samba.git
3 years agos3: smbd: Correctly reflect back SMB_PIDHIGH to a client.
Per Forlin [Sat, 11 Jun 2016 00:00:55 +0000 (17:00 -0700)]
s3: smbd: Correctly reflect back SMB_PIDHIGH to a client.

Torture test to follow.

Signed-off-by: Per Forlin <per.forlin@gmail.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agos3: libsmb: Widen the internal client smb1.pid to 32-bits as is used on the wire...
Jeremy Allison [Fri, 10 Jun 2016 23:51:11 +0000 (16:51 -0700)]
s3: libsmb: Widen the internal client smb1.pid to 32-bits as is used on the wire and in libcli/smb/smb1*.c

Note: This has *NO* effect on the lock context code, as on the
wire for all SMB1 locking requests, the pid used as the lock
context is already truncated down to 16-bits - the field is only
16-bits wide.

This allows the cli_XXX() calls to correctly set pidlow AND pidhigh
in SMB1 requests put on the wire by the libcli/smb/smb1*.c code.

Note that currently the smbd server doesn't correctly return
pidhigh yet - a fix (and tests) for that will follow.

As pidhigh is not checked in any client code (mid is used
to differentiate different requests) this has no effect
other than a correctness fix.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agos4: libcli: Internal SMB1 pid is already stored as and uses 32-bits. Correct getpid...
Jeremy Allison [Fri, 10 Jun 2016 23:15:22 +0000 (16:15 -0700)]
s4: libcli: Internal SMB1 pid is already stored as and uses 32-bits. Correct getpid() cast.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agoselftest: Remove nbt wait time
Andreas Schneider [Fri, 17 Jun 2016 08:01:19 +0000 (10:01 +0200)]
selftest: Remove nbt wait time

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jun 17 22:15:09 CEST 2016 on sn-devel-144

3 years agoselftest: Add newlines for info output
Andreas Schneider [Fri, 17 Jun 2016 08:47:06 +0000 (10:47 +0200)]
selftest: Add newlines for info output

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: Fix indentation in wait_for_start()
Andreas Schneider [Fri, 17 Jun 2016 07:48:19 +0000 (09:48 +0200)]
selftest: Fix indentation in wait_for_start()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: Consistently check for provision return code
Andreas Schneider [Fri, 17 Jun 2016 07:23:49 +0000 (09:23 +0200)]
selftest: Consistently check for provision return code

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: Remove unneeded sleep before first ldbsearch execution
Andreas Schneider [Fri, 17 Jun 2016 11:03:48 +0000 (13:03 +0200)]
selftest: Remove unneeded sleep before first ldbsearch execution

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: Use the correct smb.conf for ldbsearch
Andreas Schneider [Fri, 17 Jun 2016 11:03:34 +0000 (13:03 +0200)]
selftest: Use the correct smb.conf for ldbsearch

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib/ldb-samba: We can confirm a GUID is a GUID by length
Andrew Bartlett [Wed, 15 Jun 2016 03:42:18 +0000 (15:42 +1200)]
lib/ldb-samba: We can confirm a GUID is a GUID by length

The GUID_from_ndr_blob() is pointless and costly

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jun 17 18:13:56 CEST 2016 on sn-devel-144

3 years agoselftest: Do not run local.ndr 3 times
Andrew Bartlett [Tue, 14 Jun 2016 08:08:40 +0000 (20:08 +1200)]
selftest: Do not run local.ndr 3 times

This is already run from under source4/selftest/tests.py

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoflapping: remove samba_dnsupdate from flapping
Garming Sam [Fri, 17 Jun 2016 00:51:47 +0000 (12:51 +1200)]
flapping: remove samba_dnsupdate from flapping

nsupdate is now installed

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
3 years agorepl: Avoid excessive stack use and instead sort the links in the heap
Andrew Bartlett [Mon, 13 Jun 2016 04:41:08 +0000 (16:41 +1200)]
repl: Avoid excessive stack use and instead sort the links in the heap

The two large stack-based arrays would overflow the stack, this avoids
a duplicate of the struct drsuapi_DsReplicaLinkedAttribute array

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agogetncchanges: Match Windows on linked attribute sort
Garming Sam [Thu, 9 Jun 2016 05:03:18 +0000 (17:03 +1200)]
getncchanges: Match Windows on linked attribute sort

The order of linked attributes depends on comparison of the NDR packed
GUIDs (not its struct GUID form).

