Matthias Dieter Wallnöfer [Tue, 17 Nov 2009 18:22:00 +0000 (19:22 +0100)]
s4:SAMLDB DSDB module - Add "\n"s on debug messages
Matthias Dieter Wallnöfer [Tue, 17 Nov 2009 17:45:17 +0000 (18:45 +0100)]
s4:SAMLDB DSDB module - Remove "\n" in LDB error messages
abartlet suggested me to not use anymore "\n"s in those kind of outputs.
Plus, enhance a search filter to consider also "builtinDomain" objects which
are basically domain objects too.
Nadezhda Ivanova [Tue, 17 Nov 2009 15:10:23 +0000 (17:10 +0200)]
Fixed incorrect SID for RAS Servers.
Volker Lendecke [Tue, 17 Nov 2009 14:15:35 +0000 (15:15 +0100)]
s3: Fix the build on Solaris
Stefan Metzmacher [Mon, 16 Nov 2009 18:41:46 +0000 (19:41 +0100)]
s4:dsdb/schema: let schema_supclasses() return the correct pointer
str_list_unique() changes the pointer via talloc_realloc().
metze
Stefan Metzmacher [Mon, 16 Nov 2009 18:41:05 +0000 (19:41 +0100)]
librpc: rerun "make idl"
metze
Stefan Metzmacher [Mon, 16 Nov 2009 18:38:32 +0000 (19:38 +0100)]
netlogon.idl: fix ndr_pull_netr_DatabaseRedo()
We can't use subcontext_size() here, as
change_log_entry_size is encoded after the subcontext.
metze
Stefan Metzmacher [Mon, 16 Nov 2009 17:00:42 +0000 (18:00 +0100)]
s4:selftest: use "dc:local" instead of a hardcoded config file
If a tests needs access to the dc's config, it should run
as "dc:local", then it can also access unix named pipes...
If we pass a hardcoded config file the test fails if you use
a selftest_prefix.
metze
Stefan Metzmacher [Mon, 16 Nov 2009 15:53:51 +0000 (16:53 +0100)]
s4:selftest: allways start with $(ST_RM)
metze
Stefan Metzmacher [Mon, 16 Nov 2009 15:48:18 +0000 (16:48 +0100)]
s4:selftest: place summary file into selftest-prefix
metze
Stefan Metzmacher [Mon, 16 Nov 2009 15:34:13 +0000 (16:34 +0100)]
selftest: make sure we don't buffer any output
metze
Stefan Metzmacher [Mon, 16 Nov 2009 15:27:39 +0000 (16:27 +0100)]
selftest: Fix unexpected failure handline in Subunit/Filter.pm
We should only mark the testsuite as expected failure,
if there were more than 1 expected failure, but 0 unexpected
failures.
Before we ignored unexpected failures if there was an expected failure
within a testsuite.
metze
Andrew Bartlett [Tue, 17 Nov 2009 04:36:48 +0000 (15:36 +1100)]
s4:heimdal: import lorikeet-heimdal-
200911170333 (commit
b532c294d974cead40a1183c71be644c6ccc2832)
This fixes up connections to Windows 2003, because the previous import
had a broken arcfour-hmac-md5 implementation (fixed in Heimdal
316fc6ff8ffb0cbb1ef3689685e9977c37405bc4)
Andrew Bartlett
Kamen Mazdrashki [Mon, 16 Nov 2009 01:28:01 +0000 (03:28 +0200)]
s4/drs(tort): Convert DSSYNC test to a test case fixture
Now it should be much more clear why and where a test
in DSSYNC test case has failed.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Kamen Mazdrashki [Mon, 16 Nov 2009 09:36:20 +0000 (11:36 +0200)]
s4/drs(tort): replace DEBUG with torture_asert/comment/fail
I left dumping of decrypted attributes values 'as is'
(using DEBUG and DEBUGADD) as it uses dump_data() function.
