git.samba.org - samba.git/log

s3: torture: Add a test for setting and getting ACLs on stream handles (SMB2-STREAM-ACL).

It shows this isn't done correctly for streams_xattr.

A common config is:

vfs_objects = streams_xattr acl_xattr

to store both streams and Windows ACLs in xattrs.

Unfortunately getting and setting ACLs using handles
opened on stream files isn't being done correctly
in Samba.

This test passes against Windows 10.

This adds tests that prove this doesn't work. Next
patch will add the fix and remove the knownfail.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

ldb-samba: remove redundant negative check

smb_strtoull() already checks for negative numbers, but does
it properly, catching " -2" as well as "-2".

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Mar 30 18:55:28 UTC 2021 on sn-devel-184

ldb-samba: avoid VLA in dsdb match dns tombstone

We don't need it (only 64 bytes) and, well, they annoy people.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

ldb-samba: avoid leak in dsdb_match_for_dns_to_tombstone_time

After the first time through the loop, tmp_ctx has been freed and
NULLed, so we end up allocating on NULL and never freeing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14659

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:utils: The 'net ads keytab' commands should use machine credentials

If the user doesn't specify a username/password on the command line, we
should use the machine credentials to connect to AD. This is how it is
used by default and we should be able to retrieve SPNs.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Mar 30 06:48:18 UTC 2021 on sn-devel-184

s3:utils: Use secrets_store_creds() in net utility

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3:passdb: Add secrets_store_creds()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3:utils: Use libnetapi_set_creds() in net_dom

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3:utils: Use libnetapi_set_creds() in net_rpc_shell

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3:utils: Use libnetapi_set_creds() in net_rpc

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3:utils: Fix net_context_creds() with machine password

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3:libnetapi: Remove unused header file

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

rpc/idl dnsserver s/DNS_RPC_DATA/DNS_RPC_RECORD_DATA/

Following MS-DNSP.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Mar 30 00:20:53 UTC 2021 on sn-devel-184

librpc/idl: dnsp tombstone timestamp name matches MS-DNSP

MS-DNSP uses the term "EntombedTime" in e.g. "2.2.2.2.4.23 DNS_RPC_RECORD_TS"
which is more descriptive than the generic "timestamp", and less likely to be
confused with dwTimestamp, which has been our curse. Let's make it grep-able,
google-able, and evocative.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

pytest/dnsserver: extend record_type_int to all types

with improved diagnostics on bad arguments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

pytest/dns: use self.assertIn() and .assertNotIn()

These give a more detailed message than assertTrue(x in y).

They were new in Python 3.1, so we avoided them until recently.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

pytest/dns: remove redundant argument

We are always setting zone to the same thing which we already know,
and we can reduce cognative stress by mentioning it less and not doing
that weird pop thing.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

dsdb/dns scavange: make a helper function static

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

dsdb/scavange dns: reserve NTTIME type for NTTIME values

We know it "really" just means uint64_t, but we also know it means
100-nanosecond intervals since 1601, and that makes any other use very
confusing (and not just to me, or there wouldn't be these bugs we're
chasing).

In these cases we are talking about 32 bit hours-since-1601 timestamps.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

dns: use unix_to_dns_timestamp almost everywhere

In places we change NTTIME to uint32_t, because that is what is
actually wanted.

There is one instance of the calculation that we are not changing,
because there are other problems there.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

pydns: expose dns timestamp utils to python, and test

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

dns: add common dns_timestamp util functions

The dns structs have an unsigned 32 bit timestamp in hours since the
beginning of 1601. In a number of places we need to convert from unix
time to this timestamp, or from the timestamp to NTTIME.

You'll see subsequent patches that make use of these functions.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

dns common: always check a talloc NULL.

Also, since we're there, avoid sorting an array of 1 element.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

libcli smb smb2: Use correct enumeration type

Clang gives the following error:
../../libcli/smb/smb2_signing.c:547:48: error:
   implicit conversion from enumeration type 'gnutls_mac_algorithm_t'
   to different enumeration type 'gnutls_digest_algorithm_t'
   [-Werror,-Wenum-conversion]
   const size_t digest_len = gnutls_hash_get_len(GNUTLS_MAC_SHA256);
~~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~

Should be using GNUTLS_DIG_SHA256, which is set to GNUTLS_MAC_SHA256.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Mon Mar 29 23:19:24 UTC 2021 on sn-devel-184

smb2_tcon: also try to cancel pending compound requests on tdis

There's no reason to do something special here.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Mar 29 20:43:28 UTC 2021 on sn-devel-184

smbXsrv_session: always cancel pending requests in smb2srv_session_shutdown_send() in the same way

The session is valid for the lifetime of the requests anyway
and there's no point in having special handling for compound requests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smb2_server: don't cancel pending request if at least one channel is still alive

In order to allow replays of requests on a channel failure, we should
not cancel pending requests, the strategie that seems to make windows
clients happy is to let the requests running and return
NT_STATUS_FILE_NOT_AVAILABLE as long as the original request is still
pending.

Here we introduce xconn->transport.shutdown_wait_queue, this is used
to keep the xconn alive for the lifetime of pending requests.

Now we only cancel pending requests if the disconnected connection
is the last channel for a session.

In that case smbXsrv_session_remove_channel() and
smb2srv_session_shutdown_send() will take care of it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smb2_server: let smbd_smb2_flush_send_queue() destroy pending elements on dead connection

Otherwise we'll keep the state of already finished requests arround.

This becomes critical as the next commit will cause us to
let pending requests running and keep the xconn alive for
the lifetime of pending requests, so we would not ever
make progress and deadlock.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbXsrv_open: intruduce smbXsrv_open_replay_cache to support FILE_NOT_AVAILABLE

Before processing an open we need to reserve the replay cache entry
in order to signal that we're still in progress.
If a reserved record is already present we need to return
FILE_NOT_AVAILABLE in order to let the client retry again.

