sdb: Do not set disallow if we do not have ticket info in the DB

These things are applied by the incoming ticket by the KDC.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

torture: Add a dummy test for MIT Kerberos case

This is a preperatory test to add tests for the MIT KDC.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

torture: Fix trailing whitespaces in krb5 tests

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

s3/client/clitar.c: always close fd

Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jun  2 12:47:26 CEST 2016 on sn-devel-144

winbindd: prevent log spam when enumerating users

When enumerating users we try to fetch sAMAccountType attribute which
might not be present for whatever reason.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Thu Jun  2 09:04:13 CEST 2016 on sn-devel-144

winbindd: log domain name of failures to get trustdoms

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

talloc: rename local timeval function copies

timeval_current() and timeval_elapsed() are public functions from
libsamba-util. Redeclaring them as static functions here triggers linker
error when building with gcc link-time-optimisation (LTO).

This shows the error after reverting this patch:
[slow@kazak lto]$ make -j
WAF_MAKE=1 python ./buildtools/bin/waf build
Waf: Entering directory `/home/slow/git/samba/lto/bin'
        Selected embedded Heimdal build
[ 174/4259] Generating ctdb-samba-version-header
[ 174/4259] Generating ctdb-samba-version-header
[ 521/4259] Generating source4/torture/local/proto.h
[2565/4259] Compiling lib/talloc/testsuite.c
[4125/4259] Linking default/source4/torture/smbtorture
/tmp/ccvL9UCe.ltrans3.ltrans.o:<artificial>:function smbsrv_accept.lto_priv.11: error: undefined reference to 'timeval_current.lto_priv.630'
/tmp/ccvL9UCe.ltrans4.ltrans.o:<artificial>:function smbsrv_recv_smb2_request: error: undefined reference to 'timeval_current.lto_priv.630'
/tmp/ccvL9UCe.ltrans4.ltrans.o:<artificial>:function smb2srv_negprot_backend: error: undefined reference to 'timeval_current.lto_priv.630'
/tmp/ccvL9UCe.ltrans4.ltrans.o:<artificial>:function smb2srv_negprot_backend: error: undefined reference to 'timeval_current.lto_priv.630'
/tmp/ccvL9UCe.ltrans9.ltrans.o:<artificial>:function test_smb2_oplock_batch22: error: undefined reference to 'timeval_elapsed.lto_priv.628'
/tmp/ccvL9UCe.ltrans9.ltrans.o:<artificial>:function test_smb2_bench_oplock: error: undefined reference to 'timeval_elapsed.lto_priv.628'
/tmp/ccvL9UCe.ltrans9.ltrans.o:<artificial>:function test_smb2_bench_oplock: error: undefined reference to 'timeval_elapsed.lto_priv.628'
/tmp/ccvL9UCe.ltrans9.ltrans.o:<artificial>:function test_smb2_bench_oplock: error: undefined reference to 'timeval_elapsed.lto_priv.628'
collect2: error: ld returned 1 exit status
...

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jun  1 21:09:16 CEST 2016 on sn-devel-144

ctdb-recoverd: Freeze databases whenever the node is INACTIVE

If the node becomes stopped or banned after recovery is marked
active, then it will never freeze the databases, and hence the
node will keep banning itself indefinitely, until ctdbd is restarted.

This is a regression from 4.3, introduced with

b4357a79d916b1f8ade8fa78563fbef0ce670aa9

and

d8f3b490bbb691c9916eed0df5b980c1aef23c85

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11945

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Wed Jun  1 17:36:12 CEST 2016 on sn-devel-144

ctdb:banning: Improve debug message in ctdb_ban_node_event()

Make it more clear what happens when reading the logs.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb:banning: Improve a debug message

This adapts the debug message in local_node_got_banned
to reflect what the function is currently doing.
This message was not adapted when the function was changed.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

repl_meta_data: Do rename before deleted object cleanup

Following from the lesson of subtree_rename, do the rename first,
as this is more likely to fail for some reason

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jun  1 14:01:36 CEST 2016 on sn-devel-144

dsdb/subtree_rename: Rename the base before we rename children

Otherwise, we might rename children to be under a different, conflicting, DN.

