samba.git, branch talloc-2.1.10

talloc: version 2.1.10

2017-07-21T21:31:03+00:00

* build, documentation and python3 improvements

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s4:http/gensec: add missing tevent_req_done() to gensec_http_ntlm_update_done()

2017-07-21T21:29:39+00:00

This was missing in commit d718e92d5e145dccd492c46febc249e462ce50c6.

Sadly we can't have automated tests for this as we only implement
the client side for this protocol.

I've tested with using:

bin/smbtorture \
  -W BLA --realm=BLA.BASE \
  -s /dev/null -Uadministrator%A1b2C3d4 \
  ncacn_http:w2k8r2-219[593,RpcProxy=w2k8r2-219.bla.base,HttpUseTls=false,HttpAuthOption=basic] \
  rpc.epmapper.epmapper.Lookup_simple \

and:

bin/smbtorture \
  -W BLA --realm=BLA.BASE \
  -s /dev/null -Uadministrator%A1b2C3d4 \
  ncacn_http:w2k8r2-219[593,RpcProxy=w2k8r2-219.bla.base,HttpUseTls=false,HttpAuthOption=ntlm] \
  rpc.epmapper.epmapper.Lookup_simple \

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12919

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Fri Jul 21 23:29:39 CEST 2017 on sn-devel-144

winbindd: avoid refreshing sequence number when domain is offline

2017-07-21T17:11:13+00:00

When there's no connectivity to the domain, avoid attempt to
refresh sequence number. Before the change, this was avoided
only if winbind offline logon was enabled. However, being
able to operate based on cached data is desired even when
offline logons are disabled (offline logons are about caching
credentials for PAM authentication, a user may not want this
and still want service from the SMB server during short
AD disconnects).

Signed-off-by: Uri Simchoni 
Reviewed-by: Jeremy Allison

winbindd: queryuser - only get group name if needed

2017-07-21T17:11:13+00:00

When calculating the user entry for a user, the
primary group id *name* might be needed if it is
part of a home dir / shell template (%g or %G).

Only resolve primary group SID to primary group name
if it is needed, thereby saving a round-trip to the DC
(and better handling situations where it is disconnected).

Signed-off-by: Uri Simchoni 
Reviewed-by: Jeremy Allison

winbindd: cache name-to-sid from PAC based on lookup domain

2017-07-21T17:11:13+00:00

The name-to-sid lookup for trusted domains is not necessarily
done against the domain - in AD member case it is done
against the primary domain. Therefore the caching should also
be done against the lookup domain.

Signed-off-by: Uri Simchoni 
Reviewed-by: Jeremy Allison

vfs_ceph: fix cephwrap_chdir()

2017-07-21T17:10:46+00:00

When provided a '/' path (i.e. CephFS root), vfs_ceph does a *local*
chdir() to the share path. This breaks smb client directory listings.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12911

Signed-off-by: David Disseldorp 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): David Disseldorp 
Autobuild-Date(master): Fri Jul 21 19:10:46 CEST 2017 on sn-devel-144

selftest: Add test for password change when NTLM is disabled

2017-07-21T11:54:35+00:00

When NTLM is disabled, the server should reject NTLM-based password
changes. Changing the password is a bit complicated from python, but
because the server should reject the password change outright with
NTLM_BLOCKED, the test doesn't actually need to provide valid
credentials.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923
Signed-off-by: Tim Beale 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Garming Sam 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Fri Jul 21 13:54:35 CEST 2017 on sn-devel-144

getncchanges: Do not segfault if somehow we get 0 results from an ldb_search with scope BASE

2017-07-21T07:30:25+00:00

This should not happen, but we have seen this happen in autobuild
before the whole-DB locking issues were resolved by
https://bugzilla.samba.org/show_bug.cgi?id=12858

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam

build: fix ceph_statx check when configured with libcephfs_dir

2017-07-20T21:02:27+00:00

When configured with a custom libcephfs_dir, the ceph_statx check fails
to link. This is due to the location of the ceph-common dependency,
which is installed under a ceph subdirectory.

ceph/build > make DESTDIR=./inst install
...
ceph/build > find inst/|grep -e /libcephfs -e /libceph-common
inst/usr/local/lib64/ceph/libceph-common.so.0
inst/usr/local/lib64/ceph/libceph-common.so
inst/usr/local/lib64/libcephfs.so.2.0.0
inst/usr/local/lib64/libcephfs.so.2
inst/usr/local/lib64/libcephfs.so
inst/usr/local/include/cephfs/libcephfs.h

Signed-off-by: David Disseldorp 
Reviewed-by: Jeff Layton 

Autobuild-User(master): David Disseldorp 
Autobuild-Date(master): Thu Jul 20 23:02:27 CEST 2017 on sn-devel-144

s3/utils: smbcacls failed to detect DIRECTORIES using SMB2 (windows only)

2017-07-20T16:49:27+00:00

uint16_t get_fileinfo(...) returns file attributes, this function
called

     cli_qfileinfo_basic(cli, fnum, &mode, NULL, NULL, NULL,
                     NULL, NULL, NULL);

which was failing with NT_STATUS_ACCESS_DENIED errors when fnum above
was obtained via (when using protocol > SMB). Note: This only seems to be
an issue when run against a windows server, with smbd SMB1 & SMB2 work fine.

    status = cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ,
                  0, FILE_SHARE_READ|FILE_SHARE_WRITE,
                  FILE_OPEN, 0x0, 0x0, &fnum, NULL);

The failing cli_qfileinfo_basic call above is unnecessary as we can already
obtain the required information from the cli_ntcreate call

Signed-off-by: Noel Power 
Reviewed-by: Jeremy Allison 
Reviewed-by: David Disseldorp