ctdb-tests: New NFS test with all services up and 10 iterations

A useful baseline test to ensure that certain things (e.g. rpcinfo)
aren't consistently broken.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Allow 2nd argument of nfs_iterate_test() to be null

This means that required result will not be calculated on each
iteration.  This is useful in baseline tests where, say, all
iterations should succeed and produce no output.  This is useful for
confirming that the eventscript and test infrastructure is working
correctly.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Automate expected NFS test results instead of hard-coding

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Update NFS tests to use nfs_iterate_test()

... instead of iterate_test()

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: New function nfs_iterate_test()

Much clearer than using iterate_test() for this purpose.  This also
does failover counting by calling rpcinfo in each iteration.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: rpc_set_service_failure_response() should take RPC service name

... not a process name

Update the tests that matter.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Don't flag failure when there are no rpcinfo check failures

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Default fail count for rpc_set_service_failure_response() is 1

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Factor out stack dumping and background marking code

This makes the code that uses it easier to modify.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-daemon: Allow a new monitor event to cancel one already in progress

Before commit cbffbb7c2f406fc1d8ebad3c531cc2757232690e this was
possible and some users depend on this behaviour.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-daemon: Improve error messages when eventscript control is cancelled

Warn specifically about cancellation instead of printing a generic
error message.  Also pass back an error message for the tool - it
could just rely on the status but it already looks at the error
message.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tools: Avoiding printing "(null)" on "ctdb eventscript" error

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-daemon: Avoid double-free during monitor cancellation

The eventscript state should never be freed externally, so it should
never be allocated off a temporary context.  It will either be freed
by the handler or in the cancellation code.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Pair-programmed-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-tests: Add some 10.interfaces VLAN tests

One without a bond, one with a bond.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Add VLAN support to the "ip link" stub

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Interface number in "ip link show" stub defaults to 42

It needs to have a default for the standalone case, when it is not run
in a loop inside "ip addr show".

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Support monitoring of interestingly named VLANs on bonds

VLAN interfaces on bonds with a name other than <iface>.<id>@<iface>
are not currently supported.  That is, where the VLAN name isn't based
on the underlying bond name.  Such VLAN interfaces can be created with
the "ip link" command, as opposed to the "vconfig" command, or by
renaming a VLAN interface.

This is improved by determining the underlying interface name for a
VLAN from the output of "ip link".

No serious attempt is made to support VLANs with '@' in their name,
although this seems to be legal.  Why would you do that?

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Fix regression in VLAN interface support

Commit 6471541d6d2bc9f2af0ff92b280abbd1d933cf88 broke support for VLAN
interfaces.  Releasing a public IP address depends on
ip_maskbits_iface() and for a VLAN interface this will return an
interface of the form <vlan>@<iface>, which can't be fed back into
"ip" commands.

Update ip_maskbits_iface() to drop the '@' and everything after it.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Reported-by: Jan Schwaratzki <jschwaratzki@ddn.com>

ctdbd_conn: Move release_ip handling into process.c

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jul 14 09:56:25 CEST 2015 on sn-devel-104

ctdbd_conn: Do an early return from ctdb_read_req

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdbd_conn: Return early from ctdbd_msg_call_back

... if the callback returns != 0

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdbd_conn: Make register_with_ctdbd use an int-returning callback

This will allow an early return from ctdbd_msg_call_back so that we can also
handle CTDB_SRVID_RELEASE_IP via register_with_ctdbd.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdbd_conn: Convert ctdb_read_req to return 0/errno

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdbd_conn: Convert ctdb_handle_message to return 0/errno

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdbd_conn: Make ctdb_read_packet return 0/errno

A little less dependencies

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdbd_conn: Rename "ret"->"ok"

We'll need "ret" soon

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdbd_conn: Fix a memleak

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib/util/charset: reduce loglevel for push_ucs2_talloc error

push_ucs2_talloc() may have failed because of EILSEQ, not a failing
malloc. Log the failure with DBG_WARNING instead of level 0.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jul 14 03:59:05 CEST 2015 on sn-devel-104

torture-notify: Give nonrecursive updates 200ms

This is in line with the recursive updates before.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jul 13 15:00:26 CEST 2015 on sn-devel-104

vfs_fruit: Fix the 32-bit build

"z" is only for size_t, here we have off_t

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jul 13 11:53:47 CEST 2015 on sn-devel-104

ctdb-daemon: Remove control CTDB_CONTROL_SET_CALL

This has not been used for a long time.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Fri Jul 10 23:41:18 CEST 2015 on sn-devel-104