[MS-SMB2] contains this:

  <152> Section 3.2.5.1: For the following error codes, Windows-based clients
  will retry the operation up to three times and then retry the operation every 5
  seconds until the count of milliseconds specified by Open.ResilientTimeout is
  exceeded:
  - STATUS_SERVER_UNAVAILABLE
  - STATUS_FILE_NOT_AVAILABLE
  - STATUS_SHARE_UNAVAILABLE

This works fine for windows clients, but current windows servers seems to
return ACCESS_DENIED instead of FILE_NOT_AVAILABLE.

A Windows server doesn't do any replay detection on pending opens,
which wait for a HANDLE lease to be broken (because of a
SHARING_VIOLATION), at all.

As this is not really documented for the server part of the current [MS-SMB2],
I found the key hint in "SMB 2.2: Bigger. Faster. Scalier - (Parts 1 and 2)"
on page 24. There's a picture showing that a replay gets FILE_NOT_AVAILABLE
as long as the original request is still in progress. See:
https://www.snia.org/educational-library/smb-22-bigger-faster-scalier-parts-1-and-2-2011

A Windows client is unhappy with the current windows server behavior if it
such a situation happens. There's also a very strange interaction with oplock
where the replay gets SHARING_VIOLATION after 35 seconds because it conflicts with
the original open.

I think it's good to follow the intial design from the 2011 presentation and
make the clients happy by using FILE_NOT_AVAILABLE (and differ from Windows).
I'll report that to dochelp@microsoft.com in order to get this hopefully fixed in
their server too).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbXsrv_session: smbXsrv_session_remove_channel() should also remove the last channel

There's nothing special regarding the last channel,
as the smb2.session.bind2 test demonstrates.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:torture/smb2: add smb2.session.bind2

This demonstrates that a session and it's open handles is destroyed
when the last explicitly bound channel gets disconnected.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:torture/smb2: add smb2.replay.dhv2-pending* tests

These demonstrate that the replay detection for pending opens
either doesn't exist (for the share_access=NONE => SHARING_VIOLATION
case) or return the wrong status code => ACCESS_DENIED instead of
FILE_NOT_AVAILABLE.

Windows clients transparently retry after FILE_NOT_AVAILABLE,
while they pass ACCESS_DENIED directly to the application.

I'll report that to dochelp@microsoft.com in order to
clarify the situation.

In the meantime I added tests with a '-windows' suffix,
which demostrate the current windows server behavior,
while the tests with a '-sane' suffix expect the behavior
that whould make windows clients happy.

For Samba I'll implement the '-sane' behavior that
detects all replays and returns FILE_NOT_AVAILABLE
if the original request is still pending.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:torture/smb2: provide verbose output when we're waiting for potential lease/oplock breaks

It makes it easier to follow manual tests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:torture/smb2: add smb2_util_lease_state_string()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:torture/smb2: make use of torture_reset_break_info() in replay.c

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:torture/smb2: make use of torture_reset_lease_break_info() in lease.c

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_aio_pthread: don't allow async opens when multi channel is enabled.

We will get this supported later, but for now just disable async
opens as fsp->mid may not belong the first xconn of client->connections.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14449

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Rename mdfind to mdsearch

GNUstep as an mdfind binary, and both should be co-instalable.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14431

Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Björn Baumbach <bb@sernet.de>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Mar 29 16:18:54 UTC 2021 on sn-devel-184

build: Notice if flex is missing at configure time

This may also fix the coverage build by ensuring --noline
is always specified to flex.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14586

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Mar 29 02:12:23 UTC 2021 on sn-devel-184

build: Consolidate --with-dnsupdate with --with-ads (which implied HAVE_KRB5)

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 26 04:06:41 UTC 2021 on sn-devel-184

build: Consolidate --with-ntvfs-fileserver into --enable-selftest when building the AD DC

This removes from our configure help a feature which we retain only
to support our selftest system.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smb.conf: Remove "share backend" option

This is a confusing hold-over from the NTVFS fileserver that never became part of
the merged architecture.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3: smbd: Raise debug level when synthetic_pathref() can't find the file.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

rpc_client: cli_winreg_spoolss.h references spoolss structs

Add required includes

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Mar 24 21:28:48 UTC 2021 on sn-devel-184

nmbd: Fix socket cleanup in make_subnet()

We can have -errno in the in those variables

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

nmbd: Fix CID 1474439: Incorrect expression

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_ceph: Fix CID 1474440: Null pointer dereferences

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

printing: Align a few integer types

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

printing: Remove "else" branches, reduce indentation

Best reviewed with "git show -b"

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

printing: Fix typos

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

printing: Remove code to upgrade from before b0909cfa14f

I think even back then "printing.tdb" would have just been a stale
tdb that would have been better handled externally. It might have been
a product requirement back then, but I think a startup script and not
core code might have been a better choice to handle this.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

printing: Passing a fn pointer does not need "&"

Just looked a bit weird and different from all other fn pointer
references in Samba.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

libcli: Add file specific access flags to sddl

See

https://docs.microsoft.com/en-us/windows/win32/secauthz/ace-strings

for reference.

We can only use them for decoding, many of our tests depend on our
string representation of the flags.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

winbindd: Fix a startup race with allocate_gid

If you try to allocate a GID before winbind is fully set up,
idmap_child_handle() is still NULL. Add the required
wb_parent_idmap_setup_send()/recv() to allocate_gid().

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14678
RN: Fix a crash in winbind when allocate-gid is called early

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

dosmode: retry reading dos attributes as root for unreadable files

if there are files that the user can't access, he is still allowed to read the
dos attributes information, so we need to try reading them as root also.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14654

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ldb: bump version to 2.4.0, in order to be used for Samba 4.15

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar 24 13:11:52 UTC 2021 on sn-devel-184

CVE-2020-27840: pytests: move Dn.validate test to ldb

We had the test in the Samba Python segfault suite because
a) the signal catching infrastructure was there, and
b) the ldb tests lack Samba's knownfail mechanism, which allowed us to
assert the failure.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14595

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode

A DN string with lots of trailing space can cause ldb_dn_explode() to
put a zero byte in the wrong place in the heap.

