vlendec/samba-autobuild/.git
3 years agoWHATSNEW: add SmartCard/PKINIT improvements
Stefan Metzmacher [Fri, 22 Jul 2016 10:58:00 +0000 (12:58 +0200)]
WHATSNEW: add SmartCard/PKINIT improvements

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:selftest: run the pkinit test in the ad_dc and ad_dc_ntvfs environment
Stefan Metzmacher [Sat, 16 Jan 2016 13:25:18 +0000 (14:25 +0100)]
s4:selftest: run the pkinit test in the ad_dc and ad_dc_ntvfs environment

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:selftest: run test_pkinit_pac_heimdal.sh test
Stefan Metzmacher [Thu, 21 Jul 2016 13:35:40 +0000 (15:35 +0200)]
s4:selftest: run test_pkinit_pac_heimdal.sh test

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotestprogs/blackbox: add test_pkinit_pac_heimdal.sh
Stefan Metzmacher [Thu, 21 Jul 2016 13:34:50 +0000 (15:34 +0200)]
testprogs/blackbox: add test_pkinit_pac_heimdal.sh

This verifies that we have a PAC_CREDENTIAL_INFO element in the PAC
when using pkinit.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotest_pkinit_heimdal.sh: add some more tests regarding the UF_SMARTCARD_REQUIRED behavior
Stefan Metzmacher [Thu, 2 Jun 2016 16:24:18 +0000 (18:24 +0200)]
test_pkinit_heimdal.sh: add some more tests regarding the UF_SMARTCARD_REQUIRED behavior

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest/Samba: copy pkinit@$DOMAIN certificates to the environment
Stefan Metzmacher [Fri, 3 Jun 2016 19:46:13 +0000 (21:46 +0200)]
selftest/Samba: copy pkinit@$DOMAIN certificates to the environment

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest/manage-ca: update manage-CA-samba.example.com.sh
Stefan Metzmacher [Fri, 3 Jun 2016 19:32:04 +0000 (21:32 +0200)]
selftest/manage-ca: update manage-CA-samba.example.com.sh

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest/manage-ca: add certificates for pkinit@[addom.]samba.example.com
Stefan Metzmacher [Fri, 3 Jun 2016 19:32:04 +0000 (21:32 +0200)]
selftest/manage-ca: add certificates for pkinit@[addom.]samba.example.com

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest/Samba: remove compat admincert* files
Stefan Metzmacher [Fri, 3 Jun 2016 19:46:13 +0000 (21:46 +0200)]
selftest/Samba: remove compat admincert* files

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:dsdb/tests: add UF_SMARTCARD_REQUIRED tests
Stefan Metzmacher [Tue, 24 May 2016 00:40:00 +0000 (02:40 +0200)]
s4:dsdb/tests: add UF_SMARTCARD_REQUIRED tests

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:dsdb/password_hash: add the UF_SMARTCARD_REQUIRED password reset magic
Stefan Metzmacher [Tue, 31 May 2016 14:39:06 +0000 (16:39 +0200)]
s4:dsdb/password_hash: add the UF_SMARTCARD_REQUIRED password reset magic

When UF_SMARTCARD_REQUIRED is set to an account we need to remove
the current password and add random NT and LM hashes (without updating
the pwdLastSet field.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:kdc: provide a PAC_CREDENTIAL_INFO element for PKINIT logons
Stefan Metzmacher [Thu, 12 May 2016 21:20:39 +0000 (23:20 +0200)]
s4:kdc: provide a PAC_CREDENTIAL_INFO element for PKINIT logons

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:kdc: correctly update the PAC in samba_wdc_reget_pac()
Stefan Metzmacher [Thu, 7 Jan 2016 16:25:26 +0000 (17:25 +0100)]
s4:kdc: correctly update the PAC in samba_wdc_reget_pac()

We need to keep unknown PAC elements and just copy them.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:kdc: hook into heimdal's windc.pac_pk_generate hook
Stefan Metzmacher [Fri, 20 May 2016 07:48:41 +0000 (09:48 +0200)]
s4:kdc: hook into heimdal's windc.pac_pk_generate hook

This allows PAC_CRENDENTIAL_INFO to be added to the PAC
when using PKINIT. In that case PAC_CRENDENTIAL_INFO contains
an encrypted PAC_CRENDENTIAL_DATA.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoHEIMDAL:kdc: add krb5plugin_windc_pac_pk_generate() hook
Stefan Metzmacher [Fri, 20 May 2016 06:29:30 +0000 (08:29 +0200)]
HEIMDAL:kdc: add krb5plugin_windc_pac_pk_generate() hook

