samba.git
5 years agoselftest: s!addc.samba.example.com!addom.samba.example.com!
Stefan Metzmacher [Sat, 16 Jan 2016 12:57:47 +0000 (13:57 +0100)]
selftest: s!addc.samba.example.com!addom.samba.example.com!

It's confusing to have addc.samba.example.com as domain name
and addc.addc.samba.example.com as hostname.

We now have addom.samba.example.com as domain name
and addc.addom.samba.example.com as hostname.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
5 years agoctdb-tests: Add a utility to parse ctdb packets
Amitay Isaacs [Thu, 10 Mar 2016 04:44:24 +0000 (15:44 +1100)]
ctdb-tests: Add a utility to parse ctdb packets

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Thu Mar 17 13:56:41 CET 2016 on sn-devel-144

5 years agoctdb-protocol: Add protocol debug routines
Amitay Isaacs [Thu, 10 Mar 2016 03:00:56 +0000 (14:00 +1100)]
ctdb-protocol: Add protocol debug routines

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
5 years agoctdb-protocol: Check header is not null before copying
Amitay Isaacs [Thu, 10 Mar 2016 04:43:37 +0000 (15:43 +1100)]
ctdb-protocol: Check header is not null before copying

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
5 years agomit-kdb: Add missing SDB_F_FOR_AS_REQ for AS requests
Andreas Schneider [Wed, 20 Jan 2016 12:25:16 +0000 (13:25 +0100)]
mit-kdb: Add missing SDB_F_FOR_AS_REQ for AS requests

This correctly handles enterprise principals and ticket renewal.

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Mar 17 07:57:49 CET 2016 on sn-devel-144

5 years agomit-kdb: Fix segfault in krb5kdc dereferencing an invalid pointer
Andreas Schneider [Fri, 4 Dec 2015 11:04:49 +0000 (12:04 +0100)]
mit-kdb: Fix segfault in krb5kdc dereferencing an invalid pointer

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Add support for KDB version 8
Andreas Schneider [Mon, 30 Nov 2015 12:27:29 +0000 (13:27 +0100)]
mit-kdb: Add support for KDB version 8

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Add support for bad password count
Andreas Schneider [Wed, 20 May 2015 15:20:13 +0000 (17:20 +0200)]
mit-kdb: Add support for bad password count

This fixes the samba4.ldap.password_lockout.python test.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Restrict admin/changepw principal db_entry with some flags
Günther Deschner [Thu, 7 Aug 2014 13:04:42 +0000 (15:04 +0200)]
mit-kdb: Restrict admin/changepw principal db_entry with some flags

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Return 0 in kdb_samba_db_put_principal()
Günther Deschner [Wed, 6 Aug 2014 13:17:47 +0000 (15:17 +0200)]
mit-kdb: Return 0 in kdb_samba_db_put_principal()

This allows the kadmin server to assume an update of a db_entry has
succeeded (while in fact the update_pwd call did the update already).

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Implement KDB function to change passwords
Andreas Schneider [Thu, 30 Jul 2015 12:47:11 +0000 (14:47 +0200)]
mit-kdb: Implement KDB function to change passwords

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Use calloc to initialize master keylists.
Günther Deschner [Mon, 4 Aug 2014 10:11:22 +0000 (12:11 +0200)]
mit-kdb: Use calloc to initialize master keylists.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Add ks_get_admin_principal() and use it for kadmin users.
Andreas Schneider [Wed, 6 Aug 2014 13:38:41 +0000 (15:38 +0200)]
mit-kdb: Add ks_get_admin_principal() and use it for kadmin users.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Add ks_create_principal().
Andreas Schneider [Wed, 6 Aug 2014 13:37:41 +0000 (15:37 +0200)]
mit-kdb: Add ks_create_principal().

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Do not allow to get a kadmin ticket as a client.
Andreas Schneider [Wed, 6 Aug 2014 13:32:13 +0000 (15:32 +0200)]
mit-kdb: Do not allow to get a kadmin ticket as a client.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Add more ks_is_kadmin* functions.
Andreas Schneider [Wed, 6 Aug 2014 13:27:16 +0000 (15:27 +0200)]
mit-kdb: Add more ks_is_kadmin* functions.

