CVE-2015-5330: next_codepoint_handle_ext: don't short-circuit UTF16 low bytes

UTF16 contains zero bytes when it is encoding ASCII (for example), so we
can't assume the absense of the 0x80 bit means a one byte encoding. No
current callers use UTF16.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

CVE-2015-5330: strupper_talloc_n_handle(): properly count characters

When a codepoint eats more than one byte we really want to know,
especially if the string is not NUL terminated.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

CVE-2015-5330: Fix handling of unicode near string endings

Until now next_codepoint_ext() and next_codepoint_handle_ext() were
using strnlen(str, 5) to determine how much string they should try to
decode. This ended up looking past the end of the string when it was not
null terminated and the final character looked like a multi-byte encoding.
The fix is to let the caller say how long the string can be.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

CVE-2015-5330: ldb_dn_escape_value: use known string length, not strlen()

ldb_dn_escape_internal() reports the number of bytes it copied, so
lets use that number, rather than using strlen() and hoping a zero got
in the right place.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

CVE-2015-5330: ldb_dn: simplify and fix ldb_dn_escape_internal()

Previously we relied on NUL terminated strings and jumped back and
forth between copying escaped bytes and memcpy()ing un-escaped chunks.
This simple version is easier to reason about and works with
unterminated strings. It may also be faster as it avoids reading the
string twice (first with strcspn, then with memcpy).

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

CVE-2015-3223: lib: ldb: Use memmem binary search, not strstr text search.

Values might have embedded zeros.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11325

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

CVE-2015-3223: lib: ldb: Cope with canonicalise_fn returning string "", length 0.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11325

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

VERSION: Bump version up to 4.1.22...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

VERSION: Disable git snapshots for the 4.1.21 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

WHATSNEW: Add release notes for Samba 4.1.21.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

samr4: Use <SID=%s> in GetGroupsForUser

This way we avoid quoting problems in user's DNs

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Sep  1 23:49:14 CEST 2015 on sn-devel-104

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11488
(cherry picked from commit 841845dea35089a187fd1626c9752d708989ac7b)

Autobuild-User(v4-1-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-1-test): Tue Sep  8 21:05:56 CEST 2015 on sn-devel-104

VERSION: Bump version up to 4.1.21...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

VERSION: Disable git snapshots for the 4.1.20 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

WHATSNEW: Add release notes for Samba 4.1.20.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

s3: winbindd: Fix TALLOC_FREE of uninitialized groups variable.

Fix created by by: wei zhong <wweyeww@gmail.com>

Only for 4.2.x and below, master code already fixed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10823

Signed-off-by: Jeremy Allison <jra@samba.org>
Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Mon Aug 31 23:35:54 CEST 2015 on sn-devel-104

s3-util: Compare the maximum allowed length of a NetBIOS name

This fixes a problem where is_myname() returns true if one of our names
is a substring of the specified name.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11427

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 4e178ed498c594ffcd5592d0b792d47b064b9586)

Autobuild-User(v4-1-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-1-test): Mon Aug 31 14:39:49 CEST 2015 on sn-devel-104

s3-net: use talloc array in share allowedusers

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11426

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Aug  4 16:48:36 CEST 2015 on sn-devel-104

(cherry picked from commit 95eb6db580678a29b1f5f30a9567ea449a43d75a)

Autobuild-User(v4-1-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-1-test): Mon Aug 17 20:01:19 CEST 2015 on sn-devel-104

s3-passdb: Respect LOOKUP_NAME_GROUP flag in sid lookup.

Somewhere along the line, a config line like "valid users = @foo"
broke when "foo" also exists as a user.

user_ok_token() already does the right thing by adding the LOOKUP_NAME_GROUP
flag; but lookup_name() was not respecting that flag, and went ahead and looked
for users anyway.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11320

Signed-off-by: Justin Maggard <jmaggard@netgear.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Marc Muehlfeld <mmuehlfeld@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jul 28 21:35:58 CEST 2015 on sn-devel-104

(cherry picked from commit dc99d451bf23668d73878847219682fced547622)

Autobuild-User(v4-1-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-1-test): Mon Aug  3 20:03:05 CEST 2015 on sn-devel-104

lib: replace: Add strsep function (missing on Solaris).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11359

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@wakeful.net>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jul 29 02:24:55 CEST 2015 on sn-devel-104

