build: avoid -Wtautological-compare errors from gcc6+ by disabling it globally

Signed-off-by: Michael Adam <obnox@samba.org>

Revert "lib:dlinklist: avoid -Wtautological-compare errors with gcc6"

This reverts commit 5d85fd85467eb1f8941641d5f71d75e7d5c7234c.

Breaks compile for older (<= 4.4) gccs.
Needs to be done differently.

Signed-off-by: Michael Adam <obnox@samba.org>

Revert "tevent: avoid -Wtautological-compare errors with gcc6"

This reverts commit 2991f7709973fdcc2c0b83bbe15dda3f1ceae9b3.

Breaks compile for older (<= 4.4) gccs.
Needs to be done differently.

Signed-off-by: Michael Adam <obnox@samba.org>

Revert "ldb:dlinklist: avoid -Wtautological-compare errors with gcc6"

This reverts commit 7c9505e651287c5d4747b222af1fda970c562a00.

Breaks compile for older (<= 4.4) gccs.
Needs to be done differently.

Signed-off-by: Michael Adam <obnox@samba.org>

lib:util: fix strict aliasing warning in get_socket_port()

Only memcpy helped here ...

Signed-off-by: Michael Adam <obnox@samba.org>

ldb:dlinklist: avoid -Wtautological-compare errors with gcc6

We expect these macros to generate tautological compares
intentionally, so disabling the warning is just fine.

This lets --pick-developer work with gcc6 and newer.

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Ira Cooper <ira@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jul 14 05:44:21 CEST 2016 on sn-devel-144

tevent: avoid -Wtautological-compare errors with gcc6

We expect these macros to generate tautological compares
intentionally, so disabling the warning is just fine.

This lets --picky-developer work with gcc6 and newer.

Pair-Programmed-With: Ira Cooper <ira@samba.org>

Signed-off-by: Ira Cooper <ira@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib:dlinklist: avoid -Wtautological-compare errors with gcc6

We expect these macros to generate tautological compares
intentionally, so disabling the warning is just fine.

This lets --picky-developer work with gcc6 and newer.

Pair-Programmed-With: Michael Adam <obnox@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Ira Cooper <ira@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

selftest: Add tunable for smb2.maxfid limit

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

rpc_server: add mssing '#pragma GCC diagnostic push'

for completeness for later pop.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Thu Jul 14 02:02:33 CEST 2016 on sn-devel-144

python/remove_dc: handle dnsNode objects without dnsRecord attribute

If we have dnsNode objects without dnsRecord attribute values we trigger
the following error triggered by 'samba-tool domain demote --remove-other-dead-server=server2'

  ERROR(<type 'exceptions.TypeError'>): uncaught exception - __ndr_unpack__()
  argument 1 must be string or read-only buffer, not dnsp.DnssrvRpcRecord
    File "/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py", line 175,
  in _run
      return self.run(*args, **kwargs)
    File "/usr/lib64/python2.6/site-packages/samba/netcmd/domain.py", line 720, in
  run
      remove_dc.remove_dc(samdb, logger, remove_other_dead_server)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 423, in
  remove_dc
      remove_dns_account=True)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 351, in
  offline_remove_ntds_dc
      remove_dns_account=remove_dns_account)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 266, in
  offline_remove_server
      remove_dns_references(samdb, logger, dnsHostName)
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 186, in
  remove_dns_references
      for v in values if not to_remove(v) ]
    File "/usr/lib64/python2.6/site-packages/samba/remove_dc.py", line 160, in
  to_remove
      dnsRecord = ndr_unpack(dnsp.DnssrvRpcRecord, value)
    File "/usr/lib64/python2.6/site-packages/samba/ndr.py", line 45, in ndr_unpack
      object.__ndr_unpack__(data, allow_remaining=allow_remaining)
  A transaction is still active in ldb context [0xe1f320] on
  tdb:///var/lib/samba/private/sam.ldb

"next" is used in perl not in python!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12018

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 13 10:10:30 CEST 2016 on sn-devel-144

dsdb: Fix CID 1363810: Null pointer dereferences

The if-condition explicitly tests for new_schema==NULL, so this seems to be a
valid error case. The DEBUG statement would segfault in this case.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jul 13 06:34:33 CEST 2016 on sn-devel-144

smbtorture: Add smb2.maxfid

This is the same as base.maxfid, but for the SMB2 protocol: Keep opening
file handles until an error is returned, print the number of file
handles opened and finally close the file handles again.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

selftest: Disable full audit logging in selftest

Commit 6eba42f activated the full_audit and time_audit modules for the
simpleserver config to trigger the check that all VFS functions are
implemented in these two modules. This resulted in all operations being
logged to syslog during a test run.