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Use calloc so both authdata elements are zeroed
Günther Deschner [Fri, 16 May 2014 12:37:39 +0000 (14:37 +0200)]
mit-kdb: Use calloc so both authdata elements are zeroed

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Do not overwrite the error code in failure case.
Günther Deschner [Thu, 15 May 2014 07:05:25 +0000 (09:05 +0200)]
mit-kdb: Do not overwrite the error code in failure case.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit-kdb: Add initial MIT KDB Samba driver
Andreas Schneider [Mon, 12 May 2014 08:49:24 +0000 (10:49 +0200)]
mit-kdb: Add initial MIT KDB Samba driver

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Simo Sorce <idra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Simo Sorce <idra@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agowscript: Build the KDC code if we have the AD DC build enabled
Andreas Schneider [Thu, 23 Jul 2015 11:48:50 +0000 (13:48 +0200)]
wscript: Build the KDC code if we have the AD DC build enabled

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Setup logging to stdout
Andreas Schneider [Thu, 30 Jul 2015 15:29:51 +0000 (17:29 +0200)]
mit_samba: Setup logging to stdout

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Add function for handling bad password count
Andreas Schneider [Wed, 20 May 2015 15:19:35 +0000 (17:19 +0200)]
mit_samba: Add function for handling bad password count

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Add functions to generate random password and salt.
Andreas Schneider [Wed, 6 Aug 2014 13:41:05 +0000 (15:41 +0200)]
mit_samba: Add functions to generate random password and salt.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Add function to change the password
Andreas Schneider [Thu, 30 Jul 2015 12:46:48 +0000 (14:46 +0200)]
mit_samba: Add function to change the password

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Add ks_is_tgs_principal()
Andreas Schneider [Thu, 30 Jul 2015 13:26:50 +0000 (15:26 +0200)]
mit_samba: Add ks_is_tgs_principal()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Use talloc_zero in mit_samba_context_init().
Günther Deschner [Mon, 12 May 2014 19:35:45 +0000 (21:35 +0200)]
mit_samba: Use talloc_zero in mit_samba_context_init().

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Directly pass the principal and kflags
Andreas Schneider [Thu, 30 Jul 2015 12:36:55 +0000 (14:36 +0200)]
mit_samba: Directly pass the principal and kflags

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Make mit_samba a shim layer between Samba and KDB
Andreas Schneider [Mon, 12 May 2014 08:50:33 +0000 (10:50 +0200)]
mit_samba: Make mit_samba a shim layer between Samba and KDB

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agomit_samba: Use sdb in the mit_samba plugin
Günther Deschner [Mon, 12 May 2014 12:33:14 +0000 (14:33 +0200)]
mit_samba: Use sdb in the mit_samba plugin

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agos4-kdc: Introduce a simple sdb_kdb shim layer
Günther Deschner [Fri, 9 May 2014 11:45:19 +0000 (13:45 +0200)]
s4-kdc: Introduce a simple sdb_kdb shim layer

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agowscript: detect if we have libkdb5 and kdb.h.
Günther Deschner [Fri, 9 May 2014 11:44:05 +0000 (13:44 +0200)]
wscript: detect if we have libkdb5 and kdb.h.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agokrb5-wrap: Use the principal returned by the KDC to create the ccache
Andreas Schneider [Tue, 3 Feb 2015 12:00:34 +0000 (13:00 +0100)]
krb5-wrap: Use the principal returned by the KDC to create the ccache

We request a TGT in uppercase from the KDC. We turned on
canonicalization for that so the KDC returns the principal in lowercase
cause of this. As we use the uppercase prinicpal to create the ccache we
fail to find the tickets we need later because it is stored in the
incorrect case. You have to use the princial returned by the KDC here.

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agosmbd: fix use after free via conn->fsp_fi_cache
Michael Adam [Wed, 16 Mar 2016 22:57:33 +0000 (23:57 +0100)]
smbd: fix use after free via conn->fsp_fi_cache

Some instrumentation of the the durable reconnect
code uncovered a problem in the fsp_new, fsp_free pair:

vfs_default_durable_reconnect():
  fsp_new() ==> this does DLIST_ADD(fsp->conn->sconn->files, fsp)
  if (fsp->oplock_type == LEASE_OPLOCK) {
    find_fsp_lease(fsp, &key, l) ==> this fills conn->fsp_fi_cache
    if (client guids not equal) {
      fsp_free(fsp) ==> this does DLIST_REMOVE(fsp->conn->sconn->files, fsp)
  }

so after this code we have the fsp_fi_cache still pointing to the
free'd memory. The next call to find_fsp_lease will use the cache
and hence access the freed memory.

The fix consists in invalidating the cache in fsp_free() instead
of just in its wrapper file_free().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11799

Pair-Programmed-With: Guenther Deschner <gd@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 17 04:31:10 CET 2016 on sn-devel-144

5 years agoidmap_hash: only allow the hash module for default idmap config.
Michael Adam [Mon, 14 Mar 2016 16:07:34 +0000 (17:07 +0100)]
idmap_hash: only allow the hash module for default idmap config.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11786

This module only makes sense as the default idmap config
("idmap config * : backend = hash" ...)