(cherry picked from commit f07b746ad3f3ee2fcbb65a0d452ed80f07c9e8f9)

s3-auth: Fix a possible null pointer dereference

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11404

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 109ff388fd5e1306189d680a8f964a69374f1b01)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Tue Jul 21 19:02:14 CEST 2015 on sn-devel-104

s3-smbd: Leave sys_disk_free() if dfree command is used

If we have a broken system which reports incorrect sizes we provide the
'dfree command'. This command makes sure Samba gets the correct values.
However after that we call the quota command which then reports the
broken values. The dfree command should take care to provide the correct
values and in case of quota's it should also calculate the quote
correctly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11403

Pair-Programmed-With: Michael Adam <obnox@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 48a4d5a4078ff2a66dd753323d6e5d76d34b9828)

s3-smbd: reset protocol in smbXsrv_connection_init_tables failure paths.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11373

Guenther

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Sun Jul 19 22:23:18 CEST 2015 on sn-devel-104

s3:libsmb: Fix a bug in conversion of ea list to ea array.

Bug 11361 - Reading of EA's (Extended Attributes) fails using SMB2 and above
protocols

Tested against Win2k12r2 server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11361

Signed-off-by: Anubhav Rakshit <anubhav.rakshit@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 5af2e3eed2ac309e2491fc54e03e7b04c8b118fb)

smbd:trans2: treat new SMB_SIGNING_DESIRED in case

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 76f8d0fbada15c9466f66a2d9961bebd1425d141)

docs:smb.conf: explain effect of new setting 'desired' of smb encrypt

Thereby clarify some details.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 365d9d8bdfe9759ef9662d0080cf9c9a0767dbf2)

smbd:smb2: use encryption_desired in send_break

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 14357700fd69291995ce6adebb13e7340a63c209)

smbd:smb2: only enable encryption in tcon if desired

Don't enforce it but only announce DATA_ENCRYPT,
making use of encryption_desired in tcon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 41cb881e775ea7eb0c59d9e0cafb6ab5531918d9)

smbd:smb2: only enable encryption in session if desired

Don't enforce it but only announce ENCRYPT_DATA, using the
encryption_desired flag in session setup.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit fc228025d78f165815d3fa1670d51f0c27ed2091)

smbd:smb2: separate between encryption required and enc desired

this means we:
- accept unencrypted requests if encryption only desired
  and not required,
- but we always send encrypted responses in the desired
  case, not only when the request was encrypted.

For this purpose, the do_encryption in the request
structure is separated into was_encrypted and do_encryption.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 3bb299944391633c45d87d5e8ad48c2c14428592)

smbXsrv: add bools encryption_desired to session and tcon

This is to indicate that we should sen the ENCRYPT_DATA
flag on session or tcon replies.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit a3ea6dbef53e049701326497e684e1563344e6d8)

Introduce setting "desired" for 'smb encrypt' and 'client/server signing'

This should trigger the behaviour where the server requires
signing when the client supports it, but does not reject
clients that don't support it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 204cbe3645c59b43175beeadad792b4a00e80da3)

smbd: Make SMB3 clients use encryption with "smb encrypt = auto"

Slight modification for 4.1 by Michael Adam <obnox@samba.org>
(s/xconn/conn/ in smb2_sesssetup.c)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Mar  3 10:40:42 CET 2015 on sn-devel-104

(cherry picked from commit b3385f74db54bd8a07a0be5515151b633c067da4)

s4:selftest: also run rpc.winreg with kerberos and all possible auth options

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jun 23 17:31:08 CEST 2015 on sn-devel-104

(cherry picked from commit 6dd117b21ef06da68af67051f2822f71193d193a)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Sun Jul 12 00:09:40 CEST 2015 on sn-devel-104

s4:selftest: run rpc.echo tests also with krb5 krb5,sign krb5,seal

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 5b917fd6226952a1f792d1ad921d2ae54ab6ab42)

s4:rpc_server: fix padding caclucation in dcesrv_auth_response()

This is simplified by using DCERPC_AUTH_PAD_LENGTH() and changes the behaviour
so that we will use no padding if the stub_length is already aligned
to DCERPC_AUTH_PAD_ALIGNMENT (16 bytes).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 69c1b4b7c10dd5fd9cacaa3a76c47bc854ee3fed)

s4:rpc_server: let dcesrv_auth_response() handle sig_size == 0 with auth_info as error

