idmap: centrally check that unix IDs returned by the idmap backends are in range

Note: in the long run, it might be good to move this kind of
exit check (before handing the result back to the client)
to the parent winbindd code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12155

Signed-off-by: Michael Adam <obnox@samba.org>
(Backported from master commit b2bf61307cffd8ff7b6fb9852c107ab763653119.)

idmap: don't generally forbid id==0 from idmap_unix_id_is_in_range()

If the range allows it, then id==0 should not be forbidden.
This seems to have been taken in from idmap_ldap when the
function was originally created.

See 634cd2e0451d4388c3e3f78239495cf595368b15 .
The other backends don't seem to have had that
extra check for id == 0.

The reasoning for this change is that the range check should
apply to all cases. If the range includes the 0, then it
should be possible to get it as result. In particular,
this way, the function becomes applicable also to the
passdb backend case, e.g. in a samba4-ad-dc setup where
the Admin gets uid == 0.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12155

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit c21976d4b1c604699299f2c0f768c1add93b349d)

libgpo: Correctly use the 'server' parameter after parsing it out of the GPO path.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12135

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 2a8ccc0841184c2df9fc19f8452009b92071c115)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Tue Aug 16 16:26:28 CEST 2016 on sn-devel-144

s3: libsmb: Protect cli_connect_nb_send() from being passed a NULL hostname and dest_ss.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12135

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 27ebf64b347a770e0d1ad4f1db645cb1b8dd5861)

ldb-samba: Add "secret" as a value to hide in LDIF files

This is not secret or encrypted in LDAP, but is sensitive in secrets.ldb

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Wed May 11 07:17:38 CEST 2016 on sn-devel-144

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12154

(cherry picked from commit 15f191a2329d08b92111f71e22f8a28c8a39c193)

Autobuild-User(v4-4-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-4-test): Tue Aug 16 09:53:00 CEST 2016 on sn-devel-144

samba-tool/ldapcmp: ignore differences of whenChanged

This is implicitly replicated, but may diverge on updates of non-replicated
attributes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12129

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Aug  8 17:34:24 CEST 2016 on sn-devel-144

(cherry picked from commit a0e60e96aa38407ded8d63650dcf8f39304c958a)

script/autobuild.py: include the branch name in the output

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Aug 11 08:38:47 CEST 2016 on sn-devel-144

(cherry picked from commit 98d289d2e5162a23d15562b009d0edf20a55a56b)

autobuild: fix typo in autobuild success subject line

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Thu May  5 04:15:16 CEST 2016 on sn-devel-144

(cherry picked from commit 2fe2e662dba080536a0f6c5485514097dd74a65a)

autobuild: Return the last 50 log lines

This means that you don't have to deal with tars for quickly determining
the cause of a failure.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 3751ffbbe75524984a822d65f623a040ca79c8f7)

dbwrap_ctdb: treat empty records in ltdb as non-existing

When fetching records from remote ctdb nodes via ctdbd_parse() or in
db_ctdb_traverse(), we already check for tombstone records and skip
them. This was originally also done for the ltdb checks.

See also bug: https://bugzilla.samba.org/show_bug.cgi?id=10008
(commit 1cae59ce112ccb51b45357a52b902f80fce1eef1).

Commit 925625b52886d40b50fc631bad8bdc81970f7598 reverted part of the
patch of bug 10008 due to a deadlock it introduced.

This patch re-introduces the consistent treatment of empty records in
the ltdb but avoids the deadlock by correctly signalling
NT_STATUS_NOT_FOUND if an empty record is found authoritatively in
the ltdb and not calling ctdb in this case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12005

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Aug  9 04:38:44 CEST 2016 on sn-devel-144

(backported from commit 25df582739918b7afd4e5497eaffe279e2d92cd1)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Wed Aug 10 12:42:51 CEST 2016 on sn-devel-144

s4/torture: add a test for ctdb-tombstrone-record deadlock

This tests for a possible deadlock between smbd and ctdb dealing with
ctdb tombstone records.

Commit 925625b52886d40b50fc631bad8bdc81970f7598 explains the deadlock in
more details and contains the fix. It's a fix for a regression
introduced by the patch for bug 10008 (1cae59ce112c).

If you ever want to use this test against that specific commit:

$ git checkout 925625b52886d40b50fc631bad8bdc81970f7598
$ git cherry-pick THIS_COMMIT

This should not deadlock on a ctdb cluster.