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agogetncchanges: sort with precalculated target guid array
Garming Sam [Mon, 6 Jun 2016 23:56:49 +0000 (11:56 +1200)]
getncchanges: sort with precalculated target guid array

This avoids reparsing the linked attribute and schema refetching.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agogetncchanges: remove some whitespace
Garming Sam [Mon, 6 Jun 2016 23:57:02 +0000 (11:57 +1200)]
getncchanges: remove some whitespace

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agotests/drs: change sort order in tests to match Windows
Garming Sam [Thu, 9 Jun 2016 03:54:25 +0000 (15:54 +1200)]
tests/drs: change sort order in tests to match Windows

Although we attempted to sort by GUID based on DRSR, it is actually
sorted by the ndr packed GUID.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agotests/drs: assert sorted identifier GUIDs across getncchanges
Garming Sam [Thu, 9 Jun 2016 02:55:57 +0000 (14:55 +1200)]
tests/drs: assert sorted identifier GUIDs across getncchanges

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agotests/drs: make cleanup more robust
Garming Sam [Wed, 8 Jun 2016 22:56:28 +0000 (10:56 +1200)]
tests/drs: make cleanup more robust

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agotests/drs: extend getnc_exop test to check linked attributes
Garming Sam [Tue, 7 Jun 2016 23:10:58 +0000 (11:10 +1200)]
tests/drs: extend getnc_exop test to check linked attributes

Assert that linked attributes propagate across DRS and come in a
particular sorted order.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agolibnet: only create local private krb5.conf if joining an AD domain
Michael Adam [Wed, 15 Jun 2016 22:15:00 +0000 (00:15 +0200)]
libnet: only create local private krb5.conf if joining an AD domain

This prevents irritating warning messages.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jun 17 08:13:55 CEST 2016 on sn-devel-144

3 years agowinbind: honor 'socket options' in winbind
Jim McDonough [Wed, 15 Jun 2016 19:57:01 +0000 (15:57 -0400)]
winbind: honor 'socket options' in winbind

Set socket options from smb.conf before negprot, as done by libsmbclient

Signed-off-by: Jim McDonough <jmcd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
3 years agos4: dns: Correctly check for talloc failure.
Jeremy Allison [Thu, 16 Jun 2016 04:25:59 +0000 (21:25 -0700)]
s4: dns: Correctly check for talloc failure.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jun 16 16:55:15 CEST 2016 on sn-devel-144

3 years agoflapping: temporarily add samba_dnsupdate test
Garming Sam [Wed, 15 Jun 2016 04:32:23 +0000 (16:32 +1200)]
flapping: temporarily add samba_dnsupdate test

This should be removed when we can run nsupdate on sn-devel

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Thu Jun 16 08:37:56 CEST 2016 on sn-devel-144

3 years agodrs: Send DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP by default
Garming [Tue, 14 Jun 2016 22:05:34 +0000 (10:05 +1200)]
drs: Send DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP by default

This flag is not implemented in Samba, however, on an RODC replicating from
Windows, failing to send this flag leaves out group memberships.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: Remove print attribute from getnc_exop test
Andrew Bartlett [Tue, 14 Jun 2016 07:55:44 +0000 (19:55 +1200)]
selftest: Remove print attribute from getnc_exop test

This otherwise fills the logs with every object

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: Add a DNS test matching Windows
Andrew Bartlett [Fri, 10 Jun 2016 03:40:59 +0000 (15:40 +1200)]
selftest: Add a DNS test matching Windows

This performs the same steps as Windows does

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agodns_server: Fix typo in dns_authoritative_for_zone() name.
Garming Sam [Mon, 30 May 2016 22:48:15 +0000 (10:48 +1200)]
dns_server: Fix typo in dns_authoritative_for_zone() name.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: confirm samba_dnsupdate works in both nsupdate and samba_tool mode
Andrew Bartlett [Tue, 1 Sep 2015 03:58:30 +0000 (15:58 +1200)]
selftest: confirm samba_dnsupdate works in both nsupdate and samba_tool mode

This can be extended, but already checks the basic functionality

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: Always set up a resolv.conf and use it in samba_dnsupdate
Andrew Bartlett [Fri, 10 Jun 2016 03:43:37 +0000 (15:43 +1200)]
selftest: Always set up a resolv.conf and use it in samba_dnsupdate

