sharpe/samba-autobuild/.git
2 years agoctdb-tests: Drop use of CTDB context from takeover test
Martin Schwenke [Mon, 23 May 2016 10:43:46 +0000 (20:43 +1000)]
ctdb-tests: Drop use of CTDB context from takeover test

The ipalloc code doesn't need a CTDB context so neither should the
code that tests it.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: IP allocation state is now an opaque structure
Martin Schwenke [Wed, 22 Jun 2016 04:23:38 +0000 (14:23 +1000)]
ctdb-ipalloc: IP allocation state is now an opaque structure

It is private to the IP allocation module.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: ipalloc() returns public IP list
Martin Schwenke [Wed, 22 Jun 2016 04:22:02 +0000 (14:22 +1000)]
ctdb-ipalloc: ipalloc() returns public IP list

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Move set_ipflags_internal() to ipalloc
Martin Schwenke [Wed, 22 Jun 2016 03:18:04 +0000 (13:18 +1000)]
ctdb-ipalloc: Move set_ipflags_internal() to ipalloc

Rename it ipalloc_set_node_flags().

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Switch set_ipflags_internal() to use a new-style node map
Martin Schwenke [Wed, 22 Jun 2016 01:37:52 +0000 (11:37 +1000)]
ctdb-ipalloc: Switch set_ipflags_internal() to use a new-style node map

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Move ipalloc state initialisation to ipalloc.c
Martin Schwenke [Mon, 23 May 2016 04:28:33 +0000 (14:28 +1000)]
ctdb-ipalloc: Move ipalloc state initialisation to ipalloc.c

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Pass extra data to IP allocation state initialisation
Martin Schwenke [Mon, 23 May 2016 04:16:47 +0000 (14:16 +1000)]
ctdb-ipalloc: Pass extra data to IP allocation state initialisation

No longer require CTDB context but pass in number of nodes, algorithm,
no_ip_failback and force_rebalance_nodes.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Make no_ip_failback a boolean
Martin Schwenke [Tue, 21 Jun 2016 06:34:44 +0000 (16:34 +1000)]
ctdb-ipalloc: Make no_ip_failback a boolean

No need to expose tunable values that far down.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Fix buggy short-circuit when no IPs are available
Martin Schwenke [Wed, 29 Jun 2016 06:36:28 +0000 (16:36 +1000)]
ctdb-ipalloc: Fix buggy short-circuit when no IPs are available

At the moment IP is short-circuited when there are no available IP
addresses.  However, if some IP addresses are already allocated then
"no available IP addresses" means that all the addresses should
(probably) be released.  The current short-circuit means that no
already hosted IP addresses will be released.

The short-circuit exists to avoid lots of messages saying that all IP
addresses can not be assigned at startup time.  So, add a check to
ipalloc_can_host_ips() so that it succeeds if IP addresses are already
allocated to nodes.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: New function ipalloc_can_host_ips()
Martin Schwenke [Tue, 21 Jun 2016 11:16:27 +0000 (21:16 +1000)]
ctdb-ipalloc: New function ipalloc_can_host_ips()

Abstracts out code involving internals of IP allocation state.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Drop known public IPs from IP allocation state
Martin Schwenke [Tue, 21 Jun 2016 11:09:39 +0000 (21:09 +1000)]
ctdb-ipalloc: Drop known public IPs from IP allocation state

This is never used in the allocation algorithms.  It is only used when
building the merged IP list.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Move create_merged_ip_list() into ipalloc
Martin Schwenke [Mon, 23 May 2016 10:23:18 +0000 (20:23 +1000)]
ctdb-ipalloc: Move create_merged_ip_list() into ipalloc

How the existing IP layout is constructed and how the merged IP list is
sorted are important aspects of the IP allocation algorithm.  Construct the
merged IP list when known and available IPs are assigned.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: New function ipalloc_set_public_ips()
Martin Schwenke [Mon, 23 May 2016 10:23:18 +0000 (20:23 +1000)]
ctdb-ipalloc: New function ipalloc_set_public_ips()

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Remove function ctdb_reload_remote_public_ips()
Martin Schwenke [Tue, 21 Jun 2016 10:46:50 +0000 (20:46 +1000)]
ctdb-ipalloc: Remove function ctdb_reload_remote_public_ips()

Use ctdb_fetch_remote_public_ips() inline to fetch each list.  Assign
them into the IP allocation state separately.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Clean up reloading of remote public IPs
Martin Schwenke [Mon, 20 Jun 2016 11:27:40 +0000 (21:27 +1000)]
ctdb-ipalloc: Clean up reloading of remote public IPs

Factor out new function ctdb_fetch_remote_public_ips() to fetch known
or available public IP addresses, according to flags.