$ git revert 925625b52886d40b50fc631bad8bdc81970f7598

This will deadlock.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12005

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit b17e2f5c740fb081c007ed2e1c23138ffcba1469)

smbd: ignore ctdb tombstone records in fetch_share_mode_unlocked_parser()

dbwrap_parse_record() can return ctdb tombstone records from the lctdb,
ignore them.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12005

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 7147859c7afc1344e76485e2cbc286679110d96e)

ctdb-daemon: Fix CID 1125627 Resource leak (RESOURCE_LEAK)

Also fixes CID 1125628.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit 940272d215049f5f5079aa926e69eae1985a4bfa)

ctdb-common: Fix CID 1125585 Dereference after null check (FORWARD_NULL)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit b4f23a7e95cd9c8fc4a6324d4ec5a2881eaec207)

ctdb-common: Fix CID 1125583 Dereference after null check (FORWARD_NULL)

This also fixes CID 1125584.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit bbf0b907cb04184515d0f5f09f14824df1c2e59f)

ctdb-common: Fix CID 1125581 Dereference after null check (FORWARD_NULL)

This also fixes CID 1125582.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit 7ae3699831427725f12e0a26a0681e59f2fbb2d9)

ctdb-daemon: Fix CID 1363067 Resource leak (RESOURCE_LEAK)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit c6a7f680ce74d4a630fa9305d0a926cc1a4b3d2c)

ctdb-daemon: Fix CID 1363233 Resource leak (RESOURCE_LEAK)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit 74aca5f4c671d9f15ae6c3a901978a1cf247dd6f)

ctdb-utils: Fix CID 1297451 Explicit null dereferenced (FORWARD_NULL)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit d46960f20e795cd4abc1c727705f77b2f0e0e564)

ctdb-common: Consistently use strlcpy() on interface names

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit aff33a59479cafcb1f24a07ff76383d47bb196b3)

ctdb-common: Fix CID 1125553 Buffer not null terminated (BUFFER_SIZE_WARNING)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit 763f9c13f2998a8858e8a3ec013d166a3d429835)

ctdb-daemon: Fix CID 1364527/8/9: Null pointer dereferences (NULL_RETURNS)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12110

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit ed81e51cc1633cecfef05b84c0595418db8a384b)

ctdb-packaging: Move ctdb tests to libexec directory

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12104

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 87c38d5d741f5e58f643ad4f797c523c67bbab00)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Mon Aug  8 12:45:56 CEST 2016 on sn-devel-144

ctdb-waf: Move ctdb tests to libexec directory

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12104

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
(cherry picked from commit f9c85d04e9edb3af9479e9c83d5b1ec77b9c2ee2)

man: Wrong option for parameter ldap ssl in smb.conf man page

- "ldap ssl" does not accept the value "yes"
- Replaced "start_tls" with "start tls".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12023

Signed-off-by: Marc Muehlfeld <mmuehlfeld@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 976be8fe39c78acfd3c2a23302d26cc262be0ae0)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Fri Aug  5 13:37:41 CEST 2016 on sn-devel-144

async_req: make async_connect_send() "reentrant"

Allow callers to pass in socket fds that where already passed to an
earlier call of async_connect_send(). Callers expect this behaviour and
it was working until 05d4dbda8357712cb81008e0d611fdb0e7239587 broke it.

The proper fix would be to change callers to close the fd and start from
scratch with a fresh socket.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12105

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Aug  4 05:03:21 CEST 2016 on sn-devel-144

(cherry picked from commit 9c6a4ea2788808bdcc7bfea798d838ea56c3b5ec)

vfs_acl_xattr: objects without NT ACL xattr

Even with "ignore system acls" set to "yes", for objects without NT ACL
xattr we use the underlying filesystem permissions to construct an NT
ACL. This can result in *very* unexpected permissions, eg:

- a directory with the following ACL:

$ ./bin/smbcacls -Uslow%pass //localhost/normal ""
REVISION:1
CONTROL:SR|DP
OWNER:SLOW\slow
GROUP:Unix Group\root
ACL:SLOW\slow:ALLOWED/0x0/FULL

So only one non-inheritable(!) ACE.

- creating a subdirectory:

$ ./bin/smbclient -Uslow%pass //localhost/normal -c "mkdir dir1"

- checking whether there's an ACL xattr:

$ getfattr -m "" /Volumes/normal/dir1
getfattr: Removing leading '/' from absolute path names
system.posix_acl_access
system.posix_acl_default
user.DOSATTRIB

So there isn't an ACL xattr, because there where no inheritable ACEs on
the parent folder.

