kai/samba-autobuild/.git
22 months agolib/async_req/async_sock.c set socket close on exec
Gary Lockyer [Sun, 10 Dec 2017 20:31:33 +0000 (09:31 +1300)]
lib/async_req/async_sock.c set socket close on exec

Set SOCKET_CLOEXEC on the sockets returned by accept.  This ensures that
the socket is unavailable to any child process created by system().
Making it harder for malicious code to set up a command channel,
as seen in the exploit for CVE-2015-0240

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agolib/tevent/echo_server.c set socket close on exec
Gary Lockyer [Sun, 10 Dec 2017 20:17:49 +0000 (09:17 +1300)]
lib/tevent/echo_server.c set socket close on exec

Set SOCKET_CLOEXEC on the sockets returned by accept.  This ensures that
the socket is unavailable to any child process created by system().
Making it harder for malicious code to set up a command channel,
as seen in the exploit for CVE-2015-0240

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoWHATSNEW: Encrypted secrets
Gary Lockyer [Mon, 11 Dec 2017 21:49:05 +0000 (10:49 +1300)]
WHATSNEW: Encrypted secrets

Document the encrypted secrets feature in WHATSNEW.txt

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Dec 18 04:36:19 CET 2017 on sn-devel-144

22 months agoselftest fl2000dc provision with --plaintext-secrets
Gary Lockyer [Thu, 14 Dec 2017 18:27:10 +0000 (07:27 +1300)]
selftest fl2000dc provision with --plaintext-secrets

Provision fl2000dc provision with --plaintext-secrets to test that the
--plaintext-secrets option functions correctly.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoprovision: Changes to support encrypted_secrets module
Gary Lockyer [Thu, 14 Dec 2017 18:24:14 +0000 (07:24 +1300)]
provision: Changes to support encrypted_secrets module

Changes to provision and join to create a database with
encrypted_secrets enabled and a key file generated.

Also adds the --plaintext-secrets option to join and provision commands
to allow the creation of unencrypted databases.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodsdb encrypted secrets module
Gary Lockyer [Thu, 14 Dec 2017 18:21:10 +0000 (07:21 +1300)]
dsdb encrypted secrets module

Encrypt the samba secret attributes on disk.  This is intended to
mitigate the inadvertent disclosure of the sam.ldb file, and to mitigate
memory read attacks.

Currently the key file is stored in the same directory as sam.ldb but
this could be changed at a later date to use an HSM or similar mechanism
to protect the key.

Data is encrypted with AES 128 GCM. The encryption uses gnutls where
available and if it supports AES 128 GCM AEAD modes, otherwise nettle is
used.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agotests dsdb encrypted secrets module
Gary Lockyer [Thu, 14 Dec 2017 18:17:54 +0000 (07:17 +1300)]
tests dsdb encrypted secrets module

Add tests to check that the encrypted_secrets module encrypts
secrets/sensitive attributes on disk.

This test also proves that the provision and join operations correctly
configure the encrypted_secrets module.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agopyglue: Add function to generate a random byte string
Gary Lockyer [Wed, 1 Nov 2017 21:15:29 +0000 (10:15 +1300)]
pyglue: Add function to generate a random byte string

Adds a function to generate a random byte string using the samba random
routines.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agosmbd: Fix coredump on failing chdir during logoff
Christof Schmitt [Wed, 13 Dec 2017 18:34:23 +0000 (11:34 -0700)]
smbd: Fix coredump on failing chdir during logoff

server_exit does an internal tree disconnect which requires a chdir to
the share directory. In case the file system encountered a problem and
the chdir call returns an error, this triggers a SERVER_EXIT_ABNORMAL
which in turn results in a panic and a coredump. As the log already
indicates the problem (chdir returned an error), avoid the
SERVER_EXIT_ABNORMAL in this case and not trigger a coredump.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13189

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Dec 16 01:56:06 CET 2017 on sn-devel-144

22 months agoselftest: Add test for failing chdir call in smbd
Christof Schmitt [Wed, 13 Dec 2017 19:58:18 +0000 (12:58 -0700)]
selftest: Add test for failing chdir call in smbd

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13189

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agoselftest: Make location of log file available in tests
Christof Schmitt [Wed, 13 Dec 2017 19:47:31 +0000 (12:47 -0700)]
selftest: Make location of log file available in tests

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13189

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agoselftest: Add share for error injection testing
Christof Schmitt [Wed, 13 Dec 2017 18:34:05 +0000 (11:34 -0700)]
selftest: Add share for error injection testing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13189

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agovfs_error_inject: Add new module
Christof Schmitt [Fri, 8 Dec 2017 22:29:07 +0000 (15:29 -0700)]
vfs_error_inject: Add new module