This allows PAC_CRENDENTIAL_INFO to be added to the PAC
when using PKINIT. In that case PAC_CRENDENTIAL_INFO contains
an encrypted PAC_CRENDENTIAL_DATA.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoHEIMDAL:kdc: reset e_text after successful pre-auth verification
Stefan Metzmacher [Fri, 20 May 2016 12:57:57 +0000 (14:57 +0200)]
HEIMDAL:kdc: reset e_text after successful pre-auth verification

This is already fixed in upstream heimdal.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoHEIMDAL:lib/krb5: allow predefined PAC_{LOGON_NAME,PRIVSVR_CHECKSUM,SERVER_CHECKSUM...
Stefan Metzmacher [Thu, 7 Jan 2016 13:12:14 +0000 (14:12 +0100)]
HEIMDAL:lib/krb5: allow predefined PAC_{LOGON_NAME,PRIVSVR_CHECKSUM,SERVER_CHECKSUM} elements in _krb5_pac_sign()

A caller may want to specify an explicit order of PAC elements,
e.g. the PAC_UPN_DNS_INFO element should be placed after the PAC_LOGON_NAME
element.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This is commit 7cd40a610569d5e54ebe323672794fb6415b5dac in heimdal master.

3 years agos4:torture/remote_pac: verify the order of PAC elements
Stefan Metzmacher [Wed, 20 Jul 2016 08:12:45 +0000 (10:12 +0200)]
s4:torture/remote_pac: verify the order of PAC elements

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoauth/credentials: also do a shallow copy of the krb5_ccache.
Stefan Metzmacher [Thu, 21 Jul 2016 13:08:32 +0000 (15:08 +0200)]
auth/credentials: also do a shallow copy of the krb5_ccache.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotevent: Add overflow protection to tevent_req_create
Volker Lendecke [Fri, 22 Jul 2016 14:12:25 +0000 (16:12 +0200)]
tevent: Add overflow protection to tevent_req_create

This adds 40 bytes, but they are needed for correctness :-)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Jul 22 23:33:57 CEST 2016 on sn-devel-144

3 years agotevent: Save 140 bytes of .text in tevent_req_create
Volker Lendecke [Fri, 22 Jul 2016 14:06:45 +0000 (16:06 +0200)]
tevent: Save 140 bytes of .text in tevent_req_create

This is one of or hottest code paths, I think every bit counts here.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agotevent: Save 32 bytes of .text in tevent_req_create
Volker Lendecke [Fri, 22 Jul 2016 14:06:45 +0000 (16:06 +0200)]
tevent: Save 32 bytes of .text in tevent_req_create

This is one of or hottest code paths, I think every bit counts here.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agobuild: Add hints on what libraries to install for gpgme support on failure
Andrew Bartlett [Tue, 28 Jun 2016 22:35:16 +0000 (10:35 +1200)]
build: Add hints on what libraries to install for gpgme support on failure

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jul 22 19:51:09 CEST 2016 on sn-devel-144

3 years agoWHATSNEW: recomment python-crypto and python-m2crypto
Stefan Metzmacher [Mon, 27 Jun 2016 06:25:30 +0000 (08:25 +0200)]
WHATSNEW: recomment python-crypto and python-m2crypto

They're used for some samba-tool commands.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agoWHATSNEW: add 'Password sync as active directory domain controller'
Stefan Metzmacher [Wed, 17 Feb 2016 09:07:27 +0000 (10:07 +0100)]
WHATSNEW: add 'Password sync as active directory domain controller'

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agos4:torture/ndr: Add supplementalCredentials blob from Samba with the new SambaGPG...
Andrew Bartlett [Wed, 20 Jul 2016 04:45:34 +0000 (16:45 +1200)]
s4:torture/ndr: Add supplementalCredentials blob from Samba with the new SambaGPG blob

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
3 years agopython:samba/tests: use 'samba-tool user {getpassword,syncpasswords}' with --decrypt...
Stefan Metzmacher [Tue, 16 Feb 2016 02:19:58 +0000 (03:19 +0100)]
python:samba/tests: use 'samba-tool user {getpassword,syncpasswords}' with --decrypt-samba-gpg

