WHATSNEW: Add release notes for Samba 3.0.22.

Bug 10185 - CVE-2013-4408: DCERPC frag_len not checked
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10185

Bug 10306 - CVE-2012-6150: Fail authentication if user isn't member of *any*
require_membership_of specified groups
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10306
(BUG: https://bugzilla.samba.org/show_bug.cgi?id=10300)

Signed-off-by: Karolin Seeger <kseeger@samba.org>

CVE-2012-6150: Fail authentication for single group name which cannot be converted to sid

furthermore if more than one name is supplied and no sid is converted
then also fail.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10300
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10306

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
[ddiss@samba.org: fixed incorrect bugzilla tag I added to master commit]

CVE-2013-4408:s3:Ensure LookupRids() replies arrays are range checked.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

CVE-2013-4408:s3:Ensure LookupNames replies arrays are range checked.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s3:Ensure LookupSids replies arrays are range checked.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s3:Ensure we always check call_id when validating an RPC reply.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

CVE-2013-4408:libcli/util: add some size verification to tstream_read_pdu_blob_done()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s3:util_tsock: add some overflow detection to tstream_read_packet_done()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:async_sock: add some overflow detection to read_packet_handler()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s4:dcerpc_sock: check for invalid frag_len within sock_complete_packet()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s4:dcerpc_smb2: check for invalid frag_len in send_read_request_continue()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s4:dcerpc_smb: check for invalid frag_len in send_read_request_continue()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s4:dcerpc: check for invalid frag_len in ncacn_pull()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s3:rpc_client: verify frag_len at least contains the header size

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:s3:rpc_client: check for invalid frag_len in dcerpc_pull_ncacn_packet()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:librpc: check for invalid frag_len within dcerpc_read_ncacn_packet_next_vector()

We should do this explicit instead of relying on
tstream_readv_pdu_ask_for_next_vector() to catch the overflow.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

CVE-2013-4408:librpc: check for invalid frag_len within dcerpc_read_ncacn_packet_done()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

VERSION: Bump version up to 3.6.22.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit d57a4d130bcbf88b7f060439a33797be89353e29)

WHATSNEW: Add release notes for Samba 3.6.21.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit c458263e352328db49becec65157e9ec477bdacc)

spoolss: accept XPS_PASS datatype used by Windows 8

The new v4 driver model used in Windows 8 declares print jobs
intended to bypass the XPS processing layer by setting datatype to
"XPS_PASS" instead of "RAW".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10267

Reviewed-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit b2815b4c8c3e436a79fb7f07be285a417fd6e8cb)
(cherry picked from commit 4cfd6597bceeb0ef10d14bb7a48badd2264e85a6)

xattr: fix listing EAs on *BSD for non-root users

Thanks to Stefan Rompf for reporting.

This fixes bug #10247

Back-ported to 3.6.next from master commit 374b2cfde74e0c61f4b2da724b30d0e430596092

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit d984e764073df34729e5410026d6fa618699126f)

Fix bug #10118 - Samba is chatty about being unable to open a printer.
(cherry picked from commit 906db4fe8e6de2de67afa4655603e67d887c370b)

nsswitch: Fix short writes in winbind_write_sock

We set the socket to nonblocking and don't handle EAGAIN right. We do
a poll anyway, so wait for writability, which should fix this.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10195
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit c6909887c26d4e827633acd50b11cf08c6aee0f7)
Signed-off-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 3dfbea723553b268008063b280c808bb30951fdc)

s3-winbind: Send online/offline message of the domain to the parent.

https://bugzilla.samba.org/show_bug.cgi?id=10194

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Oct 11 13:37:56 CEST 2013 on sn-devel-104

(cherry picked from commit 275f6586c4d4547978c6ff2f04670b0d8f89fd4b)
(cherry picked from commit 80a5575849c903a3cb4a9bd74f029e5b7c293aa3)

s3-winbind: Register handlers for domain online/offline messages.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10194

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit fc5941622010843d823b5c245eccc68d1d3bce19)
(cherry picked from commit 920f8013ad5c57aaa941d5c7aea335726ed0bbae)

s3-winbind: Add functions for domain online/offline handling.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10194

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 447ec17a6bec814a2ac5cadb74dbef5789f07c52)
(cherry picked from commit 2d226b2717d0a30186636d17a8d890e1b7de8151)

idl: Add a new message for winbind domain states.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10194

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 1a884636542ba0e54c6d209662a5d1613d727a85)
(cherry picked from commit 272a22e2dba836f60a1f628206c14fe1a24f49c5)

Fix bug #10187 - Missing talloc_free can leak stackframe in error path.