- reading the new subdirectories ACL:

$ ./bin/smbcacls -Uslow%pass //localhost/normal "dir1"
REVISION:1
CONTROL:SR|DP
OWNER:SLOW\slow
GROUP:Unix Group\slow
ACL:SLOW\slow:ALLOWED/0x0/FULL
ACL:Unix Group\slow:ALLOWED/0x0/READ
ACL:Everyone:ALLOWED/0x0/READ
ACL:NT Authority\SYSTEM:ALLOWED/0x0/FULL

The ACES for "SLOW\slow", "Unix Group\slow" and "Everyone" are coming
from the underlying filesystem. This is the problem.

- Windows assigns the following ACL in this situation:

$ ./bin/smbcacls -UAdministrator%Passw0rd //10.10.10.14/data "dir"
REVISION:1
CONTROL:SR|PD|DI|DP
OWNER:VORDEFINIERT\Administratoren
GROUP:WIN2008R2\Domänen-Benutzer
ACL:WIN2008R2\Administrator:ALLOWED/0x0/FULL

$ ./bin/smbclient -UAdministrator%Passw0rd //10.10.10.14/data -c "mkdir dir\dir1"

$ ./bin/smbcacls -UAdministrator%Passw0rd //10.10.10.14/data "dir\dir1"
REVISION:1
CONTROL:SR|DI|DP
OWNER:VORDEFINIERT\Administratoren
GROUP:WIN2008R2\Domänen-Benutzer
ACL:VORDEFINIERT\Administratoren:ALLOWED/0x0/FULL
ACL:NT-AUTORITÄT\SYSTEM:ALLOWED/0x0/FULL

By changing make_default_filesystem_acl() to only adds user and system
ACE to the ACL of objects that lack an ACL xattr, we match Windows
behaviour:

$ ./bin/smbclient -Uslow%pass //localhost/normal -c "mkdir dir2"

$ ./bin/smbcacls -Uslow%pass //localhost/normal "dir2"
REVISION:1
CONTROL:SR|DP
OWNER:SLOW\slow
GROUP:Unix Group\slow
ACL:SLOW\slow:ALLOWED/0x0/FULL
ACL:NT Authority\SYSTEM:ALLOWED/0x0/FULL

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12028

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Jul 19 10:22:05 CEST 2016 on sn-devel-144

(cherry picked from commit 961c4b591bb102751079d9cc92d7aa1c37f1958c)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Thu Aug  4 14:49:18 CEST 2016 on sn-devel-144

s3/smbd: move make_default_filesystem_acl() to vfs_acl_common.c

This function is only used in vfs_acl_common.c and will be modified in
the next commit.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12028

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit afc2417b107af572081974ff9d013ddec890d31f)

s3-rpc_server/mdssd: use smbd_reinit_after_fork()

Using smbd_reinit_after_fork() rather then reinit_after_fork() ensures
am_parent is reset to NULL. Otherwise, when exiting for some reason, the
inherited atexit handler killkids() calls kill(0,SIGTERM) terminating
our whole process group including the main smbd.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12016

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jul 11 02:02:33 CEST 2016 on sn-devel-144

(cherry picked from commit 6efd0af5e8d8ee81b5f53afb126d87950088b7cd)

smbd/notifyd: use smbd_reinit_after_fork()

Using smbd_reinit_after_fork() rather then reinit_after_fork() ensures
am_parent is reset to NULL. Otherwise, when exiting for some reason, the
inherited atexit handler killkids() calls kill(0,SIGTERM) terminating
our whole process group including the main smbd.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12016

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit bb90a8484a734b76ddd4d270f31fcdb4ae6cc48d)

smbd/cleanupd: use smbd_reinit_after_fork()

Using smbd_reinit_after_fork() rather then reinit_after_fork() ensures
am_parent is reset to NULL. Otherwise, when exiting for some reason, the
inherited atexit handler killkids() calls kill(0,SIGTERM) terminating
our whole process group including the main smbd.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12016

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 3a0c16b08c7dcfe389fbc429aae734ff52c84166)

selftest: test idmap backend id allocation for unknown SIDS

If an SID is is not found becaues the RID doesn't exist in a domain and
the domain is configured to use a non-allocating idmap backend like
idmap_ad or idmap_rfc2307, winbindd must not return a mapping for the
SID.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11961

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 2a322a7671c9ffd0dd600142dd76b5b51a67e185)

selftest: make autorid the default idmap backend in admember_rfc2307

This is needed for a new test in the next commit. Exisiting tests aren't
affected by this, at least a private autobuild passed with this
change.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11961

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit aa54fa4e88cc80bc7841beba3a5561ad2c83dc80)

winbindd: in wb_lookupsids return domain name if we have it

When doing a SID to xid mapping for an unknown SID, the idmap child gets
passed a lsa_RefDomainList with an empty domain name (ie ""). This is
coming from LsaLookupSids() and causes the mapping request to end up in
the default idmap domain.

