ctdb-protocol: Add generalised socket address comparison

Add new function ctdb_sock_addr_cmp(), which returns a 3-way result
useful for qsort(3).  Reimplent ctdb_sock_addr_same() using this.

In the process, make arguments const so that ctdb_sock_addr_cmp() can
be used with qsort().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12470

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Fix "ctdb reloadips" simple test

The name of the addresses file to modify is based on the original
selection of a test node at the top of the test.  Repeating the
selection a test node can result in a mismatch between the new test
node and the addresses file.  This occurs on local daemons, because
the addresses file name has the original node number in it but the
test is being performed on the the newly selected node number.

For some reason this test has only occasionally failed.  An upcoming
commit that stops the output of "ctdb ip" from being reversed causes
this test to fail (nearly?) every time.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12470

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-build: Remove unnecessary intermediate build target

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-tests: Do not remove event script dir before shutting down ctdb

When the test is over, the exit_hook will remove the temporary event
script directory and then CTDB is restarted.  Explicitly shutting down
CTDB ensures that event script directory is not removed while CTDB is
still running.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-tests: Display filtered output when the test fails

This simplifies comparing the output to the expected output.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-daemon: Move function typedef to where it's used

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-scripts: Drop ctdb_check_service_reconfigure

This gets rid of implicit check if a service needs to configured.  As a
side effect, we also get rid of the monitor "replay" which was
introduced to avoid a collision between a script executed via event and
manually.  Event scripts are not expected to be run by hand.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-scripts: Add explicit check for service reconfiguration

This will help get rid of implicit ctdb_service_check_reconfigure.

We still need to keep "reconfigure" event in 13.per_ip_routing, so that
the per ip routing can be refreshed if the configuration has changed.
The correct fix for this is to add caching of configuration and checking
of configuration changes in "ipreallocated" event.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-scripts: Drop some tests for "reconfigure" event and monitor replay

These features are going away.  There is nothing to reconfigure for
NFS anyway.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

testsuite: Add cmocka unit test for smb_krb5_kt_open()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Dec 16 05:43:12 CET 2016 on sn-devel-144

docs: Update doc to use absolute path for 'dedicated keytab file'

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

krb5_wrap: Remove incorrect absolute path checks in smb_krb5_kt_open_relative()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

krb5_wrap: More checks for absolute path in smb_krb5_kt_open()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:crypto: Use smb_krb5_kt_open_relative() for MEMORY keytab

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

selftest: test new "lsa over netlogon" smb.conf option

This proves we can act like Windows and over lsarpc over netlogon if we want

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Dec 15 12:11:09 CET 2016 on sn-devel-144

s4-rpc_server: Add back support for lsa over \\pipe\\netlogon optionally

The idea here is that perhaps some real client relies on this (and not just Samba torture
commands), so we need a way to support it for the 4.6 release.

If no such client emerges, it can be deprecated and removed in the normal way.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

idl: Do not listen for lsarpc on \\pipe\netlogon

This prevents making the netlogon process multi-threaded.

This works on Windows becuase NETLOGON is part of lsad

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

rpc_server:netlogon Move from memcache to a tdb cache

This allows the netlogon server to be moved into a multi-process model
while still supporting clients that use a challenge from a different
network connection.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Dec 14 20:12:14 CET 2016 on sn-devel-144

torture: Add ServerReqChallengeReuseGlobal2 to rpc.netlogon

This test ensures that when the per-pipe challenge is used, the tdb cache
is wiped as well

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Dec 14 15:56:37 CET 2016 on sn-devel-144

torture: Add ServerReqChallengeReuse to rpc.netlogon

This test covers credentials reuse on the same process.

We test with direct re-use, and for the case where the challenge
is reset to zeros.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

torture: Add new test ServerReqChallengeReuseGlobal to rpc.netlogon

This tests ensures we can not re-use the entries in global challenge table.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

torture/samba3rpc: Use NETLOGON_NEG_AUTH2_ADS_FLAGS

This allows this test to pass after "allow nt4 crypto" is removed from
the default environment.

We now only set it in ad_dc

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

torture: Use DCERPC_SCHANNEL_AUTO in rpc.schannel.schannel2 test

This allows it to run against modern servers that do not permit NT4 crypto

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

torture: Add credentials downgrade and challenge reuse test to rpc.netlogon

This test confirms that the challenge set up is available
after the ServerAuthenticate has failed at the NT_STATUS_DOWNGRADE_DETECTED
check.

