VERSION: Disable GIT_SNAPSHOT for the 4.13.3 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

WHATSNEW: Add release notes for Samba 4.13.3.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE

This was an omission in the fixes for bug 14470.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14587

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec  1 20:29:34 UTC 2020 on sn-devel-184

(cherry picked from commit 936f74daed0d6221312f651f35c4ed357bbf1414)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Wed Dec  9 08:56:47 UTC 2020 on sn-devel-184

vfs_zfsacl: reformatting

No change in behaviour.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14587

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a8457ac3c80e22588e33a343c2306b702734ca88)

s4/samba: call force_check_log_size() in standard_new_task()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
RN: samba process does not honor max log size

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Dec  7 18:54:29 UTC 2020 on sn-devel-184

(cherry picked from commit 058f96f4c4eda42b404f0067521d3eafb495fe7d)

s4/samba: call force_check_log_size() in standard_accept_connection()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 6fa5fb8ef26dab862df5c46bb5e74f19839c30e2)

s4/samba: call force_check_log_size() in prefork_reload_after_fork()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 82b64e930b0e2d3b2e5186017d9f8e420994136c)

s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model

With debug_schedule_reopen_logs() the actual reopen only takes place at some
point in the future when a DEBUG message is processed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 19413e76a46f07fdd46fde5e60707bb6845a782d)

s4: replace low-level SIGUP handler with a tevent handler

Replace the low-level signal handler for SIGHUP with a nice tevent signal
handler. The low-level handler sig_hup() installed by setup_signals() remains
being used during early startup before a tevent context is available.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 9f71e6173ab43a04804ba8061cb0e8ae6c0165bf)

s4: install tevent tracing hooks to trigger logfile rotation

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 516c2a04a242a539f9fbddb2822295fee233644c)

s4: add samba server tevent trace helper stuff

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit 68f71f227b17774a12c84575c1eecd82279fac95)
[slow@samba.org: conflict due to rename source4/smbd/ -> source4/samba/ in master]

debug: detect logrotation by checking inode number

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 3651a51e93b45104323d5db1d5ea704d4f71acf1)

debug: pass struct debug_class *config to do_one_check_log_size()

Pass a pointer to the struct instead of all struct members individually. No
change in behaviour.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit b7ee36146458bcc2c944f5670b7632df8281ae61)

debug: pass struct debug_class *config to reopen_one_log()

Pass a pointer to the struct instead of all struct members individually. No
change in behaviour.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 29cd139a32d5dbf36bef68eb9c7f1160201e3042)

loadparm: setup debug subsystem setting max_log_size from config

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit ab2c712c016f4e4dacd5064b9eb8f6417f4b9b60)

s3: smbd: Quiet log messages from usershares for an unknown share.

No need to log missing shares/sharenames at debug level zero.

Keep the debug level zero for all other usershare problems.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14590

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Rowland penny <rpenny@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Dec  4 20:54:06 UTC 2020 on sn-devel-184

(cherry picked from commit 8a0a7359faba642baf55a8f98ff78c0d0884d0f0)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Tue Dec  8 10:21:11 UTC 2020 on sn-devel-184

s3-libads: Pass timeout to open_socket_out in ms

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13124

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jul 16 10:41:40 UTC 2020 on sn-devel-184

(cherry picked from commit d67e9149a612044e247e7a4d78913ecf396c69fc)

vfs_glusterfs: print exact cmdline for disabling write-behind translator

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Nov 27 17:15:07 UTC 2020 on sn-devel-184

(cherry picked from commit 369c1d539837b70e94fe9d533d44860c8a9380a1)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Wed Dec  2 14:49:18 UTC 2020 on sn-devel-184

manpages/vfs_glusterfs: Mention silent skipping of write-behind translator

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Mon Nov  9 13:30:06 UTC 2020 on sn-devel-184

