lib: Align integer types

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

libcli: Align integer types

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

passdb: Use struct allocation

Give the compiler more info

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s4:torture: Convert samba4.base.charset test to smb2

The partial surrogate test is known to fail (in
both smb1 and smb2).

Signed-off-by: David Mulder <dmulder@suse.com>
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Böhme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Thu Jan 30 12:05:13 UTC 2020 on sn-devel-184

selftest: Exit skipped daemons on close(STDIN)

Without this, teardown_env() will take ages for environments with
skipped daemons

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jan 29 11:06:53 UTC 2020 on sn-devel-184

selftest: Close STDIN_PIPE's write end for skipped daemons

Without this, any environment that skips any daemon will not shut down
properly. If a copy of a pipe's write end remains, closing one of them
won't cause the read end to be readable, i.e. the daemons waiting for
that won't exit properly.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

lib: asn1.c: Prevent ASN1_ENUMERATED from wrapping.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14238

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Douglas Bagnall <dbagnall@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jan 29 01:02:04 UTC 2020 on sn-devel-184

lib/util: use better linux os detection in gpfs configure

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Christof Schmitt cs@samba.org
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Jan 28 18:05:34 UTC 2020 on sn-devel-184

ctdb-tests: Enable job control when keeping stdin open

POSIX says:

  If job control is disabled (see set, -m), the standard input for an
  asynchronous list, before any explicit redirections are performed,
  shall be considered to be assigned to a file that has the same
  properties as /dev/null. This shall not happen if job control is
  enabled. In all cases, explicit redirection of standard input shall
  override this activity.

ctdbd is backgrounded at startup, so the above causes stdin to be
redirected from /dev/null.  Enable job control to work around this.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Tue Jan 28 11:24:35 UTC 2020 on sn-devel-184

ctdb-tests: Don't close stdin when starting local daemons

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-daemon: Shut down if interactive and stdin is closed

This allows a test environment to simply close its end of a pipe to
cleanly shutdown ctdbd.  Like in smbd, this is only done if stdin is a
pipe or a socket.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-daemon: Only stop monitoring if it has been initialised

This avoids a crash if ctdb_shutdown_sequence() is called before
monitoring is initialised.

Switch to using TALLOC_FREE() while touching this function.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

lib:util: Log mkdir error on correct debug levels

For smbd we want an error and for smbclient we only want it in NOTICE
debug level.
The default log level of smbclient is log level 1 so we need notice to
not spam the user.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14253

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Mon Jan 27 15:55:24 UTC 2020 on sn-devel-184

selftest: Convert Samba3::provision() to named parameters

9 positional parameters is a bit too much for easy overview

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

selftest: Factor out create_file_chmod()

24 lines less perl :-)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

krb5-wrap: deal with different krb5_trace_info struct flavors (earlier MIT krb5 releases)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14252

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 24 20:38:53 UTC 2020 on sn-devel-184

nsswitch:tests: Add test to check correct group lookup with samlogon cache

TEST FOR: https://bugzilla.samba.org/show_bug.cgi?id=14124

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 24 17:18:38 UTC 2020 on sn-devel-184

selftest: Make 'Samba Users' the primary group of joe

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

selftest: Add a group 'Samba Users'

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

selftest: Add user joe

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

nsswitch: Fix username in wbinfo -K output

We should not print the password if specified via the command line.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

tdb: Align integer types

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan 23 20:41:46 UTC 2020 on sn-devel-184

dbwrap: Do direct struct initalization in db_ctdb_store_db_seqnum()

Save a few lines

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

librpc: Use PRIu32 printf specifiers

Both values printed are uint32_t's

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbclient: Fix a typo

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

librpc: Use the MAX() macro where appropriate

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

librpc: Fix a gcc warning

gcc does not like const before static

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: Call string_term_tdb_data() once instead of 6 times

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

s3: lib: nmblib. Clean up and harden nmb packet processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14239
OSS-FUZZ: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20156
OSS-FUZZ: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20157

Credit to oss-fuzz.
No security implications.