This module allow injecting errors in vfs calls. It only implements one
case (return ESTALE from chdir), but the idea is to extend this to more
vfs functions and more errors when needed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13189

Signed-off-by: Christof Schmitt <cs@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agogpo: Test that unapply works
David Mulder [Wed, 6 Dec 2017 17:16:11 +0000 (10:16 -0700)]
gpo: Test that unapply works

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agogpo: Only commit the earliest change to the log
David Mulder [Fri, 1 Dec 2017 18:18:55 +0000 (11:18 -0700)]
gpo: Only commit the earliest change to the log

Otherwise we overwrite the original value,
leaving the setting tattooed on unapplied

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agogpo: Fix the empty apply log
David Mulder [Mon, 20 Nov 2017 13:41:19 +0000 (06:41 -0700)]
gpo: Fix the empty apply log

The apply log wasn't being saved, apparently the pointers to elements
of the tree were getting lost.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agolibgpo: Remedy some longer lines
Garming Sam [Tue, 21 Nov 2017 22:00:56 +0000 (11:00 +1300)]
libgpo: Remedy some longer lines

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agolibgpo: Tidy up some if statements
Garming Sam [Tue, 21 Nov 2017 22:00:35 +0000 (11:00 +1300)]
libgpo: Tidy up some if statements

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agolibgpo: typo credentaials -> credentials
Garming Sam [Tue, 21 Nov 2017 21:58:55 +0000 (10:58 +1300)]
libgpo: typo credentaials -> credentials

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agolibgpo: Always check for ldap_server argument
Garming Sam [Tue, 21 Nov 2017 21:57:18 +0000 (10:57 +1300)]
libgpo: Always check for ldap_server argument

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agomarkdown: Rename ms_markdown.py -> ms_schema_markdown.py
Garming Sam [Thu, 23 Nov 2017 04:06:53 +0000 (17:06 +1300)]
markdown: Rename ms_markdown.py -> ms_schema_markdown.py

We also reduce the scope of the import so that python-markdown is only
required if interacting with 2012 code.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Dec 14 12:34:04 CET 2017 on sn-devel-144

22 months agoprovision: Use the official MS 2008R2 schema by default
Andrew Bartlett [Mon, 20 Nov 2017 04:10:25 +0000 (17:10 +1300)]
provision: Use the official MS 2008R2 schema by default

This fixes us to have the official adminDescription etc.  While both schema were provided by
Microsoft this is a better quality one, but still under the same licence.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoschema: 2008R2 AD schema attributes and classes
Andrew Bartlett [Mon, 20 Nov 2017 02:45:41 +0000 (15:45 +1300)]
schema: 2008R2 AD schema attributes and classes

Obtained under the Open Protocols Specifications licence from
https://www.microsoft.com/en-us/download/details.aspx?id=23782

These are more complete than the version we have had in the tree until now.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoschema: 2016 AD schema attributes and classes
Andrew Bartlett [Mon, 20 Nov 2017 02:18:41 +0000 (15:18 +1300)]
schema: 2016 AD schema attributes and classes

Obtained under the Open Protocols Specifications licence from
https://www.microsoft.com/en-us/download/details.aspx?id=23782

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: RODC revision level should be at 2
Garming Sam [Wed, 16 Aug 2017 04:02:32 +0000 (16:02 +1200)]
provision: RODC revision level should be at 2

This number had been mistakenly updated alongside the standard forest
updates revision. This version number appears to be independent of the
other revision levels.

Also add the change to a new .ldf file, which can be used to apply
the schema change to an existing Samba 4.7 (or earlier) instance.
Update the provision/upgrade test to do just this (otherwise it
complains about differences between a new provision and an older Samba
4.0.0 instance).

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoselftest: Add basic test for schema upgrade
Tim Beale [Fri, 6 Oct 2017 03:30:40 +0000 (16:30 +1300)]
selftest: Add basic test for schema upgrade

This tests that we can provision using both the 2008 and 2012 schema,
that we can upgrade a 2008 Samba instance to use the 2012 schema, and
that when we do that the result (more or less) matches a straight
2012 provision.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodomain.py: Auto-patch the diffs for the adprep schemaupgrade
Garming Sam [Tue, 31 Oct 2017 22:53:29 +0000 (11:53 +1300)]
domain.py: Auto-patch the diffs for the adprep schemaupgrade

This creates a temporary directory where the markdown is parsed and the
diffs are then applied.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodomain.py: Add a base dir option for schema upgrades
Garming Sam [Tue, 31 Oct 2017 21:48:36 +0000 (10:48 +1300)]
domain.py: Add a base dir option for schema upgrades

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoschema: Some 2012 objects were missing systemflags
Garming Sam [Wed, 27 Sep 2017 01:51:25 +0000 (14:51 +1300)]
schema: Some 2012 objects were missing systemflags

The adprep LDIF files were adding the systemFlags, but they weren't
present in the 2012 schema files. This is not just a Microsoft
documentation problem - the difference was present when doing a provision
of a 2012 Windows server vs using Adprep.exe to upgrade an older Windows
server.