Change the full_audit configuration to keep loading the modules, but not
log anything from full_audit to not slow down the test or spam the logs.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Remove unused stf directory

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

dsdb: Improve debugging during SD recursion failure

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Wed Jul 13 02:59:25 CEST 2016 on sn-devel-144

dsdb: Avoid search on * in replmd_replicated_apply_next()

A search on * can be quite expensive if we have to post-process any of the results

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

samba-tool drs replicate: Allow replication call to take as long as required

This matches the behaviour in the drsuapi server for DsReplicaSync

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

pyrpc: Allow control of RPC timeout for IRPC

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

tests: Allow alternative error code for backupkey test

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

libads: improve debug messages in sitename_fetch()

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jul 12 21:23:48 CEST 2016 on sn-devel-144

selftest: check for smbd on a 1-second basis.

Chance to reduce the overall time spent in checking for smbd

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

selftest: check for winbind on 1-second basis

There is a chance to reduce the overall time spent checking.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

libsmb:namequery: fix typo in comment in get_dc_list()

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

tevent: Clarify apparently useless conditions

Comment on two similar conditions in tevent_standard.c, which,
otherwise, at a first glance, seem useless, i.e. always true.

The conditions checking glue->epoll_ops for being non-NULL, imply that
it *can* be NULL. A casual reader would not generally expect a "member"
function to modify its container's pointer in a container higher up, and
would assume that glue->epoll_ops could be NULL before the call,
resulting in a near-NULL pointer dereference.

However, in this case epoll_ops is indeed cleared in those "member"
functions, in the case of an epoll interface failure, to signify
fallback to poll interface.

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Tue Jul 12 13:56:41 CEST 2016 on sn-devel-144

Fix typo in python/samba/provision/__init__.py

Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jul 12 06:58:47 CEST 2016 on sn-devel-144

libads: ensure the right ccache is used during spnego bind

When doing spnego sasl bind:
1. Try working without kinit only if a password is not
   provided
2. When using kinit, ensure the KRB5CCNAME env var is set
   to a private memory ccache, so that the bind is on behalf
   of the requested user.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12007

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jul 12 03:23:33 CEST 2016 on sn-devel-144

libads: ensure the right ccache is used during gssapi bind

When doing gssapi sasl bind:
1. Try working without kinit only if a password is not
   provided
2. When using kinit, ensure the KRB5CCNAME env var is set
   to a private memory ccache, so that the bind is on behalf
   of the requested user.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12007

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

s3-messaging: use messaging_ctdbd_reinit() in messaging_reinit()

This is the last step to fix a regression introduced by

  3fe3226daa8488e0fa787c40359c3401b6f05fc0 and
  3fe3226daa8488e0fa787c40359c3401b6f05fc0^

where we pass the ctdb-messaging object conn to db_open() and add a
reference to it to the private db_ctdb_ctx for later use. Unfortunately
reinit_after_fork() destroys conn, leaving us with an invalid reference.

The previous patches added new lower level functions
messaging_ctdbd_reinit() and ctdbd_reinit_connection(), finally use them
them from messaging_reinit(). They preserve the conn object and simply
reinitialize the IPC fd.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Jul 11 23:45:20 CEST 2016 on sn-devel-144

s3-messaging/ctdb: add messaging_ctdbd_reinit()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3-messaging/ctdb: split messaging_ctdbd_init()

Split out and internal function from messaging_ctdbd_init() that does
the connection setup. Keep the conn object allocation in
messaging_ctdbd_init().

This is in preperation of adding messaging_ctdbd_reinit() which will use
the new internal function as well.

messaging_ctdbd_init_internal() has a new reinit flag,
messaging_ctdbd_init() calls with reinit=false resulting in unmodified
behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdbd_conn: add ctdbd_reinit_connection()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdbd_conn: split ctdbd_init_connection()

Split ctdbd_init_connection() into an internal function that does the
connection setup and only keep the conn object allocation in
ctdbd_init_connection().