Pair-Programmed-With: Guenther Deschner <gd@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
5 years agoidmap_hash: rename be_init() --> idmap_hash_initialize()
Michael Adam [Mon, 14 Mar 2016 16:06:34 +0000 (17:06 +0100)]
idmap_hash: rename be_init() --> idmap_hash_initialize()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11786

Pair-Programmed-With: Guenther Deschner <gd@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
5 years agos3:winbindd:idmap: check loadparm in domain_has_idmap_config() helper as well.
Günther Deschner [Thu, 10 Mar 2016 11:21:52 +0000 (12:21 +0100)]
s3:winbindd:idmap: check loadparm in domain_has_idmap_config() helper as well.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11786

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
5 years agos3:winbindd:idmap_hash: skip domains that already have their own idmap configuration.
Günther Deschner [Thu, 10 Mar 2016 09:39:15 +0000 (10:39 +0100)]
s3:winbindd:idmap_hash: skip domains that already have their own idmap configuration.

Check if the domain from the list is not already configured to use another idmap
backend. Not checking this makes the idmap_hash module map IDs for *all* domains
implicitly. This is quite dangeorous in multi-idmap-config setups.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11786

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
5 years agos3:winbindd:idmap: add domain_has_idmap_config() helper function.
Michael Adam [Thu, 10 Mar 2016 09:38:29 +0000 (10:38 +0100)]
s3:winbindd:idmap: add domain_has_idmap_config() helper function.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11786

Pair-Programmed-With: Guenther Deschner <gd@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
5 years agobuild: fix build when --without-quota specified
Uri Simchoni [Wed, 16 Mar 2016 18:20:02 +0000 (20:20 +0200)]
build: fix build when --without-quota specified

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11798

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
5 years agosmbd: remove quota support for some ancient OSs
Uri Simchoni [Sun, 13 Mar 2016 06:18:47 +0000 (08:18 +0200)]
smbd: remove quota support for some ancient OSs

Remove quota support for SunOS4 and VxFS on Solaris 2

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
5 years agosamba3.blackbox.smbclient_auth.plain: Add new regression test case.
Robin Hack [Mon, 14 Mar 2016 13:37:10 +0000 (14:37 +0100)]
samba3.blackbox.smbclient_auth.plain: Add new regression test case.

Test case covers commit:
96a49d23a4caebefcea66cfb855fadbae12ccf7c

Test case covers segfault of smbclient binary when
client NTLMv2 auth = yes
client use spnego = no
client max protocol = NT1
options are used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11793
RH BUG: http://bugzilla.redhat.com/show_bug.cgi?id=1271763

How to test:
$ make -j test TESTS="samba3.blackbox.smbclient_auth.plain"
RESULD: Should PASS
$ git revert 96a49d23a4caebefcea66cfb855fadbae12ccf7c
$ make -j test TESTS="samba3.blackbox.smbclient_auth.plain"
RESULT: Should FAIL
(and you can see segfault in dmesg)

Signed-off-by: Robin Hack <rhack@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar 16 18:29:10 CET 2016 on sn-devel-144

5 years agoldb-samba:wscript: python_samba__ldb depends on pyauth
Stefan Metzmacher [Tue, 15 Mar 2016 16:02:03 +0000 (17:02 +0100)]
ldb-samba:wscript: python_samba__ldb depends on pyauth

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11789

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar 16 01:34:29 CET 2016 on sn-devel-144

5 years agos3:wscript: pylibsmb depends on pycredentials
Stefan Metzmacher [Tue, 15 Mar 2016 15:59:51 +0000 (16:59 +0100)]
s3:wscript: pylibsmb depends on pycredentials

The need for pytalloc-util was based on the fact that
pycredentials depends on pytalloc-util.

As pylibsmb only used pycredentials and not pytalloc-util directly,
we should depend on pycredentials.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11789

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
5 years agosmbd: enable multi-channel if 'server multi channel support = yes' in the config
Michael Adam [Tue, 26 Jan 2016 07:16:51 +0000 (08:16 +0100)]
smbd: enable multi-channel if 'server multi channel support = yes' in the config

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Mar 15 20:58:19 CET 2016 on sn-devel-144

5 years agoparam: add parameter "server multi channel support", defaults to off.
Günther Deschner [Wed, 20 Jan 2016 16:44:45 +0000 (17:44 +0100)]
param: add parameter "server multi channel support", defaults to off.

Guenther

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agos3: vfs: vfs_xattr_tdb - cleanup. Remove unneeded variable "path".
Jeremy Allison [Sat, 12 Mar 2016 00:07:20 +0000 (16:07 -0800)]
s3: vfs: vfs_xattr_tdb - cleanup. Remove unneeded variable "path".