Samba might as well use the correct systemFlags right from the start.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoupgradeprovision: Change test to always use 2008 R2 schema
Tim Beale [Wed, 4 Oct 2017 21:01:27 +0000 (10:01 +1300)]
upgradeprovision: Change test to always use 2008 R2 schema

This tool (and the corresponding test) is designed to migrate a Samba DC
from a pre-4.0.0 release up to a more recent schema (i.e. Windows 2008R2).

Going further than 2008R2 turns this test into a bit of a nightmare. We
now have a better adprep/'samba-tool domain schemaupgrade' option for
upgrading from 2008R2 to a more recent schema.

It seems to make most sense to leave this tests just running against
2008R2 schema provisions and add new tests to migrate from 2008R2 to
2012R2.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodomain.py: Add base-schema option to samba-tool provision
Tim Beale [Wed, 4 Oct 2017 20:53:28 +0000 (09:53 +1300)]
domain.py: Add base-schema option to samba-tool provision

Allow a different base-schema to be used when provisioning a new domain.
This allows us to test the new 2012 schema without committing Samba to
using it by default.

If, in future, we change the default to use the 2012 schema, some
existing Samba tests (like upgradeprovision) rely on the 2012 schema.
So making the base-schema optional allows these tests to continue using
the older schema.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoschema: Add option of specifying the base schema for a provision
Tim Beale [Tue, 3 Oct 2017 23:30:59 +0000 (12:30 +1300)]
schema: Add option of specifying the base schema for a provision

Add the ability to override the base schema files being used for the
new provision, e.g. instead of using the default supported schema,
the code can now potentially specify an older or newer schema to use.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoselftest: Fix upgradeprovision test by importing new objects for schema 45
Andrew Bartlett [Tue, 12 Dec 2017 02:26:35 +0000 (15:26 +1300)]
selftest: Fix upgradeprovision test by importing new objects for schema 45

The recent schema changes mean that the upgradeprovision test starts
failing. This is because it's using an old 4.0.0 schema (that doesn't
have these schema changes), but it's comparing it against a fresh
provision (which does have the changes). We can avoid this failure by
using the 'samba-tool domain schemaupgrade' to bring the old 4.0.0 schema
in line with a fresh provision. Note that the 'upgradeprovision --full'
test doesn't need this change as it seems to more aggressively copy over
any schema differences with a fresh provision.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months ago2008R2: Missing flags on optional features container for objectVersion 45
Andrew Bartlett [Tue, 12 Dec 2017 02:20:26 +0000 (15:20 +1300)]
2008R2: Missing flags on optional features container for objectVersion 45

To match Windows 2008R2, this should have the same flags as the
recycle bin enabled feature.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
22 months ago2008R2: Missing extended rights for objectVersion 45
Andrew Bartlett [Wed, 13 Dec 2017 02:03:57 +0000 (15:03 +1300)]
2008R2: Missing extended rights for objectVersion 45

We appear to have been missing some extended rights from 2008R2. These were
added in samba by the extended-rights.ldif

On Windows this was in Sch45.ldf (triggered by adprep schema updates).

We add these changes to adprep/samba-4.7-missing-for-schema-45.ldif,
which can be used to apply the changes to an existing Samba instance.

This is not extracted from the Sch45.ldf file provided by Microsoft
but is instead extracted using ldapcmp against a Samba install running
the new extended-rights.ldif.

Finally, these schema changes mean that the upgradeprovision test starts
failing. This is because it's using an old 4.0.0 schema (that doesn't
have these schema changes), but it's comparing it against a fresh
provision (which does have the changes). We can avoid this failure by
using the 'samba-tool domain schemaupgrade' to bring the old 4.0.0 schema
in line with a fresh provision. Note that the 'upgradeprovision --full'
test doesn't need this change as it seems to more aggressively copy over
any schema differences with a fresh provision.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
22 months agoschema: Re-work extended rights handling in provision (prep for 2012R2)
Andrew Bartlett [Mon, 11 Dec 2017 01:42:55 +0000 (14:42 +1300)]
schema: Re-work extended rights handling in provision (prep for 2012R2)

Add the changes needed to provision a 2012 DC (mostly this just affects
the Extended Rights objects) by moving to the new extended-rights.ldif

The localizationDisplayId is not documented in MS-ATDS so these values
are moved to provision_configuation_modify.ldif and applied after the
display-specifiers.ldif

We don't enable the 2012R2 mode yet. The ${INC2012} variable
just gets replaced with '#' so the lines get commented out and not
applied.