dump_data() uses DEBUGADD internally, so I have no way
to redirect its output to torture_context at this point.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Kamen Mazdrashki [Sat, 14 Nov 2009 13:51:53 +0000 (15:51 +0200)]
s4/drs(tort): use torture_drsuapi_assert_call() macro for error checking
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Kamen Mazdrashki [Thu, 12 Nov 2009 01:11:58 +0000 (03:11 +0200)]
s4/drs(tort): replace 'printf' with 'torture_...' calls
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Kamen Mazdrashki [Tue, 10 Nov 2009 16:12:40 +0000 (18:12 +0200)]
s4/drs(tort): 'DsSyncBindInfo.pipe' renamed - 'pipe' is a system call
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Kamen Mazdrashki [Sat, 14 Nov 2009 01:56:21 +0000 (03:56 +0200)]
s4/drs(tort): 'DsPrivate.pipe' renamed - 'pipe' is a system call
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Mon, 16 Nov 2009 23:37:04 +0000 (10:37 +1100)]
s4:dsdb With these workarounds, we now pass the RPC-DSSYNC test
Andrew Bartlett [Mon, 16 Nov 2009 07:51:17 +0000 (18:51 +1100)]
s4:provision Split up reference creation, load schema earlier in the stack
The schema needs to be loaded above the extended_dn_out modules as
otherwise we don't get an extended DN in the search results.
The reference split is to ensure we create references after the
objects they reference exist.
Andrew Bartlett
Andrew Bartlett [Mon, 16 Nov 2009 07:48:46 +0000 (18:48 +1100)]
s4:schema Add the GUID to each defaultObjectCategory when loading from LDIF
This makes these full extended DNs, so we set the right values into
the database, even before we actually set the schema objects
themselves.
Andrew Bartlett
Andrew Bartlett [Mon, 16 Nov 2009 07:46:28 +0000 (18:46 +1100)]
s4:dsdb Rework samdb code to use 'storage format' DNs for defaultObjectCategory
It is important to always ensure that this attribute has an extended
DN if the rest of the database stores things that way.
The knowlege of what format the DN is stored on disk with is passed
around in an LDB opaque.
Andrew Bartlett
Andrew Bartlett [Mon, 16 Nov 2009 07:45:21 +0000 (18:45 +1100)]
s4:provision Generate a random objectGUID for each schema record
This is needed to then create extended DNs with GUID attributes in
them, when importing from the LDIF
Andrew Bartlett
Andrew Bartlett [Mon, 16 Nov 2009 07:40:24 +0000 (18:40 +1100)]
s4:dsdb Load objectGUID and extended DN defaultObjectCategory into the schema
The load of defaultObjectCategory as an extended DN means we need to
use the common parsing functions I just split out, rather than the
GET_DS_DN macro.
The objectGUIDs are loaded so that we can create the extended DN when
we load from LDIF (and are loaded for the other cases for
consistency).
Also adapt callers to API changes needed for common parsing code
Andrew Bartlett
Andrew Bartlett [Mon, 16 Nov 2009 07:37:51 +0000 (18:37 +1100)]
s4:dsdb Use the new flags to dsdb_module_search in schema_load
This loads the defaultObjectCategory DN as an extended DN, so we can
apply it, with the associated GUID, when setting this on records in
the objectClass module.
Previously we would not store the extended DN components for
objectCategory.
Andrew Bartlett
Andrew Bartlett [Mon, 16 Nov 2009 07:35:08 +0000 (18:35 +1100)]
s4:dsdb Break up 'parse a DN from DRSUAPI' into a subfunction
This should make it easier to call this function from the DRS schema
load code, rather than duplicate it.
(we may do the same with other functions in future).
Andrew Bartlett
Andrew Bartlett [Mon, 16 Nov 2009 07:32:17 +0000 (18:32 +1100)]
s4:dsdb Add 'dsdb_flags' to dsdb_module_search() to enable often-used features
These flags, also on dsdb_module_search_dn() allow us to add commonly
set controls to this pre-packaged blocking search, without rebuilding
the whole function in each caller.
Andrew Bartlett
Jeremy Allison [Mon, 16 Nov 2009 22:55:21 +0000 (14:55 -0800)]
Don't overwrite a dynamic pointer with the address of a stack
variable.
Jeremy.