This also drops the hack where the array from a
ctdb_public_ip_list_old was assigned to a pointer in a
ctdb_public_ip_list.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Don't build a global IP tree
Martin Schwenke [Mon, 20 Jun 2016 10:53:58 +0000 (20:53 +1000)]
ctdb-ipalloc: Don't build a global IP tree

It isn't used outside this function, so just use a local variable.

This makes create_merged_ip_list() independent of the CTDB context.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Drop code to update IP assignment tree
Martin Schwenke [Mon, 20 Jun 2016 10:47:17 +0000 (20:47 +1000)]
ctdb-ipalloc: Drop code to update IP assignment tree

This code is not used.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tools: Don't bother sending CTDB_SRVID_RECD_UPDATE_IP
Martin Schwenke [Mon, 20 Jun 2016 20:25:17 +0000 (06:25 +1000)]
ctdb-tools: Don't bother sending CTDB_SRVID_RECD_UPDATE_IP

Nothing is listening.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-recoverd: Drop code to change the IP assignment tree
Martin Schwenke [Mon, 20 Jun 2016 10:45:28 +0000 (20:45 +1000)]
ctdb-recoverd: Drop code to change the IP assignment tree

The tree is no longer used in verification.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Drop remote IP verification
Martin Schwenke [Mon, 20 Jun 2016 10:41:05 +0000 (20:41 +1000)]
ctdb-ipalloc: Drop remote IP verification

It is only run during a takeover run and only logs errors.  It doesn't
actually do anything to fix potential errors.  The takeover run should
fix any inconsistencies anyway.

Instead, leave a comment in the recovery daemon's monitoring loop to
add proper remote IP verification later.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Drop a use of CTDB_NO_MEMORY_NULL()
Martin Schwenke [Mon, 23 May 2016 06:44:05 +0000 (16:44 +1000)]
ctdb-ipalloc: Drop a use of CTDB_NO_MEMORY_NULL()

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Do not use node count or PNNs from CTDB context
Martin Schwenke [Mon, 23 May 2016 04:50:14 +0000 (14:50 +1000)]
ctdb-ipalloc: Do not use node count or PNNs from CTDB context

This is unnecessary.  IP allocation state already has a node count and
"i" is already a PNN.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Drop an unnecessary check
Martin Schwenke [Mon, 23 May 2016 04:46:18 +0000 (14:46 +1000)]
ctdb-ipalloc: Drop an unnecessary check

Deleted (and other inactive) nodes will have an empty list of known
IP addresses.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-ipalloc: Move if-statement with broken condition
Martin Schwenke [Mon, 23 May 2016 04:41:43 +0000 (14:41 +1000)]
ctdb-ipalloc: Move if-statement with broken condition

This pointer is for an array that is always allocated.  The check is
meant to skip a node that has no IP addresses.  However, when there
are no IP addresses the loop below will not do anything anyway.

Add this as a check at the beginning of the function instead.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: Drop CTDB_TEST_MAX_NODES
Martin Schwenke [Wed, 22 Jun 2016 01:02:36 +0000 (11:02 +1000)]
ctdb-tests: Drop CTDB_TEST_MAX_NODES

The node map is dynamically constructed.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: Build a node map instead of a hacky node flags array
Martin Schwenke [Wed, 22 Jun 2016 01:00:43 +0000 (11:00 +1000)]
ctdb-tests: Build a node map instead of a hacky node flags array

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: Assign known and available arrays via pointers.
Martin Schwenke [Tue, 21 Jun 2016 05:26:05 +0000 (15:26 +1000)]
ctdb-tests: Assign known and available arrays via pointers.