Example request with domain name "":

  wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs
     in: struct wbint_Sids2UnixIDs
         domains                  : *
             domains: struct lsa_RefDomainList
                 count                    : 0x00000001 (1)
                 domains                  : *
                     domains: ARRAY(1)
                         domains: struct lsa_DomainInfo
                             name: struct lsa_StringLarge
                                 length                   : 0x0000 (0)
                                 size                     : 0x0002 (2)
                                 string                   : *
                                     string                   : ''
                             sid                      : *
                                 sid                      : S-1-5-21-3152989960-574718769-2188965058
                 max_size                 : 0x00000020 (32)
         ids                      : *
             ids: struct wbint_TransIDArray
                 num_ids                  : 0x00000001 (1)
                 ids: ARRAY(1)
                     ids: struct wbint_TransID
                         type                     : ID_TYPE_NOT_SPECIFIED (0)
                         domain_index             : 0x00000000 (0)
                         rid                      : 0x000029aa (66666)
                         xid: struct unixid
                             id                       : 0xffffffff (4294967295)
                             type                     : ID_TYPE_NOT_SPECIFIED (0)

In _wbint_Sids2UnixIDs() we call idmap_find_domain_with_sid() with the
domain name "" and this triggers use of the default idmap domain which
in case of idmap_autorid will allocate an id from a idmap_autorid range.

If we know the domain, ensure we return it for SIDs were the SID was not
found but the domain of the SID was found. Callers like sids2xids depend
on the domain name and returning an empty string "" for valid domain can
trigger unwanted idmap range allocations.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11961

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 9be918116e356c358ef77cc2933e471090088293)

winbindd/idmap_rfc2307: fix a crash

map->map is NULL if lookupsid failed.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11961

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 5e346af078847512e86755a4634583a8a5178c0e)

s3:mdssvc: older glib2 versions require g_type_init()

Older glib2 versions will crash if g_type_init is not called:

(process:6712): GLib-GObject-CRITICAL **: ... ./gobject/gtype.c:2722:
You forgot to call g_type_init()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11801

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 18 03:52:55 CET 2016 on sn-devel-144

(cherry picked from commit 3563d79a8cb625ae78523cb32330c9f61c6c3a2f)

s3: smbd: Fix delete operations enumerating streams inside a file. This must always be done as a Windows operation.

When using UNIX extensions to delete a file containing streams,
the open for delete and close operations need to enumerate the
contained streams and do CREATE and UNLINK operations on the
stream names. These must always be done as Windows operations
(use lp_set_posix_pathnames(false) to flip the processing) as
the stream names are Windows paths.

Without this the create operation under the unlink will
recurse and cause the client to time out (or a server crash).

This (hack) is only needed for 4.4.x and below, it is fixed
correctly in 4.5.x.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12021

Signed-off-by: Jeremy Allison <jra@samba.org>
Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Tue Aug  2 16:25:32 CEST 2016 on sn-devel-144

s3: smbd: Change lp_set_posix_pathnames() to take a newval parameter and return the old one.

Currently only used in one place, but we'll need to use it to
temporarily change pathname processing to fix bug 12021.

This (hack) is only needed for 4.4.x and below, it is fixed
correctly in 4.5.x.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12021

Signed-off-by: Jeremy Allison <jra@samba.org>

python/remove_dc: handle dnsNode objects without dnsRecord attribute

If we have dnsNode objects without dnsRecord attribute values we trigger
the following error triggered by 'samba-tool domain demote --remove-other-dead-server=server2'