Don't send plaintext on the wire because of an internal error...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 1bf7ab49b4459e81ab2b82d9668b3d7cb76372f4)

s4:rpc_server: let dcesrv_reply() use a sig_size for a padded payload

The sig_size could differ depending on the aligment/padding.
So should use the same alignment as we use for the payload.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 16f3837e026e4cae135bbdddf09b44a02af25b05)

s4:rpc_server: let dcesrv_reply() use DCERPC_AUTH_PAD_ALIGNMENT define

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 3fbdb255e3ac7ad5261c5fa3836e4a38a0d59221)

s4:librpc/rpc: fix padding caclucation in ncacn_push_request_sign()

This is simplified by using DCERPC_AUTH_PAD_LENGTH() and changes the behaviour
so that we will use no padding if the stub_length is already aligned
to DCERPC_AUTH_PAD_ALIGNMENT (16 bytes).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 114c52e73ed9e0adeac8ad1bc1dc014f3c10f4d6)

s4:librpc/rpc: let ncacn_push_request_sign() handle sig_size == 0 with auth_info as internal error

Don't send plaintext on the wire because of an internal error...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 48f2c383e1d7f52114223cd2a54857426bf64025)

s4:librpc/rpc: let dcerpc_ship_next_request() use a sig_size for a padded payload

The sig_size could differ depending on the aligment/padding.
So should use the same alignment as we use for the payload.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit fc249d542fcb8d043ae72eb7963d3a85eb79253a)

s4:librpc/rpc: let dcerpc_ship_next_request() use DCERPC_AUTH_PAD_ALIGNMENT define

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit ef801bae95403e96042f5d8c87085bce21436013)

s3:rpc_server: remove pad handling from api_pipe_alter_context()

This is not needed and windows doesn't use it.
The padding is for the payload in request and response.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit a6a6795826954eef6763a39b129a4db578edca01)

s3:librpc/rpc: fix padding calculation in dcerpc_guess_sizes()

The padding needs to be relative to the payload start not to the pdu start.
We also need align the padding to DCERPC_AUTH_PAD_ALIGNMENT (16 bytes).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(similar to commit b2e042ad9652e2dfb39640de43e09030efc41d3d)

s3:librpc/rpc: allow up to DCERPC_AUTH_PAD_ALIGNMENT padding bytes in dcerpc_add_auth_footer()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 3e6e9e3acd17531148457be59a32727fb87ae43d)

librpc/rpc: add DCERPC_AUTH_PAD_LENGTH(stub_length) helper macro

This calculates the required padding DCERPC_AUTH_PAD_ALIGNMENT
and the stub_length.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(similar to commit f1e3ad269ca8f76876afd8e3837c9c9b48688941)

dcerpc.idl: add DCERPC_AUTH_PAD_ALIGNMENT (=16)

Windows pads the payload aligned to 16 bytes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 2cb3ec5856ab5b7edad8ffd67a5d0f927c161138)

auth/gensec: make sure gensec_start_mech_by_authtype() resets SIGN/SEAL before starting

We want to set GENSEC_FEATURE_SIGN and GENSEC_FEATURE_SEAL based on the given
auth_level and should not have GENSEC_FEATURE_SEAL if
DCERPC_AUTH_LEVEL_INTEGRITY is desired.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 756508c8c37b0370301a096e35abc171fe08d31c)

auth/gensec: gensec_[un]seal_packet() should only work with GENSEC_FEATURE_DCE_STYLE

gensec_sig_size() also requires GENSEC_FEATURE_DCE_STYLE if
GENSEC_FEATURE_SEAL is negotiated.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 3542d33314e32279340f07f995c1dcbd16106352)

winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 11 07:30:38 CEST 2015 on sn-devel-104

(cherry picked from commit 4c5fefe0723ae4cd3cacaabc5ae4c500d2306968)

Conflicts:
source3/winbindd/winbindd_pam.c

The last 7 patches address
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11328
we should use resource group sids obtained from pac logon_info

kerberos auth info3 should contain resource group ids available from pac_logon

successful pam auth (e.g. from ssh) will cache group sids (but not any
resource group sids)) The subsequent cached entry used for groups lookups
can be missing those resource groups

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit efadcb31215f9ccaf7942341c698a8eb2ac166ce)

Conflicts:
source3/winbindd/winbindd_pam.c

s3: auth: Fix winbindd_pam_auth_pac_send() to create a new info3 and merge in resource groups from a trusted PAC.

Based on a patch from Richard Sharpe <realrichardsharpe@gmail.com>.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-by: Simo Sorce <idra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jun 18 03:30:36 CEST 2014 on sn-devel-104

(cherry picked from commit e907f8415639d2a7cbc1cc2e40e2e35bfa0024de)

s3: auth: Change auth3_generate_session_info_pac() to use a copy of the info3 struct from the struct PAC_LOGON_INFO.