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agoselftest:Samba4: configure "password hash gpg key ids" for ad_dc (if available)
Stefan Metzmacher [Tue, 12 Jan 2016 12:51:00 +0000 (13:51 +0100)]
selftest:Samba4: configure "password hash gpg key ids" for ad_dc (if available)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agos4:selftest: run samba.tests.samba_tool.user also against ad_dc:local
Stefan Metzmacher [Tue, 16 Feb 2016 09:04:40 +0000 (10:04 +0100)]
s4:selftest: run samba.tests.samba_tool.user also against ad_dc:local

In future ad_dc_ntvfs and ad_dc will differ regarding the Primary:SambaGPG
password feature. So we should test both.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agoselftest:gnupg: add a gpg key for Samba Selftest <selftest@samba.example.com>
Stefan Metzmacher [Tue, 12 Jan 2016 12:51:00 +0000 (13:51 +0100)]
selftest:gnupg: add a gpg key for Samba Selftest <selftest@samba.example.com>

This key doesn't have a passphrase and allows automatic testing
of decryption.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agosamba-tool: add --decrypt-samba-gpg support to 'user getpasswords' and 'user syncpass...
Stefan Metzmacher [Fri, 22 Jan 2016 20:52:26 +0000 (21:52 +0100)]
samba-tool: add --decrypt-samba-gpg support to 'user getpasswords' and 'user syncpasswords'

This get's the cleartext passwords by decrypting
the 'Primary:SambaGPG' value in order to provide the
virtual attributes: virtualClearTextUTF16, virtualClearTextUTF8,
virtualCryptSHA256, virtualCryptSHA512, virtualSSHA

The virtual attribute virtualSambaGPG provides the raw
(encrypted) value of the 'Primary:SambaGPG' value.

See the "password hash gpg key ids" option for the encryption part
of this feature.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agos4:dsdb/samdb: optionally store package_PrimarySambaGPGBlob in supplementalCredentials
Stefan Metzmacher [Tue, 12 Jan 2016 09:51:38 +0000 (10:51 +0100)]
s4:dsdb/samdb: optionally store package_PrimarySambaGPGBlob in supplementalCredentials

It's important that Primary:SambaGPG is added as the last element.
This is the indication that it matches the current password.
When a password change happens on a Windows DC,
it will keep the old Primary:SambaGPG value, but as the first element.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agodrsblobs.idl: add package_PrimarySambaGPGBlob
Stefan Metzmacher [Tue, 12 Jan 2016 09:51:38 +0000 (10:51 +0100)]
drsblobs.idl: add package_PrimarySambaGPGBlob

This will be used to store the cleartext utf16 password
GPG encrypted in the supplementalCredentials attribute.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agos4:dsdb/samdb: add configure checks for libgpgme
Stefan Metzmacher [Tue, 12 Jan 2016 09:51:38 +0000 (10:51 +0100)]
s4:dsdb/samdb: add configure checks for libgpgme

This will be used to store the cleartext utf16 password
GPG encrypted as 'Primary:SambaGPG' in the
supplementalCredentials attribute.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agodocs-xml/smbdotconf: reference "unix password sync" with "password hash gpg key ids"
Stefan Metzmacher [Mon, 15 Feb 2016 08:56:03 +0000 (09:56 +0100)]
docs-xml/smbdotconf: reference "unix password sync" with "password hash gpg key ids"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agodocs-xml/smbdotconf: add "password hash gpg key ids" option
Stefan Metzmacher [Mon, 15 Feb 2016 08:10:54 +0000 (09:10 +0100)]
docs-xml/smbdotconf: add "password hash gpg key ids" option

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years ago.travis.yml: install libgpgme11-dev python[3]-gpgme
Stefan Metzmacher [Tue, 16 Feb 2016 06:01:18 +0000 (07:01 +0100)]
.travis.yml: install libgpgme11-dev python[3]-gpgme

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agodocs-xml/smbdotconf: reference "unix password sync" with "samba-tool user syncpasswords"
Stefan Metzmacher [Mon, 15 Feb 2016 08:56:03 +0000 (09:56 +0100)]
docs-xml/smbdotconf: reference "unix password sync" with "samba-tool user syncpasswords"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agodocs-xml:samba-tool.8: document "user syncpasswords" command
Stefan Metzmacher [Mon, 15 Feb 2016 08:15:38 +0000 (09:15 +0100)]
docs-xml:samba-tool.8: document "user syncpasswords" command

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agopython:samba/tests: add simple 'samba-tool user syncpasswords' test
Stefan Metzmacher [Tue, 16 Feb 2016 02:19:58 +0000 (03:19 +0100)]
python:samba/tests: add simple 'samba-tool user syncpasswords' test

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agosamba-tool: add 'user syncpasswords' command
Stefan Metzmacher [Fri, 22 Jan 2016 20:52:26 +0000 (21:52 +0100)]
samba-tool: add 'user syncpasswords' command

This provides an easy way to keep passwords in sync with
another account database, e.g. an OpenLDAP server.

