dnsupdates: clean up all RRSets and not only type A

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13706
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14244

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests: also test net ads dns (un)register with IPv6

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13706

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests: also test v6 for async dns test by using dig

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests python krb5: PEP8 cleanups

Fix all the PEP8 warnings in samba/tests/krb5. With the exception of
rfc4120_pyasn1.py, which is generated from rfc4120.asn1.

As these tests are new, it makes sense to ensure that they conform to
PEP8. And set an aspirational goal for the rest of our python code.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Mon Dec 21 21:29:28 UTC 2020 on sn-devel-184

tests python krb5: use key usage constants

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

tests python krb5: Add key usage constants

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

dns_update.c: handle DNS_QTYPE_ALL

we have code to handle this, we should not refuse the request

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14576

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Björn Jacke <bjacke@samba.org>
Autobuild-Date(master): Sat Dec 19 18:20:30 UTC 2020 on sn-devel-184

gpo: Apply Group Policy Sudo Rights from VGP

This adds a Group Policy extension which applies
Sudo rights set by Vintela Group Policy in the
SYSVOL.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Dec 19 08:11:50 UTC 2020 on sn-devel-184

gpo: Test Group Policy VGP Sudo Rights

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

gpo: Add gp_xml_ext parser for group policy

This adds an extension parser for parsing xml
files in the sysvol.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: close_file() should never see an internal dirfsp.

Assert this is the case.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Dec 18 16:27:38 UTC 2020 on sn-devel-184

vfs_acl_tdb: avoid deleting the NT ACL from the tdb

...when called as part of setting a new NT ACL. This implements the same logic
added to vfs_acl_xattr in the previous commit, to make sure both modules behave
identically.

This depends on the previous code changes, so
won't be back ported. But for reference the
bug id is below.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14592

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Dec 17 20:04:22 UTC 2020 on sn-devel-184

vfs_acl_xattr: avoid removing the ACL xattr

...when called as part of setting a new NT ACL.

This depends on the previous code changes, so
won't be back ported. But for reference the
bug id is below.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14592

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_acl_common: add an fsp extension when setting ACL

This allows the module checking for the fsp extension variable setting_nt_acl
and will be used in the module functions for .sys_acl_set_fd_fn (so
sys_acl_set_fd_xattr() and sys_acl_set_fd_tdb()).

This depends on the previous code changes, so
won't be back ported. But for reference the
bug id is below.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14592

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_acl_common: add and use a function exit label

No change in behaviour. A subsequent commit will add more function exit cleanup
logic after the done label.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_acl_xattr: reformatting

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: RIP SMB_VFS_SYS_ACL_SET_FILE()

          .--. .-,       .-..-.__
        .'(`.-` \_.-'-./`  |\_( "\__
     __.>\ ';  _;---,._|   / __/`'--)
    /.--.  : |/' _.--.<|  /  | |
_..-'    `\     /' /`  /_/ _/_/
 >_.-``-. `Y  /' _;---.`|/))))
'` .-''. \|:  .'   __, .-'"`
 .'--._ `-:  \/:  /'  '.\             _|_
     /.'`\ :;   /'      `-           `-|-`
    -`    |     |                      |
          :.; : |                  .-'~^~`-.
          |:    |                .' _     _ `.
          |:.   |                | |_) | |_) |
          :. :  |                | | \ | |   |
          : ;   |                |           |
          : ;   |                |  SMB_VFS  |
          : ;   |                |  SYS_ACL  |
          : ;   |                | SET_FILE  |
        .jgs. : ;                |           |
-."-/\\\/:::.    `\."-._'."-"_\\-|           |///."-
" -."-.\\"-."//.-".`-."_\\-.".-\\`=.........=`//-".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

posix_acls: use pathref fsp in copy_access_posix_acl()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: use pathref fsp in change_dir_owner_to_parent()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: use a real dirfsp/atname in mkdir_internal() with SMB_VFS_MKDIRAT()

Now that all VFS modules support real dirfsps in SMB_VFS_MKDIRAT(), pass the
pathref fsp from the parent directory and the basename of the new directory.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: after creating a directory, open the fsp as pathref fsp

After the directory has been created by SMB_VFS_MKDIRAT(), open the fsp on the
new directory as pathref fsp so we can use handle based VFS functions.

open_directory() will reopen the fsp as a full fsp, but that doesn't really hurt
thanks to the reopen_from_procfd() optimisation.

Note that smb_dname == fsp->fsp_name.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: pass fsp to mkdir_internal()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: open a pathref fsp on the parent directory

Prepares for calling SMB_VFS_MKDIRAT() below with a real dirfsp/atname. As
parent_dir_fname now has a pathref fsp in parent_dir_fname->fsp, make sure to
talloc_free() the parent_dir_fname before leaving the function, so the pathref
fsp is closed right there and not left around until the talloc tos is
destroyed (parent_dir_fname is a child of talloc-tos).