Signed-off-by: Jeremy Allison <jra@samba.org>
Pair programmed with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jan 21 23:33:41 UTC 2020 on sn-devel-184

vfs_gpfs: Preserve errno across unbecome_root call

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: Remove unused define

CAP_LEASE is not used in the file oplock_linux.c, so remove it there.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: Remove unused function linux_set_lease_capability

This function is no longer used. In case this capability would be
required, set_effective_capability(LEASE_CAPABILITY) could also be
called directly.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_gpfs: Cleanup lease mapping function

Shorten the function a bit by directly returning the mapped value.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_gpfs: Change lease helper function to only provide mapping

The set_gpfs_lease function first maps the lease argument to the GPFS
version and then issues the API call. Change this to only do the mapping
in the helper function.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_gpfs: Remove function call from "if" statement

Follow the current coding guidelines to first issue the function call
and then check the return code.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_gpfs: Reformat function definition of vfs_gpfs_setlease

Remove trailing whitespace and put each argument on a seperate line.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs_gpfs: Remove call to linux_set_lease_capability

The API call is already done as root user (become_root), so that the
lease contains the root user. The lease capability is already implied by
the root user, so the explicit call to linux_set_lease_capability is not
required.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

script/release.sh: make it possible to run from a git worktree

.git is a regular file in that case.

Also check that script/release.sh is present as a relative path
to ensure we're called from the expected location.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

WHATSNEW: Start release notes for Samba 4.13.0pre1.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan 21 16:04:29 UTC 2020 on sn-devel-184

VERSION: Bump version up to 4.13.0pre1...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

VERSION: Disable GIT_SNAPSHOT for the 4.12.0rc1 release...

Signed-off-by: Stefan Metzmacher <metze@samba.org>

WHATSNEW: Add release note for Samba 4.12.0rc1.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

samba-tool group addmembers: avoid python traceback on member add failure

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

selftest: add test for samba-tool groupmember --member-base-dn option

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

selftest: add tests for samba-tool group addmembers --object-types option

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

selftest: add test for new samba-tool group addmembers --member-dn option

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool group addmembers: add --member-base-dn option for group member search

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool group {add,remove}members: allow to use --member-dn in combination with listofmembers

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool group removemembers: adapt functionality to addmembers command

Adds --member-dn and --object-types options.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool group addmembers: add --member-dn option

The --member-dn option allows to specify an object by it's DN.

This is required to select a specific object if there are more than one
with the same name. Multiple contacts can exist with the same name in
different OUs.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool group addmembers: add new option --object-types

With this option the admin can specify the object types of the group
members which will be added to the group. The search filter for the objects
will be created according to the types.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

python/samdb: validation of group member types for group member filter

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

python/samdb: add type "all" to search for all common types of group members

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

python/samdb: adapt search filter for group object type

Use a group search filter which is similar to the filter which is used
by the basic MS Windows group membership management.

The filter excludes the group type GROUP_TYPE_BUILTIN_LOCAL_GROUP.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

python/samdb: adapt search filter for user object type

Use a user search filter which is similar to the filter which is used
by the basic MS Windows group membership management.

The filter filters for objects with the sAMAccountType ATYPE_NORMAL_ACCOUNT.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

python/samdb: add 'computer' to the default group member types for group member filters

Add the 'computer' type to the default member types, so that the next
commit does not change the default behavior.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

python/samdb: fetch specific error if there are more than one search results

There can be more than one contact with the same name.

Signed-off-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

python/samdb: add more object types for adding/remove group members

The filters are based on the MS Windows filter, which are used by the
basic group member management dialog.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

python/samdb: add option to specify types of group members

The option can be used to specify the type of the object which have to
be added to (or removed) from a group. The search filter for the objects
will be created according to the types.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test-case for 'ou list --base-dn'

Check if the ou list --base-dn / -b command uses a specific base dn.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add -b/--base-dn option to OUs list command

With this option it's e.g. possible to list the OUs which are
located under a different specific place in the AD.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test-case for 'user list --base-dn'

Check if the user list --base-dn / -b command uses a specific base dn.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add -b/--base-dn option to users list command

With this option it's e.g. possible to list the users of a
specify OU or users which are located under a different specific
place in the AD.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test-case for 'contact list --base-dn'

Check if the contact list --base-dn / -b command uses a specific base dn.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add -b/--base-dn option to contacts list command

With this option it's e.g. possible to list the contacts of a
specify OU or contacts which are located under a different specific
place in the AD.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test-case for 'computer list --base-dn'

Check if the computer list --base-dn / -b command uses a specific base dn.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add -b/--base-dn option to computer list command

With this option it's e.g. possible to list the computers of a
specify OU or computers which are located under a different specific
place in the AD.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test-case for 'group list --base-dn'

Check if the group list --base-dn / -b command uses a specific base dn.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add -b/--base-dn option to groups list command

With this option it's e.g. possible to list the groups of a
specify OU or groups which are located under a different specific
place in the AD.