Matthias Dieter Wallnöfer [Mon, 16 Nov 2009 16:57:50 +0000 (17:57 +0100)]
s4:SAMLDB module
- Add more "\n" to make sure that error messages are displayed immediately
- Add a "NULL" in a attribute list
Matthias Dieter Wallnöfer [Mon, 16 Nov 2009 16:01:43 +0000 (17:01 +0100)]
Revert "s4:dsdb/repl/replicated_objects - Applicate also here the new "lDAPDisplayName" generator"
This reverts commit
df95d5c29292968b465bff24c3cf78800677a4d4.
abartlet pointed out in a post on the samba-technical list that this isn't
necessary at all (lDAPDisplayName normalisation algorithm). Rather it breaks
functionality of the replication.
Stefan Metzmacher [Mon, 16 Nov 2009 09:52:27 +0000 (10:52 +0100)]
README.Coding: add section about usage of helper variables
metze
Stefan Metzmacher [Mon, 16 Nov 2009 09:51:31 +0000 (10:51 +0100)]
README.Coding: fix error in "good example"
metze
Stefan Metzmacher [Mon, 16 Nov 2009 08:59:58 +0000 (09:59 +0100)]
s3:libsmb: avoid passing a function call as function parameter
Using a helper variable makes it easier to "step" into the desired function
within gdb.
metze
Andrew Bartlett [Sun, 15 Nov 2009 23:19:42 +0000 (10:19 +1100)]
s4:dsdb LDB attribute lists must always be a static const char **.
(If they are not, then due to the async code, they will cause a segfault as they reference a reclaimed portion of the stack).
Andrew Bartlett
Endi S. Dewata [Fri, 13 Nov 2009 15:58:20 +0000 (09:58 -0600)]
s4:provision - Removed dependency on full Samba 3 schema from FDS
Nadezhda Ivanova [Sun, 15 Nov 2009 20:31:44 +0000 (22:31 +0200)]
Fixed some major bugs in inheritance and access checks.
Fixed sd creation not working on LDAP modify.
Fixed incorrect replacement of CO and CG.
Fixed incorrect access check on modify for SD modification.
Fixed failing sec_descriptor test and enabled it.
Fixed failing sd add test in ldap.python
Jelmer Vernooij [Sun, 15 Nov 2009 19:52:11 +0000 (20:52 +0100)]
s3: Remove two more DFSG-nonfree text documents at release time. (Debian bug
Wilco Baan Hofman [Thu, 15 Oct 2009 11:18:52 +0000 (13:18 +0200)]
Fix writing corrupt registries because of hardcoded version string in IDL.
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
Wilco Baan Hofman [Sat, 10 Oct 2009 22:12:28 +0000 (00:12 +0200)]
Fix NULL pointer dereference in libgpo when listing Local Policy which has no security descriptor.
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
Wilco Baan Hofman [Sat, 10 Oct 2009 19:42:27 +0000 (21:42 +0200)]
Fix writing corrupt REG_SZ to the registry.
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
Wilco Baan Hofman [Thu, 8 Oct 2009 10:36:30 +0000 (12:36 +0200)]
Fix trailing garbage in the hbin block.
This specifically fixes a problem showing extra bytes of garbage in list and
print in regshell, even though the vk.data_length has the correct size.
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
Zahari Zahariev [Sun, 15 Nov 2009 17:26:02 +0000 (19:26 +0200)]
Added tests for descriptor inheritance on ldap modify.
Fixed some expected owners and groups.
Signed-off-by: Nadezhda Ivanova <nadezhda.ivanova@postpath.com>
Matthias Dieter Wallnöfer [Sun, 15 Nov 2009 13:23:32 +0000 (14:23 +0100)]
ldb:python bindings - add a context on "py_ldb_delete"
So the converted DN will be freed after usage.
Matthias Dieter Wallnöfer [Fri, 13 Nov 2009 21:31:53 +0000 (22:31 +0100)]
s4:ldap.py - enhance schema addition test
Don't add only a new objectclass but also a new attribute. Plus let now the
server itself calculate the "lDAPDisplayName" attribute and compare the result.
Matthias Dieter Wallnöfer [Sat, 14 Nov 2009 19:14:45 +0000 (20:14 +0100)]
s4:dsdb/repl/replicated_objects - Applicate also here the new "lDAPDisplayName" generator
Also here we've to be sure to generate the attribute correctly if it doesn't
exist yet.
