samba.git
2 years agowafsamba: Allow to specify VERSION file path
Amitay Isaacs [Fri, 21 Apr 2017 08:19:00 +0000 (18:19 +1000)]
wafsamba: Allow to specify VERSION file path

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2 years agoctdb-readonly: Avoid a tight loop waiting for revoke to complete
Amitay Isaacs [Thu, 18 May 2017 01:50:09 +0000 (11:50 +1000)]
ctdb-readonly: Avoid a tight loop waiting for revoke to complete

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12697

During revoking readonly delegations, if one of the nodes disappears,
then there is no point re-trying revoking readonly delegation immedately.
The database needs to be recovered before the revoke operation can
succeed.

However, if the revoke is successful, then all the write requests need
to be processed immediately before the read-only requests.  This avoids
starving write requests, in case there are read-only requests coming
from other nodes.

In deferred_call_destructor, the result of revoke is not available and
deferred calls cannot be correctly ordered.  To correctly order the
deferred calls, process them in revokechild_destructor where the result
of revoke is known.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2 years agoRevert "ctdb-readonly: Avoid a tight loop waiting for revoke to complete"
Amitay Isaacs [Thu, 18 May 2017 00:15:01 +0000 (10:15 +1000)]
Revert "ctdb-readonly: Avoid a tight loop waiting for revoke to complete"

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12697

This reverts commit ad758cb869ac83534993caa212abc9fe9905ec68.

This is an incomplete fix and introduces a regression.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2 years agoCVE-2017-7494: rpc_server3: Refuse to open pipe names with / inside
Volker Lendecke [Mon, 8 May 2017 19:40:40 +0000 (21:40 +0200)]
CVE-2017-7494: rpc_server3: Refuse to open pipe names with / inside

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12780

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Wed May 24 14:34:30 CEST 2017 on sn-devel-144

2 years agodsdb: Do not search the sam.ldb file when trying to search all partitions
Andrew Bartlett [Thu, 4 May 2017 08:12:46 +0000 (10:12 +0200)]
dsdb: Do not search the sam.ldb file when trying to search all partitions

The sam.ldb file does not contain the same kind of data as the partitions, we do not wish to
mix these results.  This also avoids taking out locks on the sam.ldb file.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue May 23 05:18:04 CEST 2017 on sn-devel-144

2 years agodsdb: Do not write the @INDEXLIST or @ATTRIBUTES records during schema refresh
Andrew Bartlett [Wed, 3 May 2017 20:53:14 +0000 (22:53 +0200)]
dsdb: Do not write the @INDEXLIST or @ATTRIBUTES records during schema refresh

Instead, write it once in the module init, if required, and after a
modify to the schema partition is detected

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2 years agodsdb: Take out the transaction and prepare_commit locks in the same order
Andrew Bartlett [Wed, 3 May 2017 20:51:30 +0000 (22:51 +0200)]
dsdb: Take out the transaction and prepare_commit locks in the same order

We must, when starting the transaction and preparing to commit the transaction, take
out the locks in the same order across all the databases, otherwise we may deadlock.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2 years agoldb_tdb: Call talloc_free(options_dn) as soon as we are done with options_dn
Andrew Bartlett [Thu, 30 Mar 2017 00:11:15 +0000 (13:11 +1300)]
ldb_tdb: Call talloc_free(options_dn) as soon as we are done with options_dn

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2 years agoldb_tdb: Provide better debugging on end_trans failures
Andrew Bartlett [Thu, 30 Mar 2017 01:27:55 +0000 (14:27 +1300)]
ldb_tdb: Provide better debugging on end_trans failures

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2 years agoldb_tdb: Provide better debugging on prepare_commit failures
Andrew Bartlett [Thu, 30 Mar 2017 01:26:23 +0000 (14:26 +1300)]
ldb_tdb: Provide better debugging on prepare_commit failures

ltdb_index_transaction_commit() does LDB operations, sets the ldb
error string and returns LDB errors so we should not check the tdb
error code.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2 years agotdb: Improve debugging when the allrecord lock fails to upgrade
Andrew Bartlett [Thu, 30 Mar 2017 06:11:06 +0000 (19:11 +1300)]
tdb: Improve debugging when the allrecord lock fails to upgrade

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2 years agos3: smbd: Correctly identify a snapshot path using UCF_GMT_PATHNAME.
Jeremy Allison [Thu, 18 May 2017 20:28:23 +0000 (13:28 -0700)]
s3: smbd: Correctly identify a snapshot path using UCF_GMT_PATHNAME.