(cherry picked from commit be03ce7d8bb213633eedcfc3299b8d9865a3c67f)

selftest: Remove samba3.blackbox.smbclient_tar from flapping tests

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 89e2d68bb4d93dc391af97f35ff1148aec7930b0)

clitar: Use do_list()'s recursion in clitar.c

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Aurelien Aptel <aaptel@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
(cherry picked from commit 20e0ce508844fec2dd0011423b10484dc7ccfdb7)

s3/script/tests: Ensure all remote test files are removed

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
(cherry picked from commit 16ffa17ee28edfc3bc70c66abf41b5518aeab8fe)

s3/script/tests: call smbclient deltree to remove remote files

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 6c7dc4959fd5de4382aee413b4cc711cc6f281f4)

s3/script/tests: Make smb_client 'die' behaviour configurable

smb_client behaviour is to die if there is an error. This is
a little heavy handed and make it impossible for example to
use smb_client to run a command that might fail (where such
a failure isn't really an error) E.G. Calling deltree and
the directory doesn't exist

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 363bfa4e1ca10e64057a6d04d6faff7c788db89d)

s3/script/tests: Remove make_path (for remote dir)

LOCALPATH is actually the local path to the share, we should
not need to create the share path (it should already exist)

Note: When we remove the tree located at LOCALPATH we keep the root
      so the share path should always be there

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 99ffa4a98287f125e45690e87b32616f4d4254e4)

selftest: make samba3.blackbox.smbclient_tar runnable (even manually)

samba3.blackbox.smbclient_tar is marked as flapping so it
seems we have missed that it has stopped working. The local path
passed to script/tests/test_smbclient_tarmode.pl must point to a
valid share

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 6f246658cf003f7e2f393f7b7490d9e8ae84e21c)

s3/script/tests: Fix samba3.blackbox.smbclient_tarmode cleanup

Make sure samba3.blackbox.smbclient_tarmode removes data files
not just before running the test but also after

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 4bb3bffa4b7a770d36138c45f717a9048ef82cff)

s3/script: Use smbclient deltree to clean up smbclient_tarmode subdir

Replace rm -rf of local dir (that is hosted remotely)
with smbclient deltree

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit fec1f8faffd9eb1aae77e7c515e57897be34a255)

s3/script/tests: Use tarmode share for samba3.blackbox.smbclient_tar*

After this change both samba3.blackbox.smbclient_tar &
samba3.blackbox.smbclient_tarmode now use the same dedicated share

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit be8dca68f89f110ef5947e0c2a7258554772cf9a)

s3/script/test: Use different testdir for samba3.blackbox.smbclient_tarmode

The other tarmode torture test samba3.blackbox.smbclient_tar now uses a share
'tarmode' which uses the same source path as samba3.blackbox.smbclient_tarmode

Avoid conflicting paths and use a new subdir (of the test share) called
'smbclient_tarmode'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 6cb0a00f4ab4bc1a8193d50cc076ec7174a5ece9)

selftest: Add a new tarmode shares

samba3.blackbox.smbclient_tar & samba3.blackbox.smbclient_tar
need separate shares with own xattr tdb(s)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a250f73366983d2a7397608a611f295f10dbb548)

s3/script/tests: Fix 'Unrecognized option(s) passed to mkpath()' error

'keep_root' is an unrecognised option for make_path/mkpath

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 4f5a7f11b7732c3efb511e68f6b9d434d59bb3e8)

Revert "vfs_ceph: drop fdopendir handler"

This reverts commit 76d7d05b1da6c0703b1c2bade0c4467c7cc1adec.
OpenDir_fsp() no longer falls back to regular open, so this hook is
required.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14519

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Samuel Cabrero <scabrero@samba.org>
Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Mon Oct  5 12:38:34 UTC 2020 on sn-devel-184

(cherry picked from commit 83ab59d929a6319c18341cb69d5084b563fb59bb)

smbclient: Fix recursive mget

Make do_mget rely on do_list() already doing the recursion in a
breadth-first manner. The previous code called do_list() from within
its callback. Unfortunately the recent simplifications of do_list()
broke this, leading to recursive mget to segfault. Instead of figuring
out how this worked before the simplifications in do_list() (I did
spend a few hours on this) and fixing it, I chose to restructure
do_mget() to not recursively call do_list() anymore but instead rely
on do_list() to do the recursion. Saves quite a few lines of code and
complexity.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Sep 30 17:23:45 UTC 2020 on sn-devel-184