It provides a functionality like the "passwd program"
for the "unix password sync" feature of a standalone, member
and classic (NT4) server, but for an active directory domain
controller.

The provided script is called for each account/password related
change.

Like the 'user getpassword' command it allows virtual attributes like:
virtualClearTextUTF16, virtualClearTextUTF8,
virtualCryptSHA256, virtualCryptSHA512, virtualSSHA

Note that this command should just run on a single domain controller
(typically the PDC-emulator).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agodocs-xml:samba-tool.8: document "user getpassword" command
Stefan Metzmacher [Mon, 15 Feb 2016 08:15:38 +0000 (09:15 +0100)]
docs-xml:samba-tool.8: document "user getpassword" command

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agopython:samba/tests: verify the packages order in supplementalCredentials
Stefan Metzmacher [Tue, 16 Feb 2016 02:19:58 +0000 (03:19 +0100)]
python:samba/tests: verify the packages order in supplementalCredentials

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agopython:samba/tests: add simple 'samba-tool user getpassword' test
Stefan Metzmacher [Tue, 16 Feb 2016 02:19:58 +0000 (03:19 +0100)]
python:samba/tests: add simple 'samba-tool user getpassword' test

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agosamba-tool: add 'user getpassword' command
Stefan Metzmacher [Fri, 22 Jan 2016 20:52:26 +0000 (21:52 +0100)]
samba-tool: add 'user getpassword' command

This provides an easy way to get the passwords of a user
including the cleartext passwords (if stored) and derived
hashes. This is done by providing virtual attributes like:
virtualClearTextUTF16, virtualClearTextUTF8,
virtualCryptSHA256, virtualCryptSHA512, virtualSSHA

This is much easier than using ldbsearch and manually parsing
the supplementalCredentials attribute.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
3 years agopycredentials: add set_utf16_[old_]password()
Stefan Metzmacher [Tue, 12 Jul 2016 07:57:16 +0000 (09:57 +0200)]
pycredentials: add set_utf16_[old_]password()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agopycredentials: add {get,set}_old_password()
Stefan Metzmacher [Tue, 12 Jul 2016 06:14:36 +0000 (08:14 +0200)]
pycredentials: add {get,set}_old_password()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoWHATNEW: the default for "ntlm auth" is "no"
Stefan Metzmacher [Thu, 21 Jul 2016 18:04:10 +0000 (20:04 +0200)]
WHATNEW: the default for "ntlm auth" is "no"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: don't allow ntlmv1 for 'nt4_member' and 'ad_member'
Stefan Metzmacher [Thu, 21 Jul 2016 17:50:36 +0000 (19:50 +0200)]
selftest: don't allow ntlmv1 for 'nt4_member' and 'ad_member'

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodocs-xml:smbdotconf: default "ntlm auth" to "no"
Stefan Metzmacher [Tue, 15 Mar 2016 20:59:42 +0000 (21:59 +0100)]
docs-xml:smbdotconf: default "ntlm auth" to "no"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: set "ntlm auth = yes" for now as a lot of tests rely on it
Stefan Metzmacher [Thu, 21 Jul 2016 07:26:27 +0000 (09:26 +0200)]
selftest: set "ntlm auth = yes" for now as a lot of tests rely on it

In future we should use a mix of environments some which support ntlmv1
and some without.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:selftest: run smbclient_auth with a few more combinations
Stefan Metzmacher [Thu, 21 Jul 2016 17:45:04 +0000 (19:45 +0200)]
s3:selftest: run smbclient_auth with a few more combinations

E.g. we try lanman, ntlmv1 and ntlmv2 authentication.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: add 'as user' to the test names in test_smbclient_auth.sh
Stefan Metzmacher [Thu, 21 Jul 2016 17:41:57 +0000 (19:41 +0200)]
s3:tests: add 'as user' to the test names in test_smbclient_auth.sh