This is needed for NetApp ONTAP member servers.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11291

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

librpc/ndr/uuid.c: improve speed and accuracy of GUID string parsing

GUID_from_data_blob() was relying on sscanf to parse strings, which was
slow and quite accepting of invalid GUIDs. Instead we directly read a
fixed number of hex bytes for each field.

This now passes the samba4.local.ndr.*.guid_from_string_invalid tests.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Dec 14 08:55:42 CET 2016 on sn-devel-144

s4-torture: better, failing, tests for GUID_from_string

These tests reveal that the current implementation accepts all kinds
of invalid GUIDs. In particular, we fail on these ones:

 "00000001-0002-0003-0405--060708090a0"
 "-0000001-0002-0003-0405-060708090a0b"
 "-0000001-0002-0003-04-5-060708090a0b"
 "d0000001-0002-0003-0405-060708090a-b"
 "00000001-  -2-0003-0405-060708090a0b"
 "00000001-0002-0003-0405- 060708090a0"
 "0x000001-0002-0003-0405-060708090a0b"
 "00000001-0x02-0x03-0405-060708090a0b"

This test is added to selftest/knownfail.

The test for valid string GUIDs is extended to test upper and mixed case
GUIDs.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

cli-quotas: fix potential memory leak

Fix a memory leak in out-of-memory condition

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec 13 22:30:44 CET 2016 on sn-devel-144

s3: libsmb: Ensure SMB2 operations correctly set cli->raw_status.

Needs to be done even on success (cli_is_error() checks if
cli->raw_status was NT_STATUS_OK).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12468

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

pam: strip trailing whitespaces in pam_winbind.c

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Karolin Seeger <ks@sernet.de>
Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Tue Dec 13 18:01:21 CET 2016 on sn-devel-144

pam: map more NT password errors to PAM errors

NT_STATUS_ACCOUNT_DISABLED,
NT_STATUS_PASSWORD_RESTRICTION,
NT_STATUS_PWD_HISTORY_CONFLICT,
NT_STATUS_PWD_TOO_RECENT,
NT_STATUS_PWD_TOO_SHORT

now map to PAM_AUTHTOK_ERR (Authentication token manipulation error), which is
the closest match.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=2210

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed by: Jeremy Allison <jra@samba.org>

talloc: Add tests for talloc destructor behaviour after talloc_realloc()

That this behaved correctly was not clear, so I added tests to prove
it to myself.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Dec 13 06:47:58 CET 2016 on sn-devel-144

selftest: Print the POSIX ACL we got when the posixacl test fails

Knowing we have 11 of 15 ACEs is not very helpful

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

smb.conf: add identity mapping section

Add a generic identity mapping section that points out to the other
resources in Samba documentation about idmap modules and their
configuration.

This should help users to discover corresponding documentation easily.

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andrea Schneider <asn@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec 13 00:14:04 CET 2016 on sn-devel-144

s3:winbind: Do not start with an invalid default idmap backend

Pair-Programmed-With: Michael Adam <obnox@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>

s3-testparm: Print an error if we have overlapping idmap config

Except if both backends are 'ad'.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

s3-testparm: Print error if the default backend is incorrect

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

s3-testparm: Fix trailing whitespaces

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

libsmb: Correctly report error for rename failure

This prevents renaming a file over an existing one with SMB2

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12468

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

tests/dns: Check you cannot add empty CNAME

This exercises the dns_check_name case in the DNS server. Directly
attempting to add an invalid name with leading . or double .. cannot be
done due to ndr_pull_component forcing the check on the client side
(leading to a CNAME name of NUL and unexpected data of the actual name).

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Dec 12 08:46:26 CET 2016 on sn-devel-144

dnsserver_common: Add name check in name2dn

Fills in the missing TODO. Note that this may also prevent deletion of
existing corrupted records, but should be resolvable through RPC, or at
worst LDAP.

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

python/tests: expand samba-tool dns tests

These new tests concern collisions and lock in current Samba behaviour.

They do not pass against Windows Server 2012R2. See dnsserver.py tests
for the tests consistent with Windows behaviour.