(cherry picked from commit 9f24b5098f796f364a3f403ad4e9ae28b3c0935a)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Thu Nov 26 09:43:32 UTC 2020 on sn-devel-184

test3: Add a test showing that smbclient recursive mget is broken

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 254a5b034e5a081c9d3f28717a4b54d2af0180fc)

smbclient: Slightly simplify do_mget()

Put the prompt query into a separate if-statement, move the "quest"
variable closer to its use

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 71bc4d4b8d94458ac2e40d659f06110d434fd5c9)

smbclient: Remove the "abort_mget" variable

This was never set to true anywhere in the code

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 8fa451d2b052223a11b24ffc2a956b80d03aaa7c)

vfs_shadow_copy2: Preserve all open flags assuming ROFS

Instead of replacing open flags with just O_RDONLY, filter out all those
flags unrelated to a Read Only File System

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14573

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Nov 12 17:23:19 UTC 2020 on sn-devel-184

(cherry picked from commit e9e06a11daf036abf7a7022ebc8eaefde178aa52)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Thu Nov 19 11:24:37 UTC 2020 on sn-devel-184

s3: spoolss: Make parameters in call to user_ok_token() match all other uses.

We already have p->session_info->unix_info->unix_name, we don't
need to go through a legacy call to uidtoname(p->session_info->unix_token->uid).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14568

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Nov  9 04:10:45 UTC 2020 on sn-devel-184

(cherry picked from commit e5e1759057a767f517bf480a2172a36623df2799)

s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE().

They may have been carefully set by the aio_del_req_from_fsp()
destructor so we must not overwrite here.

Found via some *amazing* debugging work from Ashok Ramakrishnan <aramakrishnan@nasuni.com>.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14515

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Sep 30 11:18:43 UTC 2020 on sn-devel-184

(cherry picked from commit fca8cb63762faff54cda243c1ed8217b36333131)

interface: fix if_index is not parsed correctly

Replace probed_ifaces[i] with ifs.

In SDC 2020 SMB3 Virtual IO Lab,
run Windows Protocol Test Suite to test FileServer multichannel test cases.
Samba server has 2 virtual interfaces for VPN connection:
> name=tun2001, ip/mask=192.168.144.9/22
> name=tun2002, ip/mask=192.168.144.10/22
test suite client can ping these 2 ip addresses and browse shares.
Then client try to use IOCTL FSCTL_QUERY_NETWORK_INTERFACE_INFO to get the
virtual ip addresses of samba server, but samba server responded it
without the virtual ip addresses. My VPN setup is point-to-point and the
virtual interfaces 'tun2001' & 'tun2002' are without flag IFF_BROADCAST.
So edit smb.conf and add
"interfaces = ${virtual_ip}/${mask_length};if_index=${id}", like this:
> interfaces = eth4 eth8 eth11 eth10 qvs0 "192.168.144.9/22;if_index=50" "192.168.144.10/22;if_index=51"
then samba server IOCTL response could return the virtual ip addresses,
but found a issue:
the interface index of virtual ip addresses is always 4294967295
(0xFFFFFFFF, -1).

