auth: Exclude resource groups from a TGT

Resource group SIDs should only be placed into a service ticket, but we
were including them in all tickets. Now that we have access to the group
attributes, we'll filter out any groups with SE_GROUP_RESOURCE set if
we're creating a TGT.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:torture: Assert that group attributes match

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

auth: Store group attributes in auth_user_info_dc

Group expansion, performed in dsdb_expand_nested_groups(), now
incorporates a check of the type of each group. Those that are resource
groups receive the SE_GROUP_RESOURCE bit in the attributes which are now
carried alongside each group SID.

Whereas before, in auth_convert_user_info_dc_sambaseinfo() and
auth_convert_user_info_dc_saminfo6(), we invariantly used the flag
combination SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT |
SE_GROUP_ENABLED to set attributes in the PAC, we now take the correct
attributes from user_info_dc.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4-dsdb: Add samdb_result_dom_sid_attrs()

This function is modelled on samdb_result_dom_sid(). It allocates,
rather than a dom_sid, an auth_SidAttr object, which we can pass to
other functions accepting an auth_SidAttr.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

libcli/security: Add auth_SidAttr utility functions

These functions are modelled on add_sid_to_array() and
add_sid_to_array_unique(). They differ in that they operate not on an
array of dom_sid, but of auth_SidAttr, and take an additional 'attrs'
parameter of type uint32_t.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

auth.idl: Add auth_SidAttr type

This type incorporates, alongside a SID, a group attributes member,
through which attributes from a PAC or the AD database can be conveyed
into the completed PAC. A useful benefit this provides is the ability to
distinguish and exclude domain-local groups, which only belong in
service tickets, from the PAC of a TGT.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:torture: Skip over asserted identity SIDs when comparing groups

We've already tested for the existence of these SIDs, and the assumption
that they are always the last element in a PAC is false. We must check
all the SIDs in each array, skipping over ones that were found to be
asserted identity SIDS.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:torture: Zero-initialise netr_NetworkInfo structure

This ensures that no members contain garbage data.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests/krb5: Declare supported encryption types of service account

If SID compression support is disabled for a created account,
msDS-SupportedEncryptionTypes will be set to a value that includes the
RESOURCE_SID_COMPRESSION_DISABLED bit, but no actual encryption type
bits. Since stricter encryption type handling was introduced to address
CVE-2022-37966, this combination has been interpreted as an expression
of no encryption type support, and trying to make a Kerberos request to
a service with such a combination of bits will fail with
ERR_ETYPE_NOSUPP.

To allow us to make Kerberos requests to test service accounts again, we
must set some actual encryption type bits.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

waf: Add support for MemorySanitizer

This currently only works with binaries. As there is no shared library for
MSAN it only is statically linked against binaries. This means if we have e.g.
a python script trying to load ldb, it will fail with undefined symbols.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Feb  6 23:49:04 UTC 2023 on atb-devel-224

s3:torture: Remove unused variable

source3/torture/test_smb1_dfs.c:3264:11: error: variable 'accessmode' set but
not used [-Werror,-Wunused-but-set-variable]
        uint16_t accessmode = 0;
                 ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:utils: Remove unused variable

source3/utils/log2pcaphex.c:138:13: error: variable 'i' set but not used
[-Werror,-Wunused-but-set-variable]
        static int i = 0;
                   ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:netapi: Remove unused variables

source3/lib/netapi/tests/netfile.c:40:22: error: variable 'i2' set but not used
[-Werror,-Wunused-but-set-variable]
  struct FILE_INFO_2 *i2 = NULL;
                      ^
source3/lib/netapi/tests/netfile.c:41:22: error: variable 'i3' set but not used
[-Werror,-Wunused-but-set-variable]
  struct FILE_INFO_3 *i3 = NULL;
                      ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:modules: Initialize pointer with NULL

source3/modules/vfs_glusterfs.c:827:6: error: variable 'glfd' is used
uninitialized whenever 'if' condition is false
[-Werror,-Wsometimes-uninitialized]
  if (pglfd == NULL) {
      ^~~~~~~~~~~~~
source3/modules/vfs_glusterfs.c:853:6: note: uninitialized use occurs here
  if (glfd == NULL) {
      ^~~~
source3/modules/vfs_glusterfs.c:827:2: note: remove the 'if' if its condition is
always true
  if (pglfd == NULL) {
  ^~~~~~~~~~~~~~~~~~~
source3/modules/vfs_glusterfs.c:763:17: note: initialize the variable 'glfd' to
silence this warning
  glfs_fd_t *glfd;
                 ^
                  = NULL