Andrew Bartlett [Thu, 24 Sep 2009 04:14:37 +0000 (21:14 -0700)]
s4:SAMLDB module - Add support for required and generated schema attributes
This missing support found by Microsoft test suite at AD interop event.
Patch by Andrew Bartlett
Enhancements by Matthias Dieter Wallnöfer
Matthias Dieter Wallnöfer [Sat, 14 Nov 2009 19:12:42 +0000 (20:12 +0100)]
s4:samdb util - add a call for generating a correct "lDAPDisplayName"
This is needed for the SAMLDB module enhancement regarding schema objects.
The algorithm in pseudo code is located in MS-ADTS 3.1.1.2.3.4.
Volker Lendecke [Sat, 14 Nov 2009 16:23:08 +0000 (17:23 +0100)]
s3: Fix a memleak in sys_popen
Found with "dfree command" set
Matthias Dieter Wallnöfer [Sat, 14 Nov 2009 20:56:59 +0000 (21:56 +0100)]
s4:ldap.py - Deactivates some at the moment pointless test parts
I think those parts should be deactivated since they're result set checks for
lookups which are commented out already.
Volker Lendecke [Sat, 14 Nov 2009 11:55:41 +0000 (12:55 +0100)]
Mention typedef struct in README.Coding
Volker Lendecke [Sat, 14 Nov 2009 10:12:50 +0000 (11:12 +0100)]
s3: Add min_setup, min_param and min_data to cli_trans_recv
Every caller that expects to receive something needs to check if enough was
sent. Make this check mandatory for everyone.
Yes, this makes the parameter list for cli_trans a bit silly, but that's just
the way it is: A silly protocol request :-)
While there, convert some _done functions to tevent_req_simple_finish_ntstatus.
Volker Lendecke [Sat, 14 Nov 2009 10:32:00 +0000 (11:32 +0100)]
Attempt to fix the s4 build -- we can not use map_nt_error_from_unix in lib/
Volker Lendecke [Fri, 13 Nov 2009 23:40:21 +0000 (00:40 +0100)]
s3: Convert cli_set_unix_extensions_capabilities_send to async
Volker Lendecke [Sat, 14 Nov 2009 09:01:44 +0000 (10:01 +0100)]
Introduce tevent_req_poll_ntstatus
Volker Lendecke [Sat, 14 Nov 2009 08:38:20 +0000 (09:38 +0100)]
Introduce tevent_req_simple_finish_ntstatus
Volker Lendecke [Thu, 12 Nov 2009 19:44:37 +0000 (20:44 +0100)]
s3: Tiny logic simplification
Erick Nascimento [Wed, 11 Nov 2009 20:25:13 +0000 (18:25 -0200)]
s4-drs: DsExecuteKCC() implementation
I implemented the DsExecuteKCC() handling code on kccsrv_execute_kcc().
Signed-off-by: Andrew Tridgell <tridge@samba.org>
Björn Jacke [Sat, 14 Nov 2009 00:52:49 +0000 (01:52 +0100)]
pam_winbind: fix a printf type mismatch warning
Michael Adam [Sat, 14 Nov 2009 00:23:05 +0000 (01:23 +0100)]
s3:fix a comment typo
Michael
Michael Adam [Sat, 14 Nov 2009 00:21:42 +0000 (01:21 +0100)]
s3:is_trusted_domain: shortcut if domain name == global_sam_name
A domain can't have a trust with itself.
This saves some roundtrips to the ldap server for ldapsam.
Michael
Michael Adam [Sat, 14 Nov 2009 00:12:22 +0000 (01:12 +0100)]
s3:is_trusted_domain: shortcut if domain name is NULL or empty
This saves some roundtrips to LDAP in an ldapsm setup.
Michael
Michael Adam [Sat, 14 Nov 2009 00:07:34 +0000 (01:07 +0100)]
s3:passdb: bump interface VERSION 18->19 (removed uid_to_rid)
Michael
Michael Adam [Sat, 14 Nov 2009 00:06:35 +0000 (01:06 +0100)]
s3:passdb: remove the uid_to_rid method - we only need uid_to_sid
Michael
Michael Adam [Fri, 13 Nov 2009 23:34:14 +0000 (00:34 +0100)]
s3:pdb_default_uid_to_sid: fix some debug statements.
