source3/librpc/crypto/gse.c channel_bindings

sq source4/libcli/ldap/ldap_bind.c

ldap_bind_sasl tstream_tls_channel_bindings

source4/auth/gensec/gensec_gssapi.c support channel bindings

source4/lib/tls/tls_tstream.c tstream_tls_channel_bindings

TODO optional??? auth/ntlmssp: implement client side channel bindings

auth/gensec: add gensec_set_channel_bindings() function

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s4:netlogon: return NT_STATUS_NO_TRUST_SAM_ACCOUNT if we don't have an NTHASH for an account

This matters mostly when we're an RODC and don't have the password
attributes localy.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:libads: make check_cldap_reply_required_flags() static

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

sq dsgetdcname_cache_fetch use check_cldap_reply_usable

TODO s3:dsgetdcname: make use of check_cldap_reply_usable()

TODO explain...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

winbindd: blacklist servers returning ACCESS_DENIED/authoritative=0

https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

sq cldap_ping_list check_negative_conn_cache

s3:libads: let cldap_ping_list() check for a blacklisted server name

If we black listed a server we should not use it even if
it responses to CLDAP requests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

sq ads_try_connect check_cldap_reply_usable

sq ads_try_connect use check_cldap_reply_usable

s3:libads: let ads_try_connect() check for a valid response command

We should not use servers responding with LOGON_SAM_LOGON_PAUSE_RESPONSE_EX.

This happens if SysvolReady is still 0 under
HKLM\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

sq add check_cldap_reply_usable

sq check_cldap_reply_usable no const

TODO s3:libads: add check_cldap_reply_usable() helper function

TODO MS-ADTS 6.3.5 Mailslot Ping ...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

TODO s3:dsgetdcname: make use of ads_cldap_netlogon_5() to simplify the code

ads_cldap_netlogon_5() already calls map_netlogon_samlogon_response()
so there's no custom mapping code required anymore.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

TODO: map_ds_flags_to_nt_version removal???

s3:dsgetdcname: remove unused nt_version argument of store_cldap_reply()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:dsgetdcname: check_cldap_reply_required_flags() should check against the cached reply

We should check against the raw CLDAP reply we stored in the cache.
This is much simpler to understand. It will also simplify further
fixes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

sq ads_cldap_netlogon_5 map_netlogon_samlogon_response

s3:libads: let ads_cldap_netlogon_5() call map_netlogon_samlogon_response()

It's unlikely but possible that the server responded with a legacy response,
so there's no reason to fail instead of mapping the values.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:libads: avoid changing ADS->server.workgroup

ads_find_dc() uses c_domain = ads->server.workgroup and
don't expect it to get out of scope deep in resolve_and_ping_dns().

The result are corrupted domain values in the debug output.

Valgrind shows this:

 Invalid read of size 1
    at 0x483EF46: strlen (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
    by 0x608BE94: __vfprintf_internal (vfprintf-internal.c:1688)
    by 0x609ED49: __vasprintf_internal (vasprintf.c:57)
    by 0x5D2EC0F: __dbgtext_va (debug.c:1860)
    by 0x5D2ED3F: dbgtext (debug.c:1881)
    by 0x4BFFB50: ads_find_dc (ldap.c:570)
    by 0x4C001F4: ads_connect (ldap.c:704)
    by 0x4C1DC12: ads_dc_name (namequery_dc.c:84)
  Address 0xb69f6f0 is 0 bytes inside a block of size 11 free'd
    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
    by 0x4BFF0AF: ads_try_connect (ldap.c:299)
    by 0x4BFF40E: cldap_ping_list (ldap.c:367)
    by 0x4BFF75F: resolve_and_ping_dns (ldap.c:468)
    by 0x4BFFA91: ads_find_dc (ldap.c:556)
    by 0x4C001F4: ads_connect (ldap.c:704)
    by 0x4C1DC12: ads_dc_name (namequery_dc.c:84)
  Block was alloc'd at
    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
    by 0x60B250E: strdup (strdup.c:42)
    by 0x4FF1492: smb_xstrdup (util.c:743)
    by 0x4C10E62: ads_init (ads_struct.c:148)
    by 0x4C1DB68: ads_dc_name (namequery_dc.c:73)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Revert "s3:libads: split out ads_fill_cldap_reply() out of ads_try_connect()"

This reverts commit 1ae9106ba593f52095c1184ecfca32855aa454a7.

Revert "s3:libads: let cldap_ping_list() use cldap_multi_netlogon()"

This reverts commit 51fa91241bdbc80034e33eb95870caa222bd1e9e.

Revert "s3:conncache: improve debugging for the negative connection cache"

This reverts commit 5cf686c9757c8b0ef31f83b19d032a0d6d25bef6.

Revert "winbindd: always use winbind_add_failed_connection_entry() wrapper"

This reverts commit 4bbfbf80e53aa823adc054e40c8ef7e7c4792e18.

Revert "winbindd: blacklist servers returning ACCESS_DENIED/authoritative=0"

This reverts commit 21329a99985d29654501ef5ea1cc284e68eb537f.

