 @@ use the following steps: $ make # make install +Samba Registry Editor +===================== + +The utitlity to browse the samba registry has been overhauled by our Google +Summer of Code student Chris Davis. Now samba-regedit has a +Midnight-Commander-like theme and UI experience. You can browse keys and edit +the diffent value types. For a data value type a hexeditor has been +implemented. + +Bad Password Lockout in the AD DC +================================= + +Samba's AD DC now implements bad password lockout (on a per-DC basis). + +That is, incorrect password attempts are tracked, and accounts locked +out if too many bad passwords are submitted. There is also a grace +period of 60 minutes on the previous password when used for NTLM +authentication (matching Windows 2003 SP1: https://support2.microsoft.com/kb/906305). + +The relevant settings can be seen using 'samba-tool domain +passwordsettings show' (the new settings being highlighted): + +Password informations for domain 'DC=samba,DC=example,DC=com' + +Password complexity: on +Store plaintext passwords: off +Password history length: 24 +Minimum password length: 7 +Minimum password age (days): 1 +Maximum password age (days): 42 +* Account lockout duration (mins): 30 * +* Account lockout threshold (attempts): 0 * +* Reset account lockout after (mins): 30 * + +These values can be set using 'samba-tool domain passwordsettings set'. + +Correct defaults in the smb.conf manpages +========================================= + +The default values for smb.conf parameters are now correctly specified +in the smb.conf manpage, even when they refer to build-time specified +paths. Provided Samba is built on a system with the right tools +(xsltproc in particular) required to generate our man pages, then +these will be built with the exact same embedded paths as used by the +configuration parser at runtime. Additionally, the default values +read from the smb.conf manpage are checked by our test suite to match +the values seen in testparm and used by the running binaries. + +Consistent behaviour between samba-tool testparm and testparm +============================================================= + +With the exception of the registry backend, which remains only +available in the file server, the behaviour of the smb.conf parser and +the tools 'samba-tool testparm' and 'testparm' is now consistent, +particularly with regard to default values. Except with regard to +registry shares, it is no longer needed to use one tool on the AD +DC, and another on the file server. + +VFS WORM module +=============== + +A VFS module for basic WORM (Write once read many) support has been +added. It allows an additional layer on top of a Samba share, that provides +a basic set of WORM functionality on the client side, to control the +writeability of files and folders. + +As the module is simply an additional layer, share access and permissions +work like expected - only WORM functionality is added on top. Removing the +module from the share configuration, removes this layer again. The +filesystem ACLs are not affected in any way from the module and treated +as usual. + +The module does not provide complete WORM functions, like some archiving +products do! It is not audit-proof, because the WORM function is only +available on the client side, when accessing a share through SMB! If +the same folder is shared by other services like NFS, the access only +depents on the underlaying filesystem ACLs. Equally if you access the +content directly on the server. + +For additional information, see +https://wiki.samba.org/index.php/VFS/vfs_worm + ###################################################################### Changes @@ -191,8 +277,37 @@ smb.conf changes smb2 max trans Changed default 8388608 winbind expand groups Changed default 0 -KNOWN ISSUES -============ + +CHANGES SINCE 4.2.0rc1 +====================== + +o Jeremy Allison <j...@samba.org> + * BUG 10848: s3: smb2cli: query info return length check was reversed. + + +o Björn Baumbach <b...@sernet.de> + * BUG 10862: build: Do not install 'texpect' binary anymore. + + +o Chris Davis <cd.rat...@gmail.com> + * BUG 10859: Improve samba-regedit. + + +o Jakub Hrozek <jakub.hro...@gmail.com> + * BUG 10861: Fix build of socket_wrapper on systems without SO_PROTOCOL. + + +o Volker Lendecke <v...@samba.org> + * BUG 10860: registry: Don't leave dangling transactions. + + +o Stefan Metzmacher <me...