This allows samba_dnsupdate to be tested without resolv_wrapper.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: Ensure we write 127. addresses into DNS
Andrew Bartlett [Fri, 28 Aug 2015 03:07:49 +0000 (15:07 +1200)]
selftest: Ensure we write 127. addresses into DNS

The --all-interfaces option is required both with and without the dns_host_file

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agosamba_dnsupdate: Give the administrator more detail when DNS lookups fail
Andrew Bartlett [Wed, 12 Aug 2015 23:34:36 +0000 (11:34 +1200)]
samba_dnsupdate: Give the administrator more detail when DNS lookups fail

This avoids treating server errors identically to name-not-present status values

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agosamba_dnsupdate: Implement RPC <ZONE> prefix in dns_update_list
Andrew Bartlett [Tue, 11 Aug 2015 00:37:01 +0000 (12:37 +1200)]
samba_dnsupdate: Implement RPC <ZONE> prefix in dns_update_list

This allows us to update the stub records as well as the zone itself.

Based on a proposed syntax by metze.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agosamba_dnsupdate: Simplify logic and add more verbose debugging
Andrew Bartlett [Mon, 10 Aug 2015 00:15:04 +0000 (12:15 +1200)]
samba_dnsupdate: Simplify logic and add more verbose debugging

By reducing the intendation this code is a little clearer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agosamba_dnsupdate: Allow admin to force a particular IP into samba_dnsupdate
Andrew Bartlett [Fri, 7 Aug 2015 02:57:20 +0000 (14:57 +1200)]
samba_dnsupdate: Allow admin to force a particular IP into samba_dnsupdate

This should help in deployements beyind NAT.

It will also help in testing.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agodns_update_list: Add in NS records
Andrew Bartlett [Mon, 2 Mar 2015 00:37:54 +0000 (13:37 +1300)]
dns_update_list: Add in NS records

This is as suggested by metze in 4383ec5b83d12bd19749582217f082cbaa31a128

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agosamba_dnsupdate: Add a mode that calls samba-tool dns, rather than nsupdate
Andrew Bartlett [Wed, 25 Feb 2015 23:29:23 +0000 (12:29 +1300)]
samba_dnsupdate: Add a mode that calls samba-tool dns, rather than nsupdate

This mode is more likely to work when we change hostname or IP

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agosamba_dnsupdate: Work around a bug in nsupdate
Andreas Schneider [Tue, 25 Aug 2015 15:26:05 +0000 (17:26 +0200)]
samba_dnsupdate: Work around a bug in nsupdate

The doio_send() function of bind fails on a short write with sendmsg().

See https://bugzilla.redhat.com/show_bug.cgi?id=1250921

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agosamba_dnsupdate: Fix typo in -no-substitutions name
Garming Sam [Thu, 26 May 2016 02:12:40 +0000 (14:12 +1200)]
samba_dnsupdate: Fix typo in -no-substitutions name

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotests/drs: cleanup some whitespace
Garming Sam [Tue, 7 Jun 2016 23:11:15 +0000 (11:11 +1200)]
tests/drs: cleanup some whitespace

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agodrsuapi.idl: Add attid used in testing in idl
Garming Sam [Wed, 8 Jun 2016 02:19:42 +0000 (14:19 +1200)]
drsuapi.idl: Add attid used in testing in idl

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11960

3 years agoselftest: Check a user with only primaryGroupID is correct in samr.GetUserGroups...
Andrew Bartlett [Thu, 9 Jun 2016 02:56:02 +0000 (14:56 +1200)]
selftest: Check a user with only primaryGroupID is correct in samr.GetUserGroups() reply

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: Test that primaryGroupID is first in samr.GetUserGroups() reply
Andrew Bartlett [Thu, 9 Jun 2016 02:55:24 +0000 (14:55 +1200)]
selftest: Test that primaryGroupID is first in samr.GetUserGroups() reply

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: Add alias membership to the tokengroups test
Andrew Bartlett [Thu, 9 Jun 2016 02:54:47 +0000 (14:54 +1200)]
selftest: Add alias membership to the tokengroups test

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4-samr: Rework GetGroupsForUser to use memberOf
Andrew Bartlett [Wed, 8 Jun 2016 04:49:01 +0000 (16:49 +1200)]
s4-samr: Rework GetGroupsForUser to use memberOf