This would normally be picked up in the transaction rollback, but in replication
the transaction is not aborted for this situation

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

getncchanges: Fill in ctr6.linked_attributes with a pointer to a zero-length array

Our newly run repl_exop tests expect this, matching Windows 2012R2

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

getncchanges: Use the talloc_stackframe() for tempory memory

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

getncchanges: Give the correct error when RID_ALLOC fails on an invalid destination_dsa_guid

This is found by our new tests.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

rpc_server/drsuapi: Return the correct 3 objects for DRSUAPI_EXOP_FSMO_RID_ALLOC

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

ctdb:tests: timedout->timed out in 60.nfs.multi.004 test

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jun  1 04:30:36 CEST 2016 on sn-devel-144

ctdb:eventscript: timedout->timed out in ctdb_event_script_args()

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdb:banning: timedout->timed out in dbg messages in ctdb_ban_node_event()

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdb:tcp: add missing spaces in debug message in ctdb_tcp_node_connect()

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

dsdb: Simplify acl_validate_spn_value

Avoid pointless "else" and fix indentation

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3-dfree-quota: remove special handling of EDQUOT

It is no longer part of the quota VFS interface to return
an EDQUOT error as an indication that getting quota succeeded
but the user/group is over-quota. A VFS module implementing
quota interface always returns 0 on success.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3-sysquotas: remove special handling of EDQUOT

The sysquotas module has several supported backends for
getting/setting user/group quota. This patch removes a check
by the common code, to see if the backend has returned EDQUOT.

Before this patch, it was OK for a backend to return with error
and errno set to EDQUOT, and that meant success, but with a warning
that the user/group is over quota. This is the system behavior on
some Unices. This patch removes this from the protocol between the
sysquota module and its backend drivers - it's the responsibility
of the backend to return 0 iff it has fulfilled the request to get or
set quota.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_fake_dfq - remove support for generating EDQUOT

Remove the option to retrieve valid user/group quota while
returning -1 and EDQUOT errno - this is no longer part of the
protocol between the quota backend and smbd.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

selftest: remove test for EDQUOT returned from quota backend

Remove a test for special handling of EDQUOT errno when determining
user/group quota - If the backend has obtained the quota settings it
has to return 0 and not error.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3-sysquotas-linux: do not check for EDQUOT

When obtaining user/group quota, remove check for EDQUOT
errno return. Apparently on some Unices, EDQUOT means that
the get-quota function has succeeded, but the user/group is
over-quota. Not so in Linux.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

samba-too: Allow 'samba-tool fsmo' to cope with empty or missing fsmo roles

samba-too: Allow 'samba-tool fsmo' to cope with empty or missing fsmo roles

Signed-off-by: Rowland Penny <rpenny@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

s3/client/clitar.c: NULL-check correct variable

`f` was checked again instead of `s`.

Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: ndreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

rwrap: Update resolve_wrapper to version 1.1.4

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue May 31 20:13:43 CEST 2016 on sn-devel-144

lib: tevent: Use struct sockaddr_storage to cope with IPv6.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sun May 29 09:13:30 CEST 2016 on sn-devel-144

s3: lib: ldap: Use struct sockaddr_storage to cope with IPv6.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

s3: net: Return an error when no name servers were returned by the lookup so that we see an error in self test.

Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat May 28 04:34:20 CEST 2016 on sn-devel-144

smbd: dfree - ignore quota if not enforced

When calculating free disk space, do not take user quota
into account if quota is globally not enforced on the file
system.

This is meant to fix a specific problem with XFS. One might
say "why don't you fix the XFS-specific code instead?". The
reason for that is that getting and setting quota must not
be affected by whether quota is actually enforced. NTFS has
the same notion of separating quota accounting (and being
able to configure / retrieve configured quota), from quota
enforcement.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11937

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat May 28 00:09:05 CEST 2016 on sn-devel-144

selftest: add disk-free quota tests

Add a test for situation where quota accounting is enabled
but quota enforcement is disabled (disk-free should not take
quota into account)

Add a test for situation where overall quota status reporting
(whether or not it's enforcing) is not supported - as with NFS.
In that case it must be assumed that if quota is configured, then
it is also enforced (as with NFS).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11937

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_fake_dfq: add more mocking options

Add support for mocking FS user/group quotas (default quota and
quota flags).

Make the default block size 4096 instead of 0. This
turns the default into "no quota" instead of "punt to
lower VFS module" (that is, if the mock module is asked
to retrieve quota of a user/group/default for which there
is no config).

Add support for ENOSYS error

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11937

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Fix memory leak in share mode locking.

Not freeing up(and reparenting to NULL context) ndr buffer
used for TDB updates resulting in huge memory leak when there
in high volume of opens and closes happening on same object.