Quote Metze: https://gitlab.com/samba-team/devel/samba/-/commit/6cadb55d975a6348a417caed8b3258f5be2acba4#note_419181789
This looks good, I think that also explains
the possible memory corruption/crash I mentioned in the bug report.
As 'i' is most likely the same as 'total_probed' and
probed_ifaces[i] is not valid, so we overwrite unrelated memory.
Later I see 'realloc(): invalid pointer' and this backtrace:
  BACKTRACE:
   #0 log_stack_trace + 0x29 [ip=0x7f2f1b6fffa9] [sp=0x7ffcd0ab53e0]
   #1 smb_panic + 0x11 [ip=0x7f2f1b700301] [sp=0x7ffcd0ab5d10]
   #2 sig_fault + 0x54 [ip=0x7f2f1b7004f4] [sp=0x7ffcd0ab5e20]
   #3 funlockfile + 0x50 [ip=0x7f2f17ce6dd0] [sp=0x7ffcd0ab5ec0]
   #4 gsignal + 0x10f [ip=0x7f2f1794970f] [sp=0x7ffcd0ab6b90]
   #5 abort + 0x127 [ip=0x7f2f17933b25] [sp=0x7ffcd0ab6cb0]
   #6 __libc_message + 0x297 [ip=0x7f2f1798c897] [sp=0x7ffcd0ab6de0]
   #7 malloc_printerr + 0x1c [ip=0x7f2f17992fdc] [sp=0x7ffcd0ab6ef0]
   #8 realloc + 0x23a [ip=0x7f2f17997f6a] [sp=0x7ffcd0ab6f00]
   #9 _talloc_realloc + 0xee [ip=0x7f2f1a365d2e] [sp=0x7ffcd0ab6f50]
   #10 messaging_filtered_read_send + 0x18c [ip=0x7f2f1a10f54c] [sp=0x7ffcd0ab6fb0]
   #11 messaging_read_send + 0x55 [ip=0x7f2f1a10f705] [sp=0x7ffcd0ab7000]
   #12 smb2srv_session_table_init + 0x83 [ip=0x7f2f1b3a6cd3] [sp=0x7ffcd0ab7040]
   #13 smbXsrv_connection_init_tables + 0x2d [ip=0x7f2f1b373f4d] [sp=0x7ffcd0ab7060]
   #14 smbd_smb2_request_process_negprot + 0x827 [ip=0x7f2f1b38cb47] [sp=0x7ffcd0ab7080]
   #15 smbd_smb2_request_dispatch + 0x19db [ip=0x7f2f1b38921b] [sp=0x7ffcd0ab71d0]
   #16 smbd_smb2_process_negprot + 0x298 [ip=0x7f2f1b38bb38] [sp=0x7ffcd0ab7260]
   #17 process_smb + 0x2ca [ip=0x7f2f1b37537a] [sp=0x7ffcd0ab72b0]
   #18 smbd_server_connection_read_handler + 0xd0 [ip=0x7f2f1b376420] [sp=0x7ffcd0ab7350]

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14514

Signed-off-by: Jones Syue <jonessyue@qnap.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit b78ff5717654064c8a4facc54a8e9833e5843c21)

s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function.

file_lines_parse() plays horrible tricks with
the passed-in talloc pointers and the hierarcy
which makes freeing hard to get right.

As we know mem_ctx is freed by the caller, after
calling file_lines_parse don't free on exit and let the caller
handle it. This violates good Samba coding practice
but we know we're not leaking here.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Nov 11 15:02:27 UTC 2020 on sn-devel-184

(cherry picked from commit 457b49c67803dd95abc8502c2a410fac273f6fba)

libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob.

Blob could be NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14210

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Nov 16 09:47:38 UTC 2020 on sn-devel-184

(cherry picked from commit 26ba04a4d1987a859152751e6083d9b9aef770ff)

s3-vfs_glusterfs: always disable write-behind translator

The "pass-through" option has now been merged upstream as of:
https://github.com/gluster/glusterfs/pull/1640

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Pair-Programmed-With: Anoop C S <anoopcs@samba.org>
Pair-Programmed-With: Sachin Prabhu <sprabhu@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Nov  4 22:53:49 UTC 2020 on sn-devel-184

(cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Thu Nov  5 13:54:25 UTC 2020 on sn-devel-184

VERSION: Bump version up to 4.13.3...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

VERSION: Disable GIT_SNAPSHOT for the 4.13.2 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

WHATSNEW: Add relase notes for Samba 4.13.2.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Nov  3 01:56:59 UTC 2020 on sn-devel-184

(cherry picked from commit 7d846cd178d653600c71ee4bd6a491a9e48a56da)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Tue Nov  3 10:16:27 UTC 2020 on sn-devel-184

s3-vfs_glusterfs: refuse connection when write-behind xlator is present

s3-vfs_glusterfs: refuse connection when write-behind xlator is present

Once the new glusterfs api is available we will programmtically disable
the translator, for now we just refuse the connection as there is
a potential for serious data damage.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Pair-Programmed-With: Sachin Prabhu <sprabhu@redhat.com>
Pair-Programmed-With: Anoop C S <anoopcs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Nov  2 21:40:33 UTC 2020 on sn-devel-184

(cherry picked from commit 2a49ccbcf5e3ff0f6833bcb7f04b800125f1783f)

docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs

Add warning about data corruption with the write-behind translator.