  ERROR(<type 'exceptions.TypeError'>): uncaught exception - __ndr_unpack__()
  argument 1 must be string or read-only buffer, not dnsp.DnssrvRpcRecord
    File "/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py", line 175,
  in _run
      return self.run(*args, **kwargs)
    File "/usr/lib64/python2.6/site-packages/samba/netcmd/domain.py", line 720, in
  run
      remove_dc.remove_dc(samdb, logger, remove_other_dead_server)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 423, in
  remove_dc
      remove_dns_account=True)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 351, in
  offline_remove_ntds_dc
      remove_dns_account=remove_dns_account)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 266, in
  offline_remove_server
      remove_dns_references(samdb, logger, dnsHostName)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 186, in
  remove_dns_references
      for v in values if not to_remove(v) ]
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 160, in
  to_remove
      dnsRecord = ndr_unpack(dnsp.DnssrvRpcRecord, value)
    File "/usr/lib64/python2.6/site-packages/samba/ndr.py", line 45, in ndr_unpack
      object.__ndr_unpack__(data, allow_remaining=allow_remaining)
  A transaction is still active in ldb context [0xe1f320] on
  tdb:///var/lib/samba/private/sam.ldb

"next" is used in perl not in python!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12018

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 13 10:10:30 CEST 2016 on sn-devel-144

(cherry picked from commit f8181360a89ac9e53cc991e966958e496271fa15)

s4: ldb: Ignore case of "range" in sscanf as we've already checked for its presence.

https://bugzilla.samba.org/show_bug.cgi?id=11838

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 1d4b20d4f3829eb3778006397990cd9fee4966a5)

third_party/zlib/zlib.h: use HAVE___ATTRIBUTE__ instead of __GNUC__

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11750

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Thu Mar 24 18:43:34 CET 2016 on sn-devel-144

(cherry picked from commit d64877541036c6b82aa0204671bfdae08936b529)

s4/lib/wmi_wrap: use HAVE___ATTRIBUTE__ instead of __GNUC__

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11750

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 82258aa2a6ff1a8d139f60abb170aaffb0934025)

mdssvc/sparql_parser.c: use HAVE___ATTRIBUTE__ instead of __GNUC__

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11750

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 7b92b84415dd3292538eb4e44fac12b4e564b984)

s3/modules/getdate: use HAVE___ATTRIBUTE__ instead of __GNUC__

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11750

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit fb0ebbfcbfb5754b0fca7b309eaded0e57877230)

tevent.h: use HAVE___ATTRIBUTE__ instead of __GNUC__

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11750

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit a20ee62984bdb623f8fa55a9900cb69a99bf38e6)

libreplace: use HAVE___ATTRIBUTE__ instead of __GNUC__

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11750

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 6ba2fe2e3f1ad27b12f4ef67f41c7ad4f29f17c3)

util/attr.h: use HAVE___ATTRIBUTE__, not __GNUC__ comparisons

The comparisons that look like

    #if (__GNUC__ >= 3) && (__GNUC_MINOR__ >= 1 )

fail if __GNUC_MINOR__ is 0.  The intended comparison is something
more like

    #if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 1)

However, given that:

 * these checks are really trying to test the presence of
   __attribute__,

 * there are now credible compilers that are not GCC, which have
   __attribute__ but might not be good at emulating __GNUC__
   numbers, and

 * we really face little risk of running into GCC 2.95

 * we have a HAVE___ATTRIBUTE__ check in ./configure

let's not do the version comparisons.

(Untested on GCC 2.95, GCC 3.0 and GCC 3.1).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11750

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 88be24c279e29a363c2aabcb68b5f0a1e039f477)

configure: set HAVE___ATTRIBUTE__ for heimdal

Without this, heimdal ends up defining __attribute__ away, causing
gcc-6 compile errors with -Werror=return-type because it can't tell
when functions have __attribute__((noreturn)).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11750

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Mar  9 13:52:26 CET 2016 on sn-devel-144

(cherry picked from commit 1c796547f20fa3c7c2e93fd5ce6ee8453a2bb435)

param: Correct the defaults for "dcerpc endpoint services"

We must not list any services that we skip building, as otherwise all RPC services fail to start.

We now build without the source4 spoolss server in non-developer builds

This fixes commit 0b4c741b9c03d147ee5f56d027bacda75c1b5282

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12025
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 748384992b96c3936d82bc09f39459fb4bd489bd)

build: Always build eventlog6. This is not a duplicate of eventlog

The eventlog6 pipe is not a duplicate with the source3 code, so should be built even
for the default build with smbd for file serving

This fixes commit 0b4c741b9c03d147ee5f56d027bacda75c1b5282

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12026
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit d183261e6844724394d618912403cd0217401741)

libads: ensure the right ccache is used during spnego bind

When doing spnego sasl bind:
1. Try working without kinit only if a password is not
   provided
2. When using kinit, ensure the KRB5CCNAME env var is set
   to a private memory ccache, so that the bind is on behalf
   of the requested user.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12007