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:modules: Move structs with dynamic arrays to end of struct

source3/modules/vfs_io_uring.c:70:22: error: field 'cqe' with variable sized
    type 'struct io_uring_cqe' not at the end of a struct or class is a GNU
    extension [-Werror,-Wgnu-variable-sized-type-not-at-end]
        struct io_uring_cqe cqe;
                            ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:modules: Ignore -Wunused-but-set-variable for autogenerated code

source3/modules/getdate.c:1192:9: error: variable 'yynerrs' set but not used
    [-Werror,-Wunused-but-set-variable]
    int yynerrs;
        ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:printing: Remove unused variable

source3/printing/tests/vlp.c:144:19: error: variable 'job_count' set but not
    used [-Werror,-Wunused-but-set-variable]
        int i, num_jobs, job_count = 0;
                         ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:printing: Remove trailing whitespaces in vlp.c

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib:ldb-samba: Correctly handle search scope

lib/ldb-samba/ldb_ildap.c:482:47: error: implicit conversion from enumeration
    type 'enum ldb_scope' to different enumeration type 'enum ldap_scope'
    [-Werror,-Wenum-conversion]
                msg->r.SearchRequest.scope = req->op.search.scope;
                                           ~ ~~~~~~~~~~~~~~~^~~~~

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

nsswitch: Fix getting data out of pam_get_data()

nsswitch/pam_winbind.c:3360:24: error: cast from 'time_t **' (aka 'long **') to
    'const void **' must have all intermediate pointers const qualified to be safe
    [-Werror,-Wcast-qual]
                             (const void **)&pwdlastset_update);
                                            ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:samdb: Remove unused variable

source4/dsdb/samdb/ldb_modules/acl.c:1646:49: error: variable 'rep_val_cnt' set
    but not used [-Werror,-Wunused-but-set-variable]
        unsigned int del_val_cnt = 0, add_val_cnt = 0, rep_val_cnt = 0;
                                                       ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:samdb: Remove trailing whitespaces

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:winbind: Remove unused variable

source3/winbindd/winbindd_ads.c:1399:6: error: variable 'ret_count' set but not
    used [-Werror,-Wunused-but-set-variable]
        int ret_count;
            ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:rpcsrv:eventlog: Remove unused variable

source3/rpc_server/eventlog/srv_eventlog_nt.c:634:11: error: variable
  'num_records_read' set but not used [-Werror,-Wunused-but-set-variable]
        uint32_t num_records_read = 0;

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:smbd: Don't assign variable to itself

source3/smbd/msdfs.c:367:14: error: explicitly assigning value of variable of
    type 'char *' to itself [-Werror,-Wself-assign]
        servicename = servicename;
        ~~~~~~~~~~~ ^ ~~~~~~~~~~~

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:libsmb: Remove unused variable 'i'

namecache.c:129:9: error: variable 'i' set but not used
  [-Werror,-Wunused-but-set-variable]
        size_t i, count;
               ^

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

auth/credentials: Fix unitialized data

Fixing Red Hat internal covscan report:
Field "salt_data.magic" is uninitialized when calling "smb_krb5_create_key_from_string".

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

auth/credentials: Fix trailing whitespaces

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

pidl: avoid py compile issues with --pidl-developer

We get these warnings-as-errors:

librpc/gen_ndr/py_netlogon.c:61903:53: error: stray ‘\’ in program
61903 |    PyErr_Format(PyExc_TypeError, "Expected type %s",\  //<PIDL> Parse::Pidl::Samba4::Python::ConvertObjectFromPythonData  lib/Parse/Pidl/Samba4/Python.pm:2005

but the '\' is unnecessary and unconventional anyway, since we're in a
function argument list.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Feb  3 03:27:54 UTC 2023 on atb-devel-224

tevent/pytevent: remove no-op define

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tevent/pytevent: remove py2 ifdefs

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tdb/pytdb: remove useless HAVE_ITER non-flag

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tdb/pytdb: remove py ifdefs

This already would not compile with Python 2, because Py_TPFLAGS_HAVE_ITER
is not defined

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4/ndr/py_security: remove python 2 ifdefs

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4/ndr/py_misc: remove python 2 ifdefs

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

ldb/pyldb: remove py2 ifdefs

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

gp: Test samba-tool gpo cse register/unregister/list

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

gp: samba-tool gpo cse register/unregister/list

Add samba-tool commands for managing registration
of Client Side Extensions.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Python: remove pydoctor

Removes:

* waf pydoctor
* waf wafdocs
* make pydoctor

There is no "make wafdocs" it only appears to be in wscript.