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_time_audit: support real dirfsps in smb_time_audit_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_full_audit: support real dirfsps in smb_full_audit_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_shadow_copy2: support real dirfsps in shadow_copy2_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: check for absolute paths in full_path_from_dirfsp_atname()

If the "atname" is an absolute path we can ignore the dirfsp and just return a
copy of the atname.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_linux_xfs_sgid: support real dirfsps in linux_xfs_sgid_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_glusterfs: support real dirfsps in vfs_gluster_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_audit: support real dirfsps in audit_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_extd_audit: support real dirfsps in audit_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_xattr_tdb: support real dirfsps in xattr_tdb_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_media_harmony: support real dirfsps in mh_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_syncops: support real dirfsps in syncops_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_unityed_media: support real dirfsps in um_mkdirat()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_default: remove assert from vfswrap_mkdirat()

vfswrap_mkdirat() deals with real dirfsps just fine now.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: move mode logic out of vfswrap_mkdirat() to the caller mkdir_internal()

This is the correct place where this code should be. It also means opaque VFS
modules that implement their own mkdirat() like glusterfs now use this logic.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

pysmbd: use SMB_VFS_SYS_ACL_SET_FD() in set_sys_acl_conn()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

posix_acls: use SMB_VFS_SYS_ACL_SET_FD() in set_unix_posix_default_acl()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

posix_acls: use SMB_VFS_SYS_ACL_SET_FD() in set_canon_ace_list()

SMB_VFS_SYS_ACL_SET_FD() can now safely be used to set default ACLs on
directories.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_default: add support for SMB_ACL_TYPE_DEFAULT and pathref fsps in vfswrap_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_aixacl2: handle pathref fsps in aixjfs2_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_aixacl: handle pathref fsps in aixacl_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_vxfs: add support for SMB_ACL_TYPE_DEFAULT in vxfs_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_tru64acl: add support for SMB_ACL_TYPE_DEFAULT to tru64acl_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_solarisacl: add support for SMB_ACL_TYPE_DEFAULT in solarisacl_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_posixacl: support SMB_ACL_TYPE_DEFAULT in posixacl_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_gpfs: add support for SMB_ACL_TYPE_DEFAULT in gpfsacl_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_fake_acls: add support for SMB_ACL_TYPE_DEFAULT in fake_acls_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_aixacl2: use ACL type in aixjfs2_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_aixacl: use passed in ACL type in aixacl_sys_acl_set_fd()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

posixacl_xattr: add support for SMB_ACL_TYPE_DEFAULT in posixacl_xattr_acl_set_fd()

No need to handle pathref fsps here, as that is taken care of by
SMB_VFS_FSETXATTR().

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: add acl type arg to SMB_VFS_SYS_ACL_SET_FD()

No change in behaviour, the new arg is not yet used in any module.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: remove fd_close() from open_directory()

fd_close() was accidentally added twice by
d00d09fdcf73a5839ae4f82cf8e953bb761bfbfb. If it would have been removed by
5770cdd7635a018817418f58bd37268aedebd6a9 that adds the reopen_from_procfd()
optimisation, all would be fine. But fd_close() still being called before
reopen_from_procfd() means we're closing the pathref fd prevening the
optimisation.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: Ensure close_directory() and close_normal_file() only deal with is_fsa files.

This must be the case, so assert it.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: mark fsp as valid FSA fsp after Durable Handle reconnect succeeded

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: Move closing a print file out of close_normal_file() (it isn't a normal file) and into close_file().

Streamlines closing print files and allows close_normal_file()
to restrict itself to is_fsa fsps.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: On error exit in create_file_unixpath(), we can't call close_file() on uncompleted opens.

We can't call directly into close_file(), as that cannot deal
with regular file and directory opens where fsp->fsp_flags.is_fsa
hasn't been set to true (uncompleted opens).

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: If an smb_filename already has a pathref fsp don't overwrite it.

That leaks fsps.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: dup_file_fsp() for old DOS style opens also needs to copy the new flags.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: Fix debugs in file_new() and fsp_new().

Allows grep ' files structure ' in the log
to count up and down the number of files allocated.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd/notify: add option "honor change notify privilege"

This option can be used to make use of the change notify privilege.
By default notify results are not checked against the file system
permissions.