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jul 12 03:23:33 CEST 2016 on sn-devel-144

(cherry picked from commit a1743de74f09d5bf695f077f5127d02352a014e2)

libads: ensure the right ccache is used during gssapi bind

When doing gssapi sasl bind:
1. Try working without kinit only if a password is not
   provided
2. When using kinit, ensure the KRB5CCNAME env var is set
   to a private memory ccache, so that the bind is on behalf
   of the requested user.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12007

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit 2672968851966e5c01e4fc4d906b45b5c047e655)

auth: fix a memory leak in gssapi_get_session_key()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12006

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Richard Sharpe <sharpe@samba.org>
Autobuild-Date(master): Wed Jul  6 00:40:15 CEST 2016 on sn-devel-144

(cherry picked from commit 77f3730295735dc9465c8e3d07fc761c83761b6e)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Fri Jul  8 12:59:29 CEST 2016 on sn-devel-144

s3-libads: fix a memory leak in ads_sasl_spnego_bind()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12006

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit a646d9e796902dcb5246eb585433d4859796be2f)

VERSION: Bump version up to 4.4.6...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(v4-4-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-4-test): Fri Jul  8 07:34:51 CEST 2016 on sn-devel-144

Merge tag 'samba-4.4.5' into v4-4-test

samba: tag release samba-4.4.5

VERSION: Disable git snapshots for the 4.4.5 release.

CVE-2016-2119: Client side SMB2 signing downgrade.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Karolin Seeger <kseeger@samba.org>

WHATSNEW: Add release notes for Samba 4.4.5.

CVE-2016-2119: Client side SMB2 signing downgrade.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Karolin Seeger <kseeger@samba.org>

CVE-2016-2019: s3:selftest: add regression tests for guest logins and mandatory signing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>

CVE-2016-2019: s3:libsmb: add comment regarding smbXcli_session_is_guest() with mandatory signing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>

CVE-2016-2019: libcli/smb: don't allow guest sessions if we require signing

Note real anonymous sessions (with "" as username) don't hit this
as we don't even call smb2cli_session_set_session_key() in that case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>

dcerpc.idl: remove unused DCERPC_NCACN_PAYLOAD_MAX_SIZE

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit d9e242e9035c15e49b041afc61e5a4a08877f289)

s4:rpc_server: use a variable for the max total reassembled request payload

We still use the same limit of 4 MByte (DCERPC_NCACN_REQUEST_DEFAULT_MAX_SIZE)
by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 23 04:51:16 CEST 2016 on sn-devel-144

(cherry picked from commit 3f36d31c848496bf509db573e4c12821905b448d)

s4:librpc/rpc: allow a total reassembled response payload of 240 MBytes

This will replace DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte),
The limit of DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte) was too
strict for some workloads, e.g. DRSUAPI replication with large objects.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 7413e73c5331b760dc84b3843059230ec5fcfc7b)

dcerpc.idl: add DCERPC_NCACN_{REQUEST,RESPONSE}_DEFAULT_MAX_SIZE

This will replace DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte),
this limit is too strict for some workloads, e.g. DRSUAPI replication
with large objects.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 281e11b53f676647997fb9ce21227782529a62ad)

s3-winbind: Fix memory leak with each cached credential login

When we allow offline logon and have a lot of logins, windbind will leak
4k of memory which each log in. On systems with heavy load this can grow
quickly and the OOM killer will kill Winbind.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11999

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jun 29 19:03:53 CEST 2016 on sn-devel-144

(cherry picked from commit 826f61960ec74deedc9d556a3b8fe04d9178dcd8)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Mon Jul  4 13:04:53 CEST 2016 on sn-devel-144

VERSION: Bump version up to 4.4.5...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit e9ea633d3c673432dc6ce21e1fddde59f88f3720)

libutil: Support systemd 230

systemd 230 version finally deprecated
libsystemd-daemon/libsystemd-journal split and put everything in
libsystemd library.

Make sure HAVE_LIBSYSTEMD define is supported in the code (we already
have it defined by the waf).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11936

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Richard Sharpe <rsharpe@samba.org>
Autobuild-User(master): Richard Sharpe <sharpe@samba.org>
Autobuild-Date(master): Mon Jun 27 00:01:55 CEST 2016 on sn-devel-144

(cherry picked from commit 8813faffe3ce4b598b626afea4bf90405c8129d8)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Tue Jun 28 16:54:43 CEST 2016 on sn-devel-144

s4/torture: add a test for dosmode and hidden files

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 2db5c10ac59d5362e81c50d9a854071477de9c12)

s3/smbd: only use stored dos attributes for open_match_attributes() check

This changes the way we check for old vs new DOS attributes on open with
overwrite: only check against the DOS attributes actually set by a
client and stored in the DOS attributes xattr.