The data corruption is highlighted by the smbtorture test smb2.rw.rw1.
More information about this data corruption issue is available in the
bz.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486

Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 08f8f665d409ee7b93840c25a8142f2ce8bacfa1)

s4:torture: Pass buffer correctly to write()

../../source4/torture/basic/denytest.c: In function ‘torture_createx_specific.isra’:
../../source4/torture/basic/denytest.c:2372:9: error: ‘write’ reading 56 bytes from a region of size 8 [-Werror=stringop-overflow=]
 2372 |   res = write(data_file_fd, &cxd, cxd_len);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14555

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 5f92ec6988d2f4c20eab9449cbe17317588f6634)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Fri Oct 30 13:53:37 UTC 2020 on sn-devel-184

DNS Resolver: support both dnspython before and after 2.0.0

`dnspython` 2.0.0 has many changes and several deprecations like:

```
> dns.resolver.resolve() has been added, allowing control of whether
search lists are used. dns.resolver.query() is retained for backwards
compatibility, but deprecated. The default for search list behavior can
be set at in the resolver object with the use_search_by_default
parameter. The default is False.

> dns.resolver.resolve_address() has been added, allowing easy
address-to-name lookups.
```

The new class `DNSResolver`:
- provides the compatibility layer
- defaults the previous behavior (the search list configured in the
  system's resolver configuration is used for relative names)
- defaults lifetime to 15sec (determines the number of seconds
  to spend trying to get an answer to the question)

The compatibility shim was developed by Stanislav Levin for FreeIPA and
adopted for Samba by Alexander Bokovoy.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14553

Signed-off-by: Stanislav Levin <slev@altlinux.org>
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 183d5d63f4b40accda3b3ffc980fea391612f964)

ctdb-common: Avoid aliasing errors during code optimization

When compiling with GCC 10.x and -O3 optimization, the IP checksum
calculation code generates wrong checksum.  The function uint16_checksum
gets inlined during optimization and ip4pkt->tcp data gets wrongly
aliased.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14537

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Wed Oct 21 05:52:28 UTC 2020 on sn-devel-184

(cherry picked from commit 6aa396b0cd1f83f45cb76a4f3123d99135e8dd8c)

vfs_zfsacl: only grant DELETE_CHILD if ACL tag is special

When ZFS aclmode is set to "passthrough" chmod(2)/fchmod(2) will result
in special entries being modified in a way such that delete, delete_child,
write_named_attr, write_attribute are stripped from the returned ACL entry,
and the kernel / ZFS treats this as having rights equivalent to the desired
POSIX mode. Historically, samba has added delete_child to the NFSv4 ACL, but
this is only really called for in the case of special entries in this
particular circumstance.

Alter circumstances in which delete_child is granted so that it only
is added to special entries. This preserves the intend post-chmod behavior,
but avoids unnecessarily increasing permissions in cases where it's not
intended. Further modification of this behavior may be required so that
we grant a general read or general write permissions set in case of
POSIX read / POSIX write on special entries.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14471
RN: vfs_zfsacl: only grant DELETE_CHILD if ACL tag is special

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit c1a37b4f31d5252ce074d41f69e526aa84b0d3b3)

vfs_zfsacl: use a helper variable in zfs_get_nt_acl_common()

No change in behaviour.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14471

Pair-Programmed-With: Andrew Walker <awalker@ixsystems.com>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 13b4f913b06457d8e1f7cf71c85722bbecabd990)

vfs_zfsacl: README.Coding fix

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14471

Pair-Programmed-With: Andrew Walker <awalker@ixsystems.com>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a182f2e6cdded739812e209430d340097acc0031)

vfs_zfsacl: Add new parameter to stop automatic addition of special entries

Prevent ZFS from automatically adding NFSv4 special entries (owner@, group@,
everyone@). ZFS will automatically add these these entries when calculating the
inherited ACL of new files if the ACL of the parent directory lacks an
inheriting special entry. This may result in user confusion and unexpected
change in permissions of files and directories as the inherited ACL is
generated. Blocking this behavior is achieved by setting an inheriting
everyone@ that grants no permissions and not adding the entry to the file's
Security Descriptor.