By reading the SID values from the memberOf links, we avoid an un-indexed search on
the member attribute.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4-libcli/raw: Fix compiler errors when building with --address-sanitizer
Andrew Bartlett [Tue, 7 Jun 2016 03:43:29 +0000 (15:43 +1200)]
s4-libcli/raw: Fix compiler errors when building with --address-sanitizer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4-kcc: Fix compiler errors when building with --address-sanitizer
Andrew Bartlett [Tue, 7 Jun 2016 03:43:13 +0000 (15:43 +1200)]
s4-kcc: Fix compiler errors when building with --address-sanitizer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos3-vfs/snapper: Fix compiler errors when building with --address-sanitizer
Andrew Bartlett [Tue, 7 Jun 2016 03:43:01 +0000 (15:43 +1200)]
s3-vfs/snapper: Fix compiler errors when building with --address-sanitizer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos3-libnet: Fix compiler errors when building with --address-sanitizer
Andrew Bartlett [Tue, 7 Jun 2016 03:42:41 +0000 (15:42 +1200)]
s3-libnet: Fix compiler errors when building with --address-sanitizer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos3-client: Fix compiler errors when building with --address-sanitizer
Andrew Bartlett [Tue, 7 Jun 2016 03:42:33 +0000 (15:42 +1200)]
s3-client: Fix compiler errors when building with --address-sanitizer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agolibgpo: Fix compiler errors when building with --address-sanitizer
Andrew Bartlett [Tue, 7 Jun 2016 03:42:23 +0000 (15:42 +1200)]
libgpo: Fix compiler errors when building with --address-sanitizer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agolibcli/smb: Fix compiler errors when building with --address-sanitizer
Andrew Bartlett [Tue, 7 Jun 2016 03:42:15 +0000 (15:42 +1200)]
libcli/smb: Fix compiler errors when building with --address-sanitizer

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: Expand tokenGroups test to also compare with samr.GetGroupsForUser
Andrew Bartlett [Wed, 8 Jun 2016 02:46:07 +0000 (14:46 +1200)]
selftest: Expand tokenGroups test to also compare with samr.GetGroupsForUser

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: Expand tokenGroups test to also build nested groups
Andrew Bartlett [Wed, 8 Jun 2016 02:45:47 +0000 (14:45 +1200)]
selftest: Expand tokenGroups test to also build nested groups

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4-samr: Fix samr.QueryUserInfo level 1 primary group
Andrew Bartlett [Thu, 9 Jun 2016 02:56:44 +0000 (14:56 +1200)]
s4-samr: Fix samr.QueryUserInfo level 1 primary group

Because of this typo, the primary group ID was returned as 0

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agosamba-tool domain join: Refuse to re-join a DC with a still-valid password
Andrew Bartlett [Tue, 31 May 2016 02:54:45 +0000 (14:54 +1200)]
samba-tool domain join: Refuse to re-join a DC with a still-valid password

While the DC will eventually get back to the same state, it can take a
while, so try harder not to overwrite our already-working account

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agosamba-tool: Improve fsmo handling
Andrew Bartlett [Fri, 3 Jun 2016 02:50:55 +0000 (14:50 +1200)]
samba-tool: Improve fsmo handling

This makes a clear seperation between data and display variables
and improves the tests.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: Rebase DrsBaseTestCase on SambaToolCmdTest
Andrew Bartlett [Wed, 1 Jun 2016 09:27:07 +0000 (21:27 +1200)]
selftest: Rebase DrsBaseTestCase on SambaToolCmdTest

This then makes SambaToolCmdTest based on BlackboxTestCase.

This allows us to use better command output testing in the fsmo tests

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agoselftest: add test for DNS updates with TKEY/TSIG
Ralph Boehme [Wed, 4 May 2016 12:26:16 +0000 (14:26 +0200)]
selftest: add test for DNS updates with TKEY/TSIG

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Thu Jun 16 04:07:41 CEST 2016 on sn-devel-144

3 years agos4/dns_server: enable sending of TSIG error records
Ralph Boehme [Mon, 30 May 2016 14:44:00 +0000 (16:44 +0200)]
s4/dns_server: enable sending of TSIG error records

This final patch enables sending TSIG error records by adding
DNS_RCODE_NOTAUTH to the set of error conditions that are allowed to
trigger sending a full generated response.

See RFC 2845 "4.5.1. KEY check and error handling" and "4.5.3. MAC check
and error handling".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4/dns_server: prepare sending correct error responses for dns_verify_tsig() errors
Ralph Boehme [Mon, 30 May 2016 14:42:14 +0000 (16:42 +0200)]
s4/dns_server: prepare sending correct error responses for dns_verify_tsig() errors

Call dns_verify_tsig() after updating state.flags and assign and use
out_packet for dns_verify_tsig().