Fix error path.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Wed Oct  9 03:50:56 CEST 2013 on sn-devel-104
(cherry picked from commit 63f370bdbad94d6aba7a4783d4238fcfc524b055)

Fix is_legal_name() to not emit character conversion error messages.

Using next_codepoint() does the same check, but without the conversion
message.

Signed-off-by: Jeremy Allison <jra@samba.org>
Fix bug #10139 - valid utf8 filenames cause "invalid conversion error" messages.
(cherry picked from commit ee0ef2a5b4b06fdb723a5232f90212fda5e853d1)

s3: smb2 server - fix bug 10167 smb2 breaks "smb encryption = mandatory

Refuse an SMB2 tcon on a share wher eencryption is required.
SMB2 doesn't support this.

Signed-off-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit e00a2c90847b3c85f089b4f3c96ec6c66b949576)

VERSION: Bump version up to 3.6.21.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit c2287276eb6533586ca1eac8b445ac1f93bcee98)

WHATSNEW: Add release notes for Samba 3.6.20.

Bug 10235 - CVE-2013-4475: No access check verification on stream files.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

Fix bug #10229 - No access check verification on stream files.

https://bugzilla.samba.org/show_bug.cgi?id=10229

We need to check if the requested access mask
could be used to open the underlying file (if
it existed), as we're passing in zero for the
access mask to the base filename.

Signed-off-by: Jeremy Allison <jra@samba.org>
Fix Bug #10235 - CVE-2013-4475: No access check verification on stream files.
https://bugzilla.samba.org/show_bug.cgi?id=10235

WHATSNEW: Start release notes for Samba 3.6.20.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit b63dbd748636adfe5c98050133b14c2b61396d11)

VERSION: Bump version up to 3.6.20.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit ca43d23fb64735f35c9865e306f82bd31d4730c9)

WHATSNEW: Prepare release notes for Samba 3.6.19.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit 153fe1298a904b1225c60d8817118e71f05752da)

s3:libnet increase timeout for machine password change

DCs might run password filter modules that can delay the setting of
the machine password for a significant amount of time
use the same timeout as in the other paths of domain join
(e.g. rpccli_netlogon_set_trust_password)

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 9755541ed156d71df98607375ee3b925266c3c74)

The last 2 patches address bug #8955 - NetrServerPasswordSet2 timeout is too
short.
(cherry picked from commit d1bf6e401a41172a47684518b9836899844fdefd)

s3: Give machine password changes 10 minutes of time

This is what we do at domain join time as well, see
lib/netapi/joindomain.c:141

Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit b9a15f1bfad30a824f9ec87bc9f7c65adf50dae0)
(cherry picked from commit a43c682553e5a731f9fbca8649ba042ae2bb5eba)

s3-serverid: call serverid_init_readonly() from commandline tools.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
The last 4 patches are follow-up patches for bug #10127 - smbstatus stopped
working as non-root user.
(cherry picked from commit 037f9ead5fc490e7e463671b76e8e8474a8728f5)

s3-serverid: add a readonly variant of the serverid init code.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 11d5d3d49ecec0d2ae924ff843e97cc39fa64a16)

s3-serverid: restructure serverid initialization.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
(cherry picked from commit ec1948d3a6adec3dd659abc8ab9c49a334c1e6a7)

s3-sessionid: move sessionid init call to the only function where it is needed.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 4b8b385042ace68c4ec59fea81bf8b284b34c356)

s3-sessionid: use sessionid_init_readonly() from cmdline tools.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
The last 3 patches address bug #10127 - smbstatus stopped working as non-root
user.
(cherry picked from commit 5978eab3cdbbc8971ed7f0fd9f0aadb02c98aba7)

s3-sessionid: change session_db_ctx() to always return the session_id_ctx pointer.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
(cherry picked from commit d1352013bb694a30480282e398e29238470b0768)

s3-sessionid: make sure to call sessionid_init() also from the cmdline tools.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
(cherry picked from commit 039171a9d1fc72de39ee8aa51830a37221988859)

Optimization. Don't do the retry logic if sitename_fetch() returned NULL, we already did a NULL query.