This is in preperation of adding ctdbd_reinit_connection() which will
use the new internal function as well.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb: fix autotest with socket-wrapper installed in the system

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Mon Jul 11 15:53:30 CEST 2016 on sn-devel-144

swrap: Build socket_wrapper path relative to blddir

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Michael Adam <obnox@samba.org>

autobuild: Don't compare socket wrapper so_path for xc check

This uses the build-directory which, hence is not the same.
Achieve this by adding the path itself and the whole
defines dictionary to the exclude list.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

tests/dns_update: Add error message for diagnosis

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon Jul 11 10:58:16 CEST 2016 on sn-devel-144

s3-rpc_server/mdssd: use smbd_reinit_after_fork()

Using smbd_reinit_after_fork() rather then reinit_after_fork() ensures
am_parent is reset to NULL. Otherwise, when exiting for some reason, the
inherited atexit handler killkids() calls kill(0,SIGTERM) terminating
our whole process group including the main smbd.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12016

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jul 11 02:02:33 CEST 2016 on sn-devel-144

smbd/notifyd: use smbd_reinit_after_fork()

Using smbd_reinit_after_fork() rather then reinit_after_fork() ensures
am_parent is reset to NULL. Otherwise, when exiting for some reason, the
inherited atexit handler killkids() calls kill(0,SIGTERM) terminating
our whole process group including the main smbd.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12016

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

smbd/cleanupd: use smbd_reinit_after_fork()

Using smbd_reinit_after_fork() rather then reinit_after_fork() ensures
am_parent is reset to NULL. Otherwise, when exiting for some reason, the
inherited atexit handler killkids() calls kill(0,SIGTERM) terminating
our whole process group including the main smbd.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12016

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Revert selftest: Add knownfail entry required to disable tombstone_reanimation

This reverts e0fa42201b5ff1b2d67f1c3cdb0d3dbcce9b6e40

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sat Jul  9 18:41:40 CEST 2016 on sn-devel-144

Revert "dsdb: Disable tombstone_reanimation module until we isolate what causes flaky tests"

This reverts commit 252b62c54ed5a4aabbdccf315f1a0ae3d958d11c.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4:dsdb/tests: add RestoreUserPwdObjectTestCase test

This is the same as RestoreUserObjectTestCase, but we
set the password on add and reanimate.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/tests: improve the RestoreUserObjectTestCase test

We verify attributes, values and their replication metadata after
each step (add, delete, reanimate).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/tests: improve tombstone_reanimation varifications

We should do case sensitive checks.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/tests: make tombstone_reanimation.py executable

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/tests: make use assertAttributesEqual() in RestoreUserObjectTestCase()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/tombstone_reanimate: restructure the module logic

Now we keep all state in struct tr_context and split
the preparation and exectution of sub requests into
helper functions.

The most important change is that we now
pass mod_req to dsdb_user_obj_set_defaults(),
so that it can add controls to it.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/common: prepare dsdb_user_obj_set_defaults() for tombstone reanimation

accountExpires gets a different value, logonHours is not updated,
operatorCount and adminCount are added.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/repl_meta_data: remove secret attributes on delete

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/repl_meta_data: sort preserved_attrs and add "msDS-PortLDAP"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:password_hash: correctly update pwdLastSet on deleted objects.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/samdb: add const to dsdb_make_object_category()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

drsuapi.idl: add DRSUAPI_ATTID_operatorCount and DRSUAPI_ATTID_adminCount

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest: Add more tests for samba-tool drs replicate

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jul  8 13:39:01 CEST 2016 on sn-devel-144

samba-tool: Add --local-online mode to samba-tool drs replicate

This mode avoids an issue with using -P on an RODC, instead using an IRPC message
to trigger online replication right away

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

samba-tool: Add success message to samba-tool drs replicate --local

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

schema: raise debug level

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

schema: Remove unnecessary schema reload code

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:torture/drs: verify the whole metadata array to be the same in the repl_move tests

We've removed the difference compared to Windows and store metadata stamps for
some empty attributes.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Revert "selftest/flapping: mark samba4.drs.repl_move.python as temporary flapping"

We pass this tests again...

This reverts commit HEAD~2.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/password_hash: force replication meta data for empty password attributes

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/common: add a replication metadata stamp for an empty logonHours attribute

When a user object is created it gets a metadata stamp for logonHours,
while the logonHours attribute has no value.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

selftest/flapping: mark samba4.drs.repl_move.python as temporary flapping

We'll change the behaviour step by step to match Windows.
At the end we'll pass the test again and revert this patch.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

tests:samba3sam: make use of the dsdb_flags_ignore module

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:samba_dsdb: add "dsdb_flags_ignore" module

This module removes internal flags from ldb_message_elements.
Typically the repl_meta_data module handles DSDB_FLAG_INTERNAL_FORCE_META_DATA,
but there're some cases where we don't use that module.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s4:dsdb/samdb: add DSDB_FLAG_INTERNAL_FORCE_META_DATA

With this it's possible to add a replPropertyMetaData entry for an empty
attribute.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

CVE-2016-2019: s3:selftest: add regression tests for guest logins and mandatory signing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Thu Jul  7 14:52:20 CEST 2016 on sn-devel-144