All our client code already does this correctly for @GMT names.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon May 22 22:49:17 CEST 2017 on sn-devel-144

2 years agos3: smbd: Add UCF_GMT_PATHNAME, which represents FLAGS2_REPARSE_PATH.
Jeremy Allison [Thu, 18 May 2017 20:24:26 +0000 (13:24 -0700)]
s3: smbd: Add UCF_GMT_PATHNAME, which represents FLAGS2_REPARSE_PATH.

This must be set by a client to use shadow copy (@GMT) paths.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: Fix up the ucf_flags correctly in smb_file_rename_information().
Jeremy Allison [Thu, 18 May 2017 20:22:36 +0000 (13:22 -0700)]
s3: smbd: Fix up the ucf_flags correctly in smb_file_rename_information().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: We can now remove the 'bool dfs_path' parameter from filename_convert().
Jeremy Allison [Thu, 18 May 2017 19:29:50 +0000 (12:29 -0700)]
s3: smbd: We can now remove the 'bool dfs_path' parameter from filename_convert().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: Add UCF_DFS_PATHNAME which tracks the flags2 FLAGS2_DFS_PATHNAMES bit.
Jeremy Allison [Thu, 18 May 2017 19:18:58 +0000 (12:18 -0700)]
s3: smbd: Add UCF_DFS_PATHNAME which tracks the flags2 FLAGS2_DFS_PATHNAMES bit.

Set inside ucf_flags_from_smb_request(). This will allow us to
remove the req->flags2 & FLAGS2_DFS_PATHNAMES parameter from
filename_convert().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: In ntrename OR in ucf_flags, don't overwrite.
Jeremy Allison [Thu, 18 May 2017 19:08:57 +0000 (12:08 -0700)]
s3: smbd: In ntrename OR in ucf_flags, don't overwrite.

This isn't worth a bug backport as right now the only flag that
could be overwritten is the UCF_POSIX_PATHNAMES flag, and for
a POSIX connection the client will use posix rename, not an
ntrename.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: Always use ucf_flags_from_smb_request() in place of checking by hand (in...
Jeremy Allison [Thu, 18 May 2017 19:08:00 +0000 (12:08 -0700)]
s3: smbd: Always use ucf_flags_from_smb_request() in place of checking by hand (in most cases).

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: Split out ucf_flags_from_smb_request() from filename_create_ucf_flags().
Jeremy Allison [Thu, 18 May 2017 18:56:39 +0000 (11:56 -0700)]
s3: smbd: Split out ucf_flags_from_smb_request() from filename_create_ucf_flags().

We will use this elsewhere in later commits.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: Make it clear we only overwrite *ppath_contains_wcard if resolve_dfspath_wc...
Jeremy Allison [Thu, 18 May 2017 18:41:10 +0000 (11:41 -0700)]
s3: smbd: Make it clear we only overwrite *ppath_contains_wcard if resolve_dfspath_wcard() detected a wildcard.

The API for this function specifies that *ppath_contains_wcard
must already have been initialized on entry to filename_convert()
(not a great design, but that's the way it is currently).

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: Remove ugly use of discard_const that previously was hidden in resolve_dfsp...
Jeremy Allison [Thu, 18 May 2017 18:36:56 +0000 (11:36 -0700)]
s3: smbd: Remove ugly use of discard_const that previously was hidden in resolve_dfspath_wcard().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos3: smbd: Remove bool dfs_pathnames paramter from resolve_dfspath_wcard().
Jeremy Allison [Thu, 18 May 2017 18:34:33 +0000 (11:34 -0700)]
s3: smbd: Remove bool dfs_pathnames paramter from resolve_dfspath_wcard().

Start cleaning up the pathname parsing to move flags2 checks into UCF_FLAGS
function.

NB. This now only sets *ppath_contains_wcard inside resolve_dfspath_wcard()
if dfs_redirect() sets path_contains_wcard to true, which is a change
from the previous code which could potentially set *ppath_contains_wcard
to an uninitialized value if dfs_redirect() returned without setting
path_contains_wcard.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2 years agos4:libcli/ldap: just use gensec_update() in ldap_bind_sasl()
Stefan Metzmacher [Mon, 15 May 2017 21:53:38 +0000 (23:53 +0200)]
s4:libcli/ldap: just use gensec_update() in ldap_bind_sasl()

We're in a blocking/sync call, we should avoid using nested event loops for
this. As far as I can see ldap_bind_sasl() is only called from command line
tools, which are ok to block.

