samba.git/source4/setup, branch talloc-2.3.4

s4/dlz: add support for bind 9.18

2022-05-23T00:53:09+00:00

It seems nothing has changed since 9.16 for our purposes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14986

Signed-off-by: Douglas Bagnall 
Signed-off-by: Andreas Hasenack 
Pair-programmed-with: Andreas Hasenack 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Mon May 23 00:53:09 UTC 2022 on sn-devel-184

s4:provision_users.ldif: Add Protected Users group

2022-03-18T11:55:30+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher

CVE-2020-25722 blackbox/upgrades tests: ignore SPN for ldapcmp

2021-11-09T19:45:33+00:00

We need to have the SPNs there before someone else nabs them, which
makes the re-provisioned old releases different from the reference
versions that we keep for this comparison.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

CVE-2020-25722 s4/provision: add host/ SPNs at the start

2021-11-09T19:45:33+00:00

There are two reasons for this. Firstly, leaving SPNs unclaimed is
dangerous, as someone else could grab them first. Secondly, in some
circumstances (self join) we try to add a DNS/ SPN a little bit later
in provision. Under the rules we are introducing for CVE-2020-25722,
this will make our later attempts to add HOST/ fail.

This causes a few errors in samba4.blackbox.dbcheck.* tests, which
assert that revivified old domains match stored reference versions.
Now they don't, because they have servicePrincipalNames.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

CVE-2020-25722 tests: blackbox samba-tool spn non-admin test

2021-11-09T19:45:33+00:00

It is soon going to be impossible to add duplicate SPNs (short of
going behind DSDB's back on the local filesystem). Our test of adding
SPNs on non-admin users doubled as the test for adding a duplicate (using
--force). As --force is gone, we add these tests on Guest after the SPN
on Administrator is gone.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

CVE-2020-25722 samba-tool spn add: remove --force option

2021-11-09T19:45:33+00:00

This did not actually *force* the creation of a duplicate SPN, it just
ignored the client-side check for the existing copy. Soon we are going
to enforce SPN uniqueness on the server side, and this --force will not
work. This will make the --force test fail, and if that tests fail, so
will others that depend the duplicate values. So we remove those tests.

It is wrong-headed to try to make duplicate SPNs in any case, which is
probably why there is no sign of anyone ever having used this option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

s4:samba: Migrate samba daemon to new cmdline option parser

2021-04-29T03:58:37+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Andrew Bartlett

tests: Use --configfile instead of -s

2021-04-28T03:43:34+00:00

We should use long options in tests to make clear what we are trying to
do.

Also the -s short option will be removed for --configfile later.

Signed-off-by: Andreas Schneider 
Reviewed-by: Andrew Bartlett

tests: Use ldbsearch '--scope instead of '-s'

2021-04-28T03:43:34+00:00

We should use long options in tests to make clear what we are trying to
do.

Signed-off-by: Andreas Schneider 
Reviewed-by: Andrew Bartlett

test samba-tool group listmembers: test listing contacts as group members

2021-04-26T12:32:35+00:00

Make sure that contacts are listed as group members, even if the
--hide-expired option is used.

Expect failure. Fix follows up.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14692

Signed-off-by: Björn Baumbach 
Reviewed-by: Rowland penny