We will need the updated flags when sending TSIG error responses when
TSIG request MAC verification fails and dns_verify_tsig() uses the
passed in packet as response, so we have to make sure we copy in_packet
to out_packet before calling out and pass out_packet.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4/dns_server: don't compute TSIG MAC in TSIG error records
Ralph Boehme [Mon, 30 May 2016 15:25:56 +0000 (17:25 +0200)]
s4/dns_server: don't compute TSIG MAC in TSIG error records

See RFC 2845 "4.3. TSIG on TSIG Error returns".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4/dns_server: error codes for failing MAC verification in TSIG requests
Ralph Boehme [Mon, 30 May 2016 14:40:45 +0000 (16:40 +0200)]
s4/dns_server: error codes for failing MAC verification in TSIG requests

According to RFC 2845 "4.5.3. MAC check and error handling" we must
return NOTAUTH and DNS_RCODE_BADSIG when MAC verification fails.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4/dns_server: ensure we store the key name in error code paths
Ralph Boehme [Mon, 30 May 2016 14:37:32 +0000 (16:37 +0200)]
s4/dns_server: ensure we store the key name in error code paths

We need the TKEY name when adding TSIG records to error responses.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4/dns_server: not finding the key here is a fatal error
Ralph Boehme [Mon, 30 May 2016 14:56:21 +0000 (16:56 +0200)]
s4/dns_server: not finding the key here is a fatal error

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4/dns_server: split out function that does the MAC computation
Ralph Boehme [Mon, 30 May 2016 14:03:33 +0000 (16:03 +0200)]
s4/dns_server: split out function that does the MAC computation

Split out function that does the MAC computation from the TSIG record
creating function. This will later simplify the code when creating error
responsed to TSIG requests with bad MACs where we have to add the TSIG
record with an empty MAC.

No functional behaviour change besides hard coding "gss-tsig" algorithm
name: later when sending a TSIG error response for a TKEY request with a
bad keyname, we won't have a tkey to fetch the algorithm name from.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos4/dns_server: include request MAC in TSIG response MAC calculation
Ralph Boehme [Mon, 23 May 2016 17:09:05 +0000 (19:09 +0200)]
s4/dns_server: include request MAC in TSIG response MAC calculation

According to RFC 2845 "4.2 TSIG on Answers", when the request is signed,
the request MAC must be included in the response MAC calculation.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agolibrpc/dns: remove original_id from dns_fake_tsig_rec
Ralph Boehme [Sat, 14 May 2016 17:08:51 +0000 (19:08 +0200)]
librpc/dns: remove original_id from dns_fake_tsig_rec

Cf RFC2845, 3.4.2. "TSIG Variables", the request id (original_id) is not
used in the MAC calculation. This also explains the mysterious 2 bytes
padding.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agolibrpc/dns: don't compress strings in TKEY and TSIG responses
Ralph Boehme [Tue, 17 May 2016 12:34:52 +0000 (14:34 +0200)]
librpc/dns: don't compress strings in TKEY and TSIG responses

Certain DNS clients fail TSIG record MAC validation if the TSIG record
contains compressed strings.

Windows DNS server behaviour seems to be to not send compressed names in
TKEY and TSIG records.

This patch ensures we conform to this behaviour.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agolibrpc/ndr: add flag LIBNDR_FLAG_NO_COMPRESSION
Ralph Boehme [Tue, 17 May 2016 10:30:46 +0000 (12:30 +0200)]
librpc/ndr: add flag LIBNDR_FLAG_NO_COMPRESSION

This flag can be used to change marshalling behaviour with regard to
compression.

Example: DNS packets make use of so called DNS name compression which
means that for identical strings in a DNS packet, the second string is
replaced with a reference (an offset) to the first.

Setting this flag requests to turns off the marshalling compression.

This will be used in the next commit to prevent name compression in DNS
TSIG records.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
3 years agos3:libnet: accept empty realm for AD domains when only security=domain is set.
Günther Deschner [Tue, 31 May 2016 16:47:34 +0000 (18:47 +0200)]
s3:libnet: accept empty realm for AD domains when only security=domain is set.