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Tue Mar 15 11:45:19 CET 2016 on sn-devel-144

5 years agos3:vfs: Change get_acl_blob() to take a const smb_filename * parameter from const...
Jeremy Allison [Fri, 11 Mar 2016 23:50:57 +0000 (15:50 -0800)]
s3:vfs: Change get_acl_blob() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:smbd: Change refuse_symlink() to take a const smb_filename * parameter from const...
Jeremy Allison [Fri, 11 Mar 2016 23:38:28 +0000 (15:38 -0800)]
s3:smbd: Change refuse_symlink() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:smbd: Change get_ea_names_from_file() to take a const smb_filename * parameter...
Jeremy Allison [Fri, 11 Mar 2016 23:34:58 +0000 (15:34 -0800)]
s3:smbd: Change get_ea_names_from_file() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:smbd: Change get_ea_list_from_file_path() to take a const smb_filename * parameter...
Jeremy Allison [Fri, 11 Mar 2016 23:30:00 +0000 (15:30 -0800)]
s3:smbd: Change get_ea_list_from_file_path() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3: smbd: Change canonicalize_ea_name() to take a const smb_filename * parameter...
Jeremy Allison [Fri, 11 Mar 2016 23:25:54 +0000 (15:25 -0800)]
s3: smbd: Change canonicalize_ea_name() to take a const smb_filename * parameter from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3: smbd: Reformatting - remove unneeded const char *fname variable.
Jeremy Allison [Fri, 11 Mar 2016 23:23:23 +0000 (15:23 -0800)]
s3: smbd: Reformatting - remove unneeded const char *fname variable.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:vfs: vfs_streams_xattr.c: Change walk_xattr_streams() to const struct smb_filename...
Jeremy Allison [Fri, 11 Mar 2016 23:11:20 +0000 (15:11 -0800)]
s3:vfs: vfs_streams_xattr.c: Change walk_xattr_streams() to const struct smb_filename * from const char *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:vfs: vfs_streams_xattr.c - Remove duplicate code. This is exactly vfs_stat_smb_bas...
Jeremy Allison [Fri, 11 Mar 2016 23:08:26 +0000 (15:08 -0800)]
s3:vfs: vfs_streams_xattr.c - Remove duplicate code. This is exactly vfs_stat_smb_basename().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3: vfs: vfs_solarisacl. refuse_symlink() means we can always use STAT here.
Jeremy Allison [Sat, 12 Mar 2016 00:01:31 +0000 (16:01 -0800)]
s3: vfs: vfs_solarisacl. refuse_symlink() means we can always use STAT here.

For a posix acl call on a symlink, we've already refused it.
For a Windows acl mapped call on a symlink, we want to follow
it.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3: vfs: vfs_hpuxacl. refuse_symlink() means we can always use STAT here.
Jeremy Allison [Fri, 11 Mar 2016 22:29:20 +0000 (14:29 -0800)]
s3: vfs: vfs_hpuxacl. refuse_symlink() means we can always use STAT here.

For a posix acl call on a symlink, we've already refused it.
For a Windows acl mapped call on a symlink, we want to follow
it.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agobuild: mark explicit dependencies on pytalloc-util
Garming Sam [Tue, 15 Mar 2016 00:29:54 +0000 (13:29 +1300)]
build: mark explicit dependencies on pytalloc-util

All subsystems that include pytalloc.h need to link against
pytalloc-util.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11789

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Tue Mar 15 07:08:16 CET 2016 on sn-devel-144

5 years agobuild: improve comments in tests/oldquotas.c
Uri Simchoni [Sun, 13 Mar 2016 05:17:23 +0000 (07:17 +0200)]
build: improve comments in tests/oldquotas.c

Add comments to #else and #endif

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Mar 15 02:18:15 CET 2016 on sn-devel-144

5 years agos3:vfs: Change smbacl4_GetFileOwner() to take const struct smb_filename * from const...
Jeremy Allison [Fri, 11 Mar 2016 00:17:32 +0000 (16:17 -0800)]
s3:vfs: Change smbacl4_GetFileOwner() to take const struct smb_filename * from const char *.

Preparing to remove vfs_stat_smb_basename() call.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
5 years agos3:smbd:vfs: Change posix_get_nt_acl() from const char * to const struct smb_filename *.
Jeremy Allison [Fri, 11 Mar 2016 00:05:48 +0000 (16:05 -0800)]
s3:smbd:vfs: Change posix_get_nt_acl() from const char * to const struct smb_filename *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
5 years agos3:smbd:vfs: Change smb_get_nt_acl_nfs4() to take a const struct smb_filename *.
Jeremy Allison [Thu, 10 Mar 2016 23:56:51 +0000 (15:56 -0800)]
s3:smbd:vfs: Change smb_get_nt_acl_nfs4() to take a const struct smb_filename *.

Push the struct further down closer to places that use
lp_posix_pathname() functions.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
5 years agos3:smbd: Fix build for vfs_aixacl2.c.
Jeremy Allison [Thu, 10 Mar 2016 23:34:58 +0000 (15:34 -0800)]
s3:smbd: Fix build for vfs_aixacl2.c.