No need to allocate these and iterate as
read_ctdb_public_ip_info_node() now returns a usable array.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: read_ctdb_public_ip_info() reads all test input
Martin Schwenke [Tue, 21 Jun 2016 05:14:33 +0000 (15:14 +1000)]
ctdb-tests: read_ctdb_public_ip_info() reads all test input

If there is per-node data then each chunk is read in a separate call
and is cherry-picked out into known_public_ips[] for each node.  This
is confusing.

Instead, a single call now reads all data for multiple nodes and
returns complete arrays of known and available IP addresses.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: Drop CTDB_TEST_MAX_IPS
Martin Schwenke [Tue, 21 Jun 2016 04:49:28 +0000 (14:49 +1000)]
ctdb-tests: Drop CTDB_TEST_MAX_IPS

Arrays are now dynamically reallocated.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: Drop all_ips argument from read_ctdb_public_ip_info()
Martin Schwenke [Tue, 21 Jun 2016 04:37:53 +0000 (14:37 +1000)]
ctdb-tests: Drop all_ips argument from read_ctdb_public_ip_info()

Nothing uses the result.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: Don't bother setting all_ips
Martin Schwenke [Tue, 21 Jun 2016 04:29:25 +0000 (14:29 +1000)]
ctdb-tests: Don't bother setting all_ips

It isn't used outside this function.  Instead, update k directly.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: Simplify read_ctdb_public_ip_info() using new function add_ip()
Martin Schwenke [Tue, 21 Jun 2016 02:27:55 +0000 (12:27 +1000)]
ctdb-tests: Simplify read_ctdb_public_ip_info() using new function add_ip()

Known public IPs array is now dynamically allocated instead of
allocated once with artificial size limit.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agoctdb-tests: Remove unused tests from IP takeover test harness
Martin Schwenke [Sat, 21 May 2016 15:51:44 +0000 (01:51 +1000)]
ctdb-tests: Remove unused tests from IP takeover test harness

These tests aren't run anywhere.  They were used to test internal
functions during development.

The aim is to simplify this test program so that it can be linked with
the ipalloc subsystem, allowing removal of ctdbd_test.c and all of its
complications.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2 years agotdb: avoid many fcntl calls when incrementing seqnum
Bob Campbell [Wed, 29 Jun 2016 21:51:23 +0000 (09:51 +1200)]
tdb: avoid many fcntl calls when incrementing seqnum

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sun Jul  3 18:11:30 CEST 2016 on sn-devel-144

2 years agolib: talloc: Add check for destructor protection.
Andrew Bartlett [Wed, 29 Jun 2016 23:51:26 +0000 (16:51 -0700)]
lib: talloc: Add check for destructor protection.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: As we have a struct talloc_chunk * in _talloc_free_children_internal...
Andrew Bartlett [Wed, 29 Jun 2016 23:48:42 +0000 (16:48 -0700)]
lib: talloc: As we have a struct talloc_chunk * in _talloc_free_children_internal(), use it to call _tc_free_internal() directly.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: As _tc_free_internal() takes a struct talloc_chunk *, add an extra paran...
Andrew Bartlett [Wed, 29 Jun 2016 23:44:50 +0000 (16:44 -0700)]
lib: talloc: As _tc_free_internal() takes a struct talloc_chunk *, add an extra paranoia check against destructor overwrite.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: Rename the internals of _talloc_free_internal() to _tc_free_internal().
Andrew Bartlett [Wed, 29 Jun 2016 23:41:52 +0000 (16:41 -0700)]
lib: talloc: Rename the internals of _talloc_free_internal() to _tc_free_internal().

Make it use a struct talloc_chunk *tc parameter. Define _talloc_free_internal()
in terms of _tc_free_internal().