Free the buffer before reparenting its parent to NULL context.

https://bugzilla.samba.org/show_bug.cgi?id=11934

Signed-off-by: Hemanth Thummala <hemanth.thummala@nutanix.com>
Signed-off-by: Saji VR <saji.vr@nutanix.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri May 27 18:43:31 CEST 2016 on sn-devel-144

s3: auth: Move the declaration of struct dom_sid tmp_sid to function level scope.

It's referred to outside of the {} brace scope it was defined in by
the following code:

                uid_to_unix_users_sid(*uid, &tmp_sid);
                user_sid = &tmp_sid;

As tmp_sid was going out of scope, user_sid was
being incorrectly set in the token sid list.

I think this *may* be the root cause of:

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10618

But even if not this is an obvious error that must
be fixed.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri May 27 11:28:18 CEST 2016 on sn-devel-144

s3-sysquotas-linux - cleanup

Now that the module supports only the current Linux quota
interface, it does not need a two-level hierarchy.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Thu May 26 18:54:12 CEST 2016 on sn-devel-144

s3-sysquotas-linux: remove check for EDQUOT on getting user quota

The same check is done by sys_get_quota() which is the only caller.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3-sysquotas-linux: remove support for old interfaces

Remove support for Linux quota interfaces that predate the
2.6.x kernel series. Glibc has been supporting the "current"
quota interface for over 10 years now...

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

ctdb-common: Use correct macro for checking Ethernet hardware family

Both of these expand to 1.  However, AF_LOCAL is a Unix domain socket,
which makes no sense when reading the code.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Thu May 26 11:42:46 CEST 2016 on sn-devel-144

ctdb-tests: Make sure empty override values are properly quoted

With an empty value the first expression adds a trailing opening
quote, so the second expression doesn't add the closing quote.  Handle
this with a special case.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Allow local daemons to be run under valgrind

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Simplify ip_maskbits_iface()

This doesn't need to print the family.  Nothing uses it.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Drop no-op functions and add an ip6tables stub

Stub scripts are more obvious.  rc.local should only be used when
strictly necessary.

iptables_wrapper doesn't need to be no-op-ed, provided flock is
installed.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Rename get_iface_ip_maskbits_family() to get_iface_ip_maskbits()

The family is not needed.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: New functions ip_block() and ip_unblock()

Block and unblock IP addresses using these new functions.  This makes
the code more readable.

The case statement in each function is very cheap, so there is no need
to prematurely optimise and pass the family.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

Extend DsBind and DsGetDomainControllerInfo to work with w2k8.

W2K8 Clients ask for DRSUAPI_SUPPORTED_EXTENSION_LH_BETA2 on DsBind. W2K8
expect this to be set (with server fl 2k8) or else they do not call
DsGetDomainControllerInfo.

If DRSUAPI_SUPPORTED_EXTENSION_LH_BETA2 is set, DsGetDomainControllerInfo
must be able to return DCInfo Level 3.

If Samba4 AD ist set to work as 2k8, with >2k8 clients the following
will not work as expected:

  * Group Policy Editor Infrastructure Discovery
  * nltest /dclist:<domain>
  * w32tm /monitor

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9971
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9976

Signed-off-by: Dirk Godau <voidswitch@gmail.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Thu May 26 06:21:10 CEST 2016 on sn-devel-144

drsuapi tests for DsBind with w2k8

These are marked as known_fail pending the next patch ("Extend DsBind
and DsGetDomainControllerInfo to work with w2k8").

Signed-off-by: Dirk Godau <voidswitch@gmail.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

s3: docs: Add documentation for posix_whoami command in smbclient.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu May 26 02:43:55 CEST 2016 on sn-devel-144

s3: smbclient: Add posix_whoami command.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

s3: libsmb: Add sync and async cli_posix_whoami().

Will add as a command to smbclient, plus will be useful for testing.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

s3-smbd: Support systemd 230

systemd 230 version finally deprecated libsystemd-daemon/libsystemd-journal split
and put everything in libsystemd library.

Make sure HAVE_LIBSYSTEMD define is supported in the code (we already
have it defined by the waf).