When a DN string has a value represented with trailing spaces,
like this

     "CN=foo   ,DC=bar"

the whitespace is supposed to be ignored. We keep track of this in the
`t` pointer, which is NULL when we are not walking through trailing
spaces, and points to the first space when we are. We are walking with
the `p` pointer, writing the value to `d`, and keeping the length in
`l`.

     "CN=foo   ,DC= "       ==>       "foo   "
            ^  ^                             ^
            t  p                             d
                                       --l---

The value is finished when we encounter a comma or the end of the
string. If `t` is not NULL at that point, we assume there are trailing
spaces and wind `d and `l` back by the correct amount. Then we switch
to expecting an attribute name (e.g. "CN"), until we get to an "=",
which puts us back into looking for a value.

Unfortunately, we forget to immediately tell `t` that we'd finished
the last value, we can end up like this:

     "CN=foo   ,DC= "       ==>        ""
            ^      ^                    ^
            t      p                    d
                                        l=0

where `p` is pointing to a new value that contains only spaces, while
`t` is still referring to the old value. `p` notices the value ends,
and we subtract `p - t` from `d`:

     "CN=foo   ,DC= "       ==>  ?     ""
            ^       ^            ^
            t       p            d
                                      l ~= SIZE_MAX - 8

At that point `d` wants to terminate its string with a '\0', but
instead it terminates someone else's byte. This does not crash if the
number of trailing spaces is small, as `d` will point into a previous
value (a copy of "foo" in this example). Corrupting that value will
ultimately not matter, as we will soon try to allocate a buffer `l`
long, which will be greater than the available memory and the whole
operation will fail properly.

However, with more spaces, `d` will point into memory before the
beginning of the allocated buffer, with the exact offset depending on
the length of the earlier attributes and the number of spaces.

What about a longer DN with more attributes? For example,
"CN=foo     ,DC= ,DC=example,DC=com" -- since `d` has moved out of
bounds, won't we continue to use it and write more DN values into
mystery memory? Fortunately not, because the aforementioned allocation
of `l` bytes must happen first, and `l` is now huge. The allocation
happens in a talloc_memdup(), which is by default restricted to
allocating 256MB.

So this allows a person who controls a string parsed by ldb_dn_explode
to corrupt heap memory by placing a single zero byte at a chosen
offset before the allocated buffer.

An LDAP bind request can send a string DN as a username. This DN is
necessarily parsed before the password is checked, so an attacker does
not need proper credentials. The attacker can easily cause a denial of
service and we cannot rule out more subtle attacks.

The immediate solution is to reset `t` to NULL when a comma is
encountered, indicating that we are no longer looking at trailing
whitespace.

Found with the help of Honggfuzz.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14595

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

CVE-2020-27840: pytests:segfault: add ldb.Dn validate test

ldb.Dn.validate wraps ldb_dn_explode.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14595

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds

For a string that had N spaces at the beginning, we would
try to move N bytes beyond the end of the string.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14655

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

CVE-2021-20277 ldb tests: ldb_match tests with extra spaces

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14655

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

auth:creds: Free the uname pointer in cli_credentials_parse_string()

The data is duplicated and we don't need it anymore.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Mar 24 03:13:05 UTC 2021 on sn-devel-184

auth:creds: Don't include credentials_internal.h twice

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

netcmd: Fix opening SamDB database for offline backup

When opening the backed-up SamDB database, open the top-level database
without loading any modules so the backend database files aren't
unnecessarily opened. The domain SID is now fetched from the original
database rather than from the backup.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Samuel Cabrero <scabrero@samba.org>

netcmd: Workaround issue backing up offline domain with lmdb >= 0.9.26

The LMDB change "ITS#9278 fix robust mutex cleanup for FreeBSD" released
in version 0.9.26 makes samba-tool domain backup offline to fail with
the following error:

Failed to connect to 'mdb:///tmp/foo/private/sam.ldb.d/CN=CONFIGURATION,DC=FOO,DC=EXAMPLE,DC=COM.ldb' with backend 'mdb': Unable to load ltdb cache records for backend 'ldb_mdb backend'
module samba_dsdb initialization failed : Operations error
Unable to load modules for /tmp/foo/private/sam.ldb.bak-offline: Unable to load ltdb cache records for backend 'ldb_mdb backend'
ERROR(ldb): uncaught exception - Unable to load ltdb cache records for backend 'ldb_mdb backend'
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/netcmd/__init__.py", line 186, in _run
    return self.run(*args, **kwargs)
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/netcmd/domain_backup.py", line 1147, in run
    session_info=system_session(), lp=lp)
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/samdb.py", line 72, in __init__
    options=options)
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/__init__.py", line 114, in __init__
    self.connect(url, flags, options)
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/samdb.py", line 87, in connect
    options=options)

The error occurs opening the backed ldb to write the backup date and the
next SID, a call to pthread_mutex_lock in mdb_txn_renew0 (frame 8) returns
EINVAL:

  #0  0x00007ff63c2f1bea in wait4 () from /lib64/libc.so.6
  #1  0x00007ff63c26f3a3 in do_system () from /lib64/libc.so.6
  #2  0x00007ff63bc71e94 in smb_panic_default (why=0x7ffed481b7d0 "Signal 6: Aborted") at ../../lib/util/fault.c:153
  #3  0x00007ff63bc72168 in smb_panic (why=0x7ffed481b7d0 "Signal 6: Aborted") at ../../lib/util/fault.c:200
  #4  0x00007ff63bc71c82 in fault_report (sig=6) at ../../lib/util/fault.c:81
  #5  0x00007ff63bc71c97 in sig_fault (sig=6) at ../../lib/util/fault.c:92
  #6  <signal handler called>
  #7  0x00007ff63c2178b5 in raise () from /lib64/libpthread.so.0
  #8  0x00007ff637602e65 in mdb_txn_renew0 (txn=txn@entry=0x55d6f97fb800) at mdb.c:2710
  #9  0x00007ff637603ae8 in mdb_txn_begin (env=0x55d6f85dfa80, parent=0x0, flags=131072, ret=0x55d6f89c0928)
      at mdb.c:2912
  #10 0x00007ff6376236cc in lmdb_lock_read (module=0x55d6f8c5f4b0) at ../../lib/ldb/ldb_mdb/ldb_mdb.c:585
  #11 0x00007ff637641de6 in ldb_kv_cache_load (module=0x55d6f8c5f4b0) at ../../lib/ldb/ldb_key_value/ldb_kv_cache.c:450
  #12 0x00007ff637638792 in ldb_kv_init_store (ldb_kv=0x55d6f8af2a80, name=0x7ff637625675 "ldb_mdb backend",
      ldb=0x55d6f8cd22b0, options=0x0, _module=0x7ffed481c248) at ../../lib/ldb/ldb_key_value/ldb_kv.c:2166
  #13 0x00007ff6376247ba in lmdb_connect (ldb=0x55d6f8cd22b0,
      url=0x55d6f85d41f0 "mdb:///tmp/foo/private/sam.ldb.d/CN=CONFIGURATION,DC=FOO,DC=EXAMPLE,DC=COM.ldb", flags=64,
      options=0x0, _module=0x7ffed481c248) at ../../lib/ldb/ldb_mdb/ldb_mdb.c:1143
  #14 0x00007ff63bd94d2f in ldb_module_connect_backend (ldb=0x55d6f8cd22b0,
      url=0x55d6f85d41f0 "mdb:///tmp/foo/private/sam.ldb.d/CN=CONFIGURATION,DC=FOO,DC=EXAMPLE,DC=COM.ldb",
      options=0x0, backend_module=0x7ffed481c248) at ../../lib/ldb/common/ldb_modules.c:221
  #15 0x00007ff6375a4baf in new_partition_from_dn (ldb=0x55d6f8cd22b0, data=0x55d6f858bed0, mem_ctx=0x55d6f8a03cd0,
      dn=0x55d6f9865450, filename=0x55d6f860b6da "sam.ldb.d/CN=CONFIGURATION,DC=FOO,DC=EXAMPLE,DC=COM.ldb",
      backend_db_store=0x55d6f9d378e0 "mdb", partition=0x7ffed481c308)
      at ../../source4/dsdb/samdb/ldb_modules/partition_init.c:257
  #16 0x00007ff6375a57b9 in partition_reload_if_required (module=0x55d6f8972d10, data=0x55d6f858bed0, parent=0x0)
      at ../../source4/dsdb/samdb/ldb_modules/partition_init.c:513
  #17 0x00007ff6375a3b04 in partition_read_lock (module=0x55d6f8972d10)
      at ../../source4/dsdb/samdb/ldb_modules/partition.c:1492
  #18 0x00007ff63bd9631e in ldb_next_read_lock (module=0x55d6f8972d10) at ../../lib/ldb/common/ldb_modules.c:662
  #19 0x00007ff637484857 in schema_read_lock (module=0x55d6f9377e40)
      at ../../source4/dsdb/samdb/ldb_modules/schema_load.c:614
  #20 0x00007ff63bd9631e in ldb_next_read_lock (module=0x55d6f9377e40) at ../../lib/ldb/common/ldb_modules.c:662
  #21 0x00007ff6374b5402 in samba_dsdb_init (module=0x55d6f91c3cd0)
      at ../../source4/dsdb/samdb/ldb_modules/samba_dsdb.c:483
  #22 0x00007ff63bd95283 in ldb_module_init_chain (ldb=0x55d6f8cd22b0, module=0x55d6f91c3cd0)
      at ../../lib/ldb/common/ldb_modules.c:363
  #23 0x00007ff63bd95645 in ldb_load_modules (ldb=0x55d6f8cd22b0, options=0x0)
      at ../../lib/ldb/common/ldb_modules.c:445
  #24 0x00007ff63bd90663 in ldb_connect (ldb=0x55d6f8cd22b0,
      url=0x7ff6377d98f8 "/tmp/foo/private/sam.ldb.bak-offline", flags=64, options=0x0)
      at ../../lib/ldb/common/ldb.c:274
  #25 0x00007ff63bddb32f in py_ldb_connect (self=0x7ff63778afc0, args=(), Python Exception <class 'gdb.error'> There is no member named ma_keys.:
  kwargs=) at ../../lib/ldb/pyldb.c:1235

Deleting the previous samdb instance by setting it to None before opening the
backed ldb workaround the problem until we find the real problem here.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s3:netapi: Add libnetapi_set_creds()

This will be used by the 'net' command in future!

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Mar 24 02:07:20 UTC 2021 on sn-devel-184

s3:netapi: Get rid of set_cmdline_auth_info_*()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

auth:creds: Use our own cli_credentials_set_cmdline_callbacks()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

auth:creds: Add command line function for standard password callback

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s4:lib:cmdline: Rename cli_credentials_set_cmdline_callbacks()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Remove use_ccache from 'struct libnetapi_ctx'

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Remove use_kerberos from struct libnetapi_ctx

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Remove workgroup from 'struct libnetapi_ctx'

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Remove password from 'struct libnetapi_ctx'

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Remove username from 'struct libnetapi_ctx'

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Use public functions for username/password

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Get username/password from cli_credentials in joindomain.c

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Get username/password from cli_credentials in netapi.c

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Fill also cli_credentials with netapi setters

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Add a cli_credentials pointer to struct libnetapi_ctx

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Remove unused ctx->krb5_cc_env

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Make 'struct libnetapi_ctx' opaque

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Use public getters in getjoinableous example

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Use public getters in remote_machine example

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:netapi: Implement public libnetapi_get_(username|password) functions

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

netcmd: Fix typos in offline domain backup test

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Mar 24 00:46:31 UTC 2021 on sn-devel-184

netcmd: Avoid database corruption by opting not to create database files during an offline domain backup