Revert "s3:libads: let cldap_ping_list() check for a blacklisted server name"

This reverts commit 0772b26335423f76fab0636ff32849c0584136fe.

Revert "TODO/LATER: source3/libads/cldap.c PAUSE not state->num_good_received += 1"

This reverts commit 8e16b123c33d434be979d8ac083e573956bdbfe9.

Revert "Revert "TODO/LATER: source3/libads/cldap.c PAUSE not state->num_good_received += 1""

This reverts commit 841662580fb0fa959b314ed91d749ae35789b128.

Revert "sq s3:libads: let cldap_ping_list() check for a blacklisted server name"

This reverts commit eab05ddacf1733e9fcf7ea60d12e3405da1dc27a.

Revert "cldap_ping_list num_requests = 0"

This reverts commit c374eb24d6d6717393d76084bac6fc6a55161861.

Revert "TODO source3/libads/ldap.c cldap_ping_list blacklist"

This reverts commit 4916bc3e5839414d981da25464c46d1af8f4e502.

Revert "TODO source3/libads/kerberos.c cldap_ping_list blacklist"

This reverts commit 4dd3acbe4d6db46dbc5e765b44879d86f6ba0983.

TODO source3/libads/kerberos.c cldap_ping_list blacklist

TODO source3/libads/ldap.c cldap_ping_list blacklist

sq s3:libads: let cldap_ping_list() check for a blacklisted server name

Revert "TODO/LATER: source3/libads/cldap.c PAUSE not state->num_good_received += 1"

This reverts commit 8e16b123c33d434be979d8ac083e573956bdbfe9.

TODO/LATER: source3/libads/cldap.c PAUSE not state->num_good_received += 1

s3:libads: let cldap_ping_list() check for a blacklisted server name

If we black listed a server we should not use it even if
it responses to CLDAP requests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

winbindd: blacklist servers returning ACCESS_DENIED/authoritative=0

https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

winbindd: always use winbind_add_failed_connection_entry() wrapper

We should not use add_failed_connection_entry() directly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s3:conncache: improve debugging for the negative connection cache

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Revert "HACK nsswitch/wb_common.c no HAVE_PTHREAD"

This reverts commit f8e0bbdf431cb3b989421496f620e1f82c91105a.

HACK nsswitch/wb_common.c no HAVE_PTHREAD

Revert "HACK nsswitch/wb_common.c no HAVE_PTHREAD"

This reverts commit 59a135a54f96f686ae761d978cf83e498413e12f.

HACK nsswitch/wb_common.c no HAVE_PTHREAD

Revert "source4/torture/smb2/read_write.c"

This reverts commit c22ff934bb57304e9d1f5bb06aa94061ee18cf75.

source4/torture/smb2/read_write.c

script/autobuild.py check_symbols awk print

sq TODO ldb compat ABI

HACK lib/ldb/wscript private_library = False

Revert "HACK lib/ldb/wscript private_library = False"

This reverts commit c00a2d82f03f1e8802224f0801b4908671ca615f.

HACK lib/ldb/wscript private_library = False

sq TODO ldb compat ABI

Revert "HACK lib/ldb/wscript force public_library"

This reverts commit fe9afe6cda053ce2cbeb0428b9177b79cac6824d.

HACK lib/ldb/wscript force public_library

TODO ldb compat ABI

Revert "lib/replace: avoid using libbsd for builtin linking"

This reverts commit bb9189df666e62098441120b7d3c1c1a1e772c1f.

script/autobuild.py: check that plugins are not against libbsd

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15475

Signed-off-by: Stefan Metzmacher <metze@samba.org>

lib/replace: avoid using libbsd for builtin linking

This is similar to commit 66e90b7391bd404580f3919c4f2b8625c9c89c0e:
nsswitch: reduce dependecies to private libraries and link static/builtin if possible

There we tried to hide our internal symbols from applications loading
our plugins (e.g. libnss_winbind.so.2 or pam_winbind.so)

If we find libbsd in the system we link our plugins against it
and inject the symbols from it into the application, as the
symbols in libbsd have very common names, there's a change to
generate symbol conflicts causing unexpected behavior.

So we better use our own replacement functions from lib/replace
for the plugins instead of using the ones from libbsd
as we most likely not really need them. Currently we only
seem to use strlcpy() and we have our own version of it...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15475

Signed-off-by: Stefan Metzmacher <metze@samba.org>

wafsamba: add -D_SAMBA_BUILTIN_LINKING_ to detect builtin linking

This will help us to provide a stripped down version of libreplace
when doing builtin linking

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15475

Signed-off-by: Stefan Metzmacher <metze@samba.org>

wafsamba: allow explicit builtin_{source,deps}

This will be used in order to provide a mininal version
of libreplace...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15475