Patch is based on the code proposed by Zbigniew Jędrzejewski-Szmek
from systemd project.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11936

Signed-off-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed May 25 20:25:44 CEST 2016 on sn-devel-144

s3-smbspool: Log to stderr

This way we will be able to see the log in the cups logs and are able to
debug issues.

https://bugzilla.samba.org/show_bug.cgi?id=11935

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

drsuapi: Improve debug in DsWriteAccountSpn

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed May 25 11:34:13 CEST 2016 on sn-devel-144

samdb: Improve debugging in acl_validate_spn_value()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

selftest: use the default values for "server signing"

That will hopefully catch possible regressions.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11910

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue May 24 18:35:19 CEST 2016 on sn-devel-144

s3:selftest: run test_smbclient_ntlm also against ad_dc

This makes sure anonymous connections work if the server
requires signing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11910

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

selftest: systematize formatting of if/elseif/else indentation in cleanup_child

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue May 24 13:43:35 CEST 2016 on sn-devel-144

selftest: improve logic in cleanup_child() with early return

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

selftest: improve misleading indentation in cleanup_child()

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

selftest: fix printf in cleanup_child()

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

heimdal make kvno unisgned internally

The folks at heimdal didn't like the patch in
commit 6379737b7ddc6ccb752238c5820cc62e76a8da17 and insisted
that kvno should remain unsigned internally, even though it is
encoded as signed in packets. This patch reverts some of the
unsigned->signed changes in that commit, and resolves conversion
issues - in order to be aligned with upstream Heimdal.

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue May 24 03:00:39 CEST 2016 on sn-devel-144

s3-quotas: fix sysquotas_4B quota fetching for BSD

Correctly copy block hard/soft limits from the OS-specific structure
to samba structure.

BUG:https://bugzilla.samba.org/show_bug.cgi?id=11931

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3:rpcclient: make use of SMB_SIGNING_IPC_DEFAULT

This means we'll use the "client ipc min protocol", "client ipc max protocol"
and "client ipc signing" options. But "--signing=no" or "--signing=required"
still overwrite "client ipc signing".

The following can be used to alter the max protocol

rpcclient --option="client ipc max protocol=SMB2_10" 172.31.9.163 -Uadministrator%A1b2C3d4 -c "getusername"
Account Name: Administrator, Authority Name: W4EDOM-L4

rpcclient --option="client ipc max protocol=NT1" 172.31.9.163 -Uadministrator%A1b2C3d4 -c "getusername"
Account Name: Administrator, Authority Name: W4EDOM-L4

rpcclient 172.31.9.163 -Uadministrator%A1b2C3d4 -c "getusername"
Account Name: Administrator, Authority Name: W4EDOM-L4

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11927

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat May 21 05:01:15 CEST 2016 on sn-devel-144

Revert "s3:rpcclient add -m option"

This reverts commit a55ac51f5f67c61bda1fee7067ad7d09a0c1efdf.

This will be implemented in a more common way using the
"client ipc max protocol" option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11927

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3: wscript: Add checks for open file description locks.

Compiles and runs code that checks for working
F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW.

We now use these if available.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: VFS: Map process-associated lock operation to open file description lock operation.

Only in the default VFS. Gpfs, Ceph, Gluster and other modern
backend VFS filesystems might want to do the same.

Allow tuneable "smbd:force process locks = true" to turn
off OFD locks if in use and the kernel doesn't support them.

Display debug message showing admins what to do in this case.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: lib: util: Add map_process_lock_to_ofd_lock() utility function.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: VFS: Add bool use_ofd_locks member to struct files_struct.

Not yet used. We will set this if we translate a process-associated
lock operation to a open file description lock operation.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: lib: Add 'int op' parameter to fcntl_getlock().

Will allow us to move to open file description locks
from process-associated locks.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: torture: Add POSIX-OFD-LOCK test.

Ensures that we *always* expose ofd-lock behavior to clients.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: locking: Convert on the wire behavior of POSIX (UNIX extensions) locks from process-associated locks to open file description locks.

This means locks are associated with the SMB handle
they were created on, not the inode. In all other ways
they behave like UNIX extensions fcntl (process-associated)
locks. Torture test to follow.

When a handle is closed all locks attached to that handle
are closed, not all locks on the underlying inode. In
this respect they now behave like Windows locks.

The key to this in the UNIX extensions locking codepath is modifying
the reference count only when a new locking context is seen
on any lock request, and decrementing the reference count
when the last instance of a locking context is seen on any
unlock request. For SMB2+ the persistent part of a file handle
is used as the locking context so this behavior becomes
natural.

This is a behavior change but after consultation with
Jeff Layton and Steve French the only client that implements
UNIX extensions POSIX locks - the cifsfs client - already
expects these locks to behave like open file description
(ofd) locks. With our previous behavior Linux ofd-locks
fail against smbd.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: locking: Add a const struct lock_context * paramter to set_posix_lock_posix_flavour()

We will need this to implement open file description record locks.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: locking: Add some const.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

s3: locking: Rename xxx_windows_lock_ref_count to xxx_lock_ref_count.