Resolving this requires also resolving the general case in LDB, as that is the
API this is used from.  We would need ldb_connect_send() and ldb_connect_recv()
at a start.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon May 22 01:12:23 CEST 2017 on sn-devel-144

2 years agos4:libcli/smb2: make smb2_session_setup_spnego_* completely async
Stefan Metzmacher [Mon, 15 May 2017 21:37:22 +0000 (23:37 +0200)]
s4:libcli/smb2: make smb2_session_setup_spnego_* completely async

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:librpc: simplify dcerpc_connect_timeout_handler() logic
Stefan Metzmacher [Mon, 15 May 2017 20:49:09 +0000 (22:49 +0200)]
s4:librpc: simplify dcerpc_connect_timeout_handler() logic

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:librpc: make use of gensec_update_send() in bind_auth_next_step()
Stefan Metzmacher [Mon, 15 May 2017 20:46:39 +0000 (22:46 +0200)]
s4:librpc: make use of gensec_update_send() in bind_auth_next_step()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:librpc: use gensec_update_send() in dcerpc_bind_auth_send()
Stefan Metzmacher [Mon, 15 May 2017 20:36:20 +0000 (22:36 +0200)]
s4:librpc: use gensec_update_send() in dcerpc_bind_auth_send()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: implement async AUTH3 using gensec_update_send/recv
Stefan Metzmacher [Mon, 15 May 2017 13:20:56 +0000 (15:20 +0200)]
s4:rpc_server: implement async AUTH3 using gensec_update_send/recv

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: implement async ALTER_CONTEXT using gensec_update_send/recv
Stefan Metzmacher [Mon, 15 May 2017 13:20:56 +0000 (15:20 +0200)]
s4:rpc_server: implement async ALTER_CONTEXT using gensec_update_send/recv

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: implement async BIND using gensec_update_send/recv
Stefan Metzmacher [Mon, 15 May 2017 13:20:56 +0000 (15:20 +0200)]
s4:rpc_server: implement async BIND using gensec_update_send/recv

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: remove unused dcesrv_auth_{bind_ack,auth3,alter_ack}()
Stefan Metzmacher [Mon, 15 May 2017 12:03:54 +0000 (14:03 +0200)]
s4:rpc_server: remove unused dcesrv_auth_{bind_ack,auth3,alter_ack}()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: make use of dcesrv_auth_prepare_auth3() in dcesrv_auth3()
Stefan Metzmacher [Mon, 15 May 2017 12:02:07 +0000 (14:02 +0200)]
s4:rpc_server: make use of dcesrv_auth_prepare_auth3() in dcesrv_auth3()

It means we also need to call gensec_update_ev() and dcesrv_auth_complete()
directly in dcesrv_auth3(). Doing that will make it easier to make dcesrv_auth3()
async in the next commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: make use of dcesrv_auth_prepare_alter_ack() in dcesrv_alter()
Stefan Metzmacher [Mon, 15 May 2017 12:02:07 +0000 (14:02 +0200)]
s4:rpc_server: make use of dcesrv_auth_prepare_alter_ack() in dcesrv_alter()

It means we also need to call gensec_update_ev() and dcesrv_auth_complete()
directly in dcesrv_alter(). Doing that will make it easier to make dcesrv_alter()
async in the next commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: make use of dcesrv_auth_prepare_bind_ack() in dcesrv_bind()
Stefan Metzmacher [Mon, 15 May 2017 12:02:07 +0000 (14:02 +0200)]
s4:rpc_server: make use of dcesrv_auth_prepare_bind_ack() in dcesrv_bind()

It means we also need to call gensec_update_ev() and dcesrv_auth_complete()
directly in dcesrv_bind(). Doing that will make it easier to make dcesrv_bind()
async in the next commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: make use of dcesrv_auth_reply() in dcesrv_alter()
Stefan Metzmacher [Mon, 15 May 2017 15:37:05 +0000 (17:37 +0200)]
s4:rpc_server: make use of dcesrv_auth_reply() in dcesrv_alter()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: split out dcesrv_auth_reply() from dcesrv_bind()
Stefan Metzmacher [Mon, 15 May 2017 15:19:31 +0000 (17:19 +0200)]
s4:rpc_server: split out dcesrv_auth_reply() from dcesrv_bind()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: remove useless TALLOC_FREE(call->context) from dcesrv_bind()
Stefan Metzmacher [Mon, 15 May 2017 15:36:17 +0000 (17:36 +0200)]
s4:rpc_server: remove useless TALLOC_FREE(call->context) from dcesrv_bind()

