samba.git/source4/dsdb, branch talloc-2.3.1

build: Only link against libcrypt where needed

2019-11-13T08:42:30+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: David Mulder 
Reviewed-by: Andreas Schneider

CVE-2019-14847 dsdb: Correct behaviour of ranged_results when combined with dirsync

2019-10-31T23:29:14+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040

Signed-off-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Thu Oct 31 23:29:15 UTC 2019 on sn-devel-184

CVE-2019-14847 dsdb: Demonstrate the correct interaction of ranged_results style attributes and dirsync

2019-10-31T22:07:40+00:00

Incremental results are provided by a flag on the dirsync control, not
by changing the attribute name.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040

Signed-off-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

source4/dsdb/schema/schema_description.c: typo fixes

2019-10-31T00:43:37+00:00

Signed-off-by: Bjoern Jacke 
Reviewed-by: Martin Schwenke

CVE-2019-14833 dsdb: send full password to check password script

2019-10-29T11:58:45+00:00

utf8_len represents the number of characters (not bytes) of the
password. If the password includes multi-byte characters it is required
to write the total number of bytes to the check password script.
Otherwise the last bytes of the password string would be ignored.

Therefore we rename utf8_len to be clear what it does and does
not represent.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12438

Signed-off-by: Björn Baumbach 
Signed-off-by: Andrew Bartlett 

Autobuild-User(master): Karolin Seeger 
Autobuild-Date(master): Tue Oct 29 11:58:45 UTC 2019 on sn-devel-184

s4:dirsync: fix interaction of dirsync and extended_dn controls

2019-10-24T11:06:58+00:00

Azure AD connect reports discovery errors:
  reference-value-not-ldap-conformant
for attributes member and manager.
The key is that it sends the LDAP_SERVER_EXTENDED_DN_OID without
an ExtendedDNRequestValue blob, which means the flag value should
be treated as 0 and the HEX string format should be used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14153
RN: Prevent azure ad connect from reporting discovery errors:
reference-value-not-ldap-conformant

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Thu Oct 24 11:06:58 UTC 2019 on sn-devel-184

s4:tests/dirsync: add tests for dirsync with extended_dn

2019-10-24T09:46:28+00:00

This demonstrates a problems that the extended_dn returned
by the dirsync module always uses the SDDL format for GUID/SID
components.

Azure AD connect reports discovery errors:
  reference-value-not-ldap-conformant
for attributes member and manager.
The key is that it sends the LDAP_SERVER_EXTENDED_DN_OID without
an ExtendedDNRequestValue blob, which means the flag value should
be treated as 0 and the HEX string format should be used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14153

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

dsdb: Change LDB_TYPESAFE_QSORT() to TYPESAFE_QSORT() in operational module

2019-10-18T10:58:44+00:00

This call does not use the context argument so no additional parameter is needed.

Signed-off-by: Andrew Bartlett 
Reviewed-by: David Mulder 
Reviewed-by: Andreas Schneider 

Autobuild-User(master): Andreas Schneider 
Autobuild-Date(master): Fri Oct 18 10:58:45 UTC 2019 on sn-devel-184

dsdb: Change LDB_TYPESAFE_QSORT() to TYPESAFE_QSORT() in repl_meta_data module

2019-10-18T09:26:41+00:00

This call does not use the context argument so no additional parameter is needed.

Signed-off-by: Andrew Bartlett 
Reviewed-by: David Mulder 
Reviewed-by: Andreas Schneider

librpc/idl: change from samr_GroupAttrs in samr.idl to security_GroupAttrs in security.idl

2019-09-20T01:14:42+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Guenther Deschner