Bug 5917 - Samba does not work on site with Read Only Domain Controller

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Sep  4 01:19:05 CEST 2013 on sn-devel-104

(cherry picked from commit bdab6f9431715fbfd28f8cc0dfb4dde2966f22f3)
(cherry picked from commit 66b9ebd961efe91b87156abf1bb5e1b8f2b87c38)

Move the retry logic when site_name is passed in a NULL or "" to the wrapper function.

Bug 5917 - Samba does not work on site with Read Only Domain Controller

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Richard Sharpe <rsharpe@samba.org>
(cherry picked from commit 68e7b1c9446c7d1274b0fb85b59b90ac1a7f6041)
(cherry picked from commit f3d767ac0f6e3b07abf5672ae488ae57bc557677)

Move the manipulation of site_name into the caller function dsgetdcname().

Leave dsgetdcname_internal() only using const char *site_name.

Bug 5917 - Samba does not work on site with Read Only Domain Controller

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Richard Sharpe <rsharpe@samba.org>
(cherry picked from commit 181c11066bd53b07015a199f56eb71182e89ff71)
(cherry picked from commit c968f9cb46b44a4d1b257a89381898d16086ae26)

Refactor dsgetdcname to be called via a wrapper function.

Bug 5917 - Samba does not work on site with Read Only Domain Controller

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Richard Sharpe <rsharpe@samba.org>
(cherry picked from commit 66006be7ef703b2935334633d27641050cee5f58)
(cherry picked from commit ac4ce44d787f448e8dce7b2eca558cecdc75499e)

dsgetdcname_cache_fetch() doesn't use the site_name parameter so don't pass it.

Bug 5917 - Samba does not work on site with Read Only Domain Controller

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Richard Sharpe <rsharpe@samba.org>
(cherry picked from commit dd12bfbcbf359c1642cc2e968aec62ae904aad5d)
(cherry picked from commit deac844f4ec4bca559285744e8c6ba924c8f492a)

smbd: Correctly return INFO_LENGTH_MISMATCH for smb1

This is required if the client offered less buffer than the fixed portion
of the info level data requires

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10106
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 1b1935b876a14154ef74e447bf53eb7cd0a5dde9)
(cherry picked from commit 41a7d66a399c3e1ad999dce5d14570d60c4d53d2)

smbd: Fix error return for STREAM_INFO

The stream_info marshalling follows its own rules. This needs unifying
eventually...

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10106
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 5634f240fd4273cb7327111140ccbea0fd41e3fc)
(cherry picked from commit a63ca3ed840ca4ab19b4b4bd9238b663228ac2a6)

smbd: Revert a93f9c3

This was too broad and has been replaced by finer-grained error checks

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10106
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit b37edda32930fec372d6467d442f67532c3fbd33)
(cherry picked from commit c8e72447345bb5b737e8383cba069098f387de0a)

smbd: Correctly return BUFFER_OVERFLOW in smb2_getinfo

Also, don't overflow the client buffer

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10106
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 40f60024ca19e33cbbe9825b42692f386a8f1dd9)
(cherry picked from commit f5dfa2ac931d52b4517f4e5e07cf9730e6939967)

smbd: Correctly return INFO_LENGTH_MISMATCH in smb2_getinfo

We have to return this error if the client offered less than the fixed
portion of the infolevel data requires

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10106
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 91939614760837b2ac2c6bb8b5daac108a4f4670)
(cherry picked from commit 9818b31167531f41cbf08fccf89d60ca128c3d4d)

smbd: qfsinfo has fixed/variable buffers

The error message will have to change depending whether the buffer is
too small for the fixed or variable buffers

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10106
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit ac41df91a5a425633fc716ca02187e753879d795)
(cherry picked from commit a3d041438f2f0fde9644ec27b89f19ded3146f50)

smbd: qfilepathinfo has fixed/variable buffers

The error message will have to change depending whether the buffer is
too small for the fixed or variable buffers

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10106
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 53123996033594f68a3fc9037474aada3aef0750)
(cherry picked from commit d0f6c38f9638173b34e1a174b8811df83e045f5c)

smbd: Use #defines in smb2_getinfo_send

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Tue Aug 27 15:08:08 CEST 2013 on sn-devel-104