CVE-2016-2019: s3:libsmb: add comment regarding smbXcli_session_is_guest() with mandatory signing

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>

CVE-2016-2019: libcli/smb: don't allow guest sessions if we require signing

Note real anonymous sessions (with "" as username) don't hit this
as we don't even call smb2cli_session_set_session_key() in that case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860

Signed-off-by: Stefan Metzmacher <metze@samba.org>

testprogs: Do not use the deprecated samba-tool user add

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jul  7 02:15:16 CEST 2016 on sn-devel-144

s3:libsmb/clirap: remove unused cli_get_server_*() functions

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jul  6 22:41:41 CEST 2016 on sn-devel-144

libcli/auth: remove unused variable in msrpc_parse()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

security.idl: add SID_NT_NFS S-1-5-88* sids

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

selftest: Do not use the deprecated samba-tool user add

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4-dsdb: Add missing header file for write() and close()

This fixes compilation with gcc 4.8.5.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s4-torture: Add AES and RC4 enctype checks

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul  6 19:06:19 CEST 2016 on sn-devel-144

s4-torture: Add torture_check_krb5_error() function

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>

schema: Reorder dsdb_set_schema() to unlink the old schema last

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

dsdb: Remove 120 second delay and USN from schema refresh check

We now refresh it once the schema changes, so that replication can
proceed right away.  We use the sequence number in the metadata.tdb.

The previous commit added a cache for this value, protected by
tdb_seqnum().

metadata.tdb is now opened at startup to provide this support.

Note that while still supported, schemaUpdateNow is essentially rudundent:
instead, to ensure we increment the sequence number correctly, we unify that check
into repl_meta_data at the transaction close.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

dsdb: Remove use of schema USN in samldb_add_handle_msDS_IntId

This is not a frequent enough operation to warrent a cache, and the USN will be removed
from the schema code shortly

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

schema: Make the fetch of the schema version fast

Use the tdb_seqnum() to avoid needing locks to check if the schema has not changed

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

ldb: Avoid use-after-free when one error message is printed into another

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

provision: Ignore duplicate attid and governsID check

During the provision this causes a huge performance hit as these two
attributes are unindexed.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>

provision_fill: move GPO into transaction

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>

provision_fill: move most db accesses into transactions

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>

ctdb-scripts: Quote some variable expansions

This avoids relevant shellcheck warnings.  This is most of the
shellcheck low hanging fruit in the non-test code.  Many of the other
warnings produced by shellcheck are either false positives, are
non-trivial to fix or a fix may result in worse code.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Wed Jul  6 08:15:49 CEST 2016 on sn-devel-144

ctdb-scripts: Fix incorrect variable reference

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Use globs instead of ls to list files

shellcheck reports that using ls is fragile.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Fix incorrect variable reference

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Fix incorrect variable reference

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Update script boilerplate to avoid shellcheck warnings

* Assign the output of dirname to temporary variable to avoid word
  splitting when directory name contains whitespace

* Drop export of CTDB_BASE to avoid masking broken return value -
  functions file does the export anyway

* Quote path when including functions file

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Export CTDB_BASE in functions file

This avoids having to export it in every file that includes the
functions file.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-scripts: Drop optional argument to nfs_check_services()

Added so that nfs_check_services() could be run against an arbirary
directory.  However, with the function moved to the event script, this
isn't useful.  CTDB_NFS_CHECKS_DIR can be used for testing instead.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

gensec: Change log level for message when obtaining PAC from gss_get_name_attribute failed

This is the second part for the issue from commit 8bb4fccd. A KDC that
does not return a PAC first triggers this message, then the "resorting
to local user lookup" one. Change the log level for the "obtaining PAC
via GSSAPI gss_get_name_attribute" message as well to avoid spamming the
logs during normal usage. While changing this message, also remove the
discard_const since it is no longer required.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul  6 04:27:03 CEST 2016 on sn-devel-144

auth: fix a memory leak in gssapi_get_session_key()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12006

Signed-off-by: Uri Simchoni <uri@samba.org>
Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Richard Sharpe <sharpe@samba.org>
Autobuild-Date(master): Wed Jul  6 00:40:15 CEST 2016 on sn-devel-144

s3-libads: fix a memory leak in ads_sasl_spnego_bind()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12006

Signed-off-by: Uri Simchoni <uri@samba.org>
Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>

ctdb-build: Exit if requested feature cannot be built

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Tue Jul  5 14:38:30 CEST 2016 on sn-devel-144

ctdb-daemon: Log ctdb socket in the main daemon

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-pmda: CTDB client code does not require ctdb->methods

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>