Call create_info3_from_pac_logon_info() to add in any resource SIDs
from the struct PAC_LOGON_INFO to the info3.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit 0e5a9f44e4b08b93bc4b501d1e14b59ed7b3647c)

s3: auth: Add create_info3_from_pac_logon_info() to create a new info3 and merge resource group SIDs into it.

Originally written by Richard Sharpe Richard Sharpe <realrichardsharpe@gmail.com>.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit db775c68ccbed0252abf092b5cb811e8f5fa9bb6)

s3: auth: Change make_server_info_info3() to take a const struct netr_SamInfo3 pointer instead of a struct PAC_LOGON_INFO.

make_server_info_info3() only reads from the info3 pointer.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit 527f7b54388713acaaf7b66c718cc0f7114fc368)

s3: auth: Add some const to the struct netr_SamInfo3 * arguments of copy_netr_SamInfo3() and make_server_info_info3()

Both functions only read from the struct netr_SamInfo3 * argument.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit c2411767adb5ce48a4619349075f6f8faae41aab)

    Conflicts:
     source3/auth/proto.h
     source3/auth/server_info.c

docs: overhaul the description of "smb encrypt" to include SMB3 encryption.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11366

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Apr 24 00:53:20 CEST 2015 on sn-devel-104

(cherry picked from commit 51ae17b0703eaa481d602ffc7d8231a629fcb5fd)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Tue Jun 30 04:18:41 CEST 2015 on sn-devel-104

docs: Change smb encrypt default in docs to match s3 and lib/param

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11366

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit dba465b6c72c76781e8ca3909233d07028f99724)

s3: smbd: Codenomicon crash in do_smb_load_module().

Inside api_pipe_bind_req() we look for a pipe module name using

dcerpc_default_transport_endpoint(pkt,
                                NCACN_NP, table)

which returns NULL when given invalid pkt data from the Codenomicon fuzzer.

This gets passed directly to smb_probe_module(), which then calls
do_smb_load_module() which tries to deref the (NULL) module name.

https://bugzilla.samba.org/show_bug.cgi?id=11342

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jun 18 22:14:01 CEST 2015 on sn-devel-104

(cherry picked from commit 5a82cc21379e3fe28441cd82647313c9390b41e7)

s3:winbindd: make sure we pass a valid server to rpccli_netlogon_sam_network_logon*()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11081

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3: smbd: Use separate flag to track become_root()/unbecome_root() state.

Early function exit can mean backup_priv is set but we haven't called
become_root(). *Lots* of work by the reviewers went in to checking this
isn't a security issue.

Found by Codenomicon at the Redmond plugfest.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11339

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jun 25 22:14:58 CEST 2015 on sn-devel-104

(cherry picked from commit e2c4b8967d33b610f9f076c614352e4b8fc7c558)

s3:param/loadparm fix testparm --show-all-parameters

it didn't know about the new types of config parameters

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11170

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Jun  9 11:49:18 CEST 2015 on sn-devel-104

VERSION: Bump version up to 4.1.20...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

VERSION: Disable git snapshots for the 4.1.19 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

WHATSNEW: Add release notes for Samba 4.1.19.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

s3: libsmbclient: Re-resolving targetcli on every read/write/lseek/ftruncate/close is both incorrect and slow.

Cache targetcli on file open in the SMBCFILE struct.

Bug 11295 - Excessive cli_resolve_path() usage can slow down transmission.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11295

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 9f57244bbd1ffa203a1f50bb289789628c4a3f66)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Wed Jun 10 01:20:32 CEST 2015 on sn-devel-104

nsswitch: Extend idmap_rfc2307 testcase for reverse lookup

Also test the codepaths to map UID and GID back to SID and names.  Use
different user and group to avoid returning results cached from the
previous lookups.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11313

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jun  5 01:24:32 CEST 2015 on sn-devel-104
(cherry picked from commit c1c07b462058f863e706127203e6f30dba89a2a9)

idmap_rfc2307: Fix wbinfo --gid-to-sid query

Fix syntax error in LDAP query for gidNumber.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11313

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 835c278e43b9dec98834de0fb12445720e9df2e5)

s4.2/fsmo.py: fixed fsmo transfer exception

In transfer_role() there is an duplicate call to samdb.modify() inside the if statement
where the type of role is being determined (specifically for the naming fsmo). This
call is unnecessary as after the if statement their is a correct call, with a try/catch
block, used by all fsmo transfers that will handle errors - such as the DC with the
fsmo role being offline.