Initial patch from Matt Rogers @ RedHat.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11977

Guenther

Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Jun 15 20:28:31 CEST 2016 on sn-devel-144

3 years agos3-libnet: Print error string even on successfuly completion of libnetjoin.
Günther Deschner [Wed, 15 Jun 2016 14:04:29 +0000 (16:04 +0200)]
s3-libnet: Print error string even on successfuly completion of libnetjoin.

Sometimes useful information should be printed to the users.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11977

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
3 years agos3-libnetapi: Correctly check for lp_realm.
Andreas Schneider [Wed, 15 Jun 2016 14:05:58 +0000 (16:05 +0200)]
s3-libnetapi: Correctly check for lp_realm.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
3 years agolibnet_join: use sitename if it was set by pre-join detection
Alexander Bokovoy [Tue, 14 Jun 2016 19:37:31 +0000 (22:37 +0300)]
libnet_join: use sitename if it was set by pre-join detection

When domain member is joined to AD, we need to use the same DC to
authenticate against after the join because the machine account might
not be replicated yet to other domain controllers, including off-site.

Bug https://bugzilla.samba.org/show_bug.cgi?id=11769 dealt with
detection of the site pre-join. However, we rewrite private local
krb5.conf afterwards without taking the discovered site name into
account.

Fix this by reusing the site discovered pre-join.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11975

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jun 15 15:25:44 CEST 2016 on sn-devel-144

3 years agolib: Add a little closefrom() test
Volker Lendecke [Fri, 10 Jun 2016 09:40:33 +0000 (11:40 +0200)]
lib: Add a little closefrom() test

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jun 13 14:11:11 CEST 2016 on sn-devel-144

3 years agolibreplace: Add a closefrom() implementation
Volker Lendecke [Thu, 9 Jun 2016 19:27:09 +0000 (21:27 +0200)]
libreplace: Add a closefrom() implementation

There is closefrom in some BSDs, but Linux ships this only as part
of libbsd.  Add a new implementation of it in libreplace. The one in
libbsd of jessie and upstream differ and it has for example optimizations
for FreeBSD, but it gets some of the array calculations slightly wrong
from my point of view. If you want those, use libbsd. This replacement
is optimized on Linux only looking at /proc/self/fd/, everything else
would do the OPEN_MAX brute force fallback.

Signed-off-by: Volker Lendecke <vl@samba.org>
3 years agolib: Fix a signed/unsigned mixup
Volker Lendecke [Mon, 30 May 2016 09:18:48 +0000 (11:18 +0200)]
lib: Fix a signed/unsigned mixup

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
3 years agos3-winbind: Fix schannel connections against trusted domain DCs
Günther Deschner [Fri, 10 Jun 2016 14:51:18 +0000 (16:51 +0200)]
s3-winbind: Fix schannel connections against trusted domain DCs

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11830

Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agoctdb: use properly configured ctdb in debug-hung-script.sh
Michael Adam [Wed, 8 Jun 2016 10:32:04 +0000 (12:32 +0200)]
ctdb: use properly configured ctdb in debug-hung-script.sh

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Sat Jun 11 10:23:03 CEST 2016 on sn-devel-144

3 years agoctdb: use properly configured ctdb in statd-callout
Michael Adam [Wed, 8 Jun 2016 10:28:56 +0000 (12:28 +0200)]
ctdb: use properly configured ctdb in statd-callout

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in 99.timeout
Michael Adam [Wed, 8 Jun 2016 11:05:03 +0000 (13:05 +0200)]
ctdb: use properly configured ctdb in 99.timeout

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in 91.lvs
Michael Adam [Wed, 8 Jun 2016 11:04:48 +0000 (13:04 +0200)]
ctdb: use properly configured ctdb in 91.lvs

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in 70.iscsi
Michael Adam [Wed, 8 Jun 2016 10:44:28 +0000 (12:44 +0200)]
ctdb: use properly configured ctdb in 70.iscsi

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in 10.interfaces
Michael Adam [Wed, 8 Jun 2016 10:37:00 +0000 (12:37 +0200)]
ctdb: use properly configured ctdb in 10.interfaces

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in 13.per_ip_routing
Michael Adam [Wed, 8 Jun 2016 11:23:07 +0000 (13:23 +0200)]
ctdb: use properly configured ctdb in 13.per_ip_routing

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in 10.external
Michael Adam [Wed, 8 Jun 2016 11:22:44 +0000 (13:22 +0200)]
ctdb: use properly configured ctdb in 10.external