This is not needed if we're terminating the connection anyway.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: split out dcesrv_auth_prepare_alter_ack()
Stefan Metzmacher [Mon, 15 May 2017 10:16:35 +0000 (12:16 +0200)]
s4:rpc_server: split out dcesrv_auth_prepare_alter_ack()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: split out dcesrv_auth_prepare_auth3()
Stefan Metzmacher [Mon, 15 May 2017 10:16:35 +0000 (12:16 +0200)]
s4:rpc_server: split out dcesrv_auth_prepare_auth3()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: split out dcesrv_auth_prepare_bind_ack()
Stefan Metzmacher [Mon, 15 May 2017 10:16:35 +0000 (12:16 +0200)]
s4:rpc_server: split out dcesrv_auth_prepare_bind_ack()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: make use of dcesrv_auth_complete() in dcesrv_auth_auth3()
Stefan Metzmacher [Mon, 15 May 2017 07:13:08 +0000 (09:13 +0200)]
s4:rpc_server: make use of dcesrv_auth_complete() in dcesrv_auth_auth3()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: prepare dcesrv_auth_complete() for AUTH3
Stefan Metzmacher [Mon, 15 May 2017 07:13:08 +0000 (09:13 +0200)]
s4:rpc_server: prepare dcesrv_auth_complete() for AUTH3

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: make use of dcesrv_auth_complete() in dcesrv_auth_alter_ack()
Stefan Metzmacher [Mon, 15 May 2017 07:14:21 +0000 (09:14 +0200)]
s4:rpc_server: make use of dcesrv_auth_complete() in dcesrv_auth_alter_ack()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: split out dcesrv_auth_complete() from dcesrv_auth_bind_ack()
Stefan Metzmacher [Mon, 15 May 2017 07:00:45 +0000 (09:00 +0200)]
s4:rpc_server: split out dcesrv_auth_complete() from dcesrv_auth_bind_ack()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: add wait_send/recv infrastructure
Stefan Metzmacher [Mon, 15 May 2017 06:11:29 +0000 (08:11 +0200)]
s4:rpc_server: add wait_send/recv infrastructure

This will be used to implement async BIND/ALTER_CONTEXT/AUTH3
using gensec_update_send/recv.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: introduce call->ack_pkt and avoid pkt variable for the response on...
Stefan Metzmacher [Mon, 15 May 2017 12:15:41 +0000 (14:15 +0200)]
s4:rpc_server: introduce call->ack_pkt and avoid pkt variable for the response on the stack

This will be needed when we use async authentication using gensec_update_send/recv.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: make use of gensec_update() in kpasswd_process()
Stefan Metzmacher [Mon, 15 May 2017 05:50:31 +0000 (07:50 +0200)]
s4:kdc: make use of gensec_update() in kpasswd_process()

This avoids using gensec_update_ev() with a nested event loop.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dlz_bind9: assert SPNEGO/KRB5 and use gensec_update()
Stefan Metzmacher [Mon, 15 May 2017 05:45:47 +0000 (07:45 +0200)]
s4:dlz_bind9: assert SPNEGO/KRB5 and use gensec_update()

This avoids using gensec_update_ev() with a nested event loop.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dns_server: use samba_server_gensec_krb5_start() and gensec_update() in dns_query.c
Stefan Metzmacher [Mon, 15 May 2017 05:30:14 +0000 (07:30 +0200)]
s4:dns_server: use samba_server_gensec_krb5_start() and gensec_update() in dns_query.c

This avoids using gensec_update_ev() with a nested event loop.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth: add samba_server_gensec_krb5_start()
Stefan Metzmacher [Mon, 15 May 2017 05:17:30 +0000 (07:17 +0200)]
s4:auth: add samba_server_gensec_krb5_start()

This will be used by the dns services to only allow
spnego/krb5. This makes sure the accepting backend
doesn't require any RPC or IPC communication for now.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth: split out a samba_server_gensec_start_settings() helper function
Stefan Metzmacher [Mon, 15 May 2017 05:17:00 +0000 (07:17 +0200)]
s4:auth: split out a samba_server_gensec_start_settings() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: make sure there's only one pending gensec_update_send() per context
Stefan Metzmacher [Thu, 11 May 2017 11:28:10 +0000 (13:28 +0200)]
auth/gensec: make sure there's only one pending gensec_update_send() per context