Missed conversion of get_nt_acl_fn from const char *
to const struct smb_filename *.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
5 years agos3: smbd: Remove the last lp_posix_pathnames() in the rename path.
Jeremy Allison [Thu, 10 Mar 2016 23:15:34 +0000 (15:15 -0800)]
s3: smbd: Remove the last lp_posix_pathnames() in the rename path.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
5 years agosmbd:smb2: remove an unnecessary !! cast.
Michael Adam [Thu, 3 Mar 2016 15:57:45 +0000 (16:57 +0100)]
smbd:smb2: remove an unnecessary !! cast.

Casting to bool is done implcitly upon assignment.
Thanks to Ralph for pointing this out!

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Mon Mar 14 23:01:31 CET 2016 on sn-devel-144

5 years agos3:libnet:libnet_join: update msDS-SupportedEncryptionTypes (if required) with machin...
Günther Deschner [Fri, 11 Mar 2016 22:15:06 +0000 (23:15 +0100)]
s3:libnet:libnet_join: update msDS-SupportedEncryptionTypes (if required) with machine creds.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Mar 14 19:38:48 CET 2016 on sn-devel-144

5 years agos3:libnet:libnet_join: fill in output enctypes and only modify when necessary.
Günther Deschner [Fri, 11 Mar 2016 15:05:53 +0000 (16:05 +0100)]
s3:libnet:libnet_join: fill in output enctypes and only modify when necessary.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agos3:libnet:libnet_join: define list of desired encryption types only once.
Günther Deschner [Fri, 11 Mar 2016 15:04:52 +0000 (16:04 +0100)]
s3:libnet:libnet_join: define list of desired encryption types only once.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agos3:librpc:idl:libnet_join: add encryption types to libnet_JoinCtx.
Günther Deschner [Fri, 11 Mar 2016 15:02:27 +0000 (16:02 +0100)]
s3:librpc:idl:libnet_join: add encryption types to libnet_JoinCtx.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agos3:libnet:libnet_join: always try to create machineaccount via LDAP first.
Günther Deschner [Thu, 10 Mar 2016 17:03:47 +0000 (18:03 +0100)]
s3:libnet:libnet_join: always try to create machineaccount via LDAP first.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agos3:libads:ldap: fix ads_check_ou_dn to deal with account_ou not being initialized
Günther Deschner [Fri, 11 Mar 2016 11:15:14 +0000 (12:15 +0100)]
s3:libads:ldap: fix ads_check_ou_dn to deal with account_ou not being initialized

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agos3:libads:ndr: add ADS_AUTH_USER_CREDS to ndr_print_ads_auth_flags()
Günther Deschner [Fri, 11 Mar 2016 11:13:24 +0000 (12:13 +0100)]
s3:libads:ndr: add ADS_AUTH_USER_CREDS to ndr_print_ads_auth_flags()

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agos3:libads:ldap: print LDAP error message with log level 10.
Günther Deschner [Fri, 4 Mar 2016 16:42:05 +0000 (17:42 +0100)]
s3:libads:ldap: print LDAP error message with log level 10.

Guenther

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agos3:libnet:libnet_join: prepare to allow connecting with machine creds.
Günther Deschner [Wed, 2 Mar 2016 17:07:53 +0000 (18:07 +0100)]
s3:libnet:libnet_join: prepare to allow connecting with machine creds.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agoPartly revert "s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add"
Günther Deschner [Fri, 11 Mar 2016 22:14:13 +0000 (23:14 +0100)]
Partly revert "s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add"

This partly reverts commit 0c74d62524db376b6a3fac00c688be0cdffcaa80.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
5 years agotests: Allow alternative error code for backupkey test
Garming Sam [Sun, 13 Mar 2016 23:02:06 +0000 (12:02 +1300)]
tests: Allow alternative error code for backupkey test

It appears that incorrect decryption triggers a different error code,
causing a test which fails every now and again, as sometimes the invalid
data will parse as a SID, and so pass one of the checks.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Mar 14 03:55:16 CET 2016 on sn-devel-144

5 years agodsdb/repl: Ensure we use the LOCAL attid value, not the remote one
Andrew Bartlett [Thu, 10 Mar 2016 00:43:15 +0000 (13:43 +1300)]
dsdb/repl: Ensure we use the LOCAL attid value, not the remote one

The key here is that while this never was an issue for builtin schema,
nor for objects with an msDS-IntID used outside the schema partition,
additional attributes added and used in the schema partition were
incorrectly using the wrong attributeID value in the replPropertyMetaData.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11783

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sun Mar 13 23:29:14 CET 2016 on sn-devel-144

5 years agos4:torture/lsa: improve debug message
Stefan Metzmacher [Thu, 10 Mar 2016 11:16:25 +0000 (12:16 +0100)]
s4:torture/lsa: improve debug message