We already have 'as anon', having an indication for each case makes it
easier to mark some as knownfail.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:ntlm_auth: call fault_setup() in order to get usefull backtraces
Stefan Metzmacher [Wed, 11 May 2016 21:09:53 +0000 (23:09 +0200)]
s3:ntlm_auth: call fault_setup() in order to get usefull backtraces

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoWHATSNEW. Add text for Open File Description (OFD) locks.
Jeremy Allison [Thu, 21 Jul 2016 23:24:59 +0000 (16:24 -0700)]
WHATSNEW. Add text for Open File Description (OFD) locks.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul 22 14:13:52 CEST 2016 on sn-devel-144

3 years agoWHATSNEW: SMB 2.1 leases enabled by default
Ralph Boehme [Thu, 21 Jul 2016 19:21:46 +0000 (12:21 -0700)]
WHATSNEW: SMB 2.1 leases enabled by default

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
3 years agosmbd: Enable leases by default
Volker Lendecke [Wed, 20 Jul 2016 10:32:58 +0000 (12:32 +0200)]
smbd: Enable leases by default

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
3 years agos4: torture: Don't crash if connections fail and treeXX variables are left as NULL.
Jeremy Allison [Thu, 21 Jul 2016 19:49:57 +0000 (12:49 -0700)]
s4: torture: Don't crash if connections fail and treeXX variables are left as NULL.

Correctly log as torture fail.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
3 years agoctdb-pcp-pmda: Reimplement using new client API
Amitay Isaacs [Wed, 14 Oct 2015 04:49:12 +0000 (15:49 +1100)]
ctdb-pcp-pmda: Reimplement using new client API

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Fri Jul 22 10:31:57 CEST 2016 on sn-devel-144

3 years agoctdb-tests: Add torture test for fetch functions
Amitay Isaacs [Thu, 5 May 2016 04:51:07 +0000 (14:51 +1000)]
ctdb-tests: Add torture test for fetch functions

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Remove unused tests code
Amitay Isaacs [Wed, 20 Apr 2016 08:30:30 +0000 (18:30 +1000)]
ctdb-tests: Remove unused tests code

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Rename ctdb_porting_tests to porting_tests
Amitay Isaacs [Wed, 20 Apr 2016 06:14:39 +0000 (16:14 +1000)]
ctdb-tests: Rename ctdb_porting_tests to porting_tests

and create unit test for it.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Rename ctdb_lock_tdb to lock_tdb
Amitay Isaacs [Wed, 20 Apr 2016 06:03:41 +0000 (16:03 +1000)]
ctdb-tests: Rename ctdb_lock_tdb to lock_tdb

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Convert rb_test into a unit test
Amitay Isaacs [Wed, 20 Apr 2016 05:56:13 +0000 (15:56 +1000)]
ctdb-tests: Convert rb_test into a unit test

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Replace ctdb_update_record_persistent with update_record_persistent
Amitay Isaacs [Wed, 20 Apr 2016 04:29:56 +0000 (14:29 +1000)]
ctdb-tests: Replace ctdb_update_record_persistent with update_record_persistent

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Replace ctdb_update_record with update_record using new client API
Amitay Isaacs [Wed, 20 Apr 2016 04:27:40 +0000 (14:27 +1000)]
ctdb-tests: Replace ctdb_update_record with update_record using new client API

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Replace ctdb_transaction with transaction_loop using new client API
Amitay Isaacs [Mon, 18 Apr 2016 07:11:36 +0000 (17:11 +1000)]
ctdb-tests: Replace ctdb_transaction with transaction_loop using new client API

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Replace ctdb_fetch_readonly_loop with fetch_readonly_loop using new clien...
Amitay Isaacs [Sat, 21 Nov 2015 11:50:59 +0000 (22:50 +1100)]
ctdb-tests: Replace ctdb_fetch_readonly_loop with fetch_readonly_loop using new client API

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Replace ctdb_fetch_readonly_once with fetch_readonly using new client API
Amitay Isaacs [Wed, 20 Apr 2016 04:49:47 +0000 (14:49 +1000)]
ctdb-tests: Replace ctdb_fetch_readonly_once with fetch_readonly using new client API

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Replace ctdb_fetch_one with fetch_loop using new client API
Amitay Isaacs [Fri, 20 Nov 2015 05:24:34 +0000 (16:24 +1100)]
ctdb-tests: Replace ctdb_fetch_one with fetch_loop using new client API