If backup dirs contain hardlinks, the backup process could previously
attempt to open an LMDB database already opened during the backup,
causing it to be recreated as a new TDB database. This commit ensures
that new database files are not created during this operation, and that
the main SamDB database is not modified.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14027

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz

netcmd: Determine which files are to be copied for an offline domain backup

The old behaviour attempted to check for and remove files with duplicate
names, but did not do so due to a bug, and would have left undetermined
which files were given priority when duplicate filenames were present.
Now when hardlinks are present, only one instance of each file is
chosen, with files in the private directory having priority. If one
backup dir is nested inside another, the files contained in the nested
directory are only added once. Additionally, the BIND DNS database is
omitted from the backup.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14027

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz

netcmd: Add test for an offline backup of nested directories

This test verifies that when performing an offline backup of a domain
where one of the directories to be backed up is nested inside another,
the contained files are only included once in the backup.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14027

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz

netcmd: Add test for an offline backup of a directory containing hardlinks

This test verifies that when performing an offline backup of a domain
where the directories to be backed up contain hardlinks, only one
instance of each file is backed up, and that files in the private
directory take precedence.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14027

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz

man winbind: Remove untrue statement, you can run winbind without running nmbd.

Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Mar 23 15:15:02 UTC 2021 on sn-devel-184

s3: vxfs: Remove unused vxfs_setxattr_path().

Missed when SMB_VFS_SETXATTR() was removed.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Mulder <dmulder@samba.org>
Autobuild-User(master): David Mulder <dmulder@samba.org>
Autobuild-Date(master): Mon Mar 22 22:36:05 UTC 2021 on sn-devel-184

s3: vxfs: Remove unused vxfs_listxattr_path().

Missed when SMB_VFS_LISTXATTR() was removed.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Mulder <dmulder@samba.org>

s3:modules:vfs_virusfilter: Recent New_VFS changes break vfs_virusfilter_openat.

The_New_VFS introduces several changes that broke vfs_virusfilter_openat. The assert to make sure certain checks would work broke.

This patch fixes those breaks and converts to the SMB_VFS_FSTAT_NEXT instead of SMB_VFS_STAT_NEXT.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14671
RN: vfs_virusfilter_openat support New_VFS FSTAT, avoid SMB_ASSERT(fsp_get_pathref_fd(dirfsp) == AT_FDCWD); problem.

Signed-off-by: Trever L. Adams" <trever.adams@gmail.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Mon Mar 22 19:44:30 UTC 2021 on sn-devel-184

s3: VFS: default: vfswrap_create_dfs_pathat() isn't restricted to dirfsp->conn->cwd_fsp anymore.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power<npower@samba.org>

s3: VFS: time_audit: Log full pathname as smb_time_audit_create_dfs_pathat() isn't restricted to dirfsp->conn->cwd_fsp anymore.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power<npower@samba.org>

s3: VFS: full_audit: Log full pathname as smb_full_audit_create_dfs_pathat() isn't restricted to dirfsp->conn->cwd_fsp anymore.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power<npower@samba.org>

s3: VFS: gluster: vfs_gluster_create_dfs_pathat() isn't restricted to dirfsp->conn->cwd_fsp anymore.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>

s3: VFS: ceph: cephwrap_create_dfs_pathat() isn't restricted to dirfsp->conn->cwd_fsp anymore.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power<npower@samba.org>