This change also updates behavior so that the fd-based syscall facl() is
used where possible.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14470
RN: vfs_zfsacl: Add new parameter to stop automatic addition of special entries

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit c10ae30c1185463eb937f69c1fc9914558087167)

vfs_zfsacl: use handle based facl() call to query ZFS filesytem ACL

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14470

Pair-Programmed-With: Andrew Walker <awalker@ixsystems.com>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit f763b1e43640082af80c855a4a519f7747a6c87c)

libndr: Avoid assigning duplicate versions to symbols

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14541

Symbols _ndr_push_error and _ndr_pull_error keep getting redefined as
they are included without wildcard in abi_match.  Apparently on linux ld
does not complain about duplicate symbols, but on freebsd ld fails to
link with following error:

  [ 918/3912] Linking bin/default/librpc/libndr.so
  ld: error: duplicate symbol '_ndr_pull_error' in version script
  ld: error: duplicate symbol '_ndr_push_error' in version script
  clang: error: linker command failed with exit code 1 (use -v to see invocation)

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 4cd195aafefb02b6921ea8439dd3897f8c74b012)

smb.conf.5: add clarification how configuration changes reflected by Samba

Users of Linux distributions know to read smb.conf(5) manual page but
apparently not many of them read smbd(8) and winbindd(8) to understand
how changes to smb.conf file are reflected in the running processes.

Add a small section that makes it clear where to find relevant
information. Also correct the information in smbd, nmbd, and winbindd
manual pages.

The interval at which smbd does check for smb.conf changes was increased
from 60 seconds to 180 seconds in 1999 with commit 3db52feb1f3b.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14538

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Tue Oct 20 08:50:13 UTC 2020 on sn-devel-184

(cherry picked from commit e32846f0692df44b4ee929c5ed6ba1de88ec4bd2)

VERSION: Bump version up to 4.13.2.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

Merge tag 'samba-4.13.1' into v4-13-test

samba: tag release samba-4.13.1

daemons: report status to systemd even when running in foreground

When systemd launches samba services, the configuration we have in
systemd service files expects that the main process (/usr/sbin/*)
would use sd_notify() to report back its status. However, we only use
sd_notify() when running become_daemon().

As a result, samba/smbd/winbindd/nmbd processes never report back its
status and the status updates from other childs (smbd, winbindd, etc)
are not accepted as we now have implied NotifyAccess=main since commit
d1740fb3d5a72cb49e30b330bb0b01e7ef3e09cc

This leads to a timeout and killing samba process by systemd. Situation
is reproducible in Fedora 33, for example.

Make sure that we have required status updates for all daemons in case
we aren't runnning in interactive mode.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14552

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Oct 26 19:58:18 UTC 2020 on sn-devel-184

(cherry picked from commit 3e27dc4847bd35ca8914be087d5a8ca096510399)

Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Tue Oct 27 10:50:29 UTC 2020 on sn-devel-184

VERSION: Disable GIT_SNAPSHOT for the 4.13.1 release.

o CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify.
o CVE-2020-14323: Unprivileged user can crash winbind.
o CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily
                  crafted records.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

WHATSNEW: Add release notes for Samba 4.13.1.

Signed-off-by: Karolin Seeger <kseeger@samba.org>

docs: fix default value of spoolss:architecture

"Windows x64" is the default here since a couple of years already.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14522

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Oct  6 23:06:50 UTC 2020 on sn-devel-184

(cherry picked from commit c587685dde2448d1f68ada47ce5ad42b02a118ce)

provision: BIND 9.17.x is not supported

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Thu Sep 24 05:55:43 UTC 2020 on sn-devel-184