This approach allows us to support provisioning both a 2008R2 DC or
a 2012R2 DC (so that we can test we can upgrade a 2008 DC to 2012).

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Make clarifying header an LDIF comment in extended-rights.ldif
Andrew Bartlett [Mon, 11 Dec 2017 01:50:39 +0000 (14:50 +1300)]
provision: Make clarifying header an LDIF comment in extended-rights.ldif

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Align displayName of Property Sets with MS-ADTS 3.1.1.2.3.3
Andrew Bartlett [Mon, 11 Dec 2017 00:35:25 +0000 (13:35 +1300)]
provision: Align displayName of Property Sets with MS-ADTS 3.1.1.2.3.3

This gives some better names than what the CN of the object was.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Fill in a nicer displayName for Extended Rights
Andrew Bartlett [Mon, 11 Dec 2017 00:26:53 +0000 (13:26 +1300)]
provision: Fill in a nicer displayName for Extended Rights

We replace all the hyphens with a space.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Fill in validAccesses in extended-rights.ldif for Property Sets
Andrew Bartlett [Sun, 10 Dec 2017 23:35:45 +0000 (12:35 +1300)]
provision: Fill in validAccesses in extended-rights.ldif for Property Sets

A Property Right has the value of RIGHT_DS_READ_PROPERTY|RIGHT_DS_WRITE_PROPERTY which is
48 (0x30) per 5.1.3.2 Access Rights.

The property Sets are listed in MS-ATDS 3.1.1.2.3.3 and can also be found by looking
at the attributeSecurityGuid on the schema objects.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Fill in validAccesses in extended-rights.ldif for Validated Writes
Andrew Bartlett [Sun, 10 Dec 2017 23:26:04 +0000 (12:26 +1300)]
provision: Fill in validAccesses in extended-rights.ldif for Validated Writes

MS-ATDS 5.1.3.2.2 Validated Writes specifies the value of RIGHT_DS_WRITE_PROPERTY_EXTENDED which is
8 (0x08) per 5.1.3.2 Access Rights.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Fill in validAccesses in extended-rights.ldif for Control Access Rights
Andrew Bartlett [Sun, 10 Dec 2017 23:22:05 +0000 (12:22 +1300)]
provision: Fill in validAccesses in extended-rights.ldif for Control Access Rights

MS-ATDS 5.1.3.2.1 Control Access Rights specifies the value of RIGHT_DS_CONTROL_ACCESS which is
256 (0x100) per 5.1.3.2 Access Rights.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Align extended-rights.ldif with the adprep LDIF for 2012R2
Andrew Bartlett [Sun, 10 Dec 2017 22:57:35 +0000 (11:57 +1300)]
provision: Align extended-rights.ldif with the adprep LDIF for 2012R2

This removes the additional rights for 2016 and flags the 2012R2 changes to allow
the same file to be used to produce a 2008R2 or 2012R2 domain

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Reformat appliesTo in Extended Rights into LDIF
Andrew Bartlett [Sun, 10 Dec 2017 22:09:51 +0000 (11:09 +1300)]
provision: Reformat appliesTo in Extended Rights into LDIF

We remove comments about Schema 45 and earlier as this is the base
level that Samba supports.  A future commit will move to a
machine-parsable flag for the 2012 schema and remove the 2016 elements.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Remove section numbers from extended rights, replace with dn
Andrew Bartlett [Sun, 10 Dec 2017 21:51:32 +0000 (10:51 +1300)]
provision: Remove section numbers from extended rights, replace with dn

This makes this file more like LDIF so we can process it automatically as well as
use it as a text document.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoprovision: Import extended rights schema from MS-ADTS v47.0
Andrew Bartlett [Sun, 10 Dec 2017 21:09:55 +0000 (10:09 +1300)]
provision: Import extended rights schema from MS-ADTS v47.0

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agodomain.py: Add a schemaupgrade option to apply missing 2008R2 schema
Tim Beale [Thu, 5 Oct 2017 03:16:30 +0000 (16:16 +1300)]
domain.py: Add a schemaupgrade option to apply missing 2008R2 schema

We've identified some cases where we've gotten our implementation of the
2008R2 schema wrong. We can fix these up for new provisions going
forward, but it'd be nice to have some way of fixing up the schema on
existing DCs.