The reasoning being is these are broken and appear to not have been run for some time.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Feb  2 21:15:54 UTC 2023 on atb-devel-224

mdssvc: fix kMDScopeArray parsing

In macOS Ventura marshalling of kMDScopeArray in the "openQueryWithParams"
request has changed from

  string: kMDScopeArray
  sl_array_t(#1): {
    string: /foo/bar
  }

to:

  string: kMDScopeArray
  sl_array_t(#1): {
    sl_array_t(#1): {
      string: /foo/bar
    }
  }

With this patch we check both encodings. Bug fixed according to user feedback.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15299
RN: Spotlight doesn't work with latest macOS Ventura

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

tevent: version 0.14.1

- Build fix for GNU/Hurd
- Build fix for Solaris, after removal
  of ports backend (bug #15298)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Feb  2 18:27:08 UTC 2023 on atb-devel-224

tevent: remove the already removed tevent_port.c also from the build

This fixes a regression introduced by 147a317b7b92e60c5940d875dbd7aef19824834e.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15298

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

replace: remove unused configure checks for port_create()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15298

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

replace: provide PIPE_BUF on GNU/Hurd

There is no hardcoded PIPE_BUF pipe limitation on GNU/Hurd, but POSIX
provides a minimum value that we can use.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s3:utils: Fix UNUSED_VALUE

Reported by RedHat internal Covscan

Since cb8a0d9 we no longer stop traversing the list if encryption_flag
or signing_flags are unknown.

Assignment "result = -1;" is always overwritten by
"result = traverse_connections_*()" and is a dead code.

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Feb  2 15:46:52 UTC 2023 on atb-devel-224

s3:utils: Fix trailing whitespaces

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4-drsuapi: Give an error that matches windows on destination_dsa_guid lookup failure

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan 31 13:43:54 UTC 2023 on atb-devel-224

s4-drsuapi: Clarify role of drs_security_access_check_nc_root()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-rpc_server: Pre-check destination_dsa_guid in GetNCChanges for validity

This allows our new tests to pass as these need to be checked first.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-drsuapi: Use samdb_get_ntds_obj_by_guid() to find RODC in REPL_SECRET

We need to find the RODC per the destination_dsa_guid to mark the secrets as
having been replicated, and by using samdb_get_ntds_obj_by_guid() we are stricter
in the checks, as the RODC has to be the right objectClass (nTDSDSA) and under
the CN=Configuration partition.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: Require that the NTDS object is an nTDSDSA objectclass

This should avoid a user being able to specify the GUID of a different
type of object.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: Split samdb_get_ntds_obj_by_guid() out of samdb_is_rodc()

This will allow the logic here to be tighened up and shared
in the next few commits.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-rpc_server/drsuapi: Return correct error code for an invalid DN to EXOP_REPL_OBJ/EXOP_REPL_OBJ

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-drs: Make drs_ObjectIdentifier_to_dn() safer and able to cope with DummyDN values

We want to totally ignore the string DN if there is a GUID,
as clients like "Microsoft Azure AD connect cloud sync" will
set a literal "DummyDN" string.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: rework drs_ObjectIdentifier_to_dn() into drs_ObjectIdentifier_to_dn_and_nc_root()

This make this funciton the gatekeeper between the wire format and the
internal struct ldb_dn, checking if the DN exists and which NC
it belongs to along the way, and presenting only a DB-returned
DN for internal processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-rpc_server/drsuapi: Use dsdb_normalise_dn_and_find_nc_root()

This reuses the search done for dsdb_find_nc_root() to normalise the DN.

This will allow a GUID-input DN to be compared safely with a RID Manager DN
or Naming Context.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: Add dsdb_normalise_dn_and_find_nc_root() around dsdb_find_nc_root()

Reuse the search done for dsdb_find_nc_root() to normalise the DN.

This will allow a GUID-input DN to be compared safely with a RID Manager DN
or Naming Context.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: Add better debugging to dsdb_objects_have_same_nc()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: Make dsdb_find_nc_root() first try and use DSDB_CONTROL_CURRENT_PARTITION_OID

This allows lookup of a DN with a GUID only or GUID and string,
possibly not yet in the database, yet still getting the correct result.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: Schedule SD propegation only after successful rename

This avoids needing to anticipate errors that the rename might give
while allowing the dsdb_find_nc_root() routine to become stricter.

The problem is that dsdb_find_nc_root() will soon do a real search and
so fail more often, but these failures will give "wrong" error codes.