Michael
Björn Jacke [Fri, 13 Nov 2009 22:32:04 +0000 (23:32 +0100)]
s3/pam: move variable declaration into belonging ifdef section
This fixes a unused variable 'addr' warning on some platforms
Christian Ambach [Mon, 6 Jul 2009 12:08:57 +0000 (14:08 +0200)]
add e2fsprogs-devel as build dependency this is needed for AD because it contains libcom/libcom_err files and headers
Signed-off-by: Christian Ambach <christian.ambach@de.ibm.com>
Signed-off-by: Michael Adam <obnox@samba.org>
Michael Adam [Wed, 4 Nov 2009 11:26:46 +0000 (12:26 +0100)]
packaging(RHEL-CTDB): add the current githash to the rpm release number by default
Disable this (to build a release-rpm) by calling
USE_GITHASH=no makerpms.sh
Michael
Michael Adam [Thu, 20 Aug 2009 11:37:11 +0000 (13:37 +0200)]
packaging(RHEL-CTDB): enable parallel build
Michael
Michael Adam [Thu, 20 Aug 2009 11:33:42 +0000 (13:33 +0200)]
packaging(RHEL-CTDB): fix packaging of pam_winbind.mo file
Michael
Michael Adam [Mon, 3 Aug 2009 13:30:42 +0000 (15:30 +0200)]
packaging(RHEL-CTDB): move the idmap and nss_info modules to the common package
In this layout, this is the package that contains winbindd related stuff.
Michael
Michael Adam [Mon, 3 Aug 2009 12:32:52 +0000 (14:32 +0200)]
packaging(RHEL-CTDB): package the winbind_krb5_locator.so plugin
Michael
Michael Adam [Mon, 3 Aug 2009 12:05:42 +0000 (14:05 +0200)]
packaging(RHEL-CTDB): package the manpage of the winbind_krb5_locator plugin
Michael
Michael Adam [Mon, 3 Aug 2009 12:04:33 +0000 (14:04 +0200)]
packaging(RHEL-CTDB): package the manpage of "ldbrename"
Michael
Michael Adam [Mon, 3 Aug 2009 12:04:09 +0000 (14:04 +0200)]
packaging(RHEL-CTDB): package the manpage of "sharesec"
Michael
Michael Adam [Mon, 3 Aug 2009 11:45:40 +0000 (13:45 +0200)]
packaging(RHEL-CTDB): pam_winbindd man page has moved from section 7 to 8
This due to updating the docs tarball to the 3.4 docs.
Michael
Michael Adam [Wed, 1 Jul 2009 09:06:34 +0000 (11:06 +0200)]
packaging(RHEL-CTDB): disable the merged build.
Michael
Michael Adam [Thu, 19 Mar 2009 23:47:45 +0000 (00:47 +0100)]
packaging(RHEL-CTDB): also pack libwbcient in winbind-32bit package
Michael
Signed-off-by: Michael Adam <obnox@samba.org>
Michael Adam [Thu, 19 Mar 2009 23:30:35 +0000 (00:30 +0100)]
packaging(RHEL-CTDB): add new pam_winbind.mo to the common package
Michael
Signed-off-by: Michael Adam <obnox@samba.org>
Michael Adam [Thu, 19 Mar 2009 23:28:36 +0000 (00:28 +0100)]
packaging(RHEL-CTDB): add new binary sharesec to the client package.
Michael
Signed-off-by: Michael Adam <obnox@samba.org>
Michael Adam [Thu, 19 Mar 2009 23:26:11 +0000 (00:26 +0100)]
packaging(RHEL-CTDB): add new binary ldbrename to the common rpm
Michael
Signed-off-by: Michael Adam <obnox@samba.org>
Michael Adam [Mon, 29 Jun 2009 15:07:14 +0000 (17:07 +0200)]
packaging(RHEL-CTDB): fix location of nsswitch/ directory for install
This has been moved to the top level directory in 3.4.
Michael
Michael Adam [Mon, 29 Jun 2009 15:05:00 +0000 (17:05 +0200)]
packaging(RHEL-CTDB): don't pass CFLAGS to make.
