samba.git/client, branch talloc-2.0.0

cifs.upcall: make using ip address conditional on new option

2009-08-26T10:26:02+00:00

Igor Mammedov pointed out that reverse resolving an IP address to get
the hostname portion of a principal could open a possible attack
vector. If an attacker were to gain control of DNS, then he could
redirect the mount to a server of his choosing, and fix the reverse
resolution to point to a hostname of his choosing (one where he has
the key for the corresponding cifs/ or host/ principal).

That said, we often trust DNS for other reasons and it can be useful
to do so. Make the code that allows trusting DNS to be enabled by
adding --trust-dns to the cifs.upcall invocation.

Signed-off-by: Jeff Layton

cifs.upcall: switch to getopt_long

2009-08-26T10:15:42+00:00

...to allow long option names.

Signed-off-by: Jeff Layton

cifs.upcall: fix IPv6 addrs sent to upcall to have colon delimiters

2009-08-14T11:59:51+00:00

Current kernels don't send IPv6 addresses with the colon delimiters, add
a routine to add them when they're not present.

Signed-off-by: Jeff Layton

cifs.upcall: use ip address passed by kernel to get server's hostname

2009-08-14T11:59:50+00:00

Instead of using the hostname given by the upcall to get the server's
principal, take the IP address given in the upcall and reverse resolve
it to a hostname.

Signed-off-by: Jeff Layton

cifs.upcall: clean up flag handling

2009-08-14T11:59:50+00:00

Add a new stack var to hold the flags returned by the decoder routine
so that we don't need to worry so much about preserving "rc".

With this, we can drop privs before trying to find the location of
the credcache.

Signed-off-by: Jeff Layton

cifs.upcall: try getting a "cifs/" principal and fall back to "host/"

2009-08-14T11:59:50+00:00

cifs.upcall takes a "-c" flag that tells the upcall to get a principal
in the form of "cifs/hostname.example.com@REALM" instead of
"host/hostname.example.com@REALM". This has turned out to be a source of
great confusion for users.

Instead of requiring this flag, have the upcall try to get a "cifs/"
principal first. If that fails, fall back to getting a "host/"
principal.

Signed-off-by: Jeff Layton

cifs.upcall: declare a structure for holding decoded args

2009-08-14T11:59:49+00:00

The argument list for the decoder is becoming rather long. Declare an
args structure and use that for holding the args. This also simplifies
pointer handling a bit.

Signed-off-by: Jeff Layton

cifs.upcall: formatting cleanup

2009-08-14T11:59:49+00:00

Clean up some unneeded curly braces, and fix some indentation.

Signed-off-by: Jeff Layton

cifs.upcall: clean up logging and add debug messages

2009-08-14T11:59:49+00:00

Change the log levels to be more appropriate to the messages being
logged. Error messages should be LOG_ERR and not LOG_WARNING, for
instance.

Add some LOG_DEBUG messages that we can use to diagnose problems with
krb5 upcalls. With these, someone can set up syslog to log daemon.debug
and should be able to get more info when things aren't working.

Signed-off-by: Jeff Layton

umount.cifs: do not attempt to update /etc/mtab if it is symbolic link

2009-07-27T16:02:35+00:00

If /etc/mtab is a symbolic link to e.g. /proc/mounts, do not update it.

This is a fix for a bug reported in 4675 on samba bugzilla

Signed-off-by: Shirish Pargaonkar