ctdb-daemon: Fix valgrind invalid read error in db_statistics control

  ==20761== Invalid read of size 8
  ==20761==    at 0x11BE30: ctdb_ctrl_dbstatistics (ctdb_client.c:1286)
  ==20761==    by 0x12BA89: control_dbstatistics (ctdb.c:713)
  ==20761==    by 0x1312E0: main (ctdb.c:6543)
  ==20761==  Address 0x713b0d0 is 0 bytes after a block of size 560 alloc'd
  ==20761==    at 0x4C27A2E: malloc (vg_replace_malloc.c:270)
  ==20761==    by 0x5CB0954: _talloc_memdup (talloc.c:615)
  ==20761==    by 0x11395C: ctdb_control_recv (ctdb_client.c:1146)
  ==20761==    by 0x11BDD7: ctdb_ctrl_dbstatistics (ctdb_client.c:1265)
  ==20761==    by 0x12BA89: control_dbstatistics (ctdb.c:713)
  ==20761==    by 0x1312E0: main (ctdb.c:6543)

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

dfs_server: Use multi-byte string handling

Pre-empt a bug with multi-byte DFS pathname handling by using strchr_m()

Signed-off-by: Robin McCorkell <rmccorkell@karoshi.org.uk>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Jul 10 20:35:47 CEST 2015 on sn-devel-104

Fix MSDFS with POSIX paths in vfs_dfs_samba4

Allow for POSIX path separators when parsing a DFS query string

Signed-off-by: Robin McCorkell <rmccorkell@karoshi.org.uk>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

script/librelease.sh: use download-samba.org:~ftp/pub/ for uploading

master.samba.org might be removed in future.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Björn Jacke <bj@sernet.de>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jul 10 16:38:20 CEST 2015 on sn-devel-104

libsmb: Implement smbc_notify

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jul 10 09:35:13 CEST 2015 on sn-devel-104

dfs_server: Fix whitespace

Signed-off-by: Robin McCorkell <rmccorkell@karoshi.org.uk>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>

Replace random() and related calls with generate_random_buffer()

Result: better seeded random numbers that are cryptographically secure
(not that it matters in this case)

Please let it be right this time...

Signed-off-by: Robin McCorkell <rmccorkell@karoshi.org.uk>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbcontrol: Set internal log level to 0

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbstatus: Set internal log level to 0

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

rpcclient: Set internal log level to 0

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

rpc_server: Fix CID 1311342 Null pointer dereferences (REVERSE_INULL)

elem was dereferenced already a few lines above

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul 10 01:01:36 CEST 2015 on sn-devel-104

rpc_server: Fix CID 1311341 Integer handling issues (OVERFLOW_BEFORE_WIDEN)

Quoting the full message:

Potentially overflowing expression "total_octets * 8U" with type "unsigned int"
(32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a
context that expects an expression of type "uint64_t" (64 bits, unsigned).

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

rpc_server: Fix CID 1311340 Null pointer dereferences (NULL_RETURNS)

In practice this might not be relevant, but better be safe.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

rpc_server: Fix CID 1311339 Error handling issues (CHECKED_RETURN)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: Fix CID 1311338 Error handling issues (CHECKED_RETURN)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: Fix CID 1311337 Error handling issues (CHECKED_RETURN)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

dalloc: Fix CID 1097369 API usage errors (VARARGS)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

dalloc: Fix a typo

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

dosmode: Change message of result to informational

Logging the returned mode bits should be only "informational" (level 5).

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jul  9 15:36:30 CEST 2015 on sn-devel-104

vfs: Change final message in check_reduce_name to "info"

"Informational" is a better description for this message; change the log
level accordingly (level 5).

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: Make entry message for check_reduced_name a debug message

The interesting information is already logged later; having an
additional message when entering the function should be only done as
debug message (level 10).

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

net: fix the order of DC lookup methods when joining a domain

The dsgetdcname() function is able to try just DNS lookup, just NetBIOS,
or start with DNS and fall back to NetBIOS. For "net ads join", we know
most of the time whether the name of the domain we're joining is a DNS
name or a NetBIOS name. In that case, it makes no sense to try both lookup
methods, especially that DNS may fail and we want to fall back from site-aware
DNS lookup to site-less DNS lookup, with no NetBIOS lookup in between.

This change lets "net ads join" tell libnet what is the type of the domain
name, if it is known.

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>

util.c: fix order of inclusion to correctly consume config.h

replace.h has to be the first file included in order to correctly act
upon the definitions in config.h.

Specifically, this change fixes 32-bit i686 builds, which depend upon
_FILE_OFFSET_BITS=64 to be set before any standard library file is
included.

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: "Stefan (metze) Metzmacher" <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jul  9 12:32:03 CEST 2015 on sn-devel-104

ctdb-tests: Remove statd-callout when running NFS tests

60.nfs backgrounds it so it persists in the background causing
problems.  In particular, it causes the "ctdb ip" command stub to be
run in parallel, which produces inconstent results.