A lot of what we're missing is already documented in Microsoft's
Sch45.ldf file:
https://technet.microsoft.com/en-us/library/dd378890(v=ws.10).aspx

Unfortunately we can't just apply the Sch45.ldf file using the existing
'samba-tool domain schema-upgrade' option because:
- We have got some of the Sch45.ldf changes, just not all of them.
- We already say the Samba schema objectVersion is 47 (2008R2), so
  there's no way to tell if the Samba instance does or doesn't have the
  missing changes (apart from querying each change).

We may want to add this to dbcheck eventually, but the simplest
implementation option for now is to extend the new schemaupgrade command
to allow us to specify a particular .LDF file to apply.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodomain.py: Make schemaupgrade option work regardless of config
Tim Beale [Thu, 5 Oct 2017 02:43:53 +0000 (15:43 +1300)]
domain.py: Make schemaupgrade option work regardless of config

Currently the 'samba-tool domain schemaupgrade' command will only work
if the Samba config has the non-default option 'dsdb:schema update
allowed = yes'. The whole point of running this samba-tool option is to
upgrade the schema, so it would seem to make sense to bypass the setting
temporarily, in order to apply the schema updates successfully.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodomain.py: Add schema upgrade option to samba-tool
Tim Beale [Tue, 3 Oct 2017 23:30:59 +0000 (12:30 +1300)]
domain.py: Add schema upgrade option to samba-tool

Microsoft has published the Schema updates that its Adprep.exe tool
applies when it upgrades a 2008R2 schema to 2012R2.

This patch adds an option to samba-tool to go through these update files
and apply each change one by one. Along the way we need to make a few
changes to the LDIF operations, e.g. change 'ntdsschemaadd' to 'add' and
so on.

The bulk of the changes involve parsing the .ldif file and separating
out each update into a separate operation.

There are a couple of errors that we've chosen to ignore:
- Trying to set isDefunct for an object we don't know about.
- Trying to set a value for an attribute OID that we don't know about
  (we may need to fix this in future, but it'll require some help from
   Microsoft about what the OIDs actually are).

To try to make life easier, I've added a ldif_schema_update helper
class. This provides convenient access of the DN the change applies to
and other such details (whether it's setting isDefunct, etc).

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoschema: Allow schemaUpdateNow to refresh schema during a transaction
Garming Sam [Fri, 18 Aug 2017 01:59:30 +0000 (13:59 +1200)]
schema: Allow schemaUpdateNow to refresh schema during a transaction

When we upgrade a schema from 2008R2 to 2012R2, we want to apply all the
changes in a single transaction - if we can't apply all the updates then
we don't want to be left with a schema halfway in between the two.

However, as we apply each LDIF update, we also want to refresh the
schema. There are 2 reasons for this:
1. The adprep .LDIF files provided by Microsoft have some writes to
schemaUpdateNow in them.
2. Microsoft uses attribute OIDs in their adprep .LDIF files, which
Samba doesn't handle so well. However, we can replace the OIDs with the
attribute's ldapDisplayName and they work fine. But to do this, we need
to query the schema to map the OID to attribute name. And to query the
schema successfully, the schema needs to be refreshed after the new
attribute object has been added.

Basically this patch avoids bailing out during the dsdb_schema_refresh()
if we are writing schemaUpdateNow as part of a larger transaction.

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoadprep: Add the LDF data needed to upgrade to 2012R2 schema
Garming Sam [Mon, 2 Oct 2017 21:01:30 +0000 (10:01 +1300)]
adprep: Add the LDF data needed to upgrade to 2012R2 schema

This patch adds the LDF files corresponding to the changes that the
Windows Adprep.exe tool makes when upgrading a AD schema to Windows
2012R2.

This is based on information Microsoft has made public on github
(Schema-Updates.md - see the README.txt for more details).

The LDF files 48-56 are for upgrading to Windows Server 2012, and 57-69
are for Windows Server 2012 R2.

Unfortunately, the raw LDF information from Microsoft wasn't enough to
get the schema working. The .diff files contain changes we needed to
make on top of the raw LDF content from Microsoft.

The basic steps to regenerate the .LDF files are documented in the
README.txt file. The files used to generate the .LDF files are in the
WindowsServerDocs/ sub-directory. (The .LDF generation is done at runtime
during provision).