(cherry picked from commit 323cccd35d06c7327c19dc5cb891043507624d7d)
(cherry picked from commit 5efd0ca590670a142631db1c2133450a1020ba60)

s3:smbd: allow info class SMB_QUERY_FS_ATTRIBUTE_INFO to return partial data

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
(cherry picked from commit 270d29a743a030653037cb176f3764bec3c79b6c)
(cherry picked from commit 65d4f0b5125ebea659d0277916bb74db2c3b9cc0)

s3:smbd: allow info class SMB_QUERY_FS_VOLUME_INFO to return partial data

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
(cherry picked from commit ec46f6b91941e38dd92f8e0fb0f278592e3157b6)
(cherry picked from commit 84eabf7b012fba624e900f2cc0294f2f1c598a46)

s3:smbd: allow status code in smbd_do_qfsinfo() to be set by information class handler

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
(cherry picked from commit 616777f029e462f53c5118d79de8c6405a5fb7c1)
(cherry picked from commit a410c51fca3644ebf7a32512dc1075a23bfc8d38)

s3:smbd: allow GetInfo responses with STATUS_BUFFER_OVERFLOW to return partial, but valid data

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
(cherry picked from commit a91d2b05bab329a8a9772c2c79a3b1e02933182e)
(cherry picked from commit 331a0e8e85727724466d7a795435b8eca36b3e17)

s3:smbd: return NT_STATUS_INFO_LENGTH_MISMATCH for GetInfo in case output_buffer_length is too small

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
(cherry picked from commit a93f9c3d33e442c84d0c9da7eb5d25ca4b54fc33)
(cherry picked from commit f351fbe1fc9236ddbf52afecf872cdf7e53cae85)

smbd: Simplify dropbox special case in unix_convert

EACCESS needs special treatment: If we want to create a fresh file,
return OBJECT_PATH_NOT_FOUND, so that the client will continue creating
the file. If the client wants us to open a potentially existing file,
we need to correctly return ACCESS_DENIED.

This patch makes this behaviour hopefully a bit clearer than the code
before did.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
The last 2 patches address bug #10114 - Dropbox (write-only-directory) case
isn't handled correctly in pathname lookup.
(cherry picked from commit 0150086d44e90351634a68aced1e44ad076a693c)

smbd: Fix a profile problem

When trying to read a profile, under certain circumstances Windows tries
to read with its machine account first. The profile previously written
was stored with an ACL that only allows access for the user and not
the machine. Windows should get an NT_STATUS_ACCESS_DENIED when using
the machine account, making it retry with the user account (which would
then succeed).

Samba under these circumstances erroneously gives
NT_STATUS_OBJECT_PATH_NOT_FOUND, which makes Windows give up and not
retry. The reasons is the "dropbox" patch in unix_convert, turning EACCESS
on the last path component to OBJECT_PATH_NOT_FOUND. This patch makes
the dropbox behaviour only kick in when we are creating a file. I think
this is an abstraction violation. unix_convert() should not have to know
about the create_disposition, but given that we have pathname resolution
separated from the core open code right now this is the best we can do.

Signed-off-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit b55072ccf8d801726aec49a925f5a69277a10494)

s3-winbindd: fix fallback to ncacn_np in cm_connect_lsat().

Fallback to lsa named-pipe connection when tcp connection has failed twice (it
could be a trusted domain connection where we cannot setup a secure channel).

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9615
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9899

Signed-off-by: Günther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Tested-by: Christof Schmitt <christof.schmitt@us.ibm.com>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Aug 13 20:55:33 CEST 2013 on sn-devel-104
(cherry picked from commit 87adc2118677b7cabc3f3b476313b254856f5f9d)

Fix bug #10097 - MacOSX 10.9 will not follow path-based DFS referrals handed out by Samba.

Windows overloads the EA Length field in the DIRECTORY INFO leves of FIND FIRST/FIND NEXT.

This field indicates either the REPARSE_TAG if the file/folder has a reparse proint or
the EA Length if it has EAs, and is the fundamental reason you cannot have both on a
file or folder.

Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 3dd2f645a054b47d709a6b6f6968f86b9e916d49)

docs: Fix variable list in man vfs_crossrename.

The varlist entries need a paragraph, otherwise the list is broken and the list
entries end with ".RE".