The call to samdb.modify() inside the if statement for naming fsmo has been removed.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10924

Signed-off-by: Steve Howells <steve.howells@moscowfirst.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Marc Muehlfeld <mmuehlfeld@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 9198246f91c02e33ed7a3580588557d0fb9f8811)

s3: IPv6 enabled DNS connections for ADS client

This patch makes DNS client connections protocol independent.
For example DNS updates. This makes IPv6-only clients possible.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11283

Back-port from fff774eda3ed04d319232b108a94282af24cc6b0

Signed-off-by: David Holder <david.holder@erion.co.uk>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <rb@sernet.de>
Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Tue Jun  2 01:55:28 CEST 2015 on sn-devel-104

Add IPv6 support for determining FQDN during ADS join.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11282

Back ported from commit 6e08bfb4441022a00d0c29205e835a4858a3a57f

Signed-off-by: David Holder <david.holder@erion.co.uk>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <rb@sernet.de>

Add IPv6 support to ADS client side LDAP connects. Corrected format for IPv6 LDAP URI.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11281

(Back ported from commit c324d7901c991a6700abdc3ee701920fea5e5819)

Signed-off-by: David Holder <david.holder@erion.co.uk>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <rb@sernet.de>

s4:torture:smb2:compound: compound read and padding

Add test to check that compound read responses are padded to an 8 byte
boundary.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11277

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu May 28 16:50:39 CEST 2015 on sn-devel-104

(cherry picked from commit 2ffa939bbe2c02509e1790c8b3f6f9b6910e3cf6)

s3:smb2: add padding to last command in compound requests

Following Windows behaviour, the last command in a compound request
should be padded to an 8 byte boundary and OS X clients crash badly if
we don't pad.

[MS-SMB2] 3.3.4.1.3, "Sending Compounded Responses", doesn't make it
clear whether the padding requirement governs the last command in a
compound response, a future MS-SMB2 update will document Windwows
product behaviour in a footnote.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11277

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit dfa64b958b201931e0dbe11f153f606f20217594)

s3: smbcacls: Ensure we read a hex number as %x, not %u.

Based on a patch from Zoe O'Connell <zoe@metail.com>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11068

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jim McDonough <jmcd@samba.org>

s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used

This is a subtle bug that causes CLDAP pings to fail if SRV records
discovered cannot be resolved or connection to them cannot be
established. The code that fires up CLDAP ping will silently cancel
the whole tevent request without going to the next server in the queue.

This may happen, for example, when connection to IPv6 addresses couldn't
be established, or when IPv4 address is not online or blocked by
firewall.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11284

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit eb029b32e95c9e7382488f3a1b033cdbe3237c1c)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Thu May 21 17:44:11 CEST 2015 on sn-devel-104

s3:winbindd: make sure we remove pending io requests before closing client sockets

This avoids a crash inside the tevent epoll backend.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11141

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed May 20 22:16:54 CEST 2015 on sn-devel-104

(cherry picked from commit 435ddd8223eaa6fafb62cead0399bdd042d998e8)

s4:lib/tls: fix build with gnutls 3.4

gnutls_certificate_type_set_priority() was removed in GnuTLS 3.4.0. Use
gnutls_priority_set_direct instead.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=8780

Signed-off-by: Björn Jacke <bj@sernet.de>
Reviewed-By: Jelmer Vernooij <jelmer@samba.org>
Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Wed Apr 29 22:29:02 CEST 2015 on sn-devel-104

(cherry picked from commit c6ad8a10c12c8a79dc83cab1591e5279edd62bd6)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Thu May 21 12:00:39 CEST 2015 on sn-devel-104

libads: record service ticket endtime for sealed ldap connections

When a ticket is obtained for binding a signed/sealed ldap connection,
its liftime should be recorded in the ads struct, in order to enable
reuse of the connection.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11267

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <rb@sernet.de>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed May 13 04:32:16 CEST 2015 on sn-devel-104

(cherry picked from commit 40eac8e4d8bc85f2329b8ed6c5ba96a141dc20a3)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Wed May 20 18:44:55 CEST 2015 on sn-devel-104

s3: smbd: VFS: fake_acl module called get_full_smb_filename() with a stream path, then used the result to call XATTR functions directly.

Ensure when pulling XATTR values, we don't allow a stream filename.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11249

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 0f23bf228ceb38b024a77fcf2916971ad4f6aa4d)

s3: smbd: VFS: For all EA and ACL calls use synthetic_smb_fname(), not synthetic_smb_fname_split().