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

python/tests: fix typo to use correct var

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

dnsserver: add dns name checking

This may also prevent deletion of existing corrupted records through
DNS, but should be resolvable through RPC, or at worst LDAP.

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

tests/dnsserver: Check security descriptors

These tests discover that there are some discrepancies between Windows and Samba.
Although there are failures, they do not appear to be critical, however
some of the SD differences will be important for 2012 support.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

samba-tool/dns: remove use of dns_record_match from add and delete

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

samba-tool/dns: reword error messages and make error catching specific

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

python/tests: expand tests for dns server over rpc

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

python/tests: add tests for samba-tool dns

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

python/netcmd: print traceback through self.errf

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

lib: Remove xfile

The days of operating systems with a 255 file
descriptor limit on FILE (I'm looking at you
Solaris - Solaris 10 finally fixed this) are
long gone.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Sun Dec 11 15:01:12 CET 2016 on sn-devel-144

nmbd: xfile->stdio

Unfortunately this is a larger patch. Doing it in small pieces would
have been pretty difficult, as everybody calls everybody else.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: smbreadline xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

libnbt: lmhosts xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

printing: Convert aix_cache_reload to stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

printing: std_pcap_cache_reload xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

rpc_server: svcctl xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: expand_msdfs xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ntlm_auth3: xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

torture: upload_printer_driver_file xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: username map file handling xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: Add fgets_slash

Copy x_fgets_slash with conversion to stdio and talloc.

Probably I'd do this functionality a bit differently, but for simplicity I
chose to make it the same as what is there.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: popt_common xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

idmap_hash: xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbclient: xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbclient4: xfile->stdio

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3: ntlm_auth: Don't corrupt the output stream with debug messages.

Calling programs expect to cleanly read from STDOUT.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12467

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3: torture: Adds regression test case for se_access_check() owner rights issue.

This test passes against Win2K12 but fails against smbd
without the previous commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12466

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Dec 10 10:11:10 CET 2016 on sn-devel-144

lib: security: se_access_check() incorrectly processes owner rights (S-1-3-4) DENY ace entries

Reported and proposed fix by Shilpa K <shilpa.krishnareddy@gmail.com>.

When processing DENY ACE entries for owner rights SIDs (S-1-3-4) the
code OR's in the deny access mask bits without taking into account if
they were being requested in the requested access mask.

E.g. The current logic has:

An ACL containining:

[0] SID: S-1-3-4
    TYPE: DENY
    MASK: WRITE_DATA
[1] SID: S-1-3-4
    TYPE: ALLOW
    MASK: ALLOW_ALL

prohibits an open request by the owner for READ_DATA - even though this
is explicitly allowed.

Furthermore a non-canonical ACL containing:

[0] SID: User SID 1-5-21-something
    TYPE: ALLOW
    MASK: READ_DATA

[1] SID: S-1-3-4
    TYPE: DENY
    MASK: READ_DATA

[2] SID: User SID 1-5-21-something
    TYPE: ALLOW
    MASK: WRITE_DATA

prohibits an open request by the owner for READ_DATA|WRITE_DATA - even
though READ_DATA is explicitly allowed in ACE no 0 and is thus already
filtered out of the "access-still-needed" mask when the deny ACE no 1 is
evaluated.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12466

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

util: use SCOPE_DELIMITER for the IPv6 scope delimiter

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Fri Dec  9 20:45:15 CET 2016 on sn-devel-144

replace: make sure we have a SCOPE_DELIMITER define

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

ad/provision: change samba.org to https://samba.org

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Karolin Seeger <kseeger@samba.org>
Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Fri Dec  9 16:57:31 CET 2016 on sn-devel-144

man pages: change samba.org to https://samba.org

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Karolin Seeger <kseeger@samba.org>

docs-xml: change samba.org to https://samba.org

Signed-off-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Karolin Seeger <kseeger@samba.org>

s3:libsmb: don't pass 'passlen' to cli_tree_connect[_send]() and allow pass=NULL

There're no callers which try to pass a raw lm_response directly anymore.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Dec  9 13:09:37 CET 2016 on sn-devel-144

s3:libsmb: avoid using cli->{use_kerberos,...} in remote_password_change()

As we pass flags=0 to cli_connect_nb() all values can only be false,
so we can use false directly.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:client: avoid using cli->{use_kerberos,...} for cli_session_creds_init() in smbspool.c

CLI_FULL_CONNECTION_USE_KERBEROS is the only possible flag the
caller of smb_complete_connection() will pass, so we can avoid
use it directly instead of going via cli_start_connection()
to use cli->use_kerberos.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:client: make use of cli_tree_connect_creds() in smbspool.c

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:libsmb: add cli_tree_connect_creds()

This can be used with a valid creds structure in order
to do a share level authentication or with NULL in the cases
we assume a modern server already.