Signed-off-by: Jule Anger <ja@sernet.de>
Pair-programmed-with: Björn Baumbach <bb@samba.org>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test-case for 'user getgrouops --full-dn'

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add --full-dn option for user getgroups command

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test-case for 'group listmembers --full-dn'

Check if the group listmembers --full-dn command displays DN instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add --full-dn option to group listmembers command

With this option the command lists the groupmembers distinguished names
instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test case for 'user list --full-dn'

Check if the --full-dn option displays DN instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add --full-dn option to user list command

With this option the command lists the users distringuished names
instead of the sAMAccountNames.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: add test case for 'computer list --full-dn'

Check if the --full-dn option displays DN instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add --full-dn option to computer list command

With this option the command lists the computers distringuished names
instead of the sAMAccountNames.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool tests: Add test-case for 'group list --full-dn'

Check if the --full-dn option displays DN instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

samba-tool: add --full-dn option to group list command

With this option the command lists the groups distringuished names
instead of the sAMAccountNames.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>

Revert "vfs_glusterfs: Return fake fd from pipe() during open"

This reverts commit c9adf47ac5a5aa0dd12572c34b08cc51f15b2e97.
The fake fd is no longer necessary, as vfs_glusterfs now provides a
fcntl_fn hook.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14241

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

vfs_glusterfs: add .fcntl_fn hook

This hook is currently called via vfs_set_blocking(), so can safely be
ignored.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14241

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

vfs_ceph: add .fcntl_fn hook

This hook is currently called via vfs_set_blocking(), so can safely be
ignored.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14241

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

testenv: No "mktemp" for in_screen

We don't use this

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

testenv: Simplify "in_screen"

We don't need "seq", bash can do that itself, and we assume bash here

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

testenv: Properly kill daemons

Without this, all the daemons were kept around

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

testenv: Be more careful deleting environment tmpfiles

If there is more than one server we will have for example nt4_dc.smbd,
nt4_dc.nmbd and nt4_dc.winbind as daemon environments, together with
the commandline environment "nt4_dc" coming last. Before this patch we
would have deleted all previous tmpfiles in the commandline environment.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

WHATSNEW: Add CTDB changes for 4.12

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Tue Jan 21 13:05:00 UTC 2020 on sn-devel-184

ctdb-mutex: Change default re-check time for fcntl helper to 5s

Testing against a commonly used cluster filesystem has shown no
performance impact, as expected.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Add some tests to check recovery from recovery lock issues

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Put recovery lock for local daemons into a subdirectory

This makes it more like the way it works with a cluster filesystem.
It also allows the subdirectory to be manipulated in tests.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Add local_daemons.sh option for recovery lock recheck interval

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone

ldb_msg_add_empty reallocates the underlying element array, leaving
old_el pointing to freed memory.

This patch takes two defensive copies of the ldb message, and performs
the updates on them rather than the ldb messages in the result.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14050

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Jan 21 11:38:38 UTC 2020 on sn-devel-184

CVE-2019-14907 lib/util: Do not print the failed to convert string into the logs

The string may be in another charset, or may be sensitive and
certainly may not be terminated.  It is not safe to just print.

Found by Robert Święcki using a fuzzer he wrote for smbd.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14208
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

repl_meta_data: Only reset replMetaData entry for name if we made a conflict name here

We previously set it for any rename

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

repl_meta_data: Do not set *rename = true unless there has been a conflict on the incoming DN

The normal case of a partner-sent rename is not a cause for updating the replPropertyMetaData

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

repl_meta_data: Add comment explaining what is being renamed after the conflict is resolved

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

CVE-2019-14902 dsdb: Change basis of descriptor module deferred processing to be GUIDs

We can not process on the basis of a DN, as the DN may have changed in a rename,
not only that this module can see, but also from repl_meta_data below.

Therefore remove all the complex tree-based change processing, leaving only
a tree-based sort of the possible objects to be changed, and a single
stopped_dn variable containing the DN to stop processing below (after
a no-op change).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

CVE-2019-14902 repl_meta_data: Set renamed = true (and so do SD inheritance) after any rename

Previously if there was a conflict, but the incoming object would still
win, this was not marked as a rename, and so inheritence was not done.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

CVE-2019-14902 repl_meta_data: Fix issue where inherited Security Descriptors were not replicated.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

CVE-2019-14902 repl_meta_data: schedule SD propagation to a renamed DN

We need to check the SD of the parent if we rename, it is not the same as an incoming SD change.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>