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: Call talloc_chunk_from_ptr() less often in __talloc_with_prefix()
Andrew Bartlett [Wed, 29 Jun 2016 22:46:37 +0000 (15:46 -0700)]
lib: talloc: Call talloc_chunk_from_ptr() less often in __talloc_with_prefix()

Rename 'ptc' pointer to parent as it's re-used as
that name later in the function.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: Rename talloc_set_name_v() to tc_set_name_v(). Make it take a struct...
Andrew Bartlett [Fri, 24 Jun 2016 00:17:20 +0000 (17:17 -0700)]
lib: talloc: Rename talloc_set_name_v() to tc_set_name_v(). Make it take a struct talloc_chunk *tc as the first argument.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: Add _vasprintf_tc() which returns the struct talloc_chunk *, not the...
Andrew Bartlett [Sat, 18 Jun 2016 03:49:24 +0000 (20:49 -0700)]
lib: talloc: Add _vasprintf_tc() which returns the struct talloc_chunk *, not the talloc'ed pointer.

Define talloc_vasprintf() in terms of _vasprintf_tc().
We will use _vasprintf_tc() internally later.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: Change _talloc_set_name_const() to _tc_set_name_const()
Andrew Bartlett [Sat, 18 Jun 2016 03:40:56 +0000 (20:40 -0700)]
lib: talloc: Change _talloc_set_name_const() to _tc_set_name_const()

First argument is now struct talloc_chunk *tc.
Ensure all callers pass correct talloc chunk from given pointer.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: Change __talloc() to return a struct talloc_chunk *.
Andrew Bartlett [Sat, 18 Jun 2016 00:06:52 +0000 (17:06 -0700)]
lib: talloc: Change __talloc() to return a struct talloc_chunk *.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: Change __talloc_with_prefix() to return a struct talloc_chunk *.
Andrew Bartlett [Fri, 17 Jun 2016 23:58:34 +0000 (16:58 -0700)]
lib: talloc: Change __talloc_with_prefix() to return a struct talloc_chunk *.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agolib: talloc: Rename talloc_XXX() internal functions that take a 'struct talloc_chunk...
Jeremy Allison [Wed, 29 Jun 2016 23:25:30 +0000 (16:25 -0700)]
lib: talloc: Rename talloc_XXX() internal functions that take a 'struct talloc_chunk *' to tc_XXX().

We will be adding more and it ensures a consistent naming scheme.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotestprogs/blackbox: Improve the net ads dns register tests.
Richard Sharpe [Fri, 1 Jul 2016 04:07:19 +0000 (21:07 -0700)]
testprogs/blackbox: Improve the net ads dns register tests.

More tests are added that add an unprivileged user, enable their
account, and then test that they can add IP addressed but that they
cannot modify other user's IP addresses.

Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Richard Sharpe <sharpe@samba.org>
Autobuild-Date(master): Sun Jul  3 14:24:59 CEST 2016 on sn-devel-144

2 years agoselftest: Add test for domain join + kerberos-only auth
Uri Simchoni [Thu, 30 Jun 2016 08:55:20 +0000 (11:55 +0300)]
selftest: Add test for domain join + kerberos-only auth

Add "net ads join/leave -k" tests to the net_ads test suite.

Shift the test suite from ad_member env to ad_dc env, because:
1. Seems more appropriate (the member server plays no role in this
   test)
2. The -k test breaks against the ntvfs file server for some reason,
   when trying to open the netlogon named pipe after having established
   the session with Kerberos (the create fails).

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jul  1 15:36:37 CEST 2016 on sn-devel-144

2 years agos3/winbindd: use == -1 instead of < 0 for error checking uid_t
Aurelien Aptel [Wed, 9 Mar 2016 12:43:09 +0000 (13:43 +0100)]
s3/winbindd: use == -1 instead of < 0 for error checking uid_t

The sign of the uid_t type is left unspecified by POSIX. It's defined as
an unsigned 32b int on Linux, therefore the < 0 check is always
false.

For unsigned version of uid_t, "uid == -1" will implicitely cast -1 to
unsigned making it a valid test for both signed and unsigned version of
uid_t.

This commit makes the cast to (uid_t) explicit anyway.

Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Jul  1 05:22:36 CEST 2016 on sn-devel-144

2 years agolibrpc: add decode_netlogon_samlogon_response_packet for mailslot debugging.
Günther Deschner [Tue, 28 Jun 2016 16:40:25 +0000 (18:40 +0200)]
librpc: add decode_netlogon_samlogon_response_packet for mailslot debugging.