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: improve NT_STATUS_MORE_PROCESSING_REQUIRED logic in gensec_update_*()
Stefan Metzmacher [Thu, 11 May 2017 11:23:07 +0000 (13:23 +0200)]
auth/gensec: improve NT_STATUS_MORE_PROCESSING_REQUIRED logic in gensec_update_*()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: avoid using a state->subreq pointer
Stefan Metzmacher [Thu, 11 May 2017 11:25:26 +0000 (13:25 +0200)]
auth/gensec: avoid using a state->subreq pointer

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: remove the sync update() hook from gensec_security_ops
Stefan Metzmacher [Thu, 11 May 2017 10:48:41 +0000 (12:48 +0200)]
auth/gensec: remove the sync update() hook from gensec_security_ops

Some backends still do some nested event context magic,
but that mapping between async and sync is done in these backends
and not in the core gensec code anymore.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/spnego: add simple gensec_spnego_update_send/recv() wrapper functions
Stefan Metzmacher [Thu, 11 May 2017 07:04:02 +0000 (09:04 +0200)]
auth/spnego: add simple gensec_spnego_update_send/recv() wrapper functions

TODO: we still need to do the internals async.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/ntlmssp: add implement gensec_ntlmssp_update_send/recv()
Stefan Metzmacher [Thu, 11 May 2017 07:04:02 +0000 (09:04 +0200)]
auth/ntlmssp: add implement gensec_ntlmssp_update_send/recv()

Currently only backend functions are sync functions, but that needs
to change in future.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/ntlmssp: make gensec_ntlmssp_update() static
Stefan Metzmacher [Thu, 18 May 2017 06:45:44 +0000 (08:45 +0200)]
auth/ntlmssp: make gensec_ntlmssp_update() static

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/ntlmssp: rename 'input' to 'in' in gensec_ntlmssp_update()
Stefan Metzmacher [Thu, 18 May 2017 06:43:09 +0000 (08:43 +0200)]
auth/ntlmssp: rename 'input' to 'in' in gensec_ntlmssp_update()

This matches all other gensec modules.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/ntlmssp: remove unused variable from gensec_ntlmssp_update()
Stefan Metzmacher [Wed, 17 May 2017 18:21:19 +0000 (20:21 +0200)]
auth/ntlmssp: remove unused variable from gensec_ntlmssp_update()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/ntlmssp: avoid using NT_STATUS_NOT_OK_RETURN() in gensec_ntlmssp_update()
Stefan Metzmacher [Wed, 17 May 2017 18:21:19 +0000 (20:21 +0200)]
auth/ntlmssp: avoid using NT_STATUS_NOT_OK_RETURN() in gensec_ntlmssp_update()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/ntlmssp: remove mem_ctx=NULL handling from gensec_ntlmssp_update()
Stefan Metzmacher [Wed, 17 May 2017 18:21:19 +0000 (20:21 +0200)]
auth/ntlmssp: remove mem_ctx=NULL handling from gensec_ntlmssp_update()

The caller is expected always pass a valid context and this fallback
was needed ages ago.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:gensec_krb5: add simple gensec_krb5_update_send/recv() wrapper functions
Stefan Metzmacher [Thu, 11 May 2017 07:04:02 +0000 (09:04 +0200)]
s4:gensec_krb5: add simple gensec_krb5_update_send/recv() wrapper functions

TODO: we still need to make the internal async.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:gensec_gssapi: add simple gensec_gssapi_update_send/recv() wrapper functions
Stefan Metzmacher [Thu, 11 May 2017 07:04:02 +0000 (09:04 +0200)]
s4:gensec_gssapi: add simple gensec_gssapi_update_send/recv() wrapper functions

TODO: we still need to make the internal async.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3:gse: add simple gensec_gse_update_send/recv() wrapper functions
Stefan Metzmacher [Thu, 11 May 2017 07:04:02 +0000 (09:04 +0200)]
s3:gse: add simple gensec_gse_update_send/recv() wrapper functions

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:gensec/http_basic: add simple gensec_http_basic_update_send/recv() wrapper functions
Stefan Metzmacher [Thu, 11 May 2017 07:04:02 +0000 (09:04 +0200)]
s4:gensec/http_basic: add simple gensec_http_basic_update_send/recv() wrapper functions