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
5 years agos3:winbindd: don't unclude two '\0' at the end of the domain list
Stefan Metzmacher [Thu, 10 Mar 2016 11:17:43 +0000 (12:17 +0100)]
s3:winbindd: don't unclude two '\0' at the end of the domain list

This avoids a scary "trustdom_list_done: Got invalid trustdom response" message.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11782

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
5 years agobuild: fix disk-free quota support on Solaris 10
Uri Simchoni [Wed, 3 Feb 2016 04:41:42 +0000 (06:41 +0200)]
build: fix disk-free quota support on Solaris 10

Samba has no code to support quota on Solaris 10 (and possibly other
os's such as AIX) using the new quota interface. The new interface
serves both disk size/free space reporting (clamping the underlying
file system numbers with quota), and direct manipulation of the user's
quota.

However, there's legacy code that supports only disk size/free space on
Solaris 10. In the waf build, this code is not compiled because there is
no test for it.

This patch adds a test to see whether the legacy code can be used.

Issue reported and fix tested by Andrew Morgan <morgan@orst.edu>.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11788

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sun Mar 13 01:37:58 CET 2016 on sn-devel-144

5 years agosmbd: Only check dev/inode in open_directory, not the full stat()
Andrew Bartlett [Fri, 11 Mar 2016 01:27:53 +0000 (14:27 +1300)]
smbd: Only check dev/inode in open_directory, not the full stat()

This is needed because the smb2.create.mkdir-dup test creates a race,
and against an AD DC this can cause a flapping test if the lstat() and
stat() calls are made either side of the chown() due to creation of a
file by administrator.

Fix based on original patches by myself, by Douglas Bagnall
<douglas.bagnall@catalyst.net.nz>.  and Jeremy Allison <jra@samba.org>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11780

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Mar 12 09:43:21 CET 2016 on sn-devel-144

5 years agolib/socket/interfaces: Fix some uninitialied bytes.
Günther Deschner [Wed, 2 Mar 2016 17:32:53 +0000 (18:32 +0100)]
lib/socket/interfaces: Fix some uninitialied bytes.

Valgrind reports the following:

==26599== Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s)
==26599==    at 0x7014707: ioctl (in /usr/lib64/libc-2.22.so)
==26599==    by 0x79D1585: query_iface_speed_from_name (interfaces.c:152)
==26599==    by 0x79D1BBA: _get_interfaces (interfaces.c:277)
==26599==    by 0x79D1E80: get_interfaces (interfaces.c:368)
==26599==    by 0x508A7E3: load_interfaces (interface.c:612)
==26599==    by 0x150B30: main (net.c:963)
==26599==  Address 0xffefff0d8 is on thread 1's stack
==26599==  in frame #1, created by query_iface_speed_from_name
(interfaces.c:130)
==26599==
==26599== Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s)
==26599==    at 0x7014707: ioctl (in /usr/lib64/libc-2.22.so)
==26599==    by 0x79D15CC: query_iface_speed_from_name (interfaces.c:164)
==26599==    by 0x79D1BBA: _get_interfaces (interfaces.c:277)
==26599==    by 0x79D1E80: get_interfaces (interfaces.c:368)
==26599==    by 0x508A7E3: load_interfaces (interface.c:612)
==26599==    by 0x150B30: main (net.c:963)
==26599==  Address 0xffefff0d8 is on thread 1's stack
==26599==  in frame #1, created by query_iface_speed_from_name
(interfaces.c:130)

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
5 years agoselftest: mark samba4.winbind.struct.domain_info.ad_member as flapping
Stefan Metzmacher [Fri, 11 Mar 2016 09:49:21 +0000 (10:49 +0100)]
selftest: mark samba4.winbind.struct.domain_info.ad_member as flapping

See https://lists.samba.org/archive/samba-technical/2016-March/112861.html

  found 517 lines matching '^UNEXPECTED' in 641 files matching 'samba.stdout$'
   175 UNEXPECTED(failure): samba4.winbind.struct.domain_info(ad_member:local)
    19 UNEXPECTED(failure): samba4.winbind.struct.domain_info(s3member:local)
    12 UNEXPECTED(failure): samba4.rpc.backupkey with seal.backupkey.server_wrap_encrypt_decrypt_wrong_key(ad_dc_ntvfs)
    12 UNEXPECTED(failure): samba4.drs.delete_object.python(promoted_dc).delete_object.DrsDeleteObjectTestCase.test_ReplicateDeletedObject1(promoted_dc)
    12 UNEXPECTED(failure): samba4.rpc.backupkey with seal.backupkey.server_wrap_decrypt_wrong_r2(ad_dc_ntvfs)
    11 UNEXPECTED(failure): samba4.ldap.notification.python(ad_dc_ntvfs).__main__.LDAPNotificationTest.test_max_search(ad_dc_ntvfs)