We do not need to do this work if the operation fails, so put this in
the callback.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-selftest/drs: Confirm GetNCChanges REPL_SECRET works with a DummyDN and real GUID

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-selftest/drs: Confirm GetNCChanges full replication works with a DummyDN and real GUID

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-selftest/drs: Confirm GetNCChanges REPL_OBJ works with a DummyDN and real GUID

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-selftest/drs Allow re-run of DRS tests after failed cleanup

Using a random base is a useful start, even if the better solution also includes a self.AddCleanup()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-selftest/drs Allow some DRS tests to operate against an IP

This is not comprehensive, but makes some manual test runs easier by
avoiding the need for DNS names to resolve.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-selftest/drs Add test of expected return code for invaid DNs in GetNCChanges

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: Add tests of SamDB.get_nc_root()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10635

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4-dsdb: Rework dsdb_find_dn_by_guid() to use GUID_buf_string()

This avoids a talloc_strdup() and so a failure path.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

script:autobuild: Make sure we can send a failure mail

We should not run into an exception if the file doesn't exist.

Traceback (most recent call last):
  File "script/autobuild.py", line 1781, in <module>
    email_failure(-1, 'rebase', 'rebase', 'rebase',
  File "script/autobuild.py", line 1677, in email_failure
    f = open("%s/%s.stdout" % (gitroot, failed_tag), 'r')
FileNotFoundError: [Errno 2] No such file or directory:
  'samba-autobuild/rebase.stdout'

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jan 30 10:00:27 UTC 2023 on atb-devel-224

python: Replace calls to deprecated methods

These aliases are deprecated and have been removed in Python 3.12.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

samba-tool: Use ntstatus constants in gpo commands

Replace all the hard coded instances of ntstatus
codes in the samba-tool gpo commands with
constants from samba.ntstatus.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

samba-tool: Test gpo show/load handling of utf-16-le strings

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: gpo show/load handle utf-16-le strings

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: gpo load provide option for replace vs merge

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: gpo load set ntacl with SYSVOL file creation

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: gpo load add Registry ext by default

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: gpo load extension names

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: gpo load/remove increment GPT.INI

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: gpo load/remove bytes

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: Test gpo load/remove commands

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: gpo load/remove commands

These commands allow the setting of various group
policies on the sysvol.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

samba-tool: Move smb_connection to a common file

This is in preparation for needing it here later.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

samba-tool: Move create_directory_hier to a common file

This is in preparation for needing it here later.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

samba-tool: gpo show command list policies

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Tested-by: Kees van Vloten <keesvanvloten@gmail.com>

s3:lib: Change file_modtime() to return an error code and a struct timespec.

Removes need for external stat() code when checking for timechange.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 27 08:30:35 UTC 2023 on atb-devel-224

spelling fixes for 4.18 (errror implemenation proces Controler)

One of changes is somewhat interesting, it is "tfork waiter proces"
process title in tfork.c. I wonder why no one noticed this before.
There's another similar process title in there, "tfork waiter process(%d)".
Hopefully no one does grep for "proces$" (and there's no reason to).

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Rowland Penny <rpenny@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan 26 20:46:11 UTC 2023 on atb-devel-224

s3/lib: Prevent use after free of messaging_ctdb_fde_ev structs

In a cluster setup samba-bgqd async callback
cups_pcap_load_async can access messaging_ctdb_fde_ev associated
with already destructed global_ctdb_ctx_destructor