With this change "hide dot files" and "hide files" continue to work with
"store dos attributes = yes".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 36b7cff3188bbc21048c12ec971d9c2ac3666226)

s3/smbd: make get_ea_dos_attribute() public

Needed in a subsequent commit to read the stored dosmode for a file.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>

s3/smbd: move check for "hide files" to dos_mode_from_name()

Consolidate the "hide dot files" and "hide files" handling stuff in one
function. No change in overall behaviour.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit f2a53efb1aab0986d6a7d9621b1efff2127df4e6)

s3/smbd: call dos_mode_from_name after get_ea_dos_attribute()

This doesn't change overall behaviour in any way, it just prepares for
the next step where the IS_HIDDEN_PATH() stuff will be moved to the
function dos_mode_from_name().

It allows an optimisation by not checking "hide to files" patch if
FILE_ATTRIBUTE_HIDDEN was already set in the DOS xattr.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit 1be877038c53c88802bc19c00a49c1974f17c4eb)

s3/smbd: add helper func dos_mode_from_name()

This just moves the computation of "hide dot files" files to a helper
functions without changing overall behaviour.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11992

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit c8c67c9a2a6347e36f4628e2d0260bd6c58d8c65)

dcerpc.idl: remove unused DCERPC_NCACN_PAYLOAD_MAX_SIZE

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit d9e242e9035c15e49b041afc61e5a4a08877f289)

s4:rpc_server: use a variable for the max total reassembled request payload

We still use the same limit of 4 MByte (DCERPC_NCACN_REQUEST_DEFAULT_MAX_SIZE)
by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 23 04:51:16 CEST 2016 on sn-devel-144

(cherry picked from commit 3f36d31c848496bf509db573e4c12821905b448d)

s4:librpc/rpc: allow a total reassembled response payload of 240 MBytes

This will replace DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte),
The limit of DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte) was too
strict for some workloads, e.g. DRSUAPI replication with large objects.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 7413e73c5331b760dc84b3843059230ec5fcfc7b)

dcerpc.idl: add DCERPC_NCACN_{REQUEST,RESPONSE}_DEFAULT_MAX_SIZE

This will replace DCERPC_NCACN_PAYLOAD_MAX_SIZE (4 MByte),
this limit is too strict for some workloads, e.g. DRSUAPI replication
with large objects.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11948

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 281e11b53f676647997fb9ce21227782529a62ad)

python/tests: add auth_pad test for the dcerpc raw_protocol test

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jun 24 18:08:44 CEST 2016 on sn-devel-144

(cherry picked from commit c49f9abb19adca999d0b1d897d00d91f0ad91bbd)

s4:rpc_server: generate the correct error when we got an invalid auth_pad_length on BIND,ALTER,AUTH3

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 7d8edcc24148658e92729b3d155e432994e27525)

librpc/rpc: ignore invalid auth_pad_length values in BIND, ALTER and AUTH3 pdus

This is a workarround for a bug in old Samba releases.
For BIND_ACK <= 3.5.x and for ALTER_RESP <= 4.2.x (see bug #11061).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit aef032302863e5f3a888dbf4c52b21d561a0dff4)

librpc/rpc: let dcerpc_pull_auth_trailer() check that auth_pad_length fits within the whole pdu.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 3f7e3ed8a276f16aaed87c1f3cd5b9781aa7e1af)

librpc/rpc: let dcerpc_pull_auth_trailer() only accept auth_length!=NULL or auth_data_only=true

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit f386e81b982cd551313eb9c0f7d2f70d65515d80)

s4:librpc/rpc: don't ask for auth_length if we ask for auth data only

dcerpc_pull_auth_trailer() handles auth_length=NULL just fine.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit e05c732c6074df2524403ad7bb30eade91443525)

s4:rpc_server: parse auth data only for BIND,ALTER_REQ,AUTH3

We should tell dcerpc_pull_auth_trailer() that we only want
auth data.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11982

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 505a4e68d96e6fb3d8c7493632ecb4b0fc6caa9d)

build: Build less of Samba when building --without-ntvfs-fileserver

We would build, but not use, many components of the NTVFS file server
even when we asked not to.  They would then consume disk, but not be
of any use

https://bugzilla.samba.org/show_bug.cgi?id=11991

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit 0b4c741b9c03d147ee5f56d027bacda75c1b5282)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Fri Jun 24 12:50:12 CEST 2016 on sn-devel-144

s3: libsmb: Correctly trim a trailing \\ character in cli_smb2_create_fnum_send() when passing a pathname to SMB2 create.