If "honor change notify privilege" is enabled, a user will only
receive notify results, if he has change notify privilege or sufficient
file system permissions. If a user has the change notify privilege, he
will receive all requested notify results, even if the user does not
have the permissions on the file system.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Björn Baumbach <bb@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Dec 17 15:01:53 UTC 2020 on sn-devel-184

selftest: add tests for smb notify, using the a special share

That share will get the "honor change notify privilege = yes" option
once it's implemented. For now it's marked as knownfail.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Björn Baumbach <bb@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

selftest: add option to pass args to tests to planpythontestsuite()

The logic is basically a copy from planoldpythontestsuite().

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Björn Baumbach <bb@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

python/tests: add tests for smb notify and the dependency to the TRAVERSE privilege

The easiest way to run this against Windows was to use a domain
controller and configure an enforce group policy and grant the
"Bypass Traverse Checking" only to the "BUILTIN\Administrators" group.
(Note that "LOCAL SERVICE" and "NETWORK SERVICE" are always added in
the local security policy.

The test runs like this:

  SMB_CONF_PATH=/dev/null \
  SERVER=172.31.9.188 \
  TARGET_HOSTNAME=w2012r2-188.w2012r2-l6.base \
  USERNAME=administrator \
  PASSWORD=A1b2C3d4 \
  NOTIFY_SHARE=torture \
  USERNAME_UNPRIV=ldaptestuser \
  PASSWORD_UNPRIV=a1B2c3D4 \
  python/samba/tests/smb-notify.py -v -f SMBNotifyTests

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Björn Baumbach <bb@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

python/ntacls.py: add SMBHelper.set_acl() helper function

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Björn Baumbach <bb@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

python/ntacls.py: let SMBHelper.get_acl() use the default values of self.smb_conn.get_acl()

Now that self.smb_conn.get_acl() has sane default values for secinfo and
access_mask we can remove any additional logic in SMBHelper.

The resulting values are the same.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

libsmb_samba_internal: calculate the access_mask for {g,s}et_acl() based on the secinfo flags

SEC_FLAG_MAXIMUM_ALLOWED will never result in SEC_FLAG_SYSTEM_SECURITY
being granted. As SECINFO_SACL is part of the default secinfo value
(SECINFO_DEFAULT_FLAGS), {g,s}et_acl() will always return
NT_STATUS_ACCESS_DENIED by default.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

libsmb_samba_internal: don't send SECINFO_[UN]PROTECTED_{S,D}ACL by default

We want to get the default behavior.

It's also pointless to set PROTECTED and UNPROTECTED at the same time.
These are defined in MS-DTYP 2.4.7 SECURITY_INFORMATION with a brief
description, but they aren't referenced in anywhere in MS-DTYP itself,
nor in MS-FSA are any other document.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:pylibsmb: remove unused SECINFO_DEFAULT_FLAGS

commit 42be033b0b0c02413a74f984c8622b5baed2689a removed the last
reference.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:pylibsmb: add notify() support

The operation is a bit different from others,
as results are returned in an async fashion.
It returns a request handle.

  notify_req = conn.notify(fnum=fnum,
                           buffer_size=0xffff,
                           completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
                           recursive=True)

  # ... do other operations on conn.*() ...

  changes = notify_req.get_changes(wait=False)
  # changes is likely to be None if no result arrived yet

  # ... do other operations on conn.*() ...

  changes = notify_req.get_changes(wait=True)
  # changes is a list of change dictionaries
  # each containing "name" (a string) and
  # "action" (an integer, e.g. libsmb.NOTIFY_ACTION_REMOVED)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:pylibsmb: add echo() support

In tests it's sometimes to have a no-op in order to check the
transport is still alive.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:pylibsmb: PyErr_NTSTATUS_IS_ERR_RAISE => PyErr_NTSTATUS_NOT_OK_RAISE

We want to raise an exception for everything that's not NT_STATUS_OK.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

libcli/smb: add smbXcli_conn_send_queue()

This is useful in order to test async requests
tevent_queue_wait_send/recv() can be used to block
the queue between requests or wait for the queue to be flushed.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:libsmb: set correct min and max smb protocol when smb2 is enforced on connect

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14105

Pair-programmed-with: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Björn Baumbach <bb@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:libsmb: set min smb protocol when enforcing smb1 on connect

Otherwise the connect fails if the configured client min protocol is
higher than NT1.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14105

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

blackbox/test_samba-tool_ntacl.sh: script requires two arguments

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

docs:smbdotconf: fix a typo in oldpasswordallowedperiod.xml

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

pep8 tidy up config

Enable the following warnings:

E126: continuation line over-indented for hanging indent
E131: continuation line unaligned for hanging indent
E203: whitespace before ':'
E221: multiple spaces before operator
E501: line too long
E722: do not use bare 'except'

These were originally chosen so that as much of the existing samba code
passed. With the intention of integrating PEP8 checking into build
process.  But the PEP8 output does not integrate into the known fail
mechanism, so this approach was abandoned.

setup.cfg is the default PEP8 config file having these exceptions
enabled means that new code can be added with those issues. Also tools
like pyls (python language server) use setup.cfg.