s3:param: Fix segfault trying to add pcap printer without a [printers] share

#0  0x00007fb264e75bea in __GI___wait4 (pid=21966, stat_loc=stat_loc@entry=0x7ffdf83a9bc8, options=options@entry=0, usage=usage@entry=0x0) at ../sysdeps/unix/sysv/linux/wait4.c:30
         sc_ret = -512
         sc_ret = <optimized out>
#1  0x00007fb264e75bab in __GI___waitpid (pid=<optimized out>, stat_loc=stat_loc@entry=0x7ffdf83a9bc8, options=options@entry=0) at waitpid.c:38
No locals.
#2  0x00007fb264df33a3 in do_system (line=<optimized out>) at ../sysdeps/posix/system.c:172
         __result = <optimized out>
         _buffer = {
           __routine = 0x7fb264df35d0 <cancel_handler>,
           __arg = 0x7ffdf83a9bd0,
           __canceltype = 0,
           __prev = 0x0
         }
         _avail = 1
         cancel_args = {
           quit = 0x7fb264f6f200 <quit>,
           intr = 0x7fb264f6f2a0 <intr>,
           pid = 21966
         }
         status = -1
         ret = 0
         pid = 21966
         sa = {
           __sigaction_handler = {
             sa_handler = 0x1,
             sa_sigaction = 0x1
           },
           sa_mask = {
             __val = {[0] = 65536, [1] = 94088581545700, [2] = 0, [3] = 0, [4] = 0, [5] = 0, [6] = 0, [7] = 1703897678, [8] = 140404174928432, [9] = 140404179009536, [10] = 0, [11] = 140728768044480, [12] = 140404185491504, [13] = 18446744073709551615, [14] = 100, [15] = 140404180125856}
           },
           sa_flags = 0,
           sa_restorer = 0x7ffdf83a9df0
         }
         omask = {
           __val = {[0] = 7296, [1] = 140404179695051, [2] = 94088578316976, [3] = 140404180018176, [4] = 140404180017664, [5] = 140404185449449, [6] = 140728768044176, [7] = 140404185448599, [8] = 140404185458050, [9] = 100, [10] = 140404180125856, [11] = 7322926704, [12] = 140728768044432, [13] = 140404185491192, [14] = 112, [15] = 100}
         }
         reset = {
           __val = {[0] = 6, [1] = 5372865792, [2] = 94088581545600, [3] = 140728768044624, [4] = 100, [5] = 100, [6] = 101, [7] = 94088581545600, [8] = 140728768044288, [9] = 140404173470464, [10] = 140406703357952, [11] = 94088581545600, [12] = 94088581545600, [13] = 94088581545600, [14] = 94088581545600, [15] = 94088581545700}
         }
         spawn_attr = {
           __flags = 12,
           __pgrp = 0,
           __sd = {
             __val = {[0] = 6, [1] = 5372865792, [2] = 94088581545600, [3] = 140728768044624, [4] = 100, [5] = 100, [6] = 101, [7] = 94088581545600, [8] = 140728768044288, [9] = 140404173470464, [10] = 140406703357952, [11] = 94088581545600, [12] = 94088581545600, [13] = 94088581545600, [14] = 94088581545600, [15] = 94088581545700}
           },
           __ss = {
             __val = {[0] = 7296, [1] = 140404179695051, [2] = 94088578316976, [3] = 140404180018176, [4] = 140404180017664, [5] = 140404185449449, [6] = 140728768044176, [7] = 140404185448599, [8] = 140404185458050, [9] = 100, [10] = 140404180125856, [11] = 7322926704, [12] = 140728768044432, [13] = 140404185491192, [14] = 112, [15] = 100}
           },
           __sp = {
             sched_priority = 0
           },
           __policy = 0,
           __pad = {[0] = 0 <repeats 16 times>}
         }
#3  0x00007fb2654289f6 in smb_panic_s3 (why=0x7ffdf83a9fd0 "Signal 11: Segmentation fault") at ../../source3/lib/util.c:839
         lp_sub = 0x7fb265461a60 <s3_global_substitution>
         cmd = 0x5592b47afe30 "/home/asn/workspace/projects/samba/selftest/gdb_backtrace 21964"
         result = 32690
         __FUNCTION__ = "smb_panic_s3"
#4  0x00007fb2658f6f09 in smb_panic (why=0x7ffdf83a9fd0 "Signal 11: Segmentation fault") at ../../lib/util/fault.c:197
No locals.
#5  0x00007fb2658f6a39 in fault_report (sig=11) at ../../lib/util/fault.c:81
         counter = 1
         signal_string = "Signal 11: Segmentation fault\000\000\000\000\240:\370\375\177\000\000\000m?@/\214؊\377\245:\370\375\177\000\000\000m?@/\214؊\000\242:\370\375\177", '\000' <repeats 11 times>, "\242:\370\375\177\000\000\351C\231e\262\177\000\000`\240:\370\375\177\000\000\002:\231e\262\177\000\000Р:\370\375\177\000\000\a\000\000\000\061\000\000"
#6  0x00007fb2658f6a4e in sig_fault (sig=11) at ../../lib/util/fault.c:92
No locals.
#7  <signal handler called>
No locals.
#8  0x00007fb2653762b4 in copy_service (pserviceDest=0x5592b4657940, pserviceSource=0x0, pcopymapDest=0x0) at ../../lib/param/loadparm.c:896
         src_ptr = 0x1
         dest_ptr = 0x5592b4657941
         i = 1
         bcopyall = true
         data = 0x5592b44a9020
#9  0x00007fb2653e1e16 in add_a_service (pservice=0x0, name=0x5592b4476130 "laserjet1102w") at ../../source3/param/loadparm.c:1486
         i = 13
         tsp = 0x5592b44a9020
         __FUNCTION__ = "add_a_service"
#10 0x00007fb2653e2846 in lp_add_printer (pszPrintername=0x5592b4476130 "laserjet1102w", iDefaultService=-1) at ../../source3/param/loadparm.c:1666
         comment = 0x7fb2654339ec "From Printcap"
         i = 21906
         __FUNCTION__ = "lp_add_printer"
#11 0x00007fb2653e59b8 in lp_add_one_printer (name=0x5592b4476130 "laserjet1102w", comment=0x5592b512d5a0 "HP LaserJet Professional p 1102w, hpcups 3.19.6, requires proprietary plugin", location=0x5592b4476200 "", pdata=0x0) at ../../source3/param/loadparm.c:2988
         printers = -1
         i = 1700139171
#12 0x00007fb26556112f in printer_list_exec_fn (rec=0x7ffdf83aa7e0, private_data=0x7ffdf83aa9f0) at ../../source3/printing/printer_list.c:446
         state = 0x7ffdf83aa9f0
         time_h = 0
         time_l = 17286
         name = 0x5592b4476130 "laserjet1102w"
         comment = 0x5592b512d5a0 "HP LaserJet Professional p 1102w, hpcups 3.19.6, requires proprietary plugin"
         location = 0x5592b4476200 ""
         ret = 100
         key = {
           dptr = 0x5592b456fdd0 "PRINTERLIST/PRN/LASERJET1102W",
           dsize = 30
         }
         value = {
           dptr = 0x5592b456fdee "",
           dsize = 100
         }