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoobjectclass: Ensure that backlinks are not replicated
Garming Sam [Tue, 5 Sep 2017 04:03:04 +0000 (16:03 +1200)]
objectclass: Ensure that backlinks are not replicated

Adprep schema adds backlinks, but they do not have the NOT_REPLICATED
bit. We need to force this in locally to ensure we have it.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoms_schema: Properly handle base64 encoded attributes
Garming Sam [Fri, 18 Aug 2017 01:46:57 +0000 (13:46 +1200)]
ms_schema: Properly handle base64 encoded attributes

There used to be a special case for omobjectclass, but now there is just
generic handling for such attributes.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoschema: 2012 and 2012 R2 AD schema attributes and classes
Garming Sam [Mon, 12 Sep 2016 05:07:02 +0000 (17:07 +1200)]
schema: 2012 and 2012 R2 AD schema attributes and classes

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoms_schema: Allow for CN=X and DC=X replacements
Garming Sam [Mon, 19 Sep 2016 01:52:54 +0000 (13:52 +1200)]
ms_schema: Allow for CN=X and DC=X replacements

These occur in the newer 2012 and 2016 schemas.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agotypo: Change case to match DN
Garming Sam [Wed, 2 Aug 2017 00:52:22 +0000 (12:52 +1200)]
typo: Change case to match DN

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoflags.h: Introduce the 2016 function level constant
Garming Sam [Tue, 15 Aug 2017 03:17:34 +0000 (15:17 +1200)]
flags.h: Introduce the 2016 function level constant

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoldb: Show the last successful DN when failing to parse LDIF
Andrew Bartlett [Mon, 11 Dec 2017 02:57:30 +0000 (15:57 +1300)]
ldb: Show the last successful DN when failing to parse LDIF

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
22 months agoWHATSNEW: document the removal of 'auth methods', 'map untrusted to domain' and ...
Stefan Metzmacher [Mon, 7 Aug 2017 15:32:09 +0000 (17:32 +0200)]
WHATSNEW: document the removal of 'auth methods', 'map untrusted to domain' and 'profile acls'

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Dec 14 00:40:31 CET 2017 on sn-devel-144

22 months agodocs-xml: remove deprecated 'profile acls' option
Stefan Metzmacher [Mon, 7 Aug 2017 15:31:13 +0000 (17:31 +0200)]
docs-xml: remove deprecated 'profile acls' option

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agos3:smbd: remove deprecated handling of "profile acls = yes"
Stefan Metzmacher [Mon, 7 Aug 2017 15:24:19 +0000 (17:24 +0200)]
s3:smbd: remove deprecated handling of "profile acls = yes"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agotests/posixacl.py: remove useless 'profile acls' based test
Stefan Metzmacher [Mon, 7 Aug 2017 15:29:41 +0000 (17:29 +0200)]
tests/posixacl.py: remove useless 'profile acls' based test

test_setntacl_smbd_dont_invalidate_getntacl_smbd() is basically
the same as test_setntacl_smbd_getntacl_smbd()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agos3:auth: is_trusted_domain() is now only useful (and used as DC)
Stefan Metzmacher [Mon, 19 Jun 2017 08:43:25 +0000 (10:43 +0200)]
s3:auth: is_trusted_domain() is now only useful (and used as DC)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodocs-xml: remove unused "auth methods" option
Stefan Metzmacher [Mon, 19 Jun 2017 08:56:38 +0000 (10:56 +0200)]
docs-xml: remove unused "auth methods" option

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos4:auth_winbind: remove unused 'winbind_wbclient' backend
Stefan Metzmacher [Mon, 27 Nov 2017 12:48:34 +0000 (13:48 +0100)]
s4:auth_winbind: remove unused 'winbind_wbclient' backend

This is no longer useful as it doesn't support async requests.

It could be readded using pthreadpool_tevent_job_send()
and wbcCtxAuthenticateUserEx() if required.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos4:auth_winbind: remove unused 'winbind_rodc' backend
Stefan Metzmacher [Mon, 27 Nov 2017 12:48:34 +0000 (13:48 +0100)]
s4:auth_winbind: remove unused 'winbind_rodc' backend

This is no longer useful as the 'winbind' backend also
handles the rodc case now.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos4:auth_sam: remove unused 'sam_failtrusts' backend
Stefan Metzmacher [Tue, 28 Nov 2017 06:40:09 +0000 (07:40 +0100)]
s4:auth_sam: remove unused 'sam_failtrusts' backend

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos4:auth/ntlm: remove lpcfg_auth_methods() handling
Stefan Metzmacher [Mon, 19 Jun 2017 08:56:00 +0000 (10:56 +0200)]
s4:auth/ntlm: remove lpcfg_auth_methods() handling

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos3:auth: remove lp_auth_methods() handling
Stefan Metzmacher [Mon, 19 Jun 2017 08:55:35 +0000 (10:55 +0200)]
s3:auth: remove lp_auth_methods() handling

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos4:selftest: remove samba.blackbox.pdbtest.s4winbind test
Stefan Metzmacher [Wed, 6 Dec 2017 12:28:27 +0000 (13:28 +0100)]
s4:selftest: remove samba.blackbox.pdbtest.s4winbind test

This is marked as knownfail for quite some time.