Better not to run it at all in the NFS tests.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Thu Jul  9 09:27:02 CEST 2015 on sn-devel-104

ctdb-scripts: Use an "if" statement instead of "&&"

If statd-callout is unwanted, so is removed, then this code fails.
Change to an "if" so that it succeeds as intended.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Refactor code using simple test harness functions

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-tests: Add test cleanup hooks

To do any cleanup before exiting the test, register hooks with
test_cleanup().  Multiple hooks can be registered.  All the hooks will
be called before exiting from the test.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-tests: Remove unsed code

This code was copied from onnode unit tests, but not used.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-tests: Remove extra_header and extra_footer variables

This is now achieved by defining functions extra_header() and
extra_footer().

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-tests: Add simple test harnesses for running unit tests

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

docs: Correct list of supported socket options

Bring the list of supported socket options in smb.conf in sync
with the code

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jul  9 03:48:13 CEST 2015 on sn-devel-104

tdb: Reproducer for Bug 11381

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11381
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

tdb: Fix bug 11381, deadlock

This fixes a deadlock in tdb that is a bad interaction between tdb_lockall
and tdb_traverse. This deadlock condition has been around even before
tdb mutexes, it's just that the kernel fcntl EDEADLK detection protected
us from this ABBA lock condition to become a real deadlock stalling
processes. With tdb mutexes, this deadlock protection is gone, so we do
lock dead.

This patch glosses over this particular ABBA condition, making tdb with
mutexes behave the same as tdb without mutexes. Admittedly this is no
real fix, but it works around a real user's problem.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11381
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

librpc: Fix a "ignoring asprint return" warning

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Fix format size errors for i386 in source3/librpc/crypto/gse.c

Again, sizeof(size_t) != sizeof(uintmax_t).

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Fix ldap_bind compilation for i386

More size_t != uintmax_t issues:

../source4/libcli/ldap/ldap_bind.c: In function ‘ldap_bind_sasl’:
../source4/libcli/ldap/ldap_bind.c:237:3: error: format ‘%ju’ expects argument of type ‘uintmax_t’, but argument 2 has type ‘size_t’ [-Werror=format=]

   DEBUG(1, ("SASL bind triggered with non empty send_queue[%ju]: %s\n",
      ^
      cc1: all warnings being treated as errors

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Fix gensec_gssapi compilation for i386

Fixes this:

../source4/auth/gensec/gensec_gssapi.c:1017:3: error: format ‘%ju’ expects argument of type ‘uintmax_t’, but argument 3 has type ‘size_t’ [-Werror=format=]

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s4:torture/rpc: extend and improve rpc.lsa.trusted.domains

This adds a lot more validation arround trust credentials and
krb5 interaction.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jul  8 21:41:17 CEST 2015 on sn-devel-104

s4:torture/rpc: add missing \n in comments

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:torture/rpc: handle NT_STATUS_NO_SUCH_DOMAIN in test_query_each_TrustDom()

lsa_EnumTrusts() may also return non direct trusted domains in the forest.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

testprogs/blackbox: add test_trust_utils.sh

This tests 'samba-tool domain trust *' commands.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

testprogs/blackbox: let test_kinit_trusts.sh verify that setpassword (via LDAP) is rejected

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

testprogs/blackbox: let test_kinit_trusts.sh test a enterprise upn from the other foreset

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest/Samba4: setup forest UPN and SPN namespaces for ad_dc and fl2008r2dc

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

testprogs/blackbox: add test_kinit_trusts.sh

That verifies kinit and smbclient work across trusts.

It also tests a trust password change and a following
access.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest/Samba4: setup trusts between forest:fl2008r2dc/ad_dc and externl:fl2003dc/ad_dc

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

samba-tool: add 'domain trust *' commands

Available subcommands:
  create      - Create a domain or forest trust.
  delete      - Delete a domain trust.
  list        - List domain trusts.
  namespaces  - Manage forest trust namespaces.
  show        - Show trusted domain details.
  validate    - Validate a domain trust.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

python/samba: add on optional 'special_name' argument to CredentialsOptions()

This way we have have two sets or credentials on the command line,
while at least one uses some prefix (special_name) for the arguments.