(cherry picked from commit 1bccc67ce7c6364a95fbfeb095938522671578a8)

provision: Add support for BIND 9.16.x

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>
(cherry picked from commit 5b2ccb1c7cad5cded5dad37a18a7d42c1680b2f7)

bind9-dlz: Add support for BIND 9.16.x

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>
(cherry picked from commit ca3c18a236dedfdfbf225dcfcd0418f1634d8759)

provision: BIND 9.15.x is not supported

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>
(cherry picked from commit 4d09797652059c3ed5b2a4f94f2181ce14d39972)

provision: Add support for BIND 9.14.x

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>
(cherry picked from commit 016c1174ef783990f93e348ee82f5c989c43cbbf)

bind9-dlz: Add support for BIND 9.14.x

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>
(cherry picked from commit a167a2154d4909e8e1f97d9f36d0e4c947f2d944)

provision: BIND 9.13.x is not supported

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>
(cherry picked from commit 95278618829227632b2bcb29fc272e600607ea41)

bind9-dlz: Bind 9.13.x switched to using bool as isc_boolean_t instead of int.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Rowland Penny <rpenny@samba.org>
(cherry picked from commit cdb6c5d1eca1c0f6967941dbd1da07be6b53d302)

examples:auth: Do not install example plugin

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Oct 23 15:32:08 UTC 2020 on sn-devel-184

(cherry picked from commit 3b5b23ea848d82ec0a6d01d4e1cbb62c4c3cbb3b)

s3:modules: Do not install vfs modules only used for testing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 6e25613a3141000ac1b7e8edb146dfc320972e8b)

unittests: Mark test binaries for selftest

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 2d89ddb012d1d84871da10a61a0449f88d4eba5e)

buildtools: Do not install binaries which are for selftest

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 8fa0d3331b2b2c450d86bffec0a6f39320fcb8c0)

s3:script: Fix test_dfree_quota.sh

source3/script/tests/test_dfree_quota.sh: line 200: [: missing `]'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 9bc9f8ce66ef02d7d77cfd31dc2a72102d546d75)

third_party: Update resolv_wrapper to version 1.1.7

This fixes some Samba tests which redirect stderr to stdout and then get
more messages than expected.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14547

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit fbe58531a20cbbe0906f13e370329f3030d4ce96)

testprogs: Fix and improve upgradeprovision-oldrelease test

This fixes running `make test` in a release tarball!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Oct 22 17:28:39 UTC 2020 on sn-devel-184

(cherry picked from commit 1432d225b0426e366649cde4837eff58ee95b0c8)

testprogs: Fix and improve dbcheck-oldrelease test

This fixes running `make test` in a release tarball!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 32305d607f43a84fa862f9f97c0dc1ea51b45ab7)

testprogs: Fix and improve functionalprep test

This fixes running `make test` in a release tarball!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 28720d66df017bfaadd44378dfffaaab4e30cf22)

testprogs: Fix and improve dbcheck-links test

This fixes running `make test` in a release tarball!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit d8fe4315c85811ef3c5a1cfa42bf416bc1c8109e)

testprogs: Fix and improve runtime-links test

This fixes running `make test` in a release tarball!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit a9765084f11eae991516f150d1cd1c2370854ec7)

testprogs: Fix and improve tombstones-expunge test

This fixes running `make test` in a release tarball!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit e4194355f4c346179ceafe5086897c0c50c108d6)

testprogs: Fix and improve demote-saveddb test

This fixes running `make test` in a release tarball!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit e58ccdaa1a1e5943aa02ecba88d1de0323777041)

testprogs: Add remove_directory to common test functions

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 3770f28c6289a9328b81968a4548bfaeb8bd40aa)

python: Create targetdir recursively

This fixes `make test` in a release tarball.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 76db796181419967a483bcd71fe0cca313ccaf82)

nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h

glibc 2.32 will define these varibles [1] which results in conflicts
with these static function names, therefore prefix these function names
with samba_ to avoid it

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=499a92df8b9fc64a054cf3b7f728f8967fc1da7d

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Tue Jul 28 10:52:00 UTC 2020 on sn-devel-184

(cherry picked from commit 6e496aa3635557b59792e469f7c7f8eccd822322)

s4:dsdb:acl_read: Implement "List Object" mode feature

See [MS-ADTS] 5.1.3.3.6 Checking Object Visibility

I tried to avoid any possible overhead for the common cases:

- SEC_ADS_LIST (List Children) is already granted by default
- fDoListObject is off by default

Overhead is only added if the administrator turned on
the fDoListObject feature and removed SEC_ADS_LIST (List Children)
from a parent object.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Oct 21 08:48:02 UTC 2020 on sn-devel-184

(cherry picked from commit 7223f6453b1b38c933c9480c637ffd06d9f39b97)

s4:dsdb:util: add dsdb_do_list_object() helper

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit ffc0bdc6d49e88da1ee408956365da163ff3e1b2)

s4:dsdb:acl_read: defer LDB_ERR_NO_SUCH_OBJECT

We may need to return child objects even if the base dn
is invisible.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit e1529bedb2b6c8553e69a42537ac0cffd03af6d6)

s4:dsdb:acl_read: make use of aclread_check_object_visible() for the search base

We should only have one place to do access checks.

Use 'git show -w' to see the minimal diff.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit faff8e6c89777c38443e561235073c336cfb2e9c)

s4:dsdb:acl_read: fully set up 'struct aclread_context' before the search base acl check

This makes further change much easier.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit c4a3028de726d6708f57d02f9162a4d62d1b6ae7)

s4:dsdb:acl_read: introduce aclread_check_object_visible() helper

In future this will do more than aclread_check_parent(),
if we implement fDoListObject and SEC_ADS_LIST_OBJECT handling.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit d2dd7c2a5c1f8ee30f0f3b41f933d082b0c75f7c)

s4:dsdb:tests: add AclVisibiltyTests

This tests a sorts of combinations in order to
demonstrate the visibility of objects depending on:

- with or without fDoListObject
- with or without explicit DENY ACEs
- A hierachy of objects with 4 levels from the base dn
- SEC_ADS_LIST (List Children)
- SEC_ADS_LIST_LIST_OBJECT (List Object)
- SEC_ADS_READ_PROP
- all possible scopes and basedns

This demonstrates that NO_SUCH_OBJECT doesn't depend purely
on the visibility of the base dn, it's still possible to
get children returned und an invisible base dn.

It also demonstrates the additional behavior with "List Object" mode.
See [MS-ADTS] 5.1.3.3.6 Checking Object Visibility

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 06d134406739e76b97273db3023855150dbaebbc)

python/tests: add DynamicTestCase setUpDynamicTestCases() infrastructure

This can be used in order to run a sepcific test (coded just once)
with an autogenerated set of arguments.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Pair-Programmed-With: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 80347deb544b38be6c6814e5d1b82e48ebe83fd1)

ctdb-tests: Strengthen node state checking in ctdb disable/enable test

Check that the desired state is set on all nodes instead of just the
test node.  This ensures that node flags have correctly propagated
across the cluster.

RN: Fix remaining ctdb disable/enable bug

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14513
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Tue Oct  6 04:32:06 UTC 2020 on sn-devel-184

(cherry picked from commit b68105b8f7c20692d23d457f2777edcf44f12bb8)
Signed-off-by: Martin Schwenke <martin@meltin.net>

ctdb-recoverd: Drop unnecessary and broken code

update_flags() has already updated the recovery master's canonical
node map, based on the flags from each remote node, and pushed out
these flags to all nodes.

If i == j then the node map has already been updated from this remote
node's flags, so simply drop this case.

Although update_flags() has updated flags for all nodes, it did not
update each node map in remote_nodemaps[] to reflect this.  This means
that remote_nodemaps[] may contain inconsistent flags for some nodes
so it should not be used to check consistency when i != j.

Further, a meaningful difference in flags can only really occur if
update_flags() failed.  In that case this code is never reached.

These observations combine to imply that this whole loop should be
dropped.

This leaves potential sub-second inconsistencies due to out-of-band
healthy/unhealthy flag changes pushed via CTDB_SRVID_PUSH_NODE_FLAGS.
These updates could be dropped (takeover run asks each node for
available IPs rather than making centralised decisions based on node
flags) but for now they will be fixed in the next iteration of
main_loop().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14513
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit 4b01f54041dee469971f244e64064eed46de2ed5)