Signed-off-by: Stefan Metzmacher <metze@samba.org>

sq lib/crypto/tests/test_gnutls_aead_aes_256_cbc_hmac_sha512.c

sq source3/utils/ntlm_auth.c

source3/nmbd/nmbd_serverlistdb.c

lib/util/tests/test_talloc_keep_secret.c

BINARY hide_symbols=False/True

source3/torture/test_idmap_tdb_common.c

source3/utils/ntlm_auth.c

fedora38-samba-o3
==> /builds/samba-team/devel/samba/samba-o3.stderr <==
../../source3/utils/ntlm_auth.c: In function
‘manage_ntlm_server_1_request’:
../../source3/utils/ntlm_auth.c:1939:63: error: ‘%s’ directive argument
is null [-Werror=format-overflow=]
 1939 |                                 printf("Authentication-Error:
      %s\n.\n",
      |                                                               ^~
cc1: all warnings being treated as errors

lib/crypto/tests/test_gnutls_aead_aes_256_cbc_hmac_sha512.c

lib/cmdline: CMDLINE_S3/S4 are linked into binaries and don't need to export symbols

Signed-off-by: Stefan Metzmacher <metze@samba.org>

wafsamba: use hide_symbols=True in SAMBA_BINARY()

binaries don't need to expose symbols by default.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

lib/util: fix possible truncation in dump_data_block16()

Prefix is a 1 or 0 characters, then 64bit hex value
can take 16 charachters + '[' + ']' + '\0', means
we need a buffer of 20 characters.

The next commit will cause some code to be inlined with -O3
in use, which found this possible truncation and complained
about it.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

s4/torture: fix exit status of raw.bench-lookup

Use correct value of 'result' when the test passes.

Signed-off-by: Oleg Kravtsov <oleg@tuxera.com>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Oct 16 02:01:17 UTC 2023 on atb-devel-224

gpdupate: Implement Drive Maps Client Side Extension

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

gpupdate: Test Drive Maps Client Side Extension

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tevent: version 0.16.0

- the epoll backend is no longer limited to 2 event handlers
  per low level fd.
- finally add support for TEVENT_FD_ERROR

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Oct 13 10:45:51 UTC 2023 on atb-devel-224

tevent: add support for TEVENT_FD_ERROR

After 12 years we finally got TEVENT_FD_ERROR support :-)

TEVENT_FD_WRITE event handlers never get errors reported
instead the event handler is silently disabled.
There are likely callers relying on that behavior, so
we are not able to chance it.

Now TEVENT_FD_WRITE can be used together with TEVENT_FD_ERROR
in order to get errors reported without waiting for TEVENT_FD_READ.

TEVENT_FD_ERROR can also be used alone in order to detect errors
on sockets in order to cleanup resources.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

tevent: add test_event_fd3

The tests the interaction of multiple event handlers on
the same low level fd.

It shows that poll and epoll backends behave in the
same fair way.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

tevent: add test_fd_speed3

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

tevent: let tevent_epoll.c use new generic mpx infrastructure

This allows any number of event handlers per low level fd.

It means the epoll backend behaves like the poll backend now.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

tevent: add tevent_common_fd_mpx infrastructure

Backends may require to map individual tevent_fd instances to
a single low level kernel state (e.g. for epoll).

This generic infrastructure adds helper functions using
a generic (sub)part of struct tevent_fd.

The new code will allow us to support more than 2 tevent_fd
instances per fd, which makes sure all backends can provide
a similar behavior. This will be important when we add
TEVENT_FD_ERROR as a 3rd kind of fd event.

The aim is to use this in order to replace the limited implementation
we already have in tevent_epoll.c.

As these helpers are typically called from within
'void tevent_fd_set_flags(struct tevent_fd *fde, uint16_t flags)'
there's no way to report errors. So in order avoid additional
error handling complexity the helpers try to avoid
any allocations which may fail. It also means the logic in
tevent_epoll.c doesn't have to change much.

These are implemented as static line functions in order to avoid
the function call overhead, which showed up in profiles of the
early implementation.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

tevent: split out a tevent_common_fd_disarm() helper

It means tevent_trace_fd_callback(TEVENT_EVENT_TRACE_DETACH)
is always called and similar future changes are only
needed in one place.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

ldb: sync DLIST_DEMOTE_SHORT() changes to include/dlinklist.h

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

lib/util: sync DLIST_DEMOTE_SHORT() changes to dlinklist.h

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

tevent: introduce DLIST_DEMOTE_SHORT()

It turns out that the overhead of DLIST_DEMOTE() implemented
as DLIST_REMOVE();DLIST_ADD_END(), is very high if the list
contains only 1 or 2 elements.

The next commits will make use of DLIST_DEMOTE_SHORT() for
multiplexing multiple tevent_fd structures for a single fd
and the most important and common case is a list with just
one element.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

wintest: Fix invalid escape sequences

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Oct 13 04:55:06 UTC 2023 on atb-devel-224

selftest: Use now() instead of utcnow()

utcnow() is deprecated and will be removed in a future version of Python.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:torture: Use assertEqual() instead of assertEquals()

assertEquals() was removed in Python 3.12.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb:tests: Use loadTestsFromTestCase() instead of makeSuite()

makeSuite() is deprecated and will be removed in Python 3.13.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb:tests: Fix assertion messages

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb:tests: Remove unused variables

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb:tests: Remove unused imports

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s3:script: Remove semicolons

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests/krb5: Fix assertion messages

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>