I don't think such a test is a reason to the 'auth methods' option.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos4:selftest: remove samba.blackbox.pdbtest.s4winbind_wbclient test
Stefan Metzmacher [Wed, 6 Dec 2017 12:25:19 +0000 (13:25 +0100)]
s4:selftest: remove samba.blackbox.pdbtest.s4winbind_wbclient test

The "winbind_wbclient" backend is unused and will be removed soon.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agopdbtest: also verify the authentication path for local users via winbindd
Stefan Metzmacher [Thu, 7 Dec 2017 12:03:55 +0000 (13:03 +0100)]
pdbtest: also verify the authentication path for local users via winbindd

This basically inlines the logic from the 'winbind_wbclient' backend,
which will be removed shortly.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodocs-xml: remove unused "map untrusted to domain" option
Stefan Metzmacher [Mon, 19 Jun 2017 08:48:49 +0000 (10:48 +0200)]
docs-xml: remove unused "map untrusted to domain" option

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos3:auth: remove "map untrusted to domain" handling
Stefan Metzmacher [Mon, 12 Jun 2017 13:35:41 +0000 (15:35 +0200)]
s3:auth: remove "map untrusted to domain" handling

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agoexamples/scripts: remove unused shares directory
Stefan Metzmacher [Thu, 7 Dec 2017 12:34:36 +0000 (13:34 +0100)]
examples/scripts: remove unused shares directory

These scripts are not that useful anymore, as they rely
on parameters to be defined in loadparm.c

It's confusing to get 'git grep' matches for parameters there...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agos4: remove ipv6:enabled parameteric option
Björn Jacke [Tue, 12 Dec 2017 21:32:09 +0000 (22:32 +0100)]
s4: remove ipv6:enabled parameteric option

this was never disabling ipv6, only v6-only interfaces. This can be achieved
with the interfaces parameter also if wanted.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodoc: update and tidy up the main samba(7) man page
Bjoern Jacke [Fri, 8 Dec 2017 20:06:56 +0000 (21:06 +0100)]
doc: update and tidy up the main samba(7) man page

my favourite one here was "If you have access to a WWW viewer..." :)

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodoc: remove section on ancient history of the docs
Bjoern Jacke [Fri, 8 Dec 2017 18:57:06 +0000 (19:57 +0100)]
doc: remove section on ancient history of the docs

This is quite historically, we should drop this.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodoc: move wins related man page to wins subdir
Bjoern Jacke [Fri, 8 Dec 2017 12:48:43 +0000 (13:48 +0100)]
doc: move wins related man page to wins subdir

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
22 months agodocs-xml/manpages: Use new doc.version XML entity.
Karolin Seeger [Tue, 12 Dec 2017 08:08:06 +0000 (09:08 +0100)]
docs-xml/manpages: Use new doc.version XML entity.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9531

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Dec 13 17:22:01 CET 2017 on sn-devel-144

22 months agodocs-xml: autogenerate a doc.version XML entity.
Stefan Metzmacher [Tue, 12 Dec 2017 10:01:51 +0000 (11:01 +0100)]
docs-xml: autogenerate a doc.version XML entity.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9531

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agodocs-xml/Makefile.settings.in: make sure we don't require network access
Karolin Seeger [Tue, 12 Dec 2017 10:48:03 +0000 (11:48 +0100)]
docs-xml/Makefile.settings.in: make sure we don't require network access

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9531

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agoselftest: Fix copyright header on samba.dsdb_lock
Andrew Bartlett [Wed, 6 Dec 2017 01:31:54 +0000 (14:31 +1300)]
selftest: Fix copyright header on samba.dsdb_lock

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13178

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Wed Dec 13 13:03:16 CET 2017 on sn-devel-144

22 months agoctdb-recovery-helper: Deregister message handler in error paths
Amitay Isaacs [Wed, 13 Dec 2017 05:12:09 +0000 (16:12 +1100)]
ctdb-recovery-helper: Deregister message handler in error paths

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13188

If PULL_DB control times out but the remote node is still sending the
data, then the tevent_req for pull_database_send will be freed without
removing the message handler.  So when the data is received, srvid
handler will be called and it will try to access tevent_req which will
result in use-after-free and abort.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
22 months agoctdb-client: Add async version for ctdb_client_init()
Amitay Isaacs [Tue, 28 Nov 2017 10:17:37 +0000 (21:17 +1100)]
ctdb-client: Add async version for ctdb_client_init()

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
22 months agoctdb-common: Avoid using void ** argument
Amitay Isaacs [Thu, 9 Nov 2017 05:37:15 +0000 (16:37 +1100)]
ctdb-common: Avoid using void ** argument