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Replace ctdb_fetch with fetch_ring using new client API
Amitay Isaacs [Tue, 17 Nov 2015 21:51:41 +0000 (08:51 +1100)]
ctdb-tests: Replace ctdb_fetch with fetch_ring using new client API

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Replace ctdb_bench with message_ring using new client API
Amitay Isaacs [Tue, 10 Nov 2015 05:00:07 +0000 (16:00 +1100)]
ctdb-tests: Replace ctdb_bench with message_ring using new client API

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Add torture test for g_lock functions
Amitay Isaacs [Tue, 19 Apr 2016 06:18:54 +0000 (16:18 +1000)]
ctdb-tests: Add torture test for g_lock functions

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Common code to process commandline options
Amitay Isaacs [Wed, 18 Nov 2015 01:46:08 +0000 (12:46 +1100)]
ctdb-tests: Common code to process commandline options

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoctdb-tests: Common code to wait for synchronization across cluster
Amitay Isaacs [Wed, 18 Nov 2015 01:18:14 +0000 (12:18 +1100)]
ctdb-tests: Common code to wait for synchronization across cluster

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
3 years agoWHATSNEW: Add the update for the samba kcc
Garming Sam [Thu, 30 Jun 2016 00:19:32 +0000 (12:19 +1200)]
WHATSNEW: Add the update for the samba kcc

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Thu Jul 21 10:17:52 CEST 2016 on sn-devel-144

3 years agosamba_kcc: Enable the python samba_kcc
Garming Sam [Wed, 29 Jun 2016 22:54:29 +0000 (10:54 +1200)]
samba_kcc: Enable the python samba_kcc

For any reasonably large domain, the old KCC is impractical as the dense
mesh topology causes replication pulses.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agokcc: correct a typo in the debug messages
Garming Sam [Mon, 18 Jul 2016 02:38:40 +0000 (14:38 +1200)]
kcc: correct a typo in the debug messages

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodbcheck: Add a rule regarding replica locations
Garming Sam [Mon, 18 Jul 2016 05:06:57 +0000 (17:06 +1200)]
dbcheck: Add a rule regarding replica locations

This fixes any RW DCs with repsFrom without the corresponding link. On
any RODC, this just reports an error (and doesn't fix it).

(the knownfail entry is also now removed)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodbcheck/release-4-1-0rc3: Add a check regarding replica locations
Garming Sam [Wed, 20 Jul 2016 00:47:11 +0000 (12:47 +1200)]
dbcheck/release-4-1-0rc3: Add a check regarding replica locations

This DC has repsFrom for the DNS partitions, but not the corresponding
link. This ensures that dbcheck has fixed them up. This will currently
fail without the actual changes to dbcheck coming in the following
commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agojoin.py: Don't add replica locations without the backend
Garming Sam [Thu, 21 Jul 2016 04:01:20 +0000 (16:01 +1200)]
join.py: Don't add replica locations without the backend

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agojoin.py: Add Replica-Locations for DomainDNS and ForestDNS
Garming Sam [Mon, 18 Jul 2016 01:09:59 +0000 (13:09 +1200)]
join.py: Add Replica-Locations for DomainDNS and ForestDNS

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agojoin.py: Ensure that all expressions are escaped
Garming Sam [Wed, 20 Jul 2016 01:37:47 +0000 (13:37 +1200)]
join.py: Ensure that all expressions are escaped

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodbcheck: Replica locations can now be leftover
Garming Sam [Thu, 21 Jul 2016 03:34:13 +0000 (15:34 +1200)]
dbcheck: Replica locations can now be leftover

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9200

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agokcc: Make more fault tolerant on DC demotion
Garming Sam [Thu, 21 Jul 2016 01:08:31 +0000 (13:08 +1200)]
kcc: Make more fault tolerant on DC demotion

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agosamba_kcc: match translate connection from old KCC for RWDC
Garming Sam [Wed, 20 Jul 2016 22:42:14 +0000 (10:42 +1200)]
samba_kcc: match translate connection from old KCC for RWDC

This makes it so that repsTo are always regenerated on the target DCs.
This also happens elsewhere in drepl_out, but is to be removed.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agosamba_kcc: match translate connection from old KCC for RODC
Garming Sam [Tue, 5 Jul 2016 03:57:28 +0000 (15:57 +1200)]
samba_kcc: match translate connection from old KCC for RODC