         __FUNCTION__ = "printer_list_exec_fn"
#13 0x00007fb2646fc747 in db_tdb_traverse_read_func (tdb=0x5592b5377090, kbuf=..., dbuf=..., private_data=0x7ffdf83aa920) at ../../lib/dbwrap/dbwrap_tdb.c:399
         ctx = 0x7ffdf83aa920
         rec = {
           db = 0x5592b4957500,
           key = {
             dptr = 0x5592b456fdd0 "PRINTERLIST/PRN/LASERJET1102W",
             dsize = 30
           },
           value = {
             dptr = 0x5592b456fdee "",
             dsize = 100
           },
           value_valid = true,
           storev = 0x7fb2646fc672 <db_tdb_storev_deny>,
           delete_rec = 0x7fb2646fc68b <db_tdb_delete_deny>,
           private_data = 0x5592b5249b50
         }
#14 0x00007fb26372c08d in ?? () from /usr/lib64/libtdb.so.1
No symbol table info available.
#15 0x00007fb26372c21d in tdb_traverse_read () from /usr/lib64/libtdb.so.1
No symbol table info available.
#16 0x00007fb2646fc7b7 in db_tdb_traverse_read (db=0x5592b4957500, f=0x7fb265561001 <printer_list_exec_fn>, private_data=0x7ffdf83aa9f0) at ../../lib/dbwrap/dbwrap_tdb.c:413
         db_ctx = 0x5592b5249b50
         ctx = {
           db = 0x5592b4957500,
           f = 0x7fb265561001 <printer_list_exec_fn>,
           private_data = 0x7ffdf83aa9f0
         }
#17 0x00007fb2646f83ad in dbwrap_traverse_read (db=0x5592b4957500, f=0x7fb265561001 <printer_list_exec_fn>, private_data=0x7ffdf83aa9f0, count=0x0) at ../../lib/dbwrap/dbwrap.c:412
         ret = 0
#18 0x00007fb265560d9b in printer_list_traverse (fn=0x7fb265561001 <printer_list_exec_fn>, private_data=0x7ffdf83aa9f0, read_only=true) at ../../source3/printing/printer_list.c:328
         db = 0x5592b4957500
         status = {
           v = 0
         }
#19 0x00007fb2655611cc in printer_list_read_run_fn (fn=0x7fb2653e5970 <lp_add_one_printer>, private_data=0x0) at ../../source3/printing/printer_list.c:464
         state = {
           fn = 0x7fb2653e5970 <lp_add_one_printer>,
           private_data = 0x0,
           status = {
             v = 0
           }
         }
         status = {
           v = 0
         }
#20 0x00007fb26555c9e6 in load_printers () at ../../source3/printing/load.c:86
         status = {
           v = 0
         }
         __func__ = "load_printers"
#21 0x00007fb265599457 in delete_and_reload_printers () at ../../source3/smbd/server_reload.c:80
         n_services = -130372992
         pnum = 12
         snum = 12
         pname = 0x5592b55626f0 "\340=\277\264\222U"
         ok = true
         pcap_last_update = 17286
         frame = 0x5592b4797d70
         lp_sub = 0x7fb265461a60 <s3_global_substitution>
         __FUNCTION__ = "delete_and_reload_printers"
#22 0x00007fb2655404d7 in delete_and_reload_printers_full (ev=0x5592b44a6940, msg_ctx=0x5592b44a92c0) at ../../source3/printing/queue_process.c:131
         session_info = 0x5592b55626f0
         pinfo2 = 0x0
         lp_sub = 0x7fb265461a60 <s3_global_substitution>
         n_services = 13
         pnum = -1
         snum = 13
         pname = 0x5592b45003d0 "\240\247F\264\222U"
         sname = 0x7ffdf83aab00 "\200\253:\370\375\177"
         status = {
           v = 0
         }
         __FUNCTION__ = "delete_and_reload_printers_full"
#23 0x00007fb265540523 in reload_pcap_change_notify (ev=0x5592b44a6940, msg_ctx=0x5592b44a92c0) at ../../source3/printing/queue_process.c:150
No locals.
#24 0x00007fb265555855 in cups_async_callback (event_ctx=0x5592b44a6940, event=0x5592b5562570, flags=1, p=0x5592b4a9b160) at ../../source3/printing/print_cups.c:571
         frame = 0x5592b4e26960
         cb_args = 0x5592b4a9b160
         tmp_pcap_cache = 0x5592b45003d0
         ret_ok = true
         pcap_data = {
           status = {
             v = 0
           },
           count = 1,
           printers = 0x5592b5393800
         }
         pcap_blob = {
           data = 0x5592b47a48e0 "\001",
           length = 157
         }
         ndr_ret = NDR_ERR_SUCCESS
         i = 1
         __FUNCTION__ = "cups_async_callback"
#25 0x00007fb26548b88c in tevent_common_invoke_fd_handler (fde=0x5592b5562570, flags=1, removed=0x0) at ../../lib/tevent/tevent_fd.c:138
         handler_ev = 0x5592b44a6940
#26 0x00007fb265496148 in epoll_event_loop (epoll_ev=0x5592b4a30eb0, tvalp=0x7ffdf83aac50) at ../../lib/tevent/tevent_epoll.c:736
         fde = 0x5592b5562570
         flags = 1
         mpx_fde = 0x0
         ret = 1
         i = 0
         events = {[0] = {
             events = 17,
             data = {
               ptr = 0x5592b5562570,
               fd = -1252645520,
               u32 = 3042321776,
               u64 = 94088595907952
             }
           }}
         timeout = 750000
         wait_errno = 0
#27 0x00007fb26549678f in epoll_event_loop_once (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent_epoll.c:937
         epoll_ev = 0x5592b4a30eb0
         tval = {
           tv_sec = 749,
           tv_usec = 999054
         }
         panic_triggered = false
#28 0x00007fb2654930fa in std_event_loop_once (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent_standard.c:110
         glue_ptr = 0x5592b44aa700
         glue = 0x5592b44aa700
         ret = 21906
#29 0x00007fb26548aaf7 in _tevent_loop_once (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent.c:772
         ret = 21906
         nesting_stack_ptr = 0x0
#30 0x00007fb26548ae1e in tevent_common_loop_wait (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent.c:895
         ret = 32690
#31 0x00007fb26549319c in std_event_loop_wait (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent_standard.c:141
         glue_ptr = 0x5592b44aa700
         glue = 0x5592b44aa700
         ret = 32690
#32 0x00007fb26548aec1 in _tevent_loop_wait (ev=0x5592b44a6940, location=0x7fb2657c54e0 "../../source3/printing/queue_process.c:424") at ../../lib/tevent/tevent.c:914
No locals.
#33 0x00007fb265541028 in start_background_queue (ev=0x5592b44a6940, msg_ctx=0x5592b44a92c0, logfile=0x0) at ../../source3/printing/queue_process.c:424
