samba.git, branch ldb-1.2.3

ldb: Release 1.2.3

2017-12-22T09:05:07+00:00

 - Intersect the index from SCOPE_ONELEVEL with the index for the search expression

    This helps ensure we do not have to scan all objects at this level
    which could be very many (one per DNS zone entry).

    However, due to the O(n*m) behaviour in the LDB index code
    we only do this for small numbers of matches on the
    filter tree.

    This behaviour will only be for ldb 1.2 and will not be kept
    long-term in LDB, versions 1.3.1 and above will instead only
    intersect when the more efficient GUID index is in use.

    Finally, disallowDNFilter now applies to SCOPE_ONELEVEL banning
    dn= as a filter string when so configured.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13191

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam

ldb: Intersect the index from SCOPE_ONELEVEL with the index for the search expression

2017-12-22T09:05:07+00:00

This helps ensure we do not have to scan all objects at this level
which could be very many (one per DNS zone entry).

However, due to the O(n*m) behaviour in list_intersect() for ldb
1.2 and earlier, we only do this for small numbers of matches on the
filter tree.

This behaviour will only be for ldb 1.2 and will not be kept
long-term in LDB, versions 1.3.1 and above will instead only
intersect when the GUID index is in use.

NOTE WELL: the behaviour of disallowDNFilter is enforced
in the index code, so this fixes SCOPE_ONELEVEL to also
honour disallowDNFilter if there @IDXONE is enabled.  Again,
this will change again in 1.3.1 and above.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13191

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam 
(adapted from ef240aaca0ef693a96726ac2366c454294b87b96 in master)

ldb_tdb: Provide struct ltdb_private to index routines

2017-12-22T09:05:07+00:00

This will make it easier to switch the GUID index mode on and off

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13191

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam 
(cherry picked from commit 3d952157d72b3a4635f3942449c1727c438c97c6)

selftest: Do not use dn= filter string

2017-12-22T09:05:07+00:00

This accidentially worked with SCOPE_ONELEVEL against Samba but dn= filters are
not valid in AD.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam 
(cherry picked from commit 44eee9ce9e9818df8387b2b3782504408112f12c)

s4:samba: Fix default to be running samba as a deamon

2017-12-20T23:55:29+00:00

Commit 8736013dc42c5755b75bbb2e843a290bcd545909 got the (confusing) sense of opt_fork
wrong.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13129

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Tue Dec 19 11:24:29 CET 2017 on sn-devel-144

(cherry picked from commit 0806ff7dfd3f982226e4cd9b923a0e570b765f0c)

Autobuild-User(v4-7-test): Karolin Seeger 
Autobuild-Date(v4-7-test): Thu Dec 21 00:55:29 CET 2017 on sn-devel-144

messaging: Always register the unique id

2017-12-15T14:35:25+00:00

The winbind child does not call serverid_register, so the unique id is not
registered. ctdbd_process_exists now calls CTDB_CONTROL_CHECK_PID_SRVID, which
then fails.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13180
Signed-off-by: Volker Lendecke 

Autobuild-User(v4-7-test): Karolin Seeger 
Autobuild-Date(v4-7-test): Fri Dec 15 15:35:25 CET 2017 on sn-devel-144

winbindd: idmap_rid: error code for failing id-to-sid mapping request

2017-12-14T15:32:49+00:00

NT_STATUS_NO_SUCH_DOMAIN triggers complete request failure in the parent
winbindd. By returning NT_STATUS_NONE_MAPPED winbindd lets the individual
mapping fail but keeps processing any remaining mapping requests.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13052

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke 

Autobuild-User(master): Ralph Böhme 
Autobuild-Date(master): Tue Oct 10 19:57:37 CEST 2017 on sn-devel-144

(cherry picked from commit 490c35df35bad6c2f1c4acd2f056d6fdc480ec1f)

Autobuild-User(v4-7-test): Karolin Seeger 
Autobuild-Date(v4-7-test): Thu Dec 14 16:32:49 CET 2017 on sn-devel-144

winbindd: idmap_rid: don't rely on the static domain list

2017-12-14T11:22:18+00:00

The domain list in the idmap child is inherited from the parent winbindd
process and may not contain all domains in case enumerating trusted
domains didn't finish before the first winbind request that triggers the
idmap child fork comes along.

The previous commits added the domain SID as an additional argument to
the wbint_UnixIDs2Sids request, storing the domain SID in struct
idmap_domain.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13052

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke 
(cherry picked from commit 108675c4cf4c3d5bd29468255743423a56bd1471)

winbindd: pass domain SID to wbint_UnixIDs2Sids

2017-12-14T11:22:18+00:00

This makes the domain SID available to the idmap child for
wbint_UnixIDs2Sids mapping request. It's not used yet anywhere, this
comes in the next commit.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13052

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke 
(cherry picked from commit 71f99cb132f4c26f9febac6cb7dcd79f4940216a)

winbindd: add domain SID to idmap mapping domains

2017-12-14T11:22:18+00:00

Fetch the domain SID for every domain in the idmap-domain map. This is
in preperation of passing the domain SID as an additional argument to
xid2sid requests to the idmap child.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13052

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke 
(cherry picked from commit 59438bfd3d3551195582cf88bd1109c3cbc7e12a)