Disable the following warnings:

E402: module level import not at top of file
      Samba has a significant amount of code setting
      sys.path.insert(0, "bin/python")
W503: Line break before binary operator
      We need to have a preference, and PEP8 expresses a weak preference
      for disabling 503

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Dec 17 00:54:51 UTC 2020 on sn-devel-184

tests python krb5: initial TGS tests

Initial tests on the KDC TGS

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests python krb5: add test base class

Add a base class for the KDC tests to reduce the amount of code
duplication in  the tests.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests python krb5: Add Authorization data ad-type constants

Add constants for the Authorization Data Type values.
RFC 4120 7.5.4.  Authorization Data Types

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

auth:creds: Add cli_credentials_dump()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Dec 16 13:56:49 UTC 2020 on sn-devel-184

autobuild.py: use --enable-clangdb for the "samba-ctdb" task

The key is that we only enable it for just one task.

I plan to restructure the autobuild tasks, but 'samba-ctdb'
will stay the way it works currently.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

wafsamba: move clang_compilation_database usage behind an --enable-clangdb option

Writing bin/default/compile_commands.json doubles the total time used
for a noop build. That price should only be paid if someone wants to
use it actually.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

smbd: Remove the smb_fname parameter from set_ea().

We know we must have a valid fsp.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Dec 16 10:15:11 UTC 2020 on sn-devel-184

smbd: set_ea() must have an fsp, so remove uses of the smb_fname parameter.

Next we can remove it.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

smbd: smb_info_set_ea() can only get fsp==NULL in POSIX mode accessing a symlink.

Ensure this is the case and force-return NT_STATUS_ACCESS_DENIED here.
Remove any race condition if anyone modifies the symlink whilst the
operation is in process.

This now allows us to require a valid fsp for operations on EAs.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs: SMB_VFS_GET_COMPRESSION() -> SMB_VFS_FGET_COMPRESSION()

Now that handle based fdos_mode() is used everywhere we can be sure that we're
also always getting a handle in SMB_VFS_GET_COMPRESSION() so we can now safely
remove the path parameter. :)

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: remove unused get_ea_dos_attribute()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: RIP SMB_VFS_GET_DOS_ATTRIBUTES()

                (\  _  /)
                ( \ O / )
                 (// \\)
                    X
                   / \
                  /___\
           _____/      \\_____
          |         +         ||
          |                   ||
          |   SMB_VFS_GET_    ||
          | DOS_ATTRIBUTES()  ||
          |                   ||
          |                   ||
          |                   ||
          |  _     ___   _    ||
          | | \     |   | \   ||
          | |  |    |   |  |  ||
          | |_/     |   |_/   ||
          | | \     |   |     ||
          | |  \    |   |     ||
          | |   \. _|_. | .   ||
          |                   ||
  *     * | *   **    * **    |**     **
   \)),.,\(/.,(//,,..,,\||(,,.,\\,.((//

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: add and use fget_ea_dos_attribute()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: use SMB_VFS_FGET_DOS_ATTRIBUTES() in open_file_ntcreate()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: RIP dos_mode()

          .--. .-,       .-..-.__
        .'(`.-` \_.-'-./`  |\_( "\__
     __.>\ ';  _;---,._|   / __/`'--)
    /.--.  : |/' _.--.<|  /  | |
_..-'    `\     /' /`  /_/ _/_/
 >_.-``-. `Y  /' _;---.`|/))))
'` .-''. \|:  .'   __, .-'"`
 .'--._ `-:  \/:  /'  '.\             _|_
     /.'`\ :;   /'      `-           `-|-`
    -`    |     |                      |
          :.; : |                  .-'~^~`-.
          |:    |                .' _     _ `.
          |:.   |                | |_) | |_) |
          :. :  |                | | \ | |   |
          : ;   |                |           |
          : ;   |                |           |
          : ;   |                | dos_mode()|
        .:| . : ;                |           |
-."-/\\\/:::.    `\."-._'."-"_\\-|           |///."-
" -."-.\\"-."//.-".`-."_\\-.".-\\`=.........=`//-".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: use fdos_mode() in tsmsm_fset_dos_attributes()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: use fdos_mode() in tsmsm_set_dos_attributes()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: use fdos_mode() in dos_mode_at_vfs_get_dosmode_done()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: use fdos_mode() in smb_set_file_disposition_info()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: use fdos_mode() in smb_set_file_dosmode()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: pass fsp to smb_set_file_dosmode()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>