Fix bug #10076 - varlist in man vfs_crossrename broken.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Aug 20 04:19:42 CEST 2013 on sn-devel-104
(cherry picked from commit 1808316b1245290fd4a4aa87a801410899e4c1e3)
(cherry picked from commit db77fc0184eea3ee1a73111b84a2e1ad976ad612)

s3-libads: Print a message if no realm has been specified.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Aug  5 12:24:44 CEST 2013 on sn-devel-104

(cherry picked from commit 6659f0164c6b8d7ad522bcd6c2c6748c3d9bca81)

The last 2 patches address bug #10073 - net ads join - segmentation fault in
create_local_private_krb5_conf_for_domain.
(cherry picked from commit 8d40163e7a25091bcdbe90d5c91bcec088b097d5)

s3-libads: Fail create_local_private_krb5_conf_for_domain() if parameters missing.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 6dc7c63efa95d0c04b542667d9b6a6621c8139bf)
(cherry picked from commit c472ffab2854537b9e5d6238e68c04bfe2bd5e69)

s3-winbind: Do not delete an existing valid credential cache.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9994

Thanks to David Woodhouse <dwmw2@infradead.org>.

Reviewed-by: Günther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jul 15 12:48:46 CEST 2013 on sn-devel-104

(cherry picked from commit 0529b59fbe3f96509893fc4e93a75d6928b5a532)
(cherry picked from commit 64732d3d317be8bb3b3579455ce3b3d5c81b6ad8)

WHATWNEW: Start release notes for Samba 3.6.19.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit f14cd4118cc8e27bbc58ab5f815d0ae8d882bec5)

VERSION: Bump version up to 3.6.19.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit bfdf8da16d02f5a8b1e34c61f07280fa39bafc4c)

WHATSNEW: Prepare release notes for Samba 3.6.18.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit 3a8cab366ce6ce0f2a32a6df2f6f8fcf549a9dd3)

Ensure gpfs kernel leases are wrapped in a become_root()/unbecome_root() pair.

Ensures correct lease owner for signal delivery.

Signed-off-by: Ralph Wuerthner <ralphw@de.ibm.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Aug  1 03:57:11 CEST 2013 on sn-devel-104

The last 2 patches address bug #10064 - Linux kernel oplock breaks can miss
signals.
(cherry picked from commit 9ef80fcff6e0d03e30bd675cd7ebfc88608e81d6)

Wrap setting leases in become_root()/unbecome_root() to ensure correct delivery of signals.

Remove workaround for Linux kernel bug https://bugzilla.kernel.org/show_bug.cgi?id=43336
as we don't need to set capabilities when we're already root.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit 363025491d97171e130a7b8dd03296b9559799a0)

Fix bug 9678 - Windows 8 Roaming profiles fail

Windows 8 tries to set 'ATTRIBUTE_SECURITY_INFORMATION' on some
dirs. Ignoring it makes roaming profiles work again.
Just like w2k3 gracefully ignore all the other bits.

Signed-off-by: Gregor Beck <gbeck@sernet.de>
(cherry picked from commit b085c39d9e39d305b715fd73c267eff0fc5fd4c4)

security.idl: add new security_secinfo bits

[MS-DTYP].pdf 2.4.7

Signed-off-by: Gregor Beck <gbeck@sernet.de>
(cherry picked from commit 326ebbdaca4d13fa498779f960a202955531576b)

build:autoconf: fix output of syslog-facility check

thanks to Thomas Bork for reporting!

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Fix bug #9983 - configure and syslog facility and disk-quotas support.
(cherry picked from commit dbb52ee98b84659386d70f0e75b0fa93fada1a97)

PIDL: fix parsing linemarkers in preprocessor output

When PIDL calls out to C preprocessor to expand IDL files
and parse the output, it filters out linemarkers and line control
information as described in http://gcc.gnu.org/onlinedocs/cpp/Preprocessor-Output.html
and http://gcc.gnu.org/onlinedocs/cpp/Line-Control.html#Line-Control

With gcc 4.8 stdc-predef.h is included automatically and linemarker for the
file has extended flags that PIDL couldn't parse ('system header that needs to
be extern "C" protected for C++')

Thanks to Jakub Jelinek <jakub@redhat.com> for explanation of the linemarker format.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=906517

Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 6ba7ab5c14801aecae96373d5a9db7ab82957526)

Signed-off-by: Andreas Schneider <asn@samba.org>
Fix bug #9636 - pidl can't parse new linemarkers in preprocessor output.
(cherry picked from commit 643571470f2e4cd2f58bd60ac7189abb826d33cc)
(cherry picked from commit b5a8afd6550e9091d169d3010751913bb483fc4b)

libreplace: add a missing "eval" to the AC_VERIFY_C_PROTOTYPE macro

Without this eval, upon test success the corresponding actions
(like defining corresponding variables) are not taken.