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jul  1 01:29:42 CEST 2016 on sn-devel-144

2 years agokrb5pac.idl: introduce PAC_DOMAIN_GROUP_MEMBERSHIP to handle the resource groups
Stefan Metzmacher [Fri, 20 May 2016 12:16:35 +0000 (14:16 +0200)]
krb5pac.idl: introduce PAC_DOMAIN_GROUP_MEMBERSHIP to handle the resource groups

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 30 07:16:45 CEST 2016 on sn-devel-144

2 years agonetlogon.idl: make netr_SidAttr public
Stefan Metzmacher [Fri, 20 May 2016 12:18:35 +0000 (14:18 +0200)]
netlogon.idl: make netr_SidAttr public

It will be used in krb5pac.idl soon.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: make auth_convert_user_info_dc_sambaseinfo() a private helper
Stefan Metzmacher [Thu, 7 Jan 2016 15:06:25 +0000 (16:06 +0100)]
auth/auth_sam_reply: make auth_convert_user_info_dc_sambaseinfo() a private helper

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server/netlogon: make use of auth_convert_user_info_dc_saminfo{2,6}()
Stefan Metzmacher [Thu, 7 Jan 2016 14:59:49 +0000 (15:59 +0100)]
s4:rpc_server/netlogon: make use of auth_convert_user_info_dc_saminfo{2,6}()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server/netlogon: initialize pointer to NULL in dcesrv_netr_LogonSamLogon_base()
Stefan Metzmacher [Thu, 7 Jan 2016 14:59:03 +0000 (15:59 +0100)]
s4:rpc_server/netlogon: initialize pointer to NULL in dcesrv_netr_LogonSamLogon_base()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: do a real copy of strings in auth_convert_user_info_dc_sambaseinfo()
Stefan Metzmacher [Thu, 7 Jan 2016 14:46:10 +0000 (15:46 +0100)]
auth/auth_sam_reply: do a real copy of strings in auth_convert_user_info_dc_sambaseinfo()

That's much more expected by callers.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: add auth_convert_user_info_dc_saminfo2() helper function
Stefan Metzmacher [Thu, 7 Jan 2016 14:23:56 +0000 (15:23 +0100)]
auth/auth_sam_reply: add auth_convert_user_info_dc_saminfo2() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: add auth_convert_user_info_dc_saminfo6() and implement level...
Stefan Metzmacher [Thu, 7 Jan 2016 14:15:14 +0000 (15:15 +0100)]
auth/auth_sam_reply: add auth_convert_user_info_dc_saminfo6() and implement level 3 as wrapper

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/wbc_auth_util: change wbcAuthUserInfo_to_netr_SamInfo* from level 3 to 6
Stefan Metzmacher [Thu, 7 Jan 2016 14:10:26 +0000 (15:10 +0100)]
auth/wbc_auth_util: change wbcAuthUserInfo_to_netr_SamInfo* from level 3 to 6

This includes user_principal_name and dns_domain_name.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/wbc_auth_util: fill in base.logon_domain in wbcAuthUserInfo_to_netr_SamInfo3()
Stefan Metzmacher [Thu, 7 Jan 2016 14:13:09 +0000 (15:13 +0100)]
auth/wbc_auth_util: fill in base.logon_domain in wbcAuthUserInfo_to_netr_SamInfo3()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: let make_user_info_dc_netlogon_validation() correctly handle...
Stefan Metzmacher [Thu, 7 Jan 2016 14:06:46 +0000 (15:06 +0100)]
auth/auth_sam_reply: let make_user_info_dc_netlogon_validation() correctly handle level 6

We need to take care of extra sids in level 3 and 6!
And level 6 also includes user_principal_name and dns_domain_name.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/kerberos: improve error message in kerberos_pac_to_user_info_dc()
Stefan Metzmacher [Thu, 7 Jan 2016 14:01:16 +0000 (15:01 +0100)]
s4:auth/kerberos: improve error message in kerberos_pac_to_user_info_dc()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth: fill user_principal_* and dns_domain_name in authsam_make_user_info_dc()
Stefan Metzmacher [Thu, 7 Jan 2016 13:55:07 +0000 (14:55 +0100)]
s4:auth: fill user_principal_* and dns_domain_name in authsam_make_user_info_dc()