We'll see if we also need to add
samba4.winbind.struct.domain_info.s3member
before we're able to identify and fix the problem.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Mar 12 02:14:39 CET 2016 on sn-devel-144

5 years agos4:dsdb/test/sort: avoid 'from collections import Counter'
Stefan Metzmacher [Fri, 11 Mar 2016 09:39:13 +0000 (10:39 +0100)]
s4:dsdb/test/sort: avoid 'from collections import Counter'

This is only available in python 2.7 and >= 3.1

This should fix make test with python 2.6.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agos4:dsdb/test/notification: make test_invalid_filter more resilient against ordering...
Stefan Metzmacher [Fri, 11 Mar 2016 09:16:27 +0000 (10:16 +0100)]
s4:dsdb/test/notification: make test_invalid_filter more resilient against ordering races

We saw a lot of flapping tests with:

    [1793(11038)/1892 at 1h55m26s]
    samba4.ldap.notification.python(ad_dc_ntvfs)(ad_dc_ntvfs)
    UNEXPECTED(failure):
    samba4.ldap.notification.python(ad_dc_ntvfs).__main__.LDAPNotificationTest.test_max_search(ad_dc_ntvfs)
    REASON: Exception: Exception: Traceback (most recent call last):
      File
    "/memdisk/autobuild/fl/b1782183/samba/source4/dsdb/tests/python/notification.py",
    line 181, in test_max_search
        self.assertEquals(num, ERR_TIME_LIMIT_EXCEEDED)
    AssertionError: 11 != 3

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agoAdded MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth
Herwin Weststrate [Wed, 9 Dec 2015 17:47:47 +0000 (18:47 +0100)]
Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth

An implementation of https://lists.samba.org/archive/samba/2012-March/166497.html (which has been discussed in 2012, but was never implemented).

It has been tested on a Debian Jessie system with this patch added to the Debian package (which is currently 4.1.17). Even though this is Samba 4, the ntlm_auth installed is the one from Samba 3 (yes, it surprised me too). The backend was a machine with Windows 2012R2.

It was first tested with the local security policy 'Network Security: LAN Manager authentication level' setting changed to 'Send NTLMv2 Response Only' (allow ntlm v1). This way we are able to authenticate with and without the MSV1_0_ALLOW_MSVCHAPV2 flag (as expected).

After the basic step has been verified, the local security policy 'Network Security: LAN Manager authentication level' setting was changed to 'Send NTLMv2 Response Only. Refuse LM & NTLM' (only allow ntlm v2). The behaviour now changed according to the MSV1_0_ALLOW_MSVCHAPV2 flag (again: as expected).

  $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain=
  Logon failure (0xc000006d)
  $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain= --allow-mschapv2
  NT_KEY: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

The changes in `wbclient.h` are intended for programs that use libwinbind directly instead of authenticating via `ntlm_auth`. I intend to use that within FreeRADIUS (see https://bugzilla.samba.org/show_bug.cgi?id=11149).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11694
Signed-off-by: Herwin Weststrate <herwin@quarantainenet.nl>
Reviewed-by: Kai Blin <kai@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agoctdb-client: Increase the timeout for TRANS3_COMMIT control
Amitay Isaacs [Thu, 10 Mar 2016 07:01:31 +0000 (18:01 +1100)]
ctdb-client: Increase the timeout for TRANS3_COMMIT control

On a busy system, TRANS3_COMMIT control can take upto or longer than
3 seconds.  On timeout, there are few possible outcomes.

1. The transaction has completed on all nodes and TRANS3_COMMIT control
   has returned.  In such a case, there is no problem.

2. The transaction has completed on the local node, but TRANS3_COMMIT
   control is still active.  In such a case, ctdb_transaction_commit()
   can return successfully.  If this is being called from ctdb, then
   ctdb will exit.  This will cause ctdb daemon to trigger recovery
   since the client exited while transaction is active.  This will cause
   unnecessary recovery.

3. Database recovery was started and ctdb_transaction_commit() will
   retry till the recovery completes the transaction.

Increasing the timeout to 30 seconds will avoid the spurious database
recoveries when TRANS3_COMMIT control takes longer to finish.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Mar 11 19:59:53 CET 2016 on sn-devel-144

5 years agosmbd: Prevent a crash
Volker Lendecke [Thu, 10 Mar 2016 07:54:54 +0000 (08:54 +0100)]
smbd: Prevent a crash

smb2srv_session_close_previous_check crashes if
ndr_pull_smbXsrv_session_globalB fails for some reason. It depends on "is_free"
to be correctly set. All we can do for an invalid database is to discard the
record and set it free.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 11 00:12:18 CET 2016 on sn-devel-144

5 years agos3: smbd: Simplify logic inside rename_internals_fsp() part 2
Jeremy Allison [Thu, 10 Mar 2016 00:12:00 +0000 (16:12 -0800)]
s3: smbd: Simplify logic inside rename_internals_fsp() part 2

Removes the use of an extraneous 'struct smb_filename *'
which wasn't being created correctly, only as a place
holder for two char * pointers.