This breaks the build since 3.3 since it overwrites the CFLAGS
set by configure.
Michael
Michael Adam [Mon, 29 Jun 2009 15:03:09 +0000 (17:03 +0200)]
packaging(RHEL-CTDB): don't "make proto" any more.
This has become unnecessary in 3.3
Michael
Michael Adam [Tue, 23 Jun 2009 21:09:09 +0000 (23:09 +0200)]
packaging(RHEL-CTDB):makerpms.sh: replace source/ by source3/
Michael
Michael Adam [Tue, 23 Jun 2009 21:06:40 +0000 (23:06 +0200)]
packaging(RHEL-CTDB):makespec.sh: fix detection of version
Michael
Michael Adam [Tue, 23 Jun 2009 20:41:51 +0000 (22:41 +0200)]
packaging(RHEL-CTDB): makeversion.sh: v3-4-test uses source3 instead of source
Michael
Michael Adam [Wed, 21 Jan 2009 08:49:12 +0000 (09:49 +0100)]
packaging(RHEL-CTDB): makerpms.sh: build winbind-32bit libs in the 64bit build
Michael
(cherry picked from commit
a9a506b6640986548e2ae8540b7ae93960d6ece5)
Michael Adam [Tue, 20 Jan 2009 18:47:28 +0000 (19:47 +0100)]
packaging(RHEL-CTDB): Build winbind-32bit package in the 64bit build
Michael
(cherry picked from commit
f5cd88a25f360e6609dc5abe24247fab78af6854)
Michael Adam [Wed, 21 Jan 2009 10:03:34 +0000 (11:03 +0100)]
packaging(RHEL-CTDB): extend makespec.sh to extract VENDOR_PATCH from version.h
Michael
(cherry picked from commit
fc122aa276bce379b492e5bdf52ab3e03bc3737f)
Michael Adam [Wed, 21 Jan 2009 09:24:31 +0000 (10:24 +0100)]
packaging(RHEL-CTDB): The former release number has basically moved into VERSION
Michael
Michael Adam [Fri, 13 Nov 2009 15:16:50 +0000 (16:16 +0100)]
s3:smbd: also fill the memcache with sid<->id mappings in ldapsam_sid_to_id()
not only the persistent idmap cache.
Michael
Michael Adam [Fri, 13 Nov 2009 14:51:33 +0000 (15:51 +0100)]
s3:smbd: make idmap cache persistent for "ldapsam:trusted".
This stores the mappings found in the idmap cache (which lives
inside gencache). This cache is already read in sid_to_Xid()
and Xid_to_sid() for ldapsam:trusted, this fills the opposite
direction, massively reducing the number of ldap roundtrips
across smbd restarts.
Michael
Kamen Mazdrashki [Fri, 13 Nov 2009 01:57:48 +0000 (03:57 +0200)]
util: str_list_unique() bugfix
j is actually the index of the last element in the list
size of the list though is j+1 <- to make room for the
terminating NULL element
Kamen Mazdrashki [Fri, 13 Nov 2009 01:56:07 +0000 (03:56 +0200)]
util: str_list_unique_2() test implementation
Difference with previous test for str_list_unique() is
that this test allows number of elements and number
of duplicates to be supplied on command line using
--option="list_unique:count=47"
--option="list_unique:dups=7"
Andrew Bartlett [Fri, 13 Nov 2009 02:50:25 +0000 (13:50 +1100)]
s4:heimdal Import generated files from heimdal tree
We should be able to rebuild these, but a cp is easier :-)
Andrew Bartlett [Thu, 12 Nov 2009 23:51:14 +0000 (10:51 +1100)]
Andrew Bartlett [Mon, 21 Sep 2009 06:18:34 +0000 (23:18 -0700)]
Volker Lendecke [Mon, 18 May 2009 14:04:04 +0000 (16:04 +0200)]
Fix large paged search
Signed-off-by: Michael Adam <obnox@samba.org>
Volker Lendecke [Wed, 13 May 2009 08:12:26 +0000 (10:12 +0200)]
fix bogus "out of memory" winbind msg
Signed-off-by: Michael Adam <obnox@samba.org>