==26053== Invalid read of size 8
==26053==    at 0x71692E1: messaging_ctdb_fde_ev_destructor (messages_ctdb.c:181)
==26053==    by 0x40B2309: _tc_free_internal (talloc.c:1158)
==26053==    by 0x40B3539: _tc_free_children_internal (talloc.c:1669)
==26053==    by 0x40B24C4: _tc_free_internal (talloc.c:1184)
==26053==    by 0x40B3539: _tc_free_children_internal (talloc.c:1669)
==26053==    by 0x40B24C4: _tc_free_internal (talloc.c:1184)
==26053==    by 0x40B2685: _talloc_free_internal (talloc.c:1248)
==26053==    by 0x40B3963: _talloc_free (talloc.c:1792)
==26053==    by 0x4056BCA: tevent_req_received (tevent_req.c:301)
==26053==    by 0x405673D: tevent_req_destructor (tevent_req.c:135)
==26053==    by 0x40B2309: _tc_free_internal (talloc.c:1158)
==26053==    by 0x40B3539: _tc_free_children_internal (talloc.c:1669)
==26053==    by 0x40B24C4: _tc_free_internal (talloc.c:1184)
==26053==    by 0x40B2685: _talloc_free_internal (talloc.c:1248)
==26053==    by 0x40B3963: _talloc_free (talloc.c:1792)
==26053==    by 0x1384EF: cups_pcap_load_async (print_cups.c:507)
==26053==    by 0x13894B: cups_cache_reload (print_cups.c:602)
==26053==    by 0x1373AE: pcap_cache_reload (pcap.c:140)
==26053==    by 0x1369D2: register_printing_bq_handlers (queue_process.c:323)
==26053==    by 0x122AD6: main (samba-bgqd.c:316)
==26053==  Address 0xed64d48 is 120 bytes inside a block of size 128 free'd
==26053==    at 0x4C370EB: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==26053==    by 0x40B25E1: _tc_free_internal (talloc.c:1222)
==26053==    by 0x40B2685: _talloc_free_internal (talloc.c:1248)
==26053==    by 0x40B3963: _talloc_free (talloc.c:1792)
==26053==    by 0x71691F6: messaging_ctdb_destroy (messages_ctdb.c:141)
==26053==    by 0x7169C21: msg_ctdb_ref_destructor (messages_ctdb_ref.c:142)
==26053==    by 0x40B2309: _tc_free_internal (talloc.c:1158)
==26053==    by 0x40B3539: _tc_free_children_internal (talloc.c:1669)
==26053==    by 0x40B24C4: _tc_free_internal (talloc.c:1184)
==26053==    by 0x40B2685: _talloc_free_internal (talloc.c:1248)
==26053==    by 0x40B3963: _talloc_free (talloc.c:1792)
==26053==    by 0x4157380: messaging_reinit (messages.c:646)
==26053==    by 0x416C01E: reinit_after_fork (util.c:488)
==26053==    by 0x13844C: cups_pcap_load_async (print_cups.c:498)
==26053==    by 0x13894B: cups_cache_reload (print_cups.c:602)
==26053==    by 0x1373AE: pcap_cache_reload (pcap.c:140)
==26053==    by 0x1369D2: register_printing_bq_handlers (queue_process.c:323)
==26053==    by 0x122AD6: main (samba-bgqd.c:316)
==26053==  Block was alloc'd at
==26053==    at 0x4C346A4: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==26053==    by 0x40B1989: __talloc_with_prefix (talloc.c:783)
==26053==    by 0x40B1B23: __talloc (talloc.c:825)
==26053==    by 0x40B1ECC: _talloc_named_const (talloc.c:982)
==26053==    by 0x40B49C3: _talloc_zero (talloc.c:2421)
==26053==    by 0x7168E68: messaging_ctdb_init (messages_ctdb.c:93)
==26053==    by 0x716979D: messaging_ctdb_ref (messages_ctdb_ref.c:75)
==26053==    by 0x415702A: messaging_init_internal (messages.c:563)
==26053==    by 0x41572FD: messaging_init (messages.c:622)
==26053==    by 0x4163ED3: global_messaging_context (global_contexts.c:62)
==26053==    by 0x12273B: main (samba-bgqd.c:271)
==26053==

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15293

Signed-off-by: Noel Power <npower@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Thu Jan 26 16:03:49 UTC 2023 on atb-devel-224

s3:test: Test winbind call depth trace

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jan 26 15:07:57 UTC 2023 on atb-devel-224

s3:winbind: Move tevent_req_create() before debug macros to have the right call depth

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:winbind: Deactivate call depth tracking in child winbindd

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:winbind: Activate the call depth tracking in main winbindd

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

debug: Call depth: Indent the debug text

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

debug: Call depth: Print ", depth=..." in the debug header

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

debug: Call depth: Interface

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

debug: Fix whitespaces in debug.c

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15287

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

selftest: Update devel_env.sh for SAMBA_DCERPCD_DONT_LOG_STDOUT=1

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipen@redhat.com>

s3:tests: Add support for SMBD_DONT_LOG_STDOUT=1 in test_chdir_cache.sh

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15291

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

selftest: Only run samba.tests.smb3unix in developer mode

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jan 26 13:13:50 UTC 2023 on atb-devel-224

python:tests: Avoid exceptions in cleanup code if a test fails in smb3unix.py

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

param: Use a higher time resolution for lp_file_list_changed()

It is possible that in our test environment one of the config 'include' files
change more than once per second. To avoid missing a file update we use a
higher time resolution than seconds.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>