This is required in order to support netr_SamInfo6 and PAC_UPN_DNS_INFO
correctly.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth: make use of lpcfg_sam_name() in authsam_get_user_info_dc_principal()
Stefan Metzmacher [Thu, 7 Jan 2016 13:52:25 +0000 (14:52 +0100)]
s4:auth: make use of lpcfg_sam_name() in authsam_get_user_info_dc_principal()

This is more generic and matches all other places.

As this is only used in the KDC it's not a real logic change.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth.idl: add user_principal_* and dns_domain_name to auth_user_info
Stefan Metzmacher [Thu, 7 Jan 2016 13:46:24 +0000 (14:46 +0100)]
auth.idl: add user_principal_* and dns_domain_name to auth_user_info

This is required in order to support netr_SamInfo6 and PAC_UPN_DNS_INFO
correctly.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agolib/param: add lpcfg_sam_dnsname() helper function
Stefan Metzmacher [Thu, 7 Jan 2016 13:40:02 +0000 (14:40 +0100)]
lib/param: add lpcfg_sam_dnsname() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py verify the logonCount values
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py verify the logonCount values

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py validate the lastLogon and lastLogonTimestamp...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py validate the lastLogon and lastLogonTimestamp interaction

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py test with all combinations of krb5, ntlmssp...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py test with all combinations of krb5, ntlmssp and lockOutObservationWindow

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py verify more fields in _readd_user()
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py verify more fields in _readd_user()

The results differ depending on Kerberos or NTLMSSP usage
and the lockOutObservationWindow.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py copy user{name,pass} from the template in...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py copy user{name,pass} from the template in insta_creds()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use creds and other_ldb as function arguments
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use creds and other_ldb as function arguments

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use userpass variables in all functions
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use userpass variables in all functions

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use other_ldb variables instead of self.ldb3
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use other_ldb variables instead of self.ldb3

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use userdn variables in all functions
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use userdn variables in all functions

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py make use of self.addCleanup() to cleanup objects
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py make use of self.addCleanup() to cleanup objects

This is easier than doing it by hand...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use _readd_user() for testuser3 too
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use _readd_user() for testuser3 too

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py pass creds as argument to _readd_user()
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py pass creds as argument to _readd_user()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use user{name,pass,dn} variables in _readd_user()
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use user{name,pass,dn} variables in _readd_user()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py pass username,userpass optionally to insta_creds()
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py pass username,userpass optionally to insta_creds()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py let _readd_user() return the ldb connection...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py let _readd_user() return the ldb connection as user

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py make use of the _readd_user() helper function
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py make use of the _readd_user() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py add a _readd_user() helper function
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py add a _readd_user() helper function

This is a complete copy of the code that's currently inline.
I'm doing this in multiple steps in order to keep the diff
in a reviewable state.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py make the LDAP error string checks more useful
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py make the LDAP error string checks more useful

We should first check if the error number is as expected and
then check for a specific WERROR in the error string.

We also add the full error string as msg to assertTrue(),
so we'll actually see it if the assertion is wrong.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py cross-check the lastLogon value with samr
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py cross-check the lastLogon value with samr

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py reduce the values for lockoutDuration and...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py reduce the values for lockoutDuration and lockOutObservationWindow

This reduces the runtime of the test while still producing reliable results.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/sam: update the logonCount for interactive logons
Stefan Metzmacher [Wed, 3 Feb 2016 18:33:51 +0000 (19:33 +0100)]
s4:auth/sam: update the logonCount for interactive logons

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/sam: don't update lastLogon just because it's 0 currently
Stefan Metzmacher [Wed, 3 Feb 2016 18:33:51 +0000 (19:33 +0100)]
s4:auth/sam: don't update lastLogon just because it's 0 currently

Non interactive logons doesn't trigger an update
unless the (effective) badPwdCount is not 0 and lockoutTime is 0.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/sam: only reset badPwdCount when the effetive value is not 0 already
Stefan Metzmacher [Wed, 3 Feb 2016 18:33:51 +0000 (19:33 +0100)]
s4:auth/sam: only reset badPwdCount when the effetive value is not 0 already