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:gensec/http_ntlm: add implement gensec_http_ntlm_update_send/recv()
Stefan Metzmacher [Thu, 11 May 2017 07:04:02 +0000 (09:04 +0200)]
s4:gensec/http_ntlm: add implement gensec_http_ntlm_update_send/recv()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/spnego: make sure a fatal error or the final success make the state as SPNEGO_DONE
Stefan Metzmacher [Wed, 10 May 2017 15:12:14 +0000 (17:12 +0200)]
auth/spnego: make sure a fatal error or the final success make the state as SPNEGO_DONE

This means any further gensec_update() will fail with
NT_STATUS_INVALID_PARAMETER.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/spnego: let spnego.c use the new gensec_child_* helper functions
Stefan Metzmacher [Fri, 30 Dec 2016 17:05:17 +0000 (18:05 +0100)]
auth/spnego: let spnego.c use the new gensec_child_* helper functions

This means we no longer allow operations on a half finished authentication,
it's activated by gensec_child_ready().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: add gensec_child_* helper functions
Stefan Metzmacher [Fri, 30 Dec 2016 16:54:12 +0000 (17:54 +0100)]
auth/gensec: add gensec_child_* helper functions

They will be used to simplify the spnego backend
and maybe of some use for a future negoex backend.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: reset existing context on gensec_start_mech()
Stefan Metzmacher [Wed, 10 May 2017 22:05:29 +0000 (00:05 +0200)]
auth/gensec: reset existing context on gensec_start_mech()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: make gensec_start_mech() static
Stefan Metzmacher [Wed, 10 May 2017 22:05:02 +0000 (00:05 +0200)]
auth/gensec: make gensec_start_mech() static

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server: simplify the GENSEC_FEATURE_SIGN_PKT_HEADER logic
Stefan Metzmacher [Fri, 12 May 2017 05:56:47 +0000 (07:56 +0200)]
s4:rpc_server: simplify the GENSEC_FEATURE_SIGN_PKT_HEADER logic

We can directly check this after gensec_start_mech_by_authtype(),
the backend either supports it or not. There's nothing that
can change during the authentication phase.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:librpc: ask for GENSEC_FEATURE_SIGN_PKT_HEADER after the gensec_update() dance
Stefan Metzmacher [Sat, 13 May 2017 22:28:50 +0000 (00:28 +0200)]
s4:librpc: ask for GENSEC_FEATURE_SIGN_PKT_HEADER after the gensec_update() dance

Most features should be added before the update() dance, while
GENSEC_FEATURE_SIGN_PKT_HEADER needs to be after the dance on the client
side.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3:rpc_server: move gensec_update() out of auth_generic_server_authtype_start*()
Stefan Metzmacher [Sat, 13 May 2017 23:22:32 +0000 (01:22 +0200)]
s3:rpc_server: move gensec_update() out of auth_generic_server_authtype_start*()

We let the caller use auth_generic_server_step() instead.
This allows us to request GENSEC_FEATURE_SIGN_PKT_HEADER before
starting the gensec_update() dance.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3:cli_pipe: ask for GENSEC_FEATURE_SIGN_PKT_HEADER after the gensec_update() dance
Stefan Metzmacher [Sat, 13 May 2017 22:28:50 +0000 (00:28 +0200)]
s3:cli_pipe: ask for GENSEC_FEATURE_SIGN_PKT_HEADER after the gensec_update() dance

Most features should be added before the update() dance, while
GENSEC_FEATURE_SIGN_PKT_HEADER needs to be after the dance on the client
side.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: add some basic doxygen comments for gensec_{want,have}_feature()
Stefan Metzmacher [Sun, 14 May 2017 00:06:08 +0000 (02:06 +0200)]
auth/gensec: add some basic doxygen comments for gensec_{want,have}_feature()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/spnego: always announce GENSEC_FEATURE_SIGN_PKT_HEADER support.
Stefan Metzmacher [Fri, 12 May 2017 09:05:15 +0000 (11:05 +0200)]
auth/spnego: always announce GENSEC_FEATURE_SIGN_PKT_HEADER support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:gensec_gssapi: always announce GENSEC_FEATURE_SIGN_PKT_HEADER
Stefan Metzmacher [Fri, 12 May 2017 06:05:03 +0000 (08:05 +0200)]
s4:gensec_gssapi: always announce GENSEC_FEATURE_SIGN_PKT_HEADER