Later we can change the ordering and implement
cli_tree_connect() on top of cli_tree_connect_creds().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:libsmb: fix 'client lanman auth = no' DEBUG message in cli_session_setup_creds_send()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:libsmb: fix memory leak in cli_raw_ntlm_smb_encryption_start()

smb_trans_enc_state is a talloc pointer now, so we can talloc_move()
the gensec_security to the correct talloc parent.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12408

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:torture: make use of cli_full_connection_creds() in torture.c

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

auth/credentials: clear all unused blobs in cli_credentials_get_ntlm_response()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

auth/credentials: fix cut'n'paste error in cli_credentials_get_principal_and_obtained()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

auth/credentials: let cli_credentials_parse_string() handle the "winbind separator"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

ctdb: add test script for ctdb_mutex_ceph_rados_helper

This standalone test script performs the following:
- using ctdb_mutex_ceph_rados_helper, take a lock on the Ceph RADOS
  object a CLUSTER/$POOL/$OBJECT using the Ceph keyring for $USER
  + confirm that lock is obtained, via ctdb_mutex_ceph_rados_helper "0"
    output
- check RADOS object lock state, using the "rados lock info" command
- attempt to obtain the lock again, using ctdb_mutex_ceph_rados_helper
  + confirm that the lock is not successfully taken
- tell the first locker to drop the lock and exit, via SIGTERM
- once the first locker has exited, attempt to get the lock again
  + confirm that this attempt succeeds

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Fri Dec  9 07:59:33 CET 2016 on sn-devel-144

ctdb/doc: man page for Ceph RADOS cluster mutex helper

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb: cluster mutex helper using Ceph RADOS

ctdb_mutex_ceph_rados_helper implements the cluster mutex helper API
atop Ceph using the librados rados_lock_exclusive()/rados_unlock()
functionality.

Once configured, split brain avoidance during CTDB recovery will be
handled using locks against an object located in a Ceph RADOS pool.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-build: configure time switch for etcd support

Disable generation/installation of the etcd cluster mutex helper by
default. Support can be explicitly enabled at configure time with
--enable-etcd-reclock.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-build: move ctdb_etcd_lock to utils/etcd

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-build: Generate pre-built documentation in wscript itself

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: David Disseldorp <ddiss@samba.org>

ctdb-build: Avoid duplicate list of man pages

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: David Disseldorp <ddiss@samba.org>

lib/util: Fix indentation within routine description for dbghdrclass

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Dec  9 02:02:36 CET 2016 on sn-devel-144

lib/util: Fix input arguments description for dbghdrclass() routine

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>

tevent: remove shebang from tevent.py

The tevent.py is not a executable python script.
And rpmlint consider it as an error if module file
contians shebang

    python2-tevent.x86_64: E: non-executable-script
        /usr/lib64/python2.7/site-packages/tevent.py 644 /usr/bin/python
    python3-tevent.x86_64: E: non-executable-script
        /usr/lib64/python3.5/site-packages/tevent.py 644 /usr/bin/python

Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

s4:repl_meta_data: normalize rdn attribute name via the schema

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12399

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Dec  8 17:16:47 CET 2016 on sn-devel-144

pidl: Make dcesrv\_$name\_interface "static const"

This moves it out of the global namespace

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Dec  8 13:25:57 CET 2016 on sn-devel-144

s4-rpc_server: Avoid extern reference to dcesrv_mgmt_interface and memcpy()

Use a typesafe struct-returning function instead

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s3: torture: Regression test case for permissions check on rename.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12460

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Dec  7 11:52:03 CET 2016 on sn-devel-144

s3: smbd: Add missing permissions check on destination folder.

Based on code from Michael Zeis <mzeis.quantum@gmail.com>.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12460

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3: smbd: Make check_parent_access() available to rename code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12460

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>