Found by Timur I. Bakeyev, and based on his patch for 3.5.
(cherry picked from commit 0ef506d4f31d206c300e4f3f326edac2b60bdc15)
(cherry picked from commit e98d3b7648fe298f03e408ab91b8b53904bab8ca)

docs: mention AD prerequirements for using idmap_ad

Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit c3057f69a274f0d8e0e66183bd5e8be7703b6750)

Reviewed-by: David Disseldorp <ddiss@samba.org>
The last 2 patches address bug #9880 - Use of wrong RFC2307 primary group field.
(cherry picked from commit 006ba0cc73a3fe484452f594a25dd3bfee9b39fd)

winbind/idmap_ad: be verbose about the user that we fail to map

Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit f08205be7003f6c0a15fd5fd99d01951164ad15c)

Reviewed-by: David Disseldorp <ddiss@samba.org>
(cherry picked from commit 17794737fedf095212cf45920dd1e29b5a1a9fa0)

Ensure we test the dirsort module in make test.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Apr 11 21:17:21 CEST 2013 on sn-devel-104

The last 10 patches address bug #9777 - vfs_dirsort uses non-stackable calls,
dirfd(), malloc instead of talloc and doesn't cope with directories being
modified whilst reading.
(cherry picked from commit 1f601d14d0ee440126d7202924e5cf7af88f6ea3)

Remove unneeded initializations (we already talloc_zero).

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 8a1ec80ee233405f2f484c31a8d6e4b2702678e0)

Remove the use of dirfd inside the vfs_dirsort.c.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit ffc2d250d2d0fd59a1524e15c4be5cf53d5b0135)

Convert mtime from a time_t to a struct timespec.

In preparation for removing the dirfd and using fsp_stat()
and VFS_STAT functions.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 8a761c7806fddd0faa919f343a079f8d4f343316)

Check SMB_VFS_NEXT_OPENDIR return in dirsort_opendir().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 052f74c2122301a3be19ab84ee4551f3259a3ee5)

Clean error paths in opendir and fd_opendir by only setting handle data on success.

Pass extra struct dirsort_privates * to open_and_sort_dir() function
to avoid it having to re-read the handle data.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit a2da5a78c48e9be6ec2ecad99ddd23d4773b2267)

Protect open_and_sort_dir() from the directory changing size.

Otherwise there could be an error between initial count, allocation
and re-read.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 582d8ca565ad12133a4319650e886f58246b3bd9)

Use an index i rather than re-using a state variable.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit f81822166d8d41c6c3ee6f17924ebe87e4303211)

Protect against early error in SMB_VFS_NEXT_READDIR.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit f34063ed9cd3d6a4542c39ad576c6ecc807878e8)

Change source3/modules/vfs_dirsort.c from MALLOC -> TALLOC.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit e2118fd251ac64f47a9ee4ea18a441ae1941fe4e)

WHATSNEW: Start release notes for Samba 3.6.18.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit cb48b067251c3a523b1bdc10bf4b3ff4fc8b104f)

VERSION: Bump version number up to 3.6.18.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit dda0d8da02a41be149af5b66e6b77dae2fd6f227)

WHATSNEW: Add release notes for Samba 3.6.17.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

Fix bug #10010 - Missing integer wrap protection in EA list reading can cause server to loop with DOS.

Ensure we never wrap whilst adding client provided input.
CVE-2013-4124

Signed-off-by: Jeremy Allison <jra@samba.org>

WHATSNEW: Start release notes for Samba 3.6.17.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit 1e064e91759b541bfee81c9f0df9392d12ba9e84)

VERSION: Bump version number up to 3.6.17.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit 35c13477545df38c279ba83eeba5fe3273bdf41f)

WHATSNEW: Add another fix since 3.6.15.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit c81635ab7a6f2d6ed68cba92809053ea036dae76)