EA's and ACL paths are all post-stream name checks (and shouldn't
get stream names). This one took a *long* time to find.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11249

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit ccb4f791fd19d9b3af79a205a15c0219ed7240ea)

s3: smbd: VFS: All the places that are currently calling vfs_stat_smb_fname() and vfs_lstat_smb_fname() should be calling vfs_stat_smb_basename().

They are all post-stream name processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11249

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 14f4e254bb8d1f456ebb8da728f2fb812a9b3034)

s3: smbd: VFS: Add vfs_stat_smb_basename() - to be called when we *know* stream name parsing has already been done.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11249

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 044dabfd92d09de4f168a36a07ac3232f5647a1d)

vfs_gpfs: move failure label before END_PROFILE

The label was added in 5e65ae14ddb74c648f31b4dfbacd4af9c02ca058 as part
of fix for bug 11244, but was wrongly placed behind END_PROFILE.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11244

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu May  7 19:22:00 CEST 2015 on sn-devel-104

(cherry picked from commit 3876e59826ad17466975ae9e9a65879c76737b2b)

vfp_gpfs: ensure END_PROFILE is always called

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11244

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Apr 30 19:34:41 CEST 2015 on sn-devel-104

(cherry picked from commit 5e65ae14ddb74c648f31b4dfbacd4af9c02ca058)

s3:selftest: run smb2.notify with --signing=required

This reproduces a bug withe implicit canceled requests.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(similar to commit c49ad3f89530d078fdd6ffcd1a6dc8c38be9169b)

s3:smb2_sesssetup: remove unused smbd_smb2_session_setup_* destructors

The cleanup of a failing session setup is now handled in
smbd_smb2_session_setup_wrap_*().

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(similar to commit 5871d3da871349cba058bb91218ae58107cf05c8)

s3:smb2_sesssetup: add smbd_smb2_session_setup_wrap_send/recv()

The wrapper calls smbXsrv_session_shutdown_send/recv() in case of an error,
this makes sure a failing reauth shuts down the session like an explicit logoff.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 50aeb6b38b14d6c26229834ece3c32eb50f9e56a)

s3:smb2_sesssetup: always assign smb2req->session when a session was created.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 8f0d4d1132b74615dc6198ab736590dec52effda)

s3:smb2_sesssetup: let smbd_smb2_logoff_* use smbXsrv_session_shutdown_*

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(similar to commit 95057fe375348b918cb2ca58109f4c110a4a5f77)

s3:smbXsrv_session: cancel pending requests when we logoff a previous session

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(similar to commit cc9d52e10f4f1b192171e03674061d4e8e6bcc84)

s3:smbXsrv_session: add smb2srv_session_shutdown_send/recv helper functions

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(similar to commit 4fceb4531ccd6bb1fd6ebd7b6eb5b894959bc010)

s3:smbXsrv_session: clear smb2req->session of pending requests in smbXsrv_session_logoff_all_callback()

smbXsrv_session_logoff_all_callback() is called when the last transport
connection is gone, which means we won't need to sign any response...

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(similar to commit b6c34a07760141bda3e78624d62eb556bb70da65)

s3:smbXsrv_session: clear smb2req->session of pending requests in smbXsrv_session_destructor()

This won't be needed typically needed as the caller is supposted to cancel
the requests already, but this makes sure we don't keep dangling pointers.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(similar to commit 7fea42110596e8e9da0155d726aaa72223107fbd)

s4:torture/smb2: add smb2.notify.session-reconnect test

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit f435c89d61385272bf5b79f82f6e1373908d2b94)

s4:torture/smb2: add smb2.notify.invalid-reauth test

An invalid reauth closes the session.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a8ec77e86b17213eeb6a51a835639d79e9486223)

s4:torture/smb2: add smb2.notify.close test

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 44f9e1052de81a0a3052997e7e19a01813fbec43)

s4:torture/smb2: verify STATUS_NOTIFY_CLEANUP return value

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 4bfa6b024e530694741c7c07171fa09762578389)

s3:smbd: use STATUS_NOTIFY_CLEANUP on smb2 logoff (explicit and implicit) and tdis

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 5169e9b20c69092d04b596f48ca0e69a46af438f)

s3:smbd: use STATUS_NOTIFY_CLEANUP when closing a smb2 directory handle

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11182

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a5981d137461e5715c92a4fb4cdeaa650f34e999)