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3:gse: always announce GENSEC_FEATURE_SIGN_PKT_HEADER support.
Stefan Metzmacher [Fri, 12 May 2017 06:04:33 +0000 (08:04 +0200)]
s3:gse: always announce GENSEC_FEATURE_SIGN_PKT_HEADER support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoselftest: let fl2003dc use "dcesrv:header signing = no"
Stefan Metzmacher [Sat, 13 May 2017 06:37:05 +0000 (08:37 +0200)]
selftest: let fl2003dc use "dcesrv:header signing = no"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:smb_server: avoid using gensec_update_ev() for the negotiate blob
Stefan Metzmacher [Thu, 11 May 2017 13:36:31 +0000 (15:36 +0200)]
s4:smb_server: avoid using gensec_update_ev() for the negotiate blob

Getting the SPNEGO mech type blob, we don't expect to block for
any network io, so we can also use gensec_update() which creates
a temporary event context.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3:libsmb: don't rely on gensec_session_key() to work on an unfinished authentication
Stefan Metzmacher [Wed, 10 May 2017 14:17:48 +0000 (16:17 +0200)]
s3:libsmb: don't rely on gensec_session_key() to work on an unfinished authentication

If smbXcli_session_is_guest() returns true, we should handle the authentication
as anonymous and don't touch the gensec context anymore.

Note that smbXcli_session_is_guest() always returns false, if signing is
required!

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/gensec: call gensec_verify_features() also after update_recv() in gensec_update_ev()
Stefan Metzmacher [Sat, 13 May 2017 00:25:44 +0000 (02:25 +0200)]
auth/gensec: call gensec_verify_features() also after update_recv() in gensec_update_ev()

This is no a real problem until now, because the only backends with update_send()/recv()
are "schannel" (which only supports AUTH_LEVEL_{INTEGRITY,PRIVACY}) and
"naclrpc_as_system" (which doesn't support any protection beside using unix
domain sockets).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/spnego: fix gensec_update_ev() argument order for the SPNEGO_FALLBACK case
Stefan Metzmacher [Fri, 12 May 2017 07:10:19 +0000 (09:10 +0200)]
auth/spnego: fix gensec_update_ev() argument order for the SPNEGO_FALLBACK case

This went unnoticed so long as we don't use -Wc++-compat
and gensec_update_ev() used the sync update() hook for all
NTLMSSP and Kerberos.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12788

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoselftest: Actually run python3 tests during the selftest
Andrew Bartlett [Tue, 2 May 2017 10:55:45 +0000 (12:55 +0200)]
selftest: Actually run python3 tests during the selftest

These previously only ran if the develper was using EXTRA_PYTHON in their
OS environment

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat May 20 02:26:33 CEST 2017 on sn-devel-144

2 years agopython3:tests: Fix Python 3 test issues
Petr Viktorin [Wed, 3 May 2017 17:11:03 +0000 (19:11 +0200)]
python3:tests: Fix Python 3 test issues

- Forgotten text strings that should be binary
- Inverted PY3 condition

Signed-off-by: Petr Viktorin <pviktori@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agopython3: Use "y#" instead of "s#" for binary data in PyArg_ParseTuple
Petr Viktorin [Wed, 3 May 2017 14:57:07 +0000 (16:57 +0200)]
python3: Use "y#" instead of "s#" for binary data in PyArg_ParseTuple

The "s#" format code for PyArg_ParseTupleAndKeywords and Py_BuildValue
converts a char* and size to/from Python str (with utf-8 encoding under
Python 3).
In some cases, we want bytes (str on Python 2, bytes on 3) instead. The
code for this is "y#" in Python 3, but that is not available in 2.

Introduce a PYARG_BYTES_LEN macro that expands to "s#" or "y#", and use
that in:
- credentials.get_ntlm_response (for input and output)
- ndr_unpack argument in PIDL generated code

Signed-off-by: Petr Viktorin <pviktori@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3: smbd: Fix open_files.idl to correctly ignore share_mode_lease *lease in share_mod...
Jeremy Allison [Tue, 16 May 2017 23:12:19 +0000 (16:12 -0700)]
s3: smbd: Fix open_files.idl to correctly ignore share_mode_lease *lease in share_mode_entry.

This is currently marked 'skip', which means it isn't stored in the
db, but printed out in ndr dump. However, this pointer can be invalid
if the lease_idx is set to 0xFFFFFFFF (invalid).