Use split_stream_filename() to create the char * pointers
directly and make it clearer what we're up to here.

The logic here is still complex, but I'm satified
it does the correct thing.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3: smbd: Simplify logic inside rename_internals_fsp() part 1.
Jeremy Allison [Thu, 10 Mar 2016 00:01:52 +0000 (16:01 -0800)]
s3: smbd: Simplify logic inside rename_internals_fsp() part 1.

Use standard parent_dirname() function instead of hand-hacking
using strrchr_m(xxx, '/'). Next commit should enable removal
of synthetic_smb_fname_split().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:lib: Move internal lp_posix_pathnames() call out of utility function synthetic_smb...
Jeremy Allison [Thu, 10 Mar 2016 00:00:47 +0000 (16:00 -0800)]
s3:lib: Move internal lp_posix_pathnames() call out of utility function synthetic_smb_fname_split().

Make it a passed in parameter instead.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:lib: Remove the const SMB_STRUCT_STAT * parameter from synthetic_smb_fname_split().
Jeremy Allison [Wed, 9 Mar 2016 23:50:02 +0000 (15:50 -0800)]
s3:lib: Remove the const SMB_STRUCT_STAT * parameter from synthetic_smb_fname_split().

Only one caller uses this, and this can be handled externally.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:lib: Rewrite synthetic_smb_fname_split() to use split_stream_filename().
Jeremy Allison [Wed, 9 Mar 2016 23:45:55 +0000 (15:45 -0800)]
s3:lib: Rewrite synthetic_smb_fname_split() to use split_stream_filename().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agos3:lib. Add split_stream_filename() Not yet used.
Jeremy Allison [Wed, 9 Mar 2016 22:56:49 +0000 (14:56 -0800)]
s3:lib. Add split_stream_filename() Not yet used.

Will replace internals of synthetic_smb_fname_split().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
5 years agoselftest: add some test cases to net ads join
Uri Simchoni [Wed, 4 Nov 2015 05:32:57 +0000 (07:32 +0200)]
selftest: add some test cases to net ads join

Perform a testjoin between steps to verify join status
Perform most testjoins with machine account because that's
the more common case.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Thu Mar 10 14:41:13 CET 2016 on sn-devel-144

5 years agoselftest: run net ads join test in a private client env
Uri Simchoni [Wed, 4 Nov 2015 05:31:47 +0000 (07:31 +0200)]
selftest: run net ads join test in a private client env

net ads join command changes machine password, thus affecting
the test environment beyond the thing we want to test.

This cange runs the test in a private client env, with its
own hostname, newly-generated machine SID, and a separate
secrets.tdb, thus not affecting the running AD member server,

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
5 years agos4:rpc_server: dcesrv_generic_session_key should only work on local transports
Stefan Metzmacher [Tue, 10 Nov 2015 09:25:10 +0000 (10:25 +0100)]
s4:rpc_server: dcesrv_generic_session_key should only work on local transports

This matches modern Windows servers.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Mar 10 10:15:21 CET 2016 on sn-devel-144

5 years agos4:rpc_server/samr: hide a possible NO_USER_SESSION_KEY error
Stefan Metzmacher [Fri, 26 Feb 2016 15:41:10 +0000 (16:41 +0100)]
s4:rpc_server/samr: hide a possible NO_USER_SESSION_KEY error

Windows servers doesn't return the raw NT_STATUS_NO_USER_SESSION_KEY
error, but return WRONG_PASSWORD or even hide the error by using a random
session key, that results in an invalid, unknown, random NTHASH.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agos4:librpc/rpc: dcerpc_generic_session_key() should only be available on local transports
Stefan Metzmacher [Tue, 10 Nov 2015 09:25:10 +0000 (10:25 +0100)]
s4:librpc/rpc: dcerpc_generic_session_key() should only be available on local transports

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agos4:torture:samba3rpc: use an authenticated SMB connection and an anonymous DCERPC...
Stefan Metzmacher [Tue, 15 Dec 2015 21:44:24 +0000 (22:44 +0100)]
s4:torture:samba3rpc: use an authenticated SMB connection and an anonymous DCERPC connection on top

This is the only way to get a reliable transport session key.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
5 years agos4:selftest: run rpc.samr over ncacn_np instead of ncacn_ip_tcp
Stefan Metzmacher [Fri, 18 Dec 2015 19:18:42 +0000 (20:18 +0100)]
s4:selftest: run rpc.samr over ncacn_np instead of ncacn_ip_tcp

It requires a transport session key, which is only reliable available
over SMB.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>