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
22 months agoctdb-build: Apply dependency to correct subsystem
Amitay Isaacs [Thu, 2 Nov 2017 06:33:19 +0000 (17:33 +1100)]
ctdb-build: Apply dependency to correct subsystem

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
22 months agoselftest: Add cleanup of ForeignSecurityPrincipal in samba.dsdb test
Andrew Bartlett [Wed, 13 Dec 2017 01:47:59 +0000 (14:47 +1300)]
selftest: Add cleanup of ForeignSecurityPrincipal in samba.dsdb test

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Dec 13 08:47:05 CET 2017 on sn-devel-144

22 months agoselftest: Fix flapping samba.dsdb test
Andrew Bartlett [Wed, 13 Dec 2017 01:46:00 +0000 (14:46 +1300)]
selftest: Fix flapping samba.dsdb test

The check for the final digit in the SID was wrong, any domain SID
ending with a zero would fail the test.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
22 months agopthreadpool: Fix deadlock
Volker Lendecke [Tue, 12 Dec 2017 22:07:39 +0000 (23:07 +0100)]
pthreadpool: Fix deadlock

Christof's idea from

https://lists.samba.org/archive/samba-technical/2017-December/124384.html

was that the thread already exited. It could also be that the thread is
not yet idle when the new pthreadpool_add_jobs comes around the corner.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
Autobuild-User(master): Christof Schmitt <cs@samba.org>
Autobuild-Date(master): Wed Dec 13 04:46:12 CET 2017 on sn-devel-144

22 months agopthreadpool: Add some asserts
Volker Lendecke [Tue, 12 Dec 2017 12:58:48 +0000 (13:58 +0100)]
pthreadpool: Add some asserts

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Dec 13 00:44:57 CET 2017 on sn-devel-144

22 months agopthreadpool: Simplify the logic in add_job a bit
Volker Lendecke [Tue, 12 Dec 2017 12:52:56 +0000 (13:52 +0100)]
pthreadpool: Simplify the logic in add_job a bit

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
22 months agosmbd: Enable async I/O by default
Volker Lendecke [Mon, 4 Dec 2017 14:39:10 +0000 (15:39 +0100)]
smbd: Enable async I/O by default

We've had this code in for long enough that we should enable it by default.
Modern clients do overlapping I/O, we should utilize that if possible.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agovfs_aio_fork: Use a shorter random delay
Volker Lendecke [Mon, 11 Dec 2017 16:32:40 +0000 (17:32 +0100)]
vfs_aio_fork: Use a shorter random delay

Otherwise the rw2 test takes ages for no good reason

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agovfs_aio_fork: Fix vfs_aio_pwrite
Volker Lendecke [Fri, 8 Dec 2017 13:07:47 +0000 (14:07 +0100)]
vfs_aio_fork: Fix vfs_aio_pwrite

Make the data to write available to the child

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agovfs_aio_fork: Fix vfs_aio_pread
Volker Lendecke [Fri, 8 Dec 2017 13:07:06 +0000 (14:07 +0100)]
vfs_aio_fork: Fix vfs_aio_pread

Copy the data that the child read into the caller's buffer. This can't
have been used in half a decade at least...

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agovfs_aio_fork: Fix a crash in aio_fork
Volker Lendecke [Thu, 7 Dec 2017 19:53:18 +0000 (20:53 +0100)]
vfs_aio_fork: Fix a crash in aio_fork

Since the introduction of the vfs_aio_fork:erratic_testing_mode this
crashed reliably, as we had two different structs behind
SMB_VFS_HANDLE_SET_DATA. I had always believed that due to the fact that
we have specific aio_fork tests in our autobuild, this would have been
tested. But it was not, because the share definition missed the the "aio
read/write size = 1" to actually use the async code in vfs_aio_fork.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agovfs_aio_fork: Drop "volatile" from the mmap area in aio_fork
Volker Lendecke [Fri, 8 Dec 2017 13:30:46 +0000 (14:30 +0100)]
vfs_aio_fork: Drop "volatile" from the mmap area in aio_fork

We don't do that in tdb either, and the mmap/memcpy prototypes don't
have it either

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agosmbd: Fix async large read
Volker Lendecke [Thu, 7 Dec 2017 17:12:28 +0000 (18:12 +0100)]
smbd: Fix async large read

We also do the 128k reads asynchronously, just not the huge 24MB
ones. smb_setlen does not work well for >64k.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
22 months agotorture: Check messaging_send_all
Volker Lendecke [Mon, 11 Dec 2017 14:58:26 +0000 (15:58 +0100)]
torture: Check messaging_send_all

We must make sure not to receive our own broadcast

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>