@samba.org> + * BUG 10866: libcli/smb: Fix smb2cli_validate_negotiate_info with + min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02. + + +o Christof Schmitt <c...@samba.org> + * BUG 10837: idmap_rfc2307: Fix a crash after connection problem to DC. ####################################### diff --git a/lib/socket_wrapper/socket_wrapper.c b/lib/socket_wrapper/socket_wrapper.c index afd9343..67303eb 100644 --- a/lib/socket_wrapper/socket_wrapper.c +++ b/lib/socket_wrapper/socket_wrapper.c @@ -3169,6 +3169,8 @@ static int swrap_getsockopt(int s, int level, int optname, *(int *)optval = si->family; return 0; #endif /* SO_DOMAIN */ + +#ifdef SO_PROTOCOL case SO_PROTOCOL: if (optval == NULL || optlen == NULL || *optlen < (socklen_t)sizeof(int)) { @@ -3179,6 +3181,7 @@ static int swrap_getsockopt(int s, int level, int optname, *optlen = sizeof(int); *(int *)optval = si->protocol; return 0; +#endif /* SO_PROTOCOL */ case SO_TYPE: if (optval == NULL || optlen == NULL || *optlen < (socklen_t)sizeof(int)) { diff --git a/lib/texpect/wscript b/lib/texpect/wscript index 51602f1..4163ca1 100644 --- a/lib/texpect/wscript +++ b/lib/texpect/wscript @@ -1,9 +1,7 @@ #!/usr/bin/env python def configure(conf): - conf.CHECK_FUNCS_IN('openpty', 'util', checklibc=True, headers='pty.h util.h libutil.h') + conf.CHECK_FUNCS_IN('openpty', 'util', checklibc=True, headers='pty.h util.h libutil.h') def build(bld): - bld.SAMBA_BINARY('texpect', - 'texpect.c', - deps='popt util') + bld.SAMBA_BINARY('texpect', 'texpect.c', deps='popt util', install=False) diff --git a/libcli/smb/smb2cli_query_info.c b/libcli/smb/smb2cli_query_info.c index 454f25a..a24844b 100644 --- a/libcli/smb/smb2cli_query_info.c +++ b/libcli/smb/smb2cli_query_info.c @@ -154,7 +154,7 @@ static void smb2cli_query_info_done(struct tevent_req *subreq) return; } - if (output_buffer_length < dyn_len) { + if (output_buffer_length > dyn_len) { tevent_req_nterror( req, NT_STATUS_INVALID_NETWORK_RESPONSE); return; diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c index ac81f7a..8a8bbd0 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c @@ -4649,7 +4649,11 @@ struct tevent_req *smb2cli_validate_negotiate_info_send(TALLOC_CTX *mem_ctx, } else { memset(buf+4, 0, 16); /* ClientGuid */ } - SCVAL(buf, 20, conn->smb2.client.security_mode); + if (state->conn->min_protocol >= PROTOCOL_SMB2_02) { + SCVAL(buf, 20, conn->smb2.client.security_mode); + } else { + SCVAL(buf, 20, 0); + } SCVAL(buf, 21, 0); /* reserved */ for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) { diff --git a/source3/registry/reg_api.c b/source3/registry/reg_api.c index 47a717b..d1c70ec 100644 --- a/source3/registry/reg_api.c +++ b/source3/registry/reg_api.c @@ -634,7 +634,7 @@ WERROR reg_createkey(TALLOC_CTX *ctx, struct registry_key *parent, key->token)) { err = WERR_ACCESS_DENIED; - goto done; + goto trans_done; } /* diff --git a/source3/utils/regedit.c b/source3/utils/regedit.c index 21fd257..bff23ec 100644 --- a/source3/utils/regedit.c +++ b/source3/utils/regedit.c @@ -25,19 +25,20 @@ #include "regedit_treeview.h" #include "regedit_valuelist.h" #include "regedit_dialog.h" +#include "regedit_list.h" #include <ncurses.h> #include <menu.h> #include <panel.h> #define KEY_START_X 0 -#define KEY_START_Y 3 +#define KEY_START_Y 1 #define KEY_WIDTH (COLS / 4) #define KEY_HEIGHT (LINES - KEY_START_Y - 2) #define VAL_START_X KEY_WIDTH -#define VAL_START_Y 3 +#define VAL_START_Y 1 #define VAL_WIDTH (COLS - KEY_WIDTH) #define VAL_HEIGHT (LINES - VAL_START_Y - 2) -#define HEADING_START_Y (KEY_START_Y - 1) + #define HELP1_START_Y (LINES - 2) #define HELP1_START_X 0 #define HELP1_WIDTH (LINES) @@ -51,12 +52,14 @@ #define PATH_WIDTH_MAX 1024 struct regedit { + struct registry_context *registry_context; WINDOW *main_window; WINDOW *path_label; size_t path_len; struct value_list *vl; struct tree_view *keys; bool tree_input; + struct regedit_search_opts active_search; }; static struct regedit *regedit_main = NULL; @@ -73,6 +76,8 @@ static void show_path(struct regedit *regedit) } copywin(regedit->path_label, regedit->main_window, 0, start_pad, PATH_START_Y, start_win, PATH_START_Y, PATH_MAX_Y, false); + + mvchgat(0, 0, COLS, A_BOLD, PAIR_YELLOW_CYAN, NULL); } static void print_path(struct regedit *regedit, struct tree_node *node) @@ -81,53 +86,6 @@ static void print_path(struct regedit *regedit, struct tree_node *node) show_path(regedit); } -/* load all available hives */ -static struct tree_node *load_hives(TALLOC_CTX *mem_ctx, - struct registry_context *ctx) -{ - const char *hives[] = { - "HKEY_CLASSES_ROOT", - "HKEY_CURRENT_USER", - "HKEY_LOCAL_MACHINE", - "HKEY_PERFORMANCE_DATA", - "HKEY_USERS", - "HKEY_CURRENT_CONFIG", - "HKEY_DYN_DATA", - "HKEY_PERFORMANCE_TEXT", - "HKEY_PERFORMANCE_NLSTEXT", - NULL - }; - struct tree_node *root, *prev, *node; - struct registry_key *key; - WERROR rv; - size_t i; - - root = NULL; - prev = NULL; - - for (i = 0; hives[i] != NULL; ++i) { - rv = reg_get_predefined_key_by_name(ctx, hives[i], &key); - if (!W_ERROR_IS_OK(rv)) { - continue; - } - - node = tree_node_new(mem_ctx, NULL, hives[i], key); - if (node == NULL) { - return NULL; - } - - if (root == NULL) { - root = node; - } - if (prev) { - tree_node_append(prev, node); - } - prev = node; - } - - return root; -} - static void print_help(struct regedit *regedit) { const char *khelp = "[n] New Key [s] New Subkey [d] Del Key " @@ -136,8 +94,9 @@ static void print_help(struct regedit *regedit) "[b] Edit binary"; const char *msg = "KEYS"; const char *help = khelp; - const char *genhelp = "[TAB] Switch sections [q] Quit regedit " - "[UP] List up [DOWN] List down"; + const char *genhelp = "[TAB] Switch sections [q] Quit " + "[UP] List up [DOWN] List down " + "[/] Search [x] Next"; int i, pad; if (!regedit->tree_input) { @@ -147,15 +106,16 @@ static void print_help(struct regedit *regedit) move(HELP1_START_Y, HELP1_START_X); clrtoeol(); - attron(A_REVERSE); + attron(COLOR_PAIR(PAIR_BLACK_CYAN)); mvaddstr(HELP1_START_Y, HELP1_START_X, help); pad = COLS - strlen(msg) - strlen(help); for (i = 0; i < pad; ++i) { addch(' '); } - attron(A_BOLD); + attroff(COLOR_PAIR(PAIR_BLACK_CYAN)); + attron(COLOR_PAIR(PAIR_YELLOW_CYAN) | A_BOLD); addstr(msg); - attroff(A_REVERSE | A_BOLD); + attroff(COLOR_PAIR(PAIR_YELLOW_CYAN) | A_BOLD); move(HELP2_START_Y, HELP2_START_X); clrtoeol(); @@ -164,24 +124,13 @@ static void print_help(struct regedit *regedit) static void print_heading(struct regedit *regedit) { - move(HEADING_START_Y, 0); - clrtoeol(); - if (regedit->tree_input) { - attron(A_REVERSE); - } else { - attroff(A_REVERSE); - } - mvprintw(HEADING_START_Y, KEY_START_X, "Key"); - attroff(A_REVERSE); - - if (!regedit->tree_input) { - attron(A_REVERSE); + tree_view_set_selected(regedit->keys, true); + value_list_set_selected(regedit->vl, false); } else { - attroff(A_REVERSE); + tree_view_set_selected(regedit->keys, false); + value_list_set_selected(regedit->vl, true); } - mvprintw(HEADING_START_Y, VAL_START_X, "Value"); - attroff(A_REVERSE); print_help(regedit); } @@ -190,17 +139,17 @@ static void load_values(struct regedit *regedit) { struct tree_node *node; - node = item_userptr(current_item(regedit->keys->menu)); + node = tree_view_get_current_node(regedit->keys); value_list_load(regedit->vl, node->key); } static void add_reg_key(struct regedit *regedit, struct tree_node *node, bool subkey) { - char *name; + const char *name; const char *msg; - if (!subkey && !node->parent) { + if (!subkey && tree_node_is_top_level(node)) { return; } @@ -234,69 +183,262 @@ static void add_reg_key(struct regedit *regedit, struct tree_node *node, new_node = tree_node_new(parent, parent, name, new_key); SMB_ASSERT(new_node); - tree_node_append_last(list, new_node); + tree_node_insert_sorted(list, new_node); + } else { + /* Reopen the parent key to make sure the + new subkey will be noticed. */ + tree_node_reopen_key(regedit->registry_context, + parent); } list = tree_node_first(node); tree_view_clear(regedit->keys); tree_view_update(regedit->keys, list); + if (!subkey) { + node = new_node; + } + tree_view_set_current_node(regedit->keys, node); + load_values(regedit); } else { + msg = get_friendly_werror_msg(rv); dialog_notice(regedit, DIA_ALERT, "New Key", - "Failed to create key."); + "Failed to create key: %s", msg); } - talloc_free(name); + talloc_free(discard_const(name)); } } +enum search_flags { + SEARCH_NEXT = (1<<0), + SEARCH_PREV = (1<<1), + SEARCH_REPEAT = (1<<2) +}; +static WERROR regedit_search(struct regedit *regedit, struct tree_node *node, + struct value_item *vitem, unsigned flags) +{ + struct regedit_search_opts *opts; + struct tree_node *found; + struct value_item *found_value; + bool search_key, need_sync; + char *save_value_name; + WERROR rv; + bool (*iterate)(struct tree_node **, bool, WERROR *); + struct value_item *(*find_item)(struct value_list *, + struct value_item *, + const char *, + regedit_search_match_fn_t); + + opts = ®edit->active_search; + + if (!opts->query || !opts->match) { + return WERR_OK; + } -- Samba Shared Repository