The default options without special_name are:

  Credentials Options:
    --simple-bind-dn=DN
                        DN to use for a simple bind
    --password=PASSWORD
                        Password
    -U USERNAME, --username=USERNAME
                        Username
    -W WORKGROUP, --workgroup=WORKGROUP
                        Workgroup
    -N, --no-pass       Don't ask for a password
    -k KERBEROS, --kerberos=KERBEROS
                        Use Kerberos
    --ipaddress=IPADDRESS
                        IP address of server
    -P, --machine-pass  Use stored machine account password

With special_name='local-dc' it's:

  Credentials Options (local-dc):
    --local-dc-simple-bind-dn=DN
                        DN to use for a simple bind
    --local-dc-password=PASSWORD
                        Password
    --local-dc-username=USERNAME
                        Username
    --local-dc-workgroup=WORKGROUP
                        Workgroup
    --local-dc-no-pass  Don't ask for a password
    --local-dc-kerberos=KERBEROS
                        Use Kerberos
    --local-dc-ipaddress=IPADDRESS
                        IP address of server
    --local-dc-machine-pass
                        Use stored machine account password

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

python/samba: add current_unix_time()

This is needed to get the time from modules in python/samba/netcmd/
where a time.py exist.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/netlogon: check domain state in netr_*GetForestTrustInformation()

This should only work on a forest root domain controller and a forest function
level >= 2003.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/netlogon: make use of dsdb_trust_xref_forest_info()

This collects the whole information about the local forest,
including all domains and defined top level names (uPNSuffixes and
msDS-SPNSuffixes).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/netlogon: implement netr_DsRGetForestTrustInformation with trusted domains

We redirect this to remote DC as netr_GetForestTrustInformation() via an IRPC
call to winbindd.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s3:winbindd: add wb_irpc_GetForestTrustInformation()

This allows the netlogon server to forward netr_DrsGetForestTrustInformation()
to winbindd in order to do the work.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s3:winbindd: implement winbind_GetForestTrustInformation()

We use in internal connection to our local LSA server
in order to update the local msDS-TrustForestTrustInfo attribute.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

librpc/idl: add winbind_GetForestTrustInformation()

This will be used by the netr_DrsGetForestTrustInformation()
in order to contact remote domains via winbindd.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/netlogon: implement NETLOGON_CONTROL_{QUERY,REDISCOVER,TC_QUERY,TC_VERIFY,CHANGE_PASSWORD}

We pass NETLOGON_CONTROL_{REDISCOVER,TC_QUERY,TC_VERIFY,CHANGE_PASSWORD} to
winbindd and do the hard work there, while we answer NETLOGON_CONTROL_QUERY
directly.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s3:winbindd: add wb_irpc_LogonControl()

This can be called by the netlogon server to pass netr_LogonControl*()
to a winbindd child process in order to do the real work.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s3:winbindd: implement _winbind_LogonControl*()

This implements NETLOGON_CONTROL_{REDISCOVER,TC_QUERY,TC_VERIFY,CHANGE_PASSWORD}.
These are triggered by the netlogon server (currently only as AD DC) via IRPC.

While NETLOGON_CONTROL_REDISCOVER ignores an optional '\dcname' at the end of
the specified domain name for now.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

librpc/idl: add winbind_LogonControl()

This will be used by the netr_LogonControl()
in order to contact remote domains via winbindd.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/lsa: remove unused code

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/lsa: use dsdb_trust_*() helper functions in dcesrv_lsa_lsaRSetForestTrustInformation()

This means we return mostly the same error codes as a Windows
and also normalize the given information before storing.

Storing is now done within a transaction in order to avoid races
and inconsistent values.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/common: add dsdb_trust_merge_forest_info() helper function

This is used to merge the netr_GetForestTrustInformation() result with
the existing information in msDS-TrustForestTrustInfo.

New top level names are added with LSA_TLN_DISABLED_NEW
while all others keep their flags.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/common: dsdb_trust_normalize_forest_info_step[1,2]() and dsdb_trust_verify_forest_info()

These will be used in dcesrv_lsa_lsaRSetForestTrustInformation() in the
following order:

- dsdb_trust_normalize_forest_info_step1() verifies the input
  forest_trust_information and does some basic normalization.

- the output of step1 is used in dsdb_trust_verify_forest_info()
  to verify overall view of trusts and forests, this may generate
  collision records and marks records as conflicting.

- dsdb_trust_normalize_forest_info_step2() prepares the records
  to be stored in the msDS-TrustForestTrustInfo attribute.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/common: add dsdb_trust_xref_tdo_info() helper function

This emulates a lsa_TrustDomainInfoInfoEx struct for our own domain.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/common: add dsdb_trust_forest_info_from_lsa() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/lsa: implement dcesrv_lsa_lsaRQueryForestTrustInformation()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/lsa: improve dcesrv_lsa_CreateTrustedDomain_base()

We need to make sure a trusted domain has 'flatName', 'trustPartner'
and 'securityIdentifier' values, which are unique.

Otherwise other code will get INTERNAL_DB_CORRUPTION errors.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/lsa: fix dcesrv_lsa_CreateTrustedDomain()

It needs to pass 'name' as 'netbios_name' and also 'dns_name'.

flatName and trustPartner have the same value for downlevel trusts.
And both are required.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:rpc_server/netlogon: implement dcesrv_netr_ServerTrustPasswordsGet()

We just need to call dcesrv_netr_ServerGetTrustInfo() and ignore trust_info.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>