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in 01.reclock
Michael Adam [Wed, 8 Jun 2016 11:22:24 +0000 (13:22 +0200)]
ctdb: use properly configured ctdb in 01.reclock

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in 00.ctdb
Michael Adam [Wed, 8 Jun 2016 11:21:56 +0000 (13:21 +0200)]
ctdb: use properly configured ctdb in 00.ctdb

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in ctdbd_wrapper
Michael Adam [Tue, 7 Jun 2016 07:44:53 +0000 (07:44 +0000)]
ctdb: use properly configured ctdb in ctdbd_wrapper

This makes ctdbd_wrapper usable in non-standard installs.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: use properly configured ctdb in functions
Michael Adam [Wed, 8 Jun 2016 10:28:36 +0000 (12:28 +0200)]
ctdb: use properly configured ctdb in functions

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: make sure scripts using $CTDB called by test find ctdb
Michael Adam [Thu, 9 Jun 2016 11:55:29 +0000 (13:55 +0200)]
ctdb: make sure scripts using $CTDB called by test find ctdb

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb: set the path to 'ctdb' in 'functions' in CTDB
Michael Adam [Wed, 8 Jun 2016 10:08:35 +0000 (12:08 +0200)]
ctdb: set the path to 'ctdb' in 'functions' in CTDB

Allow this to be overridden from the caller.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agos3-script: Install the findsmb script
Andreas Schneider [Tue, 7 Jun 2016 11:49:39 +0000 (13:49 +0200)]
s3-script: Install the findsmb script

When we transitioned from autotools to waf we dropped installing the
findsmb script. However we create and install the manpage for it so
install it in the system again.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jun  9 19:10:15 CEST 2016 on sn-devel-144

3 years agoselftest: Set the correct hostname
Andreas Schneider [Tue, 7 Jun 2016 08:23:59 +0000 (10:23 +0200)]
selftest: Set the correct hostname

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
3 years agos3: krb5: keytab - The done label can be jumped to with context == NULL.
Jeremy Allison [Wed, 8 Jun 2016 21:50:59 +0000 (14:50 -0700)]
s3: krb5: keytab - The done label can be jumped to with context == NULL.

Ensure we don't crash in this case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11959

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Thu Jun  9 13:18:56 CEST 2016 on sn-devel-144

3 years agolib: Fix uninitialized read in msghdr_copy
Jeremy Allison [Wed, 8 Jun 2016 12:34:20 +0000 (14:34 +0200)]
lib: Fix uninitialized read in msghdr_copy

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jun  8 18:34:27 CEST 2016 on sn-devel-144

3 years agoctdb-daemon: Reset push_started flag once DB_PUSH_CONFIRM is done
Amitay Isaacs [Wed, 8 Jun 2016 05:04:52 +0000 (15:04 +1000)]
ctdb-daemon: Reset push_started flag once DB_PUSH_CONFIRM is done

Once DB_PUSH_START is processed as part of recovery, push_started
flag tracks if there are multiple attempts to send DB_PUSH_START.
In DB_PUSH_CONFIRM, once the record count is confirmed, all information
related to DB_PUSH should be reset.  However, The push_started flag was
not reset when the push_state was reset.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Wed Jun  8 14:31:52 CEST 2016 on sn-devel-144

3 years agoctdb-recoverd: Avoid duplicate recoverd event in parallel recovery
Amitay Isaacs [Wed, 8 Jun 2016 04:15:22 +0000 (14:15 +1000)]
ctdb-recoverd: Avoid duplicate recoverd event in parallel recovery

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11956

In do_recovery, after the recovery and takeover is complete, recoverd
event is triggered.  When the parallel database recovery was separated,
ctdb_recovery_helper implemented sending END_RECOVERY control which
causes recoverd event to be triggered.  So when there is parallel database
recovery, recoverd event is triggered twice.

Instead move the call to run_recovered_eventscript() explicitly in
the serial recovery code path.  This avoids the duplication trigger of
recoverd event.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-system: Remove duplicate functions
Amitay Isaacs [Fri, 27 May 2016 03:32:28 +0000 (13:32 +1000)]
ctdb-system: Remove duplicate functions

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-daemon: Use lib/util functions instead of redefinitions
Amitay Isaacs [Fri, 27 May 2016 03:50:06 +0000 (13:50 +1000)]
ctdb-daemon: Use lib/util functions instead of redefinitions

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>