         fde = 0x5592b53bcee0
         ret = 21906
         status = {
           v = 0
         }
         pid = 0
         state = 0x5592b4bf3d50
         pause_pipe = {[0] = -1, [1] = 48}
         __FUNCTION__ = "start_background_queue"
#34 0x00007fb265541154 in printing_subsystem_init (ev_ctx=0x5592b44a6940, msg_ctx=0x5592b44a92c0, dce_ctx=0x5592b44ae3e0, start_daemons=true, background_queue=true) at ../../source3/printing/queue_process.c:457
         pid = -1
#35 0x00005592b436b820 in main (argc=5, argv=0x7ffdf83ab2e8) at ../../source3/smbd/server.c:2131
         bgq = true
         ok = false
         is_daemon = true
         interactive = false
         Fork = false
         no_process_group = false
         log_stdout = true
         ports = 0x0
         profile_level = 0x0
         opt = -1
         pc = 0x5592b4496df0
         print_build_options = false
         main_server_id = {
           pid = 21931,
           task_id = 0,
           vnn = 4294967295,
           unique_id = 7715839874465799134
         }
         OPT_DAEMON = OPT_DAEMON
         OPT_INTERACTIVE = OPT_INTERACTIVE
         OPT_FORK = OPT_FORK
         OPT_NO_PROCESS_GROUP = OPT_NO_PROCESS_GROUP
         OPT_LOG_STDOUT = OPT_LOG_STDOUT
         long_options = {[0] = {
             longName = 0x0,
             shortName = 0 '\000',
             argInfo = 4,
             arg = 0x7fb2650d9400 <poptHelpOptions>,
             val = 0,
             descrip = 0x5592b43732e1 "Help options:",
             argDescrip = 0x0
           }, [1] = {
             longName = 0x5592b43732ef "daemon",
             shortName = 68 'D',
             argInfo = 0,
             arg = 0x0,
             val = 1000,
             descrip = 0x5592b43732f6 "Become a daemon (default)",
             argDescrip = 0x0
           }, [2] = {
             longName = 0x5592b4373310 "interactive",
             shortName = 105 'i',
             argInfo = 0,
             arg = 0x0,
             val = 1001,
             descrip = 0x5592b4373320 "Run interactive (not a daemon) and log to stdout",
             argDescrip = 0x0
           }, [3] = {
             longName = 0x5592b4373351 "foreground",
             shortName = 70 'F',
             argInfo = 0,
             arg = 0x0,
             val = 1002,
             descrip = 0x5592b4373360 "Run daemon in foreground (for daemontools, etc.)",
             argDescrip = 0x0
           }, [4] = {
             longName = 0x5592b4373391 "no-process-group",
             shortName = 0 '\000',
             argInfo = 0,
             arg = 0x0,
             val = 1003,
             descrip = 0x5592b43733a8 "Don't create a new process group",
             argDescrip = 0x0
           }, [5] = {
             longName = 0x5592b43733c9 "log-stdout",
             shortName = 83 'S',
             argInfo = 0,
             arg = 0x0,
             val = 1004,
             descrip = 0x5592b43733d4 "Log to stdout",
             argDescrip = 0x0
           }, [6] = {
             longName = 0x5592b43733e2 "build-options",
             shortName = 98 'b',
             argInfo = 0,
             arg = 0x0,
             val = 98,
             descrip = 0x5592b43733f0 "Print build options",
             argDescrip = 0x0
           }, [7] = {
             longName = 0x5592b4373404 "port",
             shortName = 112 'p',
             argInfo = 1,
             arg = 0x7ffdf83ab158,
             val = 0,
             descrip = 0x5592b4373409 "Listen on the specified ports",
             argDescrip = 0x0
           }, [8] = {
             longName = 0x5592b4373427 "profiling-level",
             shortName = 80 'P',
             argInfo = 1,
             arg = 0x7ffdf83ab150,
             val = 0,
             descrip = 0x5592b4373437 "Set profiling level",
             argDescrip = 0x5592b437344b "PROFILE_LEVEL"
           }, [9] = {
             longName = 0x0,
             shortName = 0 '\000',
             argInfo = 4,
             arg = 0x7fb2654a8140 <popt_common_samba>,
             val = 0,
             descrip = 0x5592b4373459 "Common samba options:",
             argDescrip = 0x0
           }, [10] = {
             longName = 0x0,
             shortName = 0 '\000',
             argInfo = 0,
             arg = 0x0,
             val = 0,
             descrip = 0x0,
             argDescrip = 0x0
           }}
         parent = 0x5592b44addf0
         frame = 0x5592b448d6b0
         status = {
           v = 0
         }
         ev_ctx = 0x5592b44a6940
         msg_ctx = 0x5592b44a92c0
         dce_ctx = 0x5592b44ae3e0
         server_id = {
           pid = 21931,
           task_id = 0,
           vnn = 4294967295,
           unique_id = 5659117256920205400
         }
         se = 0x5592b44c0f90
         profiling_level = 0
         np_dir = 0x5592b4f2bdc0 "/home/asn/workspace/projects/samba/st/fl2003dc/ncalrpc/np"
         lp_sub = 0x7fb265461a60 <s3_global_substitution>
         smbd_shim_fns = {
           send_stat_cache_delete_message = 0x7fb26563ba6e <smbd_send_stat_cache_delete_message>,
           change_to_root_user = 0x7fb265613e99 <smbd_change_to_root_user>,
           become_authenticated_pipe_user = 0x7fb265613f4b <smbd_become_authenticated_pipe_user>,
           unbecome_authenticated_pipe_user = 0x7fb265614067 <smbd_unbecome_authenticated_pipe_user>,
           contend_level2_oplocks_begin = 0x7fb2656bb8df <smbd_contend_level2_oplocks_begin>,
           contend_level2_oplocks_end = 0x7fb2656bb902 <smbd_contend_level2_oplocks_end>,
           become_root = 0x7fb2656142cc <smbd_become_root>,
           unbecome_root = 0x7fb2656142f5 <smbd_unbecome_root>,
           exit_server = 0x7fb2656add55 <smbd_exit_server>,
           exit_server_cleanly = 0x7fb2656add72 <smbd_exit_server_cleanly>
         }
         __FUNCTION__ = "main"
         __func__ = "main"

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 19 18:56:33 UTC 2021 on sn-devel-184