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agokcc: Prevent the KCC from doing work on the RODC
Garming Sam [Fri, 1 Jul 2016 05:02:50 +0000 (17:02 +1200)]
kcc: Prevent the KCC from doing work on the RODC

This should never have done any real work, new code or not. This just removes
the initial KCC calls and bails out in the KCC if we actually ran it.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: Add more information when KCC fails
Garming Sam [Thu, 21 Jul 2016 01:08:56 +0000 (13:08 +1200)]
selftest: Add more information when KCC fails

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agokcc: Make debug more scarce
Garming Sam [Sun, 3 Jul 2016 23:17:45 +0000 (11:17 +1200)]
kcc: Make debug more scarce

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodrepl: Fix a typo
Garming Sam [Wed, 20 Jul 2016 21:08:11 +0000 (09:08 +1200)]
drepl: Fix a typo

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoWHATSNEW: Samba-tool speed-up
Garming Sam [Thu, 21 Jul 2016 04:30:35 +0000 (16:30 +1200)]
WHATSNEW: Samba-tool speed-up

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoctdb-tests: Add shellcheck test suite
Martin Schwenke [Thu, 14 Jul 2016 02:01:14 +0000 (12:01 +1000)]
ctdb-tests: Add shellcheck test suite

CTDB has a lot of scripts and shellcheck can be useful to find dubious
scripting practices.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Thu Jul 21 06:06:49 CEST 2016 on sn-devel-144

3 years agoctdb-tests: Add new test support script for script install paths
Martin Schwenke [Thu, 14 Jul 2016 01:58:51 +0000 (11:58 +1000)]
ctdb-tests: Add new test support script for script install paths

This helps unit tests locate CTDB's scripts.  It is being created to
support some new shellcheck unit tests.

Hopefully, it can also be used to simplify some of the symlink
complexity in some other unit tests suites, such as eventscripts.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
3 years agoctdb-scripts: Avoid shellcheck warning SC2006 (legacy `..`)
Martin Schwenke [Thu, 14 Jul 2016 02:58:31 +0000 (12:58 +1000)]
ctdb-scripts: Avoid shellcheck warning SC2006 (legacy `..`)

SC2006: Use $(..) instead of legacy `..`.

Make the obvious changes to $(...) but convert some to $((...)).

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
3 years agoctdb-scripts: Avoid shellcheck warning SC2124 (string=array)
Martin Schwenke [Thu, 14 Jul 2016 02:28:17 +0000 (12:28 +1000)]
ctdb-scripts: Avoid shellcheck warning SC2124 (string=array)

SC2124: Assigning an array to a string!
        Assign as array, or use * instead of @ to concatenate.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
3 years agoctdb-scripts: Avoid shellcheck warning SC2155 (declare, assign)
Martin Schwenke [Thu, 14 Jul 2016 02:27:05 +0000 (12:27 +1000)]
ctdb-scripts: Avoid shellcheck warning SC2155 (declare, assign)

SC2155: Declare and assign separately to avoid masking return values.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
3 years agoctdb-scripts: Avoid shellcheck warning SC2059 ($ in printf format)
Martin Schwenke [Thu, 14 Jul 2016 02:08:04 +0000 (12:08 +1000)]
ctdb-scripts: Avoid shellcheck warning SC2059 ($ in printf format)

SC2059: Don't use variables in the printf format string.
        Use printf "..%s.." "$foo".

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
3 years agoctdb-scripts: Avoid chellcheck warning SC2012 (ls for file list)
Martin Schwenke [Wed, 13 Jul 2016 01:50:58 +0000 (11:50 +1000)]
ctdb-scripts: Avoid chellcheck warning SC2012 (ls for file list)

SC2012: Use find instead of ls to better handle non-alphanumeric filenames.

Make this cope better with unexpected whitespace.

Unfortunately, this results in shellcheck warning:

  SC2035: Use ./*.tdb.* so names with dashes won't become options.

No!  Then stat(1) will print ./file.tdb.X.  We want the basenames and
we know the filenames don't start with dashes.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
3 years agoctdb-scripts: Avoid shellcheck warning SC2012 (ls for file list)
Martin Schwenke [Tue, 12 Jul 2016 20:53:21 +0000 (06:53 +1000)]
ctdb-scripts: Avoid shellcheck warning SC2012 (ls for file list)

SC2012: Use find instead of ls to better handle non-alphanumeric filenames.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>