This is fixed up inside parse_share_modes(), but not until after
ndr_pull_share_mode_data() is called. If lease_idx == 0xFFFFFFFF
then ndr_print_share_mode_lease() prints an invalid value and
crashes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12793

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu May 18 03:01:40 CEST 2017 on sn-devel-144

2 years agoselftest: enable alternate streams for fs_specific share
David Disseldorp [Wed, 17 May 2017 10:54:15 +0000 (12:54 +0200)]
selftest: enable alternate streams for fs_specific share

This ensures that the new "smb2.ioctl.copy-chunk streams" test passes
when run under selftest atop Btrfs.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agos4/torture: vfs_fruit: test copy-chunk on streams
Ralph Boehme [Fri, 12 May 2017 15:10:07 +0000 (17:10 +0200)]
s4/torture: vfs_fruit: test copy-chunk on streams

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12787

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2 years agos4/torture: vfs_fruit: add src and dst path args to test_setup_copy_chunk
Ralph Boehme [Fri, 12 May 2017 12:56:53 +0000 (14:56 +0200)]
s4/torture: vfs_fruit: add src and dst path args to test_setup_copy_chunk

Just let the caller pass in the paths, no change in behaviour. A new
test in a subsequent commit will use it to pass paths to streams.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12787

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2 years agos4/torture: smb2.ioctl: add copy-chunk test with stream to smb2.ioctl
Ralph Boehme [Tue, 16 May 2017 11:14:16 +0000 (13:14 +0200)]
s4/torture: smb2.ioctl: add copy-chunk test with stream to smb2.ioctl

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12787

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2 years agos4/torture: smb2.ioctl: add src and dst path args to test_setup_copy_chunk
Ralph Boehme [Tue, 16 May 2017 11:13:08 +0000 (13:13 +0200)]
s4/torture: smb2.ioctl: add src and dst path args to test_setup_copy_chunk

Just let the caller pass in the paths, no change in behaviour. A new
test in a subsequent commit will use it to pass paths to streams.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12787

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2 years agolib/torture: add two more ndr assert macros
Ralph Boehme [Fri, 12 May 2017 15:09:08 +0000 (17:09 +0200)]
lib/torture: add two more ndr assert macros

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12787

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2 years agovfs_fruit: add pread_send/recv and pwrite_send/recv
Ralph Boehme [Fri, 12 May 2017 12:40:03 +0000 (14:40 +0200)]
vfs_fruit: add pread_send/recv and pwrite_send/recv

This is needed to support copy-chunk of streams. vfs_default issues
calls to async pread and pwrite (send/recv versions) since
commit60e45a2d25401eaf9a15a86d19114670ccfde259.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12787

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2 years agovfs_streams_xattr: add pread_send/recv and pwrite_send/recv
Ralph Boehme [Fri, 12 May 2017 05:58:01 +0000 (07:58 +0200)]
vfs_streams_xattr: add pread_send/recv and pwrite_send/recv

This is needed to support copy-chunk of streams. vfs_default issues
calls to async pread and pwrite (send/recv versions) since commit
60e45a2d25401eaf9a15a86d19114670ccfde259.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12787

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2 years agolib: Update pam_wrapper to 1.0.4
Andreas Schneider [Mon, 15 May 2017 15:25:27 +0000 (17:25 +0200)]
lib: Update pam_wrapper to 1.0.4

* Fix build on OpenBSD
* Fix a resource leak

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolibads: abstract out SASL wrapping code
Alexander Bokovoy [Fri, 5 May 2017 12:37:20 +0000 (15:37 +0300)]
libads: abstract out SASL wrapping code

Prepare for rebasing libads on top of libsmbldap.

To make libads using 'struct smbldap_state' instead of direct LDAP
structure, we need to abstract out libads logic from connection
handling. SASL wrapping does not really depend on availability of LDAP
handle and does not need direct access to ADS_STRUCT. As result, we'll
be able to move SASL wrapping code under smbldap once the latter is able
to pass settings that libads passes to the SASL wrapping.

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoSMB_INFO_ALLOCATION: return with UINT32_MAX rather than cutting at 4 bytes
Peter Somogyi [Mon, 15 May 2017 08:21:01 +0000 (10:21 +0200)]
SMB_INFO_ALLOCATION: return with UINT32_MAX rather than cutting at 4 bytes

An AIX cifs client queries SMB_INFO_ALLOCATION that has only 4 bytes to report
dfree and dsize. Return the max instead of random unexpeced numbers.

Signed-off-by: Peter Somogyi <psomogyi@hu.ibm.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed May 17 05:49:46 CEST 2017 on sn-devel-144