Non interactive logons doesn't reset badPwdCount to 0
when the effective badPwdCount is already 0
(with (badPasswordTime + lockOutObservationWindows) < now).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb: add some const to {samdb_result,dsdb}_effective_badPwdCount()
Stefan Metzmacher [Fri, 29 Apr 2016 11:20:12 +0000 (13:20 +0200)]
s4:dsdb: add some const to {samdb_result,dsdb}_effective_badPwdCount()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotest_pkinit_heimdal.sh: add a FILE: prefix to the KRB5CCNAME variable
Stefan Metzmacher [Fri, 3 Jun 2016 16:19:40 +0000 (18:19 +0200)]
test_pkinit_heimdal.sh: add a FILE: prefix to the KRB5CCNAME variable

This makes the tests more robust.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotest_pkinit_heimdal.sh: add a helper VARIABLE to store the certificate paths
Stefan Metzmacher [Thu, 2 Jun 2016 17:23:27 +0000 (19:23 +0200)]
test_pkinit_heimdal.sh: add a helper VARIABLE to store the certificate paths

We also don't need the separation of admincert.pem and admincertupn.pem
anymore.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool: add 'samba-tool user setpassword --smartcard-required/--clear-smartcard...
Stefan Metzmacher [Thu, 2 Jun 2016 13:15:15 +0000 (15:15 +0200)]
samba-tool: add 'samba-tool user setpassword --smartcard-required/--clear-smartcard-required'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool: do a password retype validation check for 'samba-tool user setpassword'
Stefan Metzmacher [Thu, 2 Jun 2016 12:25:12 +0000 (14:25 +0200)]
samba-tool: do a password retype validation check for 'samba-tool user setpassword'

This matches the behavior of 'samba-tool user create' and 'samba-tool user password'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool: add --smartcard-required option to 'samba-tool user create'
Stefan Metzmacher [Thu, 2 Jun 2016 12:19:37 +0000 (14:19 +0200)]
samba-tool: add --smartcard-required option to 'samba-tool user create'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamdb.py: add smartcard_required option to newuser()
Stefan Metzmacher [Thu, 2 Jun 2016 12:17:17 +0000 (14:17 +0200)]
samdb.py: add smartcard_required option to newuser()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: don't allow interactive password logons with UF_SMARTCARD_REQUIRED
Stefan Metzmacher [Thu, 2 Jun 2016 15:47:12 +0000 (17:47 +0200)]
s4:kdc: don't allow interactive password logons with UF_SMARTCARD_REQUIRED

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth_sam: don't allow interactive logons with UF_SMARTCARD_REQUIRED
Stefan Metzmacher [Thu, 2 Jun 2016 12:14:06 +0000 (14:14 +0200)]
s4:auth_sam: don't allow interactive logons with UF_SMARTCARD_REQUIRED

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3:winbindd: pass 'interactive' down through winbindd_dual_auth_passdb()
Stefan Metzmacher [Thu, 2 Jun 2016 16:13:40 +0000 (18:13 +0200)]
s3:winbindd: pass 'interactive' down through winbindd_dual_auth_passdb()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/common: remove unused samdb_result_force_password_change()
Stefan Metzmacher [Fri, 3 Jun 2016 22:53:45 +0000 (00:53 +0200)]
s4:dsdb/common: remove unused samdb_result_force_password_change()

The logic is incomplete and the correct logic is already available
via the constructed "msDS-UserPasswordExpiryTimeComputed" attribute.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: use "msDS-UserPasswordExpiryTimeComputed" instead of samdb_result_force_passw...
Stefan Metzmacher [Fri, 3 Jun 2016 22:48:56 +0000 (00:48 +0200)]
s4:kdc: use "msDS-UserPasswordExpiryTimeComputed" instead of samdb_result_force_password_change()

The logic in samdb_result_force_password_change() is incomplete
and the correct logic is already available via the constructed
"msDS-UserPasswordExpiryTimeComputed" attribute.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>