We will be using this to also ref count a posix lock applied
to a file handle when changing to open file description lock
semantics.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

ctdb-scripts: Drop unnecessary detect_init_style() call

CTDB_INIT_STYLE isn't used in this script.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Kai Blin <kai@samba.org>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Fri May 20 21:06:18 CEST 2016 on sn-devel-144

ctdb-scripts: Support systemctl directly

Some Linux distributions don't have a "service" compatibility command.

To avoid breaking working systems, prefer the "service" compatibility
command just in case it does some extra, unexpected magic.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Kai Blin <kai@samba.org>

notifyd: prevent NULL deref segfault in notifyd_peer_destructor

It seems it could happen that p->db == NULL in the list
from notifyd_clean_peers_next(). This has been seen in
a ctdb cluster when an node-internal ctdb interface is
brought down.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11930

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri May 20 17:32:55 CEST 2016 on sn-devel-144

swrap: Update to version 1.1.7

* Added support for accept4()
* Added support for OpenBSD
* Fixed sendto() with UDP and a connected socket
* Fixed AF_RAWLINK sockets

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri May 20 13:58:37 CEST 2016 on sn-devel-144

vfs_fruit: Fix a few signed/unsigned mixups

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu May 19 23:53:47 CEST 2016 on sn-devel-144

vfs_fileid: Fix a signed/unsigned mixup

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

python:samba: move netcmd/time.py to python/samba/netcmd/nettime.py

This allows 'import time' to work.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu May 19 15:21:58 CEST 2016 on sn-devel-144

WHATSNEW: add 'Support for LDAP_SERVER_NOTIFICATION_OID'

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

WHATSNEW: Clear release notes for Samba 4.5.0pre1.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

smbd:close: only remove kernel share modes if they had been taken at open

This avoids errors due to 'not implemented' for SMB_VFS_KERNEL_FLOCK
on some file systems like glusterfs (with the vfs module). The only
other code path where SMB_VFS_KERNEL_FLOCK is called, is already protected.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11919

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Christian Ambach <ambi@samba.org>
Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Thu May 19 02:34:36 CEST 2016 on sn-devel-144

s3:vfs: add 'kernel_share_modes_taken' to files_struct

This will allow to track whether kernel share modes have been
taken at open and correclty remove them again on close.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11919

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Christian Ambach <ambi@samba.org>

s3-net: Cleanup the code of printing migration

Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed May 18 23:00:35 CEST 2016 on sn-devel-144

s3-net: Convert the key_name to UTF8 during migration

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11922

Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>

packaging: Set default limit for core file size in service files

This change adds the missing LimitCORE variable setting in nmb and
winbind service files to have no limit for coredumps by default.

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed May 18 19:26:49 CEST 2016 on sn-devel-144

packaging: Set default limit for core file size in init scripts

SysV init scripts used for initiating smb and winbind services
determines the value for default limit of coredump from variable
named DAEMON_COREFILE_LIMIT within a bash env. Therefore this
patch explicitly sets this variable to 'unlimited' so as to have
no limit for core file size by default.

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

packaging: Remove ulimit usage for setting core file size limit

Recent commit ebd139c4db7e51a2d7843a773991f15cadf504dd modified smb.init
to set core file size to 'unlimited' by default using the ulimit command.
But when smb and winbind services are initiated via sysv init scripts,
another variable named DAEMON_COREFILE_LIMIT takes higher priority in
deciding the core file size. Therefore setting default value using ulimit
command is useless.

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

s3:smbd: fix anonymous authentication if signing is mandatory

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11910

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed May 18 15:49:46 CEST 2016 on sn-devel-144

s3:ntlm_auth: make ntlm_auth_generate_session_info() more complete

The generate_session_info() function maybe called more than once
per session.

Some may try to look/dereference session_info->security_token,
so we provide simplified token.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11914

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

ctdb: Fix CID 1327222 Copy into fixed size buffer

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Tue May 17 21:21:30 CEST 2016 on sn-devel-144

ctdb: Fix CID 1361817 Dereference after null check

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

dbwrap_ctdb: Remove get_my_vnn dependency

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue May 17 16:54:36 CEST 2016 on sn-devel-144

dbwrap_ctdb: Fix some 32-bit hickups

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

ctdbd_conn: Remove messages.h dependency

This removes a circular dependency

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

dbwrap: Add "msg_ctx" to db_open_ctdb

Another step towards making ctdbd_conn.c independent of messages.c. No call to
ctdb_conn_msg_ctx() anymore

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>