We already trim any leading \\ characters in this function, so this is the simplest place
to clean the pathname.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11986

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Wed Jun 22 10:33:29 CEST 2016 on sn-devel-144

(cherry picked from commit c0704d99ce43a5497a29bfc53331159e4f978441)

selftest: Add a DNS test matching Windows

This performs the same steps as Windows does

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit c752e93fc5960d2d31d80fcf608eff0fbfa784a0)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Thu Jun 23 15:53:05 CEST 2016 on sn-devel-144

s4: dns: Correctly check for talloc failure.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jun 16 16:55:15 CEST 2016 on sn-devel-144

(cherry picked from commit c3dfeb3aa6c7df5127022abc090e446adc1b7d71)

selftest: add test for DNS updates with TKEY/TSIG

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Thu Jun 16 04:07:41 CEST 2016 on sn-devel-144

(backported from commit 721b21bb801735fe9179502ff34e7a707176dbd8)

s4/dns_server: enable sending of TSIG error records

This final patch enables sending TSIG error records by adding
DNS_RCODE_NOTAUTH to the set of error conditions that are allowed to
trigger sending a full generated response.

See RFC 2845 "4.5.1. KEY check and error handling" and "4.5.3. MAC check
and error handling".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit 88700e7d890c017e2d360fe4385e196f4016db4a)

s4/dns_server: prepare sending correct error responses for dns_verify_tsig() errors

Call dns_verify_tsig() after updating state.flags and assign and use
out_packet for dns_verify_tsig().

We will need the updated flags when sending TSIG error responses when
TSIG request MAC verification fails and dns_verify_tsig() uses the
passed in packet as response, so we have to make sure we copy in_packet
to out_packet before calling out and pass out_packet.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit ba683d459e1b1550d0a4de3a0f576c857ee595c8)

s4/dns_server: don't compute TSIG MAC in TSIG error records

See RFC 2845 "4.3. TSIG on TSIG Error returns".

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit 8f46bf2102a91c5f2d5beee530ece0387fdfbb0c)

s4/dns_server: error codes for failing MAC verification in TSIG requests

According to RFC 2845 "4.5.3. MAC check and error handling" we must
return NOTAUTH and DNS_RCODE_BADSIG when MAC verification fails.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit 8b4a2dcf38e9f38bb99bd1daa5e0d5da176a1e15)

s4/dns_server: ensure we store the key name in error code paths

We need the TKEY name when adding TSIG records to error responses.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit 77c5bfdce417a36b523e9901668fbff0d42f1ed2)

s4/dns_server: not finding the key here is a fatal error

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit c1fca8fa398461fb0a67dbb0e181c71b83a32b62)

s4/dns_server: split out function that does the MAC computation

Split out function that does the MAC computation from the TSIG record
creating function. This will later simplify the code when creating error
responsed to TSIG requests with bad MACs where we have to add the TSIG
record with an empty MAC.

No functional behaviour change besides hard coding "gss-tsig" algorithm
name: later when sending a TSIG error response for a TKEY request with a
bad keyname, we won't have a tkey to fetch the algorithm name from.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit 830316ce84c6f4994841a1c68e60d90225a2963d)

s4/dns_server: include request MAC in TSIG response MAC calculation

According to RFC 2845 "4.2 TSIG on Answers", when the request is signed,
the request MAC must be included in the response MAC calculation.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit 8ed125e8bb13904638f8506e860c169f788e8ee9)

librpc/dns: remove original_id from dns_fake_tsig_rec

Cf RFC2845, 3.4.2. "TSIG Variables", the request id (original_id) is not
used in the MAC calculation. This also explains the mysterious 2 bytes
padding.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit bea4aec521576576b8dc55065f11c6c5025d9c4f)

librpc/dns: don't compress strings in TKEY and TSIG responses

Certain DNS clients fail TSIG record MAC validation if the TSIG record
contains compressed strings.

Windows DNS server behaviour seems to be to not send compressed names in
TKEY and TSIG records.

This patch ensures we conform to this behaviour.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
(cherry picked from commit a